@fjall/deploy-core 14.0.0 → 14.2.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "34c98837fffe6bc5850e1ab87bbd3a819ae9453a7a6a00a9429d12c8c3a69759",
+  "hash": "deed7718acaf53ae067e715be43fb2680a50ccf7438edac6d5b04253379dd0b0",
   "files": {
     "src/__test-utils__/awsMockHelpers.ts": "fea371c1b1869678",
     "src/__test-utils__/index.ts": "e03cf35821157dc4",
@@ -52,9 +52,9 @@
     "src/aws/utils/regions.ts": "3a5191f4d2242a60",
     "src/aws/utils/stackStatus.ts": "55fb23ba5514bc13",
     "src/events/index.ts": "e55c022f0d9013e6",
-    "src/index.ts": "5d0887d5c3bf0fde",
+    "src/index.ts": "7c0f630c1434c8a2",
     "src/orchestration/activeDeploymentGuard.ts": "e8dde742c00ea728",
-    "src/orchestration/application/applicationDeploy.ts": "867232cbc981906c",
+    "src/orchestration/application/applicationDeploy.ts": "6a4090e898f86a28",
     "src/orchestration/application/applicationDeployHelpers.ts": "bca833cc04f0b4c5",
     "src/orchestration/application/applicationDestroy.ts": "38b8ecf69c85d884",
     "src/orchestration/application/approvalGate.ts": "e4dee819c94fd15c",
@@ -106,12 +106,13 @@
     "src/orchestration/destroy.ts": "b6da154984e63a8d",
     "src/orchestration/dockerBuildParamsKeys.ts": "ac3d6ecd24d68792",
     "src/orchestration/dockerInterface.ts": "f2efc8a98d3b3d65",
-    "src/orchestration/domain/WorkerDomainDeployProvider.ts": "fa34993b4f96451a",
+    "src/orchestration/domain/WorkerDomainDeployProvider.ts": "bf31cc0454abb0f3",
     "src/orchestration/domain/caaPreflight.ts": "4a9ab5bd9567fb41",
     "src/orchestration/domain/delegatedDomainDeploy.ts": "b5e5c2db59250b8a",
     "src/orchestration/domain/delegationDestroyMirror.ts": "939f6c3cc3293d8b",
+    "src/orchestration/domain/delegationResolution.ts": "f2b91a8aaf284dfa",
     "src/orchestration/domain/domainTakeoverGate.ts": "70c77f8eb61b1e3d",
-    "src/orchestration/domain/index.ts": "e3c35fd95d88567e",
+    "src/orchestration/domain/index.ts": "4380d473c1990efe",
     "src/orchestration/domain/nsPropagationGate.ts": "c7a443e7048d4430",
     "src/orchestration/domain/recordConsentSpelling.ts": "9869eadf39e75d98",
     "src/orchestration/domain/route53Delegation.ts": "a7149a0542e4d185",
@@ -188,7 +189,7 @@
     "src/services/application/applicationStackHelpers.ts": "04e1758b97ffc5fc",
     "src/services/application/index.ts": "ee810be803dfda9c",
     "src/services/index.ts": "8c441c1b37540650",
-    "src/services/infrastructure/CdkArgumentBuilder.ts": "0427db7f4a0add33",
+    "src/services/infrastructure/CdkArgumentBuilder.ts": "6191c51028fddca0",
     "src/services/infrastructure/CdkCommandRunner.ts": "427a9c1171902e42",
     "src/services/infrastructure/CdkErrorFormatter.ts": "e2e017136108a5d1",
     "src/services/infrastructure/CdkEventMonitoring.ts": "f172272948a5db40",
@@ -196,7 +197,7 @@
     "src/services/infrastructure/CdkOutputParser.ts": "eed9f3475324118e",
     "src/services/infrastructure/CdkProcessManager.ts": "165c97be53d6de8f",
     "src/services/infrastructure/CdkService.ts": "954ac16a4c646912",
-    "src/services/infrastructure/CdkServiceTypes.ts": "c4f3075238952728",
+    "src/services/infrastructure/CdkServiceTypes.ts": "f2861947ac9481ab",
     "src/services/infrastructure/CfnRegistryService.ts": "bd4f57d97982cdda",
     "src/services/infrastructure/CloudFormationService.ts": "82ce03614feae2db",
     "src/services/infrastructure/EcrImageInspectorService.ts": "e784440b5680df74",
@@ -207,7 +208,7 @@
     "src/services/infrastructure/SsmParameterMetadataService.ts": "3ff0bb42219cec3d",
     "src/services/infrastructure/bootstrapConvergence.ts": "ca11f0bf9552ba8c",
     "src/services/infrastructure/cancelInFlightStack.ts": "8388a16a23db725a",
-    "src/services/infrastructure/cdkServiceHelpers.ts": "2db30686382e568a",
+    "src/services/infrastructure/cdkServiceHelpers.ts": "60e93898614c8b4e",
     "src/services/infrastructure/cfnRegistrySeed.ts": "b1232b66883d6f90",
     "src/services/infrastructure/changeSetProbe.ts": "5f3e100db396cf9b",
     "src/services/infrastructure/constructMapEnrichment.ts": "7400af9bcfaa0da3",
@@ -215,7 +216,7 @@
     "src/services/infrastructure/index.ts": "c45e43711bf64fa9",
     "src/services/infrastructure/infraTypecheckPreflight.ts": "09e423a8283e3b8b",
     "src/services/infrastructure/transientNetworkRecovery.ts": "264b9a16fea86869",
-    "src/services/supporting/CdkContextBuilder.ts": "dee16f4302f7312a",
+    "src/services/supporting/CdkContextBuilder.ts": "ea23e4652bb4f587",
     "src/services/supporting/TemplateHashService.ts": "9fd5351f90b5cefb",
     "src/services/supporting/helpers.ts": "81c0ba7bfdd99366",
     "src/services/supporting/index.ts": "4bf4e746399d80e3",
@@ -239,7 +240,7 @@
     "src/types/deployEventParse.ts": "16bc2371fb747d96",
     "src/types/deployEventTypeGuards.ts": "731c4e5761b13fca",
     "src/types/deployment/DeploymentServiceTypes.ts": "ba257f2e37013afd",
-    "src/types/deployment/DeploymentTypes.ts": "fc7cf47cd1061408",
+    "src/types/deployment/DeploymentTypes.ts": "68776f62040b93a5",
     "src/types/deployment/cloudformation.ts": "5a0c51e263827943",
     "src/types/deployment/index.ts": "4bdffd195379a05d",
     "src/types/deployment/parallel.ts": "c06e3ac55fb39eb7",
@@ -256,7 +257,7 @@
     "src/types/frameworkBuilder.ts": "41198a0b446f60b6",
     "src/types/index.ts": "94240086d5b486af",
     "src/types/operations.ts": "57a6c9e22a3f37ca",
-    "src/types/params.ts": "8d7e40c0e526d75e",
+    "src/types/params.ts": "891244c0081aec2e",
     "src/types/remediation.ts": "0e1138f0c8fdc6bf",
     "src/types/stepDefinitions.ts": "a5e2aa03b15011b4",
     "src/types/validation.ts": "44aa473ec0e25dc4",
@@ -267,9 +268,9 @@
     "src/util/sleepAbortable.ts": "f9cac3bf8a79a476",
     "src/version.ts": "1811a4475823b27e",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "5673986a308fdc6b",
+    "package.json": "fe8702fc3e63acd8",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "9fcba88e9201cb766d6f82fbce6e98b3d318407331da2b926633b89eea1a2f46",
-  "outputFileCount": 503
+  "outputHash": "79e8b33d2a72cbd79bb5778269bc6628a2c5ab8a2a6e14952346e77ad0265184",
+  "outputFileCount": 505
 }

package/dist/.minified

@@ -1 +1 @@
-251 files minified at 2026-08-17T02:04:26.183Z
+252 files minified at 2026-08-18T14:33:26.650Z

package/dist/src/index.d.ts

@@ -86,8 +86,8 @@ export { runOrganisationSetup, ORG_SETUP_PHASES } from "./orchestration/index.js
 export type { OrgSetupPhase, OrgSetupCallbacks, OrgSetupConfig, OrgSetupResult, DockerProvider, DockerProgressCallback, DockerBuildParams, DockerBuildResult, ResolvedBuildSecret, ResolvedBuildSecrets, ECRInitParams, ECRInitResult, TagImagesParams, TagImagesResult, TagByDigestParams, DomainDeployProvider, DomainConfig, DomainDeployResult, DomainTakeoverSynth, DeployServices } from "./orchestration/index.js";
 export { recordPhysicalName, parseRecordPhysicalName, recordSetKey, deleteRecordSetsByKey, cascadeTakeoverDigestSeed, buildCascadeTakeoverTicket, runCascadeTakeoverGate, WorkerDomainDeployProvider, createWorkerDomainDeployProvider } from "./orchestration/index.js";
 export type { RecordConsentIdentity, DeletedRecordSet, DomainsTakeoverContext, DomainsTakeoverWithheld, DomainsTakeoverGateOutcome, WorkerDomainDeployProviderParams } from "./orchestration/index.js";
-export { DOMAIN_DELEGATION_ERROR_TYPES, DomainDelegationError, DEFAULT_PUBLIC_RESOLVER_ADDRESSES, PUBLIC_DNS_QUERY_TIMEOUT_MS, createPublicResolvers, NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS, NS_PROPAGATION_DEFAULT_INTERVAL_MS, waitForNsPropagation, ACM_CAA_ISSUERS, runCaaPreflight, deployDelegatedDomain, CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE, templateOwnsDelegationRecord, deleteChildNsFromParent, nsDelegationPhysicalName, runDelegatedDomainDestroy } from "./orchestration/index.js";
-export type { DomainDeployPhase, DomainDelegationErrorType, PublicCaaRecord, PublicDnsResolver, NsPropagationGateParams, NsPropagationVerdict, CaaPreflightParams, CaaPreflightVerdict, DelegatedDomainDeployer, DelegatedZonePhaseState, DeployDelegatedDomainParams, DelegatedDomainDeployOutcome, NsDeleteOutcome, DeleteChildNsParams, DelegationDestroyNsOutcome, DelegatedDomainDestroyOutcome, DelegatedDomainDestroyParams } from "./orchestration/index.js";
+export { DOMAIN_DELEGATION_ERROR_TYPES, DomainDelegationError, DEFAULT_PUBLIC_RESOLVER_ADDRESSES, PUBLIC_DNS_QUERY_TIMEOUT_MS, createPublicResolvers, NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS, NS_PROPAGATION_DEFAULT_INTERVAL_MS, waitForNsPropagation, ACM_CAA_ISSUERS, runCaaPreflight, deployDelegatedDomain, delegationRoleUnusableError, deriveZonePhaseState, extractDelegationRoleArn, readDelegatedTopologyFromProps, readDomainStackOutputsByExport, CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE, templateOwnsDelegationRecord, deleteChildNsFromParent, nsDelegationPhysicalName, runDelegatedDomainDestroy } from "./orchestration/index.js";
+export type { DomainDeployPhase, DelegatedDomainTopology, DomainDelegationErrorType, PublicCaaRecord, PublicDnsResolver, NsPropagationGateParams, NsPropagationVerdict, CaaPreflightParams, CaaPreflightVerdict, DelegatedDomainDeployer, DelegatedZonePhaseState, DeployDelegatedDomainParams, DelegatedDomainDeployOutcome, NsDeleteOutcome, DeleteChildNsParams, DelegationDestroyNsOutcome, DelegatedDomainDestroyOutcome, DelegatedDomainDestroyParams } from "./orchestration/index.js";
 export { classifyZoneRecords, buildSatelliteRecordIndex, createSystemDnsNameProbe, systemDnsNameProbe, normaliseRecordName, isRoute53NameServer, isDelegatedToRoute53 } from "./orchestration/index.js";
 export type { RecordClassification, ClassifiedRecord, ZoneClassificationReport, ZoneClassifierClients, ZoneClassifierPhase, ClassifyZoneOptions, SatelliteRecordIndex, DelegatedChildDomain, ChildAccountClients, ChildAccountClientFactory, AwsSdkClientLike, DnsProbeVerdict, DnsNameProbe } from "./orchestration/index.js";
 export { resolveBuildSecrets, resolveSecretRefValue, resolveBuildSecretSessionProvider, sourcedRefsFromBuildArgs, resolveBuildArgs, buildBuildSecretSessionPolicy, buildDeploySessionPolicy, partitionForRegion, validateBuildGroup } from "./orchestration/index.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as i,DEPLOYMENT_EVENT_TYPES as a,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as S,CASCADE_PHASES as l,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as T,truncateUtf16Safe as _}from"./types/index.js";import{DeployEventSchema as R,StepProgressSchema as m,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as N,SUPPORTED_CONTRACT_MARKERS as C,DEPLOY_EVENT_ID_MAX as I,DEPLOY_EVENT_NAME_MAX as y,DEPLOY_EVENT_MESSAGE_MAX as L,DEPLOY_EVENT_STATUS_REASON_MAX as g,DEPLOY_EVENT_ERROR_MESSAGE_MAX as h,DEPLOY_EVENT_TRAIL_DETAIL_MAX as x,DEPLOY_EVENT_OUTPUT_MAX as v,DEPLOY_EVENT_ARN_MAX as F,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ie,probeAccountStackExists as ae}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as Se,describeOrganisation as le,enablePolicyTypes as pe,enableServiceAccess as Te,SERVICE_PRINCIPALS as _e,enableRamSharing as Ae,activateTrustedAccess as Re,enableIpamDelegatedAdmin as me,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ne,findDevelopmentOuId as Ce,activateCostAllocationTags as Ie,checkIdentityCentreStatus as ye,snapshotIdentityCentre as Le,composeSdkAbortSignal as ge,extractErrorName as he,isAborted as xe,DEFAULT_MAX_PAGES as ve,IDENTITY_STORE_PAGE_SIZE as Fe,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ir}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as Sr,verbsForDriftVerdict as lr}from"./types/index.js";import{REMEDIATION_PHASES as Tr,RemediationPhaseSchema as _r,RemediationTargetSchema as Ar,RemediationFlipProofSchema as Rr,RemediationJournalRecordSchema as mr,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Nr,APPLICATION_DEPLOY_ORDER as Cr,APPLICATION_DESTROY_ORDER as Ir,OPENNEXT_DEPLOY_ORDER as yr,OPENNEXT_DESTROY_ORDER as Lr,PARALLEL_DEPLOY_GROUPS as gr,PARALLEL_DESTROY_GROUPS as hr,OPENNEXT_PARALLEL_GROUPS as xr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Fr,isOrganisationOperation as Mr,getParallelDeployGroups as Ur,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Wr,OPENNEXT_PATTERNS as Qr,STACK_NOT_FOUND_PATTERN as jr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as at,readStateFile as nt,writeStateFile as st,createEmptyState as ct,deleteStateFile as Et,updateTemplateHash as St,getStateFilePath as lt,regionSuffix as pt}from"./types/config/FjallState.js";import{readDomainState as _t,writeDomainState as At,recordDomainDeployState as Rt,deleteDomainState as mt,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Nt,CdkProcessManager as Ct,ensureDependencyIntegrity as It,clearDependencyIntegrityCache as yt,DEPENDENCY_SYNC_TIMEOUT_MS as Lt,CdkEventMonitor as gt,startStackMonitoring as ht,DEFAULT_DEPLOY_TIMEOUT_MS as xt,isCdkError as vt,formatInfrastructureError as Ft,getStructuralHint as Mt,getSourceContext as Ut,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Wt,parseBuildPhase as Qt,buildStepContextBuildConfig as jt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as io,DeploymentError as ao,NetworkError as no,FileSystemError as so,ConfigError as co,toServiceError as Eo}from"./types/errors/index.js";import{filterDangerousEnvVars as lo,maskSensitiveOutput as po,parseShellArgs as To,sleep as _o}from"@fjall/util";import{artefactOutputKey as Ro,DeployModeSchema as mo,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as No}from"./util/sleepAbortable.js";import{createSequencedCallbacks as Io}from"./util/sequencedCallbacks.js";import{fileExists as Lo}from"@fjall/util/fsHelpers";import{success as ho,failure as xo,isSuccess as vo,isFailure as Fo}from"@fjall/generator";import{deploy as Uo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{buildParamsContext as Vo}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Bo,emitWarningEvent as Ko}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Ho}from"./util/diagnosticScopes.js";import{restart as Jo,probeSecretsDrift as Wo,probeServiceDeploymentStatus as Qo,computeSecretsDrift as jo,deriveStaleParameters as Zo,extractConsumedSsmParameters as qo}from"./orchestration/index.js";import{partitionAccounts as $o}from"./orchestration/index.js";import{buildRegionList as ri,buildAccountRegionPairs as ti,cascadeHomeRegion as oi,cascadeOperationKey as ii}from"./orchestration/index.js";import{projectScalarSummary as ni,projectAccountRows as si}from"./orchestration/index.js";import{reconcileProviderAccounts as Ei,mergeReconciledProviderAccounts as Si}from"./orchestration/index.js";import{decideNextTransition as pi,reconcileTrailMigration as Ti,decommissionMemberTrailStorage as _i,ORG_TRAIL_BUCKET_OUTPUT_KEY as Ai,TRAIL_BUCKET_OUTPUT_KEY as Ri,TRAIL_KEY_ARN_OUTPUT_KEY as mi}from"./orchestration/index.js";import{classifyDriftFailure as ui,fetchLastOperationEvents as Di,DriftProbe as Pi,clearDriftSuspects as Oi,defaultDriftJournalDir as fi,readDriftSuspects as Ni,recordDriftSuspects as Ci,detectStackDrift as Ii,runDriftPreFlight as yi,formatDriftPreFlightBlock as Li,DRIFT_PREFLIGHT_TRIGGER_STATUSES as gi,DRIFT_PREFLIGHT_BUDGET_MS as hi,runRoute53RecordPreflight as xi}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Fi,computeRemediationOpId as Mi,defaultRemediationJournalDir as Ui,findRemediationJournalByOpId as ki,listActiveRemediationOps as bi,listActiveRemediationOpsForContext as Yi,readRemediationJournal as Vi,sweepExpiredRemediationJournals as Gi,writeRemediationJournal as Bi,REMEDIATION_JOURNAL_RETENTION_DAYS as Ki,captureRemediationForensics as Xi,defaultRemediationForensicsDir as Hi,applyRetainFlip as wi,composeFlipCapabilities as Ji,computeTemplateDigest as Wi,deriveRetainFlipTemplate as Qi,findMarkedResourcesByOpId as ji,proveFlipMetadataOnly as Zi,readRetainFlipState as qi,verifyRetainFlipDiff as zi,FORGET_MARKER_KEY as $i,FORGET_FLIP_SPEC as ea,RECREATE_MARKER_KEY as ra,assessForgetResumability as ta,completeForgetAfterConverge as oa,completeForgetAfterDeploy as ia,formatRecreateInFlightCures as aa,partitionPreFlightByRemediation as na,runForgetSurgery as sa,synthTemplateDeclaresResource as ca,runRecreateSurgery as Ea,snapshotPolicyForType as Sa,SNAPSHOT_CAPABLE_RESOURCE_TYPES as la,runRecreatePreFlight as pa,deriveRemovalTemplate as Ta,findRemovalDeletionFailures as _a,findResourcesPresent as Aa,proveRemovalTargetsOnly as Ra,advertisableDriftVerbs as ma,buildDriftRepairTicket as da,runDriftRepairGate as ua,formatPinOutcomeDetail as Da,pinProbeCoverage as Pa,renderPinReportLines as Oa,runPinRemediation as fa,captureLegacySurfaces as Na,decodeLegacyAnchor as Ca,runIdentitySurfaceGate as Ia,collectIdentityPinCandidates as ya,degradedIdentityPinOutcomes as La,renderIdentityPinReportLines as ga,runIdentityPinMigration as ha,composePostFailureRepairOffer as xa,formatDriftRepairOffer as va,DriftRepairAvailableError as Fa,checkDeployPathStackAvailability as Ma,isDeployPathBlockingStatus as Ua,StackUnavailableError as ka,assertLeaseBeforeStack as ba,LeaseDeniedError as Ya}from"./orchestration/index.js";import{unlockBucket as Ga,unlockQueue as Ba}from"./orchestration/index.js";import{triageBucketPolicy as Xa,isEnforceSslStatement as Ha,toResourcePolicyStatements as wa,restoreBucketPolicy as Ja,synthesiseEnforceSslDocument as Wa,ensureEnforceSsl as Qa,restoreAndReconcileQuarantinedBucket as ja}from"./orchestration/index.js";import{verifyOrgTrailDelivery as qa}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as $a,isRootTaskPolicyArn as en,ROOT_TASK_POLICY_ARNS as rn,MAX_ROOT_SESSION_SECONDS as tn}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as an,flattenAccountsToEnvironments as nn,extractAllAccountNames as sn,accountsConfigToOUTree as cn,isStringArray as En,isAccountsConfig as Sn,isOuOnlyAccountBucket as ln,OU_ONLY_ACCOUNT_BUCKETS as pn}from"./orchestration/index.js";import{runOpenNextBuild as _n}from"./orchestration/index.js";import{runOrganisationSetup as Rn,ORG_SETUP_PHASES as mn}from"./orchestration/index.js";import{recordPhysicalName as un,parseRecordPhysicalName as Dn,recordSetKey as Pn,deleteRecordSetsByKey as On,cascadeTakeoverDigestSeed as fn,buildCascadeTakeoverTicket as Nn,runCascadeTakeoverGate as Cn,WorkerDomainDeployProvider as In,createWorkerDomainDeployProvider as yn}from"./orchestration/index.js";import{DOMAIN_DELEGATION_ERROR_TYPES as gn,DomainDelegationError as hn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as xn,PUBLIC_DNS_QUERY_TIMEOUT_MS as vn,createPublicResolvers as Fn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Mn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Un,waitForNsPropagation as kn,ACM_CAA_ISSUERS as bn,runCaaPreflight as Yn,deployDelegatedDomain as Vn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as Gn,templateOwnsDelegationRecord as Bn,deleteChildNsFromParent as Kn,nsDelegationPhysicalName as Xn,runDelegatedDomainDestroy as Hn}from"./orchestration/index.js";import{classifyZoneRecords as Jn,buildSatelliteRecordIndex as Wn,createSystemDnsNameProbe as Qn,systemDnsNameProbe as jn,normaliseRecordName as Zn,isRoute53NameServer as qn,isDelegatedToRoute53 as zn}from"./orchestration/index.js";import{resolveBuildSecrets as es,resolveSecretRefValue as rs,resolveBuildSecretSessionProvider as ts,sourcedRefsFromBuildArgs as os,resolveBuildArgs as is,buildBuildSecretSessionPolicy as as,buildDeploySessionPolicy as ns,partitionForRegion as ss,validateBuildGroup as cs}from"./orchestration/index.js";import{FrameworkRegistry as Ss}from"./orchestration/index.js";import{openNextBuilder as ps,staticSiteBuilder as Ts,dockerBuilder as _s}from"./orchestration/index.js";import{StepRegistry as Rs,getDestroyStepId as ms}from"./steps/index.js";import{buildDeployPlan as us,computeDeployPlan as Ds,computeAssemblyDigest as Ps,digestHead as Os,classifyImpact as fs,derivePropertyChanges as Ns,isDataLoss as Cs,isStatefulResourceType as Is,renderPlanSummary as ys,renderPlanLines as Ls,toWirePlanChanges as gs,signApprovalToken as hs,verifyApprovalToken as xs,DEFAULT_APPROVAL_TTL_MS as vs,APPROVAL_TOKEN_PATTERN as Fs,runApprovalGate as Ms,approvalRefusalReason as Us}from"./orchestration/index.js";import{runDestructionGate as bs,buildDestructionTicket as Ys,evaluateDestructionConsents as Vs,computeTicketDigest as Gs,legalRemediationVerbs as Bs,executableRemediationVerbs as Ks,advertisableRemediationVerbs as Xs,renderDestructionTicketLines as Hs,renderConsentVerdictLines as ws,loadDeployPlan as Js,createMemoisedPlanLoader as Ws}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as js,classifyDeployFailure as Zs,classifyFromEcsCompletion as qs,classifyFromFailureAnalysis as zs,classifyUnclassified as $s}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as rc,getDeploymentFailure as tc}from"./orchestration/failure/deploymentFailureAttachment.js";export{bn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Cr as APPLICATION_DEPLOY_ORDER,Ir as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Fs as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,io as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,l as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,Gn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Nt as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,gt as CdkEventMonitor,Ct as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,co as ConfigError,vs as DEFAULT_APPROVAL_TTL_MS,xt as DEFAULT_DEPLOY_TIMEOUT_MS,ve as DEFAULT_MAX_PAGES,xn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,Lt as DEPENDENCY_SYNC_TIMEOUT_MS,S as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,a as DEPLOYMENT_EVENT_TYPES,js as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,F as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,N as DEPLOY_EVENT_CONTRACT_MINOR,h as DEPLOY_EVENT_ERROR_MESSAGE_MAX,I as DEPLOY_EVENT_ID_MAX,L as DEPLOY_EVENT_MESSAGE_MAX,y as DEPLOY_EVENT_NAME_MAX,v as DEPLOY_EVENT_OUTPUT_MAX,g as DEPLOY_EVENT_STATUS_REASON_MAX,x as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,gn as DOMAIN_DELEGATION_ERROR_TYPES,hi as DRIFT_PREFLIGHT_BUDGET_MS,gi as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,R as DeployEventSchema,mo as DeployModeSchema,d as DeployResourceSchema,ao as DeploymentError,i as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,hn as DomainDelegationError,Er as DriftFindingSchema,Sr as DriftJournalRecordSchema,Pi as DriftProbe,Fa as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Ho as ENGINE_DIAGNOSTIC_SCOPE,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,ea as FORGET_FLIP_SPEC,$i as FORGET_MARKER_KEY,so as FileSystemError,at as FjallStateFileSchema,Ss as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,Fe as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Ya as LeaseDeniedError,tn as MAX_ROOT_SESSION_SECONDS,Un as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Mn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,yr as OPENNEXT_DEPLOY_ORDER,Lr as OPENNEXT_DESTROY_ORDER,xr as OPENNEXT_PARALLEL_GROUPS,Qr as OPENNEXT_PATTERNS,Nr as ORGANISATION_TYPES,mn as ORG_SETUP_PHASES,Ai as ORG_TRAIL_BUCKET_OUTPUT_KEY,pn as OU_ONLY_ACCOUNT_BUCKETS,gr as PARALLEL_DEPLOY_GROUPS,hr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Wt as PROGRESS_MESSAGES,vn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,ra as RECREATE_MARKER_KEY,Ki as REMEDIATION_JOURNAL_RETENTION_DAYS,Tr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,rn as ROOT_TASK_POLICY_ARNS,Rr as RemediationFlipProofSchema,mr as RemediationJournalRecordSchema,_r as RemediationPhaseSchema,Ar as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,_e as SERVICE_PRINCIPALS,la as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,jr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,C as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,ka as StackUnavailableError,m as StepProgressSchema,Rs as StepRegistry,or as TICKET_VERDICT_SOURCES,Ri as TRAIL_BUCKET_OUTPUT_KEY,mi as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,ir as TicketVerdictSourceSchema,to as ValidationError,In as WorkerDomainDeployProvider,cn as accountsConfigToOUTree,Ie as activateCostAllocationTags,Re as activateTrustedAccess,ma as advertisableDriftVerbs,Xs as advertisableRemediationVerbs,wi as applyRetainFlip,Us as approvalRefusalReason,Fi as archiveCompletedRemediationJournal,Ro as artefactOutputKey,ba as assertLeaseBeforeStack,ta as assessForgetResumability,$a as assumeRootForTask,rc as attachDeploymentFailure,ti as buildAccountRegionPairs,Ne as buildAccountToOUMap,as as buildBuildSecretSessionPolicy,Nn as buildCascadeTakeoverTicket,us as buildDeployPlan,ns as buildDeploySessionPolicy,Ys as buildDestructionTicket,da as buildDriftRepairTicket,Vo as buildParamsContext,ri as buildRegionList,Wn as buildSatelliteRecordIndex,jt as buildStepContextBuildConfig,ie as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Na as captureLegacySurfaces,Xi as captureRemediationForensics,oi as cascadeHomeRegion,ii as cascadeOperationKey,fn as cascadeTakeoverDigestSeed,Ma as checkDeployPathStackAvailability,ye as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,T as clampDeploymentEventStrings,Zs as classifyDeployFailure,ui as classifyDriftFailure,qs as classifyFromEcsCompletion,zs as classifyFromFailureAnalysis,fs as classifyImpact,$s as classifyUnclassified,Jn as classifyZoneRecords,yt as clearDependencyIntegrityCache,Oi as clearDriftSuspects,ya as collectIdentityPinCandidates,oa as completeForgetAfterConverge,ia as completeForgetAfterDeploy,Ji as composeFlipCapabilities,xa as composePostFailureRepairOffer,ge as composeSdkAbortSignal,Ps as computeAssemblyDigest,Ds as computeDeployPlan,Mi as computeRemediationOpId,jo as computeSecretsDrift,Wi as computeTemplateDigest,Gs as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,j as createDeployEmitter,ct as createEmptyState,Ws as createMemoisedPlanLoader,Fn as createPublicResolvers,Io as createSequencedCallbacks,Qn as createSystemDnsNameProbe,yn as createWorkerDomainDeployProvider,pi as decideNextTransition,Ca as decodeLegacyAnchor,_i as decommissionMemberTrailStorage,fi as defaultDriftJournalDir,Hi as defaultRemediationForensicsDir,Ui as defaultRemediationJournalDir,La as degradedIdentityPinOutcomes,Kn as deleteChildNsFromParent,mt as deleteDomainState,On as deleteRecordSetsByKey,Et as deleteStateFile,Uo as deploy,Vn as deployDelegatedDomain,Ns as derivePropertyChanges,Ta as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,Qi as deriveRetainFlipTemplate,Zo as deriveStaleParameters,le as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,Ii as detectStackDrift,Os as digestHead,_s as dockerBuilder,Me as drainPages,Jt as emitProgress,Bo as emitStepWarnings,Ko as emitWarningEvent,Ye as enableCentralisedRootAccess,me as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Ae as enableRamSharing,Te as enableServiceAccess,It as ensureDependencyIntegrity,Qa as ensureEnforceSsl,Se as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Vs as evaluateDestructionConsents,Ks as executableRemediationVerbs,sn as extractAllAccountNames,qo as extractConsumedSsmParameters,he as extractErrorName,xo as failure,Di as fetchLastOperationEvents,Lo as fileExists,lo as filterDangerousEnvVars,De as findAccount,Ce as findDevelopmentOuId,ji as findMarkedResourcesByOpId,ki as findRemediationJournalByOpId,_a as findRemovalDeletionFailures,Aa as findResourcesPresent,nn as flattenAccountsToEnvironments,Li as formatDriftPreFlightBlock,va as formatDriftRepairOffer,Ft as formatInfrastructureError,Da as formatPinOutcomeDetail,aa as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,tc as getDeploymentFailure,ms as getDestroyStepId,Gr as getOrganisationStackName,Ur as getParallelDeployGroups,kr as getParallelDestroyGroups,Ut as getSourceContext,lt as getStateFilePath,Mt as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,xe as isAborted,Sn as isAccountsConfig,Fr as isApplicationOperation,Br as isApplicationStack,vt as isCdkError,Cs as isDataLoss,zn as isDelegatedToRoute53,Ua as isDeployPathBlockingStatus,Ha as isEnforceSslStatement,Fo as isFailure,Ue as isOULeaf,Wr as isOpenNextPattern,Mr as isOrganisationOperation,ln as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,en as isRootTaskPolicyArn,qn as isRoute53NameServer,Is as isStatefulResourceType,En as isStringArray,vo as isSuccess,Bs as legalRemediationVerbs,ue as listAccounts,bi as listActiveRemediationOps,Yi as listActiveRemediationOpsForContext,Js as loadDeployPlan,po as maskSensitiveOutput,Si as mergeReconciledProviderAccounts,Zn as normaliseRecordName,Xn as nsDelegationPhysicalName,ps as openNextBuilder,an as parseAccountsConfiguration,Qt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,Dn as parseRecordPhysicalName,To as parseShellArgs,$o as partitionAccounts,ss as partitionForRegion,na as partitionPreFlightByRemediation,Pa as pinProbeCoverage,fe as placeAccountsInOUs,ae as probeAccountStackExists,Wo as probeSecretsDrift,Qo as probeServiceDeploymentStatus,si as projectAccountRows,ni as projectScalarSummary,Zi as proveFlipMetadataOnly,Ra as proveRemovalTargetsOnly,_t as readDomainState,Ni as readDriftSuspects,Vi as readRemediationJournal,qi as readRetainFlipState,nt as readStateFile,Ei as reconcileProviderAccounts,Ti as reconcileTrailMigration,Rt as recordDomainDeployState,Ci as recordDriftSuspects,un as recordPhysicalName,Pn as recordSetKey,ce as regionDisabledMessage,pt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,ws as renderConsentVerdictLines,Hs as renderDestructionTicketLines,ga as renderIdentityPinReportLines,Oa as renderPinReportLines,Ls as renderPlanLines,ys as renderPlanSummary,is as resolveBuildArgs,ts as resolveBuildSecretSessionProvider,es as resolveBuildSecrets,rs as resolveSecretRefValue,Jo as restart,ja as restoreAndReconcileQuarantinedBucket,Ja as restoreBucketPolicy,Ms as runApprovalGate,Yn as runCaaPreflight,Cn as runCascadeTakeoverGate,Hn as runDelegatedDomainDestroy,bs as runDestructionGate,yi as runDriftPreFlight,ua as runDriftRepairGate,sa as runForgetSurgery,ha as runIdentityPinMigration,Ia as runIdentitySurfaceGate,_n as runOpenNextBuild,Rn as runOrganisationSetup,fa as runPinRemediation,pa as runRecreatePreFlight,Ea as runRecreateSurgery,xi as runRoute53RecordPreflight,hs as signApprovalToken,_o as sleep,No as sleepAbortable,Le as snapshotIdentityCentre,Sa as snapshotPolicyForType,os as sourcedRefsFromBuildArgs,ht as startStackMonitoring,Ts as staticSiteBuilder,rt as stubCallerIdentity,ho as success,Gi as sweepExpiredRemediationJournals,ca as synthTemplateDeclaresResource,Wa as synthesiseEnforceSslDocument,jn as systemDnsNameProbe,Bn as templateOwnsDelegationRecord,Jr as toPascalCase,wa as toResourcePolicyStatements,Eo as toServiceError,gs as toWirePlanChanges,Xa as triageBucketPolicy,_ as truncateUtf16Safe,Ga as unlockBucket,Ba as unlockQueue,de as updateBackupGlobalSettings,St as updateTemplateHash,cs as validateBuildGroup,lr as verbsForDriftVerdict,xs as verifyApprovalToken,qa as verifyOrgTrailDelivery,zi as verifyRetainFlipDiff,kn as waitForNsPropagation,et as wrapApplicationError,At as writeDomainState,Bi as writeRemediationJournal,st as writeStateFile};
+import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as a,DEPLOYMENT_EVENT_TYPES as i,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as S,CASCADE_PHASES as l,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as T,truncateUtf16Safe as _}from"./types/index.js";import{DeployEventSchema as R,StepProgressSchema as m,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as N,SUPPORTED_CONTRACT_MARKERS as C,DEPLOY_EVENT_ID_MAX as g,DEPLOY_EVENT_NAME_MAX as I,DEPLOY_EVENT_MESSAGE_MAX as y,DEPLOY_EVENT_STATUS_REASON_MAX as L,DEPLOY_EVENT_ERROR_MESSAGE_MAX as x,DEPLOY_EVENT_TRAIL_DETAIL_MAX as h,DEPLOY_EVENT_OUTPUT_MAX as v,DEPLOY_EVENT_ARN_MAX as F,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ae,probeAccountStackExists as ie}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as Se,describeOrganisation as le,enablePolicyTypes as pe,enableServiceAccess as Te,SERVICE_PRINCIPALS as _e,enableRamSharing as Ae,activateTrustedAccess as Re,enableIpamDelegatedAdmin as me,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ne,findDevelopmentOuId as Ce,activateCostAllocationTags as ge,checkIdentityCentreStatus as Ie,snapshotIdentityCentre as ye,composeSdkAbortSignal as Le,extractErrorName as xe,isAborted as he,DEFAULT_MAX_PAGES as ve,IDENTITY_STORE_PAGE_SIZE as Fe,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ar}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as Sr,verbsForDriftVerdict as lr}from"./types/index.js";import{REMEDIATION_PHASES as Tr,RemediationPhaseSchema as _r,RemediationTargetSchema as Ar,RemediationFlipProofSchema as Rr,RemediationJournalRecordSchema as mr,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Nr,APPLICATION_DEPLOY_ORDER as Cr,APPLICATION_DESTROY_ORDER as gr,OPENNEXT_DEPLOY_ORDER as Ir,OPENNEXT_DESTROY_ORDER as yr,PARALLEL_DEPLOY_GROUPS as Lr,PARALLEL_DESTROY_GROUPS as xr,OPENNEXT_PARALLEL_GROUPS as hr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Fr,isOrganisationOperation as Mr,getParallelDeployGroups as Ur,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Wr,OPENNEXT_PATTERNS as Qr,STACK_NOT_FOUND_PATTERN as jr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as it,readStateFile as nt,writeStateFile as st,createEmptyState as ct,deleteStateFile as Et,updateTemplateHash as St,getStateFilePath as lt,regionSuffix as pt}from"./types/config/FjallState.js";import{readDomainState as _t,writeDomainState as At,recordDomainDeployState as Rt,deleteDomainState as mt,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Nt,CdkProcessManager as Ct,ensureDependencyIntegrity as gt,clearDependencyIntegrityCache as It,DEPENDENCY_SYNC_TIMEOUT_MS as yt,CdkEventMonitor as Lt,startStackMonitoring as xt,DEFAULT_DEPLOY_TIMEOUT_MS as ht,isCdkError as vt,formatInfrastructureError as Ft,getStructuralHint as Mt,getSourceContext as Ut,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Wt,parseBuildPhase as Qt,buildStepContextBuildConfig as jt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as ao,DeploymentError as io,NetworkError as no,FileSystemError as so,ConfigError as co,toServiceError as Eo}from"./types/errors/index.js";import{filterDangerousEnvVars as lo,maskSensitiveOutput as po,parseShellArgs as To,sleep as _o}from"@fjall/util";import{artefactOutputKey as Ro,DeployModeSchema as mo,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as No}from"./util/sleepAbortable.js";import{createSequencedCallbacks as go}from"./util/sequencedCallbacks.js";import{fileExists as yo}from"@fjall/util/fsHelpers";import{success as xo,failure as ho,isSuccess as vo,isFailure as Fo}from"@fjall/generator";import{deploy as Uo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{buildParamsContext as Vo}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Bo,emitWarningEvent as Ko}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Ho}from"./util/diagnosticScopes.js";import{restart as Jo,probeSecretsDrift as Wo,probeServiceDeploymentStatus as Qo,computeSecretsDrift as jo,deriveStaleParameters as Zo,extractConsumedSsmParameters as qo}from"./orchestration/index.js";import{partitionAccounts as $o}from"./orchestration/index.js";import{buildRegionList as ra,buildAccountRegionPairs as ta,cascadeHomeRegion as oa,cascadeOperationKey as aa}from"./orchestration/index.js";import{projectScalarSummary as na,projectAccountRows as sa}from"./orchestration/index.js";import{reconcileProviderAccounts as Ea,mergeReconciledProviderAccounts as Sa}from"./orchestration/index.js";import{decideNextTransition as pa,reconcileTrailMigration as Ta,decommissionMemberTrailStorage as _a,ORG_TRAIL_BUCKET_OUTPUT_KEY as Aa,TRAIL_BUCKET_OUTPUT_KEY as Ra,TRAIL_KEY_ARN_OUTPUT_KEY as ma}from"./orchestration/index.js";import{classifyDriftFailure as ua,fetchLastOperationEvents as Da,DriftProbe as Pa,clearDriftSuspects as Oa,defaultDriftJournalDir as fa,readDriftSuspects as Na,recordDriftSuspects as Ca,detectStackDrift as ga,runDriftPreFlight as Ia,formatDriftPreFlightBlock as ya,DRIFT_PREFLIGHT_TRIGGER_STATUSES as La,DRIFT_PREFLIGHT_BUDGET_MS as xa,runRoute53RecordPreflight as ha}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Fa,computeRemediationOpId as Ma,defaultRemediationJournalDir as Ua,findRemediationJournalByOpId as ka,listActiveRemediationOps as ba,listActiveRemediationOpsForContext as Ya,readRemediationJournal as Va,sweepExpiredRemediationJournals as Ga,writeRemediationJournal as Ba,REMEDIATION_JOURNAL_RETENTION_DAYS as Ka,captureRemediationForensics as Xa,defaultRemediationForensicsDir as Ha,applyRetainFlip as wa,composeFlipCapabilities as Ja,computeTemplateDigest as Wa,deriveRetainFlipTemplate as Qa,findMarkedResourcesByOpId as ja,proveFlipMetadataOnly as Za,readRetainFlipState as qa,verifyRetainFlipDiff as za,FORGET_MARKER_KEY as $a,FORGET_FLIP_SPEC as ei,RECREATE_MARKER_KEY as ri,assessForgetResumability as ti,completeForgetAfterConverge as oi,completeForgetAfterDeploy as ai,formatRecreateInFlightCures as ii,partitionPreFlightByRemediation as ni,runForgetSurgery as si,synthTemplateDeclaresResource as ci,runRecreateSurgery as Ei,snapshotPolicyForType as Si,SNAPSHOT_CAPABLE_RESOURCE_TYPES as li,runRecreatePreFlight as pi,deriveRemovalTemplate as Ti,findRemovalDeletionFailures as _i,findResourcesPresent as Ai,proveRemovalTargetsOnly as Ri,advertisableDriftVerbs as mi,buildDriftRepairTicket as di,runDriftRepairGate as ui,formatPinOutcomeDetail as Di,pinProbeCoverage as Pi,renderPinReportLines as Oi,runPinRemediation as fi,captureLegacySurfaces as Ni,decodeLegacyAnchor as Ci,runIdentitySurfaceGate as gi,collectIdentityPinCandidates as Ii,degradedIdentityPinOutcomes as yi,renderIdentityPinReportLines as Li,runIdentityPinMigration as xi,composePostFailureRepairOffer as hi,formatDriftRepairOffer as vi,DriftRepairAvailableError as Fi,checkDeployPathStackAvailability as Mi,isDeployPathBlockingStatus as Ui,StackUnavailableError as ki,assertLeaseBeforeStack as bi,LeaseDeniedError as Yi}from"./orchestration/index.js";import{unlockBucket as Gi,unlockQueue as Bi}from"./orchestration/index.js";import{triageBucketPolicy as Xi,isEnforceSslStatement as Hi,toResourcePolicyStatements as wi,restoreBucketPolicy as Ji,synthesiseEnforceSslDocument as Wi,ensureEnforceSsl as Qi,restoreAndReconcileQuarantinedBucket as ji}from"./orchestration/index.js";import{verifyOrgTrailDelivery as qi}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as $i,isRootTaskPolicyArn as en,ROOT_TASK_POLICY_ARNS as rn,MAX_ROOT_SESSION_SECONDS as tn}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as an,flattenAccountsToEnvironments as nn,extractAllAccountNames as sn,accountsConfigToOUTree as cn,isStringArray as En,isAccountsConfig as Sn,isOuOnlyAccountBucket as ln,OU_ONLY_ACCOUNT_BUCKETS as pn}from"./orchestration/index.js";import{runOpenNextBuild as _n}from"./orchestration/index.js";import{runOrganisationSetup as Rn,ORG_SETUP_PHASES as mn}from"./orchestration/index.js";import{recordPhysicalName as un,parseRecordPhysicalName as Dn,recordSetKey as Pn,deleteRecordSetsByKey as On,cascadeTakeoverDigestSeed as fn,buildCascadeTakeoverTicket as Nn,runCascadeTakeoverGate as Cn,WorkerDomainDeployProvider as gn,createWorkerDomainDeployProvider as In}from"./orchestration/index.js";import{DOMAIN_DELEGATION_ERROR_TYPES as Ln,DomainDelegationError as xn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as hn,PUBLIC_DNS_QUERY_TIMEOUT_MS as vn,createPublicResolvers as Fn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Mn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Un,waitForNsPropagation as kn,ACM_CAA_ISSUERS as bn,runCaaPreflight as Yn,deployDelegatedDomain as Vn,delegationRoleUnusableError as Gn,deriveZonePhaseState as Bn,extractDelegationRoleArn as Kn,readDelegatedTopologyFromProps as Xn,readDomainStackOutputsByExport as Hn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as wn,templateOwnsDelegationRecord as Jn,deleteChildNsFromParent as Wn,nsDelegationPhysicalName as Qn,runDelegatedDomainDestroy as jn}from"./orchestration/index.js";import{classifyZoneRecords as qn,buildSatelliteRecordIndex as zn,createSystemDnsNameProbe as $n,systemDnsNameProbe as es,normaliseRecordName as rs,isRoute53NameServer as ts,isDelegatedToRoute53 as os}from"./orchestration/index.js";import{resolveBuildSecrets as is,resolveSecretRefValue as ns,resolveBuildSecretSessionProvider as ss,sourcedRefsFromBuildArgs as cs,resolveBuildArgs as Es,buildBuildSecretSessionPolicy as Ss,buildDeploySessionPolicy as ls,partitionForRegion as ps,validateBuildGroup as Ts}from"./orchestration/index.js";import{FrameworkRegistry as As}from"./orchestration/index.js";import{openNextBuilder as ms,staticSiteBuilder as ds,dockerBuilder as us}from"./orchestration/index.js";import{StepRegistry as Ps,getDestroyStepId as Os}from"./steps/index.js";import{buildDeployPlan as Ns,computeDeployPlan as Cs,computeAssemblyDigest as gs,digestHead as Is,classifyImpact as ys,derivePropertyChanges as Ls,isDataLoss as xs,isStatefulResourceType as hs,renderPlanSummary as vs,renderPlanLines as Fs,toWirePlanChanges as Ms,signApprovalToken as Us,verifyApprovalToken as ks,DEFAULT_APPROVAL_TTL_MS as bs,APPROVAL_TOKEN_PATTERN as Ys,runApprovalGate as Vs,approvalRefusalReason as Gs}from"./orchestration/index.js";import{runDestructionGate as Ks,buildDestructionTicket as Xs,evaluateDestructionConsents as Hs,computeTicketDigest as ws,legalRemediationVerbs as Js,executableRemediationVerbs as Ws,advertisableRemediationVerbs as Qs,renderDestructionTicketLines as js,renderConsentVerdictLines as Zs,loadDeployPlan as qs,createMemoisedPlanLoader as zs}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as ec,classifyDeployFailure as rc,classifyFromEcsCompletion as tc,classifyFromFailureAnalysis as oc,classifyUnclassified as ac}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as nc,getDeploymentFailure as sc}from"./orchestration/failure/deploymentFailureAttachment.js";export{bn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Cr as APPLICATION_DEPLOY_ORDER,gr as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Ys as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,ao as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,l as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,wn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Nt as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,Lt as CdkEventMonitor,Ct as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,co as ConfigError,bs as DEFAULT_APPROVAL_TTL_MS,ht as DEFAULT_DEPLOY_TIMEOUT_MS,ve as DEFAULT_MAX_PAGES,hn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,yt as DEPENDENCY_SYNC_TIMEOUT_MS,S as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,i as DEPLOYMENT_EVENT_TYPES,ec as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,F as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,N as DEPLOY_EVENT_CONTRACT_MINOR,x as DEPLOY_EVENT_ERROR_MESSAGE_MAX,g as DEPLOY_EVENT_ID_MAX,y as DEPLOY_EVENT_MESSAGE_MAX,I as DEPLOY_EVENT_NAME_MAX,v as DEPLOY_EVENT_OUTPUT_MAX,L as DEPLOY_EVENT_STATUS_REASON_MAX,h as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,Ln as DOMAIN_DELEGATION_ERROR_TYPES,xa as DRIFT_PREFLIGHT_BUDGET_MS,La as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,R as DeployEventSchema,mo as DeployModeSchema,d as DeployResourceSchema,io as DeploymentError,a as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,xn as DomainDelegationError,Er as DriftFindingSchema,Sr as DriftJournalRecordSchema,Pa as DriftProbe,Fi as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Ho as ENGINE_DIAGNOSTIC_SCOPE,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,ei as FORGET_FLIP_SPEC,$a as FORGET_MARKER_KEY,so as FileSystemError,it as FjallStateFileSchema,As as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,Fe as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Yi as LeaseDeniedError,tn as MAX_ROOT_SESSION_SECONDS,Un as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Mn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,Ir as OPENNEXT_DEPLOY_ORDER,yr as OPENNEXT_DESTROY_ORDER,hr as OPENNEXT_PARALLEL_GROUPS,Qr as OPENNEXT_PATTERNS,Nr as ORGANISATION_TYPES,mn as ORG_SETUP_PHASES,Aa as ORG_TRAIL_BUCKET_OUTPUT_KEY,pn as OU_ONLY_ACCOUNT_BUCKETS,Lr as PARALLEL_DEPLOY_GROUPS,xr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Wt as PROGRESS_MESSAGES,vn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,ri as RECREATE_MARKER_KEY,Ka as REMEDIATION_JOURNAL_RETENTION_DAYS,Tr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,rn as ROOT_TASK_POLICY_ARNS,Rr as RemediationFlipProofSchema,mr as RemediationJournalRecordSchema,_r as RemediationPhaseSchema,Ar as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,_e as SERVICE_PRINCIPALS,li as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,jr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,C as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,ki as StackUnavailableError,m as StepProgressSchema,Ps as StepRegistry,or as TICKET_VERDICT_SOURCES,Ra as TRAIL_BUCKET_OUTPUT_KEY,ma as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,ar as TicketVerdictSourceSchema,to as ValidationError,gn as WorkerDomainDeployProvider,cn as accountsConfigToOUTree,ge as activateCostAllocationTags,Re as activateTrustedAccess,mi as advertisableDriftVerbs,Qs as advertisableRemediationVerbs,wa as applyRetainFlip,Gs as approvalRefusalReason,Fa as archiveCompletedRemediationJournal,Ro as artefactOutputKey,bi as assertLeaseBeforeStack,ti as assessForgetResumability,$i as assumeRootForTask,nc as attachDeploymentFailure,ta as buildAccountRegionPairs,Ne as buildAccountToOUMap,Ss as buildBuildSecretSessionPolicy,Nn as buildCascadeTakeoverTicket,Ns as buildDeployPlan,ls as buildDeploySessionPolicy,Xs as buildDestructionTicket,di as buildDriftRepairTicket,Vo as buildParamsContext,ra as buildRegionList,zn as buildSatelliteRecordIndex,jt as buildStepContextBuildConfig,ae as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Ni as captureLegacySurfaces,Xa as captureRemediationForensics,oa as cascadeHomeRegion,aa as cascadeOperationKey,fn as cascadeTakeoverDigestSeed,Mi as checkDeployPathStackAvailability,Ie as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,T as clampDeploymentEventStrings,rc as classifyDeployFailure,ua as classifyDriftFailure,tc as classifyFromEcsCompletion,oc as classifyFromFailureAnalysis,ys as classifyImpact,ac as classifyUnclassified,qn as classifyZoneRecords,It as clearDependencyIntegrityCache,Oa as clearDriftSuspects,Ii as collectIdentityPinCandidates,oi as completeForgetAfterConverge,ai as completeForgetAfterDeploy,Ja as composeFlipCapabilities,hi as composePostFailureRepairOffer,Le as composeSdkAbortSignal,gs as computeAssemblyDigest,Cs as computeDeployPlan,Ma as computeRemediationOpId,jo as computeSecretsDrift,Wa as computeTemplateDigest,ws as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,j as createDeployEmitter,ct as createEmptyState,zs as createMemoisedPlanLoader,Fn as createPublicResolvers,go as createSequencedCallbacks,$n as createSystemDnsNameProbe,In as createWorkerDomainDeployProvider,pa as decideNextTransition,Ci as decodeLegacyAnchor,_a as decommissionMemberTrailStorage,fa as defaultDriftJournalDir,Ha as defaultRemediationForensicsDir,Ua as defaultRemediationJournalDir,yi as degradedIdentityPinOutcomes,Gn as delegationRoleUnusableError,Wn as deleteChildNsFromParent,mt as deleteDomainState,On as deleteRecordSetsByKey,Et as deleteStateFile,Uo as deploy,Vn as deployDelegatedDomain,Ls as derivePropertyChanges,Ti as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,Qa as deriveRetainFlipTemplate,Zo as deriveStaleParameters,Bn as deriveZonePhaseState,le as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,ga as detectStackDrift,Is as digestHead,us as dockerBuilder,Me as drainPages,Jt as emitProgress,Bo as emitStepWarnings,Ko as emitWarningEvent,Ye as enableCentralisedRootAccess,me as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Ae as enableRamSharing,Te as enableServiceAccess,gt as ensureDependencyIntegrity,Qi as ensureEnforceSsl,Se as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Hs as evaluateDestructionConsents,Ws as executableRemediationVerbs,sn as extractAllAccountNames,qo as extractConsumedSsmParameters,Kn as extractDelegationRoleArn,xe as extractErrorName,ho as failure,Da as fetchLastOperationEvents,yo as fileExists,lo as filterDangerousEnvVars,De as findAccount,Ce as findDevelopmentOuId,ja as findMarkedResourcesByOpId,ka as findRemediationJournalByOpId,_i as findRemovalDeletionFailures,Ai as findResourcesPresent,nn as flattenAccountsToEnvironments,ya as formatDriftPreFlightBlock,vi as formatDriftRepairOffer,Ft as formatInfrastructureError,Di as formatPinOutcomeDetail,ii as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,sc as getDeploymentFailure,Os as getDestroyStepId,Gr as getOrganisationStackName,Ur as getParallelDeployGroups,kr as getParallelDestroyGroups,Ut as getSourceContext,lt as getStateFilePath,Mt as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,he as isAborted,Sn as isAccountsConfig,Fr as isApplicationOperation,Br as isApplicationStack,vt as isCdkError,xs as isDataLoss,os as isDelegatedToRoute53,Ui as isDeployPathBlockingStatus,Hi as isEnforceSslStatement,Fo as isFailure,Ue as isOULeaf,Wr as isOpenNextPattern,Mr as isOrganisationOperation,ln as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,en as isRootTaskPolicyArn,ts as isRoute53NameServer,hs as isStatefulResourceType,En as isStringArray,vo as isSuccess,Js as legalRemediationVerbs,ue as listAccounts,ba as listActiveRemediationOps,Ya as listActiveRemediationOpsForContext,qs as loadDeployPlan,po as maskSensitiveOutput,Sa as mergeReconciledProviderAccounts,rs as normaliseRecordName,Qn as nsDelegationPhysicalName,ms as openNextBuilder,an as parseAccountsConfiguration,Qt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,Dn as parseRecordPhysicalName,To as parseShellArgs,$o as partitionAccounts,ps as partitionForRegion,ni as partitionPreFlightByRemediation,Pi as pinProbeCoverage,fe as placeAccountsInOUs,ie as probeAccountStackExists,Wo as probeSecretsDrift,Qo as probeServiceDeploymentStatus,sa as projectAccountRows,na as projectScalarSummary,Za as proveFlipMetadataOnly,Ri as proveRemovalTargetsOnly,Xn as readDelegatedTopologyFromProps,Hn as readDomainStackOutputsByExport,_t as readDomainState,Na as readDriftSuspects,Va as readRemediationJournal,qa as readRetainFlipState,nt as readStateFile,Ea as reconcileProviderAccounts,Ta as reconcileTrailMigration,Rt as recordDomainDeployState,Ca as recordDriftSuspects,un as recordPhysicalName,Pn as recordSetKey,ce as regionDisabledMessage,pt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,Zs as renderConsentVerdictLines,js as renderDestructionTicketLines,Li as renderIdentityPinReportLines,Oi as renderPinReportLines,Fs as renderPlanLines,vs as renderPlanSummary,Es as resolveBuildArgs,ss as resolveBuildSecretSessionProvider,is as resolveBuildSecrets,ns as resolveSecretRefValue,Jo as restart,ji as restoreAndReconcileQuarantinedBucket,Ji as restoreBucketPolicy,Vs as runApprovalGate,Yn as runCaaPreflight,Cn as runCascadeTakeoverGate,jn as runDelegatedDomainDestroy,Ks as runDestructionGate,Ia as runDriftPreFlight,ui as runDriftRepairGate,si as runForgetSurgery,xi as runIdentityPinMigration,gi as runIdentitySurfaceGate,_n as runOpenNextBuild,Rn as runOrganisationSetup,fi as runPinRemediation,pi as runRecreatePreFlight,Ei as runRecreateSurgery,ha as runRoute53RecordPreflight,Us as signApprovalToken,_o as sleep,No as sleepAbortable,ye as snapshotIdentityCentre,Si as snapshotPolicyForType,cs as sourcedRefsFromBuildArgs,xt as startStackMonitoring,ds as staticSiteBuilder,rt as stubCallerIdentity,xo as success,Ga as sweepExpiredRemediationJournals,ci as synthTemplateDeclaresResource,Wi as synthesiseEnforceSslDocument,es as systemDnsNameProbe,Jn as templateOwnsDelegationRecord,Jr as toPascalCase,wi as toResourcePolicyStatements,Eo as toServiceError,Ms as toWirePlanChanges,Xi as triageBucketPolicy,_ as truncateUtf16Safe,Gi as unlockBucket,Bi as unlockQueue,de as updateBackupGlobalSettings,St as updateTemplateHash,Ts as validateBuildGroup,lr as verbsForDriftVerdict,ks as verifyApprovalToken,qi as verifyOrgTrailDelivery,za as verifyRetainFlipDiff,kn as waitForNsPropagation,et as wrapApplicationError,At as writeDomainState,Ba as writeRemediationJournal,st as writeStateFile};

package/dist/src/orchestration/application/applicationDeploy.js

@@ -1 +1 @@
-var Re=Object.defineProperty;var P=(e,n)=>Re(e,"name",{value:n,configurable:!0});import{join as fe}from"path";import{CloudFormationClient as Ie}from"@aws-sdk/client-cloudformation";import{EC2Client as Ce}from"@aws-sdk/client-ec2";import{success as A,failure as l}from"@fjall/generator";import{logger as F}from"@fjall/util/logger";import{ImageTagSchema as Oe,getErrorMessage as Q,imageTagParameterName as Ae,maskSensitiveOutput as h}from"@fjall/util";import{parseDockerDeclarationsFromManifest as Le}from"@fjall/util/manifest";import{stubCallerIdentity as Be}from"../../types/deployment/index.js";import{getApplicationDeployOrder as Me,getApplicationStackName as C,getApplicationStepName as pe,getApplicationStepId as me,APPLICATION_STACKS as R}from"../../types/operations.js";import{CdkContextBuilder as $e}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as xe,buildCapacityIdentityContext as Fe,bootstrapOrFail as je}from"../contextHelpers.js";import{resolveDeployEnvironment as Ge}from"../deployEnvironment.js";import{buildBootstrapTagsIfResolved as He}from"../bootstrapTags.js";import{hasOrganisationTierAccount as Ue}from"../../aws/organisations/accountGlobals.js";import{runDetectionPipeline as _e}from"./detectionPipeline.js";import{assertCapacityPinsSupportedByAssembly as We,assertEngineCompatibleWithAssembly as Ke}from"./engineCompat.js";import{STEP_IDS as _,STEP_NAMES as qe}from"../../types/stepDefinitions.js";import{StepRegistry as Ve}from"../../steps/stepRegistry.js";import{checkTargetReadiness as ze}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as Je}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as Ye}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as ye,runDockerBuild as Qe}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as Xe,getStackNamesToDeploy as Ze,deployParallelPhase as et,deployStackSequential as tt,runDockerPreCompute as rt,runLambdaVersionPublish as nt,createBuildCallbacks as ot,willRunDockerBuild as at}from"./applicationDeployHelpers.js";import{verifyAssemblyIntegrity as he}from"./assemblyIntegrity.js";import{captureDatabaseConnectionOutputs as it,captureServiceTaskDefinitions as st,reconcileDatabaseEndpointChange as ct}from"./databaseEndpointReconcile.js";import{deployCodeOnly as lt}from"./codeOnlyDeploy.js";import{ensureSchemaGateImage as dt}from"./schemaGateImage.js";import{checkDeployPathStackAvailability as ke}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as W}from"./leaseGate.js";import{collectFullDeployArtefacts as ut}from"./artefactCollection.js";import{CfnRegistryService as gt}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as ft}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as pt}from"./approvalGate.js";import{buildDestructionTicket as mt,runDestructionGate as yt}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as ht,signApprovalToken as kt}from"./plan/approvalToken.js";import{computeAssemblyDigest as St}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as bt}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as wt}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as Et}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as Se}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as Tt,runPinRemediation as Pt}from"../remediation/pinRemediation.js";import{degradedIdentityPinOutcomes as be,renderIdentityPinReportLines as vt}from"../remediation/migrateIdentity.js";import{runRecreatePreFlight as Nt}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as Dt}from"../remediation/recreateResource.js";const j="applicationDeploy";function Rt(e){const n=Object.entries(e);if(n.length===0)return;const o={};for(const[t,s]of n){const E=Ae(t);o[E]=s}return o}P(Rt,"buildCdkImageTagParameters");function It(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return l(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return l(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return l(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return l(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return l(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const n=Object.entries(e.serviceImageTags);if(n.length===0)return l(new Error("serviceImageTags must name at least one service"));for(const[o,t]of n){const s=Oe.safeParse(t);if(!s.success)return l(new Error(`serviceImageTags.${o} is not a valid image tag: ${s.error.message}`))}}return A(void 0)}P(It,"validateRollbackOptions");function we(e,n,o){if(e.onStackTargets===void 0||o.length===0)return;const t=n.awsProvider.getAccountId(),s=n.awsProvider.getRegion();e.onStackTargets(o.map(E=>({stackName:E,...t!==""?{accountId:t}:{},...s!==""?{region:s}:{}})))}P(we,"emitStackTargets");async function wr(e,n,o){const{callbacks:t,options:s}=e,E=Date.now(),G=s?.mode??(s?.imageTag||s?.serviceImageTags?"rollback":s?.deployOnly?"code-only":"full");if(G==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),l(r)}const X=It(s);if(!X.success){const r=h(X.error.message),a=new Error(r);return t.onError?.(a),l(a)}const K=Ge({orgConfig:e.orgConfig,accountId:n.awsProvider.getAccountId()});if(!K.success){const r=new Error(h(K.error.message));return t.onError?.(r),l(r)}const B=$e.buildDeploymentContext({deployType:"application",target:o.appName,path:o.path,region:n.awsProvider.getRegion(),environment:K.data,callerIdentity:Be(n.awsProvider.getAccountId()),...xe({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc}),...e.managedDomainBindings!==void 0?{managedDomainBindings:e.managedDomainBindings}:{},...Fe(e)},{verbose:s?.verbose,infraOnly:s?.infraOnly},e.orgConfig),v=n.frameworkRegistry.resolve({appPath:o.path});let Z;const M=G==="rollback";if(v&&!M){Z=v.builder.plan({appPath:o.path},v.detection);const r=ot(t),a=await v.builder.build(o.path,Z,r,{skipBuild:s?.skipBuild,infraOnly:s?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!a.success){const i=new Error(h(a.error.message));return t.onError?.(i),l(i)}}if(G==="code-only"||M){t.onLog?.(M?s?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(s.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${s?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=fe(o.path,"cdk.out"),a=Ke({cdkOutPath:r,onWarning:P(f=>t.onLog?.(f,"warn"),"onWarning")});if(!a.success){const f=new Error(h(a.error.message));return t.onError?.(f),l(f)}const i=We({cdkOutPath:r,capacityIdentityWire:B.capacityIdentity,appName:o.appName});if(!i.success){const f=new Error(h(i.error.message));return t.onError?.(f),l(f)}const m=Le(r),d=m.declaresBuild,y=v?.detection.hasDockerfile===!0,g=d||y;F.debug(j,"Deploy-only branch entered",{mode:G,imageTag:s?.imageTag,serviceImageTags:s?.serviceImageTags,appName:o.appName,appPath:o.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:v?.builder.name,hasDockerfileFromManifest:d,hasDockerfileFromDisk:y,hasDockerfile:g,manifestDockerServiceCount:m.ecsServices.length,manifestDockerPaths:m.ecsServices.map(f=>f.docker.path),manifestLambdaDockerEntryCount:m.lambdaEntries.length}),!d&&!y&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const c=await ke([C(o.appName,R.COMPUTE)],n.cfnService,e.abortSignal);if(!c.success)return t.onError?.(c.error),l(c.error);we(t,n,[C(o.appName,R.COMPUTE)]);let u={},k;if(!M&&e.dockerProvider!==void 0&&g){F.debug(j,"Running Docker build before code-only deploy",{source:d?"manifest":"disk"});const f=await Qe(e,n,o,t);if(!f.success)return l(f.error);u=f.data.contentHashTagsByService,k=f.data}else F.debug(j,"Skipping Docker build",{reason:M?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const w=await W(e.assertLeaseForStack,C(o.appName,R.COMPUTE),e.abortSignal);return w!==void 0?(t.onError?.(w),l(w)):lt(e,n,o,u,k)}t.onLog?.("Analysing infrastructure\u2026","info");const H=await _e(o,n,B,t,e.abortSignal);if(!H.success){const r=new Error(h(H.error.message),{cause:H.error});return t.onError?.(r),l(r)}const p=H.data;try{await t.onDetectionComplete?.({...p,builderName:v?.builder.name??"unknown"})}catch(r){const a=new Error(h(Q(r)),{cause:r});return t.onError?.(a),l(a)}const Ee={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:s?.infraOnly??!1,hasDockerfile:p.hasDockerfile,pattern:p.pattern,resources:p.resources,...v&&{builderName:v.builder.name}},ee=Ve.getSteps(Ee),te=ee.findIndex(r=>r.id===_.TARGET_READINESS),re=await Ye(t,{stepId:_.TARGET_READINESS,stepName:qe.TARGET_READINESS,...te>=0&&{stepIndex:te,totalSteps:ee.length}},async()=>{if(s?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=n.awsProvider.getAccountId(),a=e.orgConfig?.providerAccounts.find(y=>y.id===r)?.name,i=n.awsProvider.getCredentials(),m=Je(e.orgConfig),d=await ze({cloudFormation:n.awsProvider.getClient(Ie),ec2:new Ce({region:m,...i!==void 0&&{credentials:i}})},{id:r,...a!==void 0&&{name:a}},n.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return d.success?d.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(h(d.data.advisory))}:{kind:"error",error:new Error(h(d.error.message),{cause:d.error})}},e.abortSignal);if(!re.success)return re;const N=Me({pattern:p.pattern,resources:p.resources}),L=N.length,ne=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE)&&s?.infraOnly!==!0;if(!p.hasDifferences&&!s?.force&&!ne){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(s?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE);for(let i=0;i<N.length;i++){const m=N[i];r&&m===R.COMPUTE&&(t.onStepStart?.(_.DOCKER_OPERATIONS,ye),t.onStepComplete?.(_.DOCKER_OPERATIONS,ye,"skipped"));const d=me(m,"deploy"),y=pe(m,"deploy");t.onStepStart?.(d,y,i,L),t.onStepComplete?.(d,y,"skipped",i,L)}const a=await n.stackService.resolveWebsiteUrl(o.appName);return A({target:o.appName,deploymentType:"application",outputs:a?{websiteUrl:a}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-E})}const O=fe(o.path,"cdk.out"),b=Ze({deployOrder:N,stackChanges:p.stackChanges,appName:o.appName,force:s?.force===!0,computeBuildPossible:ne});we(t,n,[...b]);const q=await ke([...b],n.cfnService,e.abortSignal);if(!q.success)return t.onError?.(q.error),l(q.error);const oe={stacksToDeploy:[...b],imageBuild:at({stackNamesToDeploy:b,appName:o.appName,hasDockerProvider:e.dockerProvider!==void 0,hasDockerfile:p.hasDockerfile})},ae=St(p.currentHashes,oe),V=bt({cfnService:n.cfnService,cdkOutPath:O,changedStacks:[...b],assemblyDigest:ae,registry:new gt(n.awsProvider),changeSetProbe:new ft(n.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),z=await wt(n.awsProvider,{stackNames:[...b],cdkOutPath:O,cfnService:n.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(z.kind==="blocked"){const r=new Error(z.message);return t.onError?.(r),l(r)}const ie=z.verifiedAbsentByNecessity??[],U=e.approvalGate!==void 0||s?.approvalToken!==void 0&&s.approvalToken!==""||s?.planOnly===!0;if(U){const r=await pt({approvalGate:e.approvalGate,options:s??{},target:o.appName,cdkOutPath:O,detection:{stackChanges:p.stackChanges,currentHashes:p.currentHashes},scope:oe,cfnService:n.cfnService,loadPlan:V,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const a=r.data;if(a.kind==="rejected")return t.onLog?.(`Deploy rejected: ${h(a.reason)}`,"warn"),A({target:o.appName,deploymentType:"application",rejected:!0,artefacts:[],...a.planDetail!==void 0?{planDetail:a.planDetail}:{},durationMs:Date.now()-E});if(a.kind==="awaiting"){const i=await V(),m=i.success?mt(i.data,ie):void 0;return A({target:o.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:a.approvalToken,assemblyDigest:a.assemblyDigest,planDetail:a.planDetail,...m!==void 0?{destructionTicket:m}:{},artefacts:[],durationMs:Date.now()-E})}}const D=await yt({loadPlan:V,options:s??{},target:o.appName,callbacks:t,verifiedAbsentByNecessity:ie,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!D.success)return t.onError?.(D.error),l(D.error);if(D.data.kind==="withheld"){const r=U?kt({assemblyDigest:ae,ttlMs:ht}):void 0;return A({target:o.appName,deploymentType:"application",destructionPending:!0,destructionTicket:D.data.ticket,destructionOutcome:D.data.outcome,destructionHaltReasons:D.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-E})}if(b.has(C(o.appName,R.COMPUTE))){const r=await dt({awsProvider:n.awsProvider,cdkOutPath:O,onLog:P((a,i)=>t.onLog?.(a,i),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return t.onError?.(r.error),l(r.error)}if(D.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:a}=D.data,i=r.resources.filter(d=>a.get(d.physicalName)==="pin");if(i.length>0){const d=i.filter(u=>u.finding==="rename-detected"),y=i.filter(u=>u.finding!=="rename-detected");t.onLog?.(`Pin remediation for ${o.appName}: ${i.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied to AWS`,"warn");let g;if(d.length>0){if(e.identityPinRunner!==void 0)try{g=await e.identityPinRunner(d,e.abortSignal)}catch(u){g={outcomes:be(d,"unknown",`identity-pin runner failed: ${h(Q(u))} \u2014 fix the cause, then run 'fjall migrate identity'`),verified:[],clean:!1}}else g={outcomes:be(d,"unknown","this surface cannot run the identity-pin migration \u2014 run 'fjall migrate identity' to pin and validate this slot"),verified:[],clean:!1};for(const u of vt(g))t.onLog?.(u,"warn")}let c;if(y.length>0){c=await Pt(n.awsProvider,{targets:y.map(u=>({stack:u.stack,logicalId:u.logicalId,resourceType:u.resourceType,physicalName:u.physicalName,offendingProperties:u.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const u of Tt(c))t.onLog?.(u,"warn")}return i.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),A({target:o.appName,deploymentType:"application",pinPending:!0,...c!==void 0?{pinReport:c}:{},...g!==void 0?{identityPinReport:g}:{},pinDeferredConsents:r.resources.length-i.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-E})}const m=r.resources.filter(d=>d.finding==="pinned-name-replacement"&&a.get(d.physicalName)==="recreate");if(m.length>0){const d=new Map;for(const c of m){const u=d.get(c.stack)??[];u.push(c),d.set(c.stack,u)}const y=await Nt(n.awsProvider,{stacks:[...d].map(([c,u])=>({stackName:c,targets:u.map(k=>({logicalId:k.logicalId,resourceType:k.resourceType,physicalId:k.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!y.success){const c=new Error(h(y.error.message),{cause:y.error});return t.onError?.(c),l(c)}const g=[];for(const[c,u]of d){const k=await W(e.assertLeaseForStack,c,e.abortSignal,"destroy");if(k!==void 0)return g.length>0&&t.onLog?.(`Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(k),l(k);const w=u.map(S=>S.physicalName);t.onLog?.(`Recreate remediation for ${o.appName}: orchestrating the pinned-name replacement of ${w.join(", ")} on ${c}`,"warn");const f=await Dt(n.awsProvider,{stackName:c,targets:u.map(S=>({logicalId:S.logicalId,resourceType:S.resourceType,physicalId:S.physicalName})),appName:o.appName,consentedPhysicalNames:w,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:u.map(S=>S.logicalId),onProgress:P(S=>t.onLog?.(S,"info"),"onProgress"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!f.success){const S=g.length>0?` Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",T=new Error(h(`${f.error.message}${S}`));return t.onError?.(T),l(T)}g.push(`${c} (${w.join(", ")})`)}}}const Te=e.orgConfig!==void 0&&!Ue(e.orgConfig.providerAccounts),Pe=He({account:e.orgConfig?.providerAccounts.find(r=>r.id===n.awsProvider.getAccountId()),estate:Te?"solo":"org"}),se=await je(n,B,t,Pe);if(!se.success)return se;const ce=C(o.appName,R.DATABASE),J=b.has(ce),ve=J?await it(n.cfnService,o.appName,e.abortSignal):void 0,Ne=J?await st(n.ecsResolver,n.ecsService,o.appName,e.abortSignal):void 0,$={},x=new Map;let le,de={};const I=P(async()=>{!J||!x.has(ce)||await ct({appName:o.appName,connectionOutputsBefore:ve,serviceTaskDefinitionsBefore:Ne,services:{cfnService:n.cfnService,ecsService:n.ecsService,ecsResolver:n.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let r=0;r<N.length;r++){const a=N[r],i=C(o.appName,a),m=me(a,"deploy"),d=pe(a,"deploy");if(!b.has(i)){t.onStepStart?.(m,d,r,L),t.onLog?.(`Skipping ${a} \u2014 no changes detected`,"info"),t.onStepComplete?.(m,d,"skipped",r,L);continue}const y=await W(e.assertLeaseForStack,i,e.abortSignal);if(y!==void 0)return await I(),t.onError?.(y),l(y);const g=Xe(N,r,o.appName,b);if(g.length>=2){const T=await he({hashService:n.hashService,cdkOutPath:O,stackNames:g.map(Y=>C(o.appName,Y)),detectionHashes:p.currentHashes,approvalGated:U});if(!T.success)return await I(),t.onError?.(T.error),l(T.error);const ge=await et(g,o,n,B,t,r,L,p,$,x);if(!ge.success)return await I(),l(await Se(n.awsProvider,{stackNames:g.map(Y=>C(o.appName,Y)),appName:o.appName,originalError:ge.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=g.length-1;continue}const c=await rt(a,e,n,o,t,p.hasDockerfile);if(c!==null&&!c.success)return await I(),l(c.error);c!==null&&c.success&&(le=c.data);const u=c!==null&&c.success?c.data.contentHashTagsByService:{},k=Rt(u);if(c!==null){const T=await W(e.assertLeaseForStack,i,e.abortSignal);if(T!==void 0)return await I(),t.onError?.(T),l(T)}const w=await he({hashService:n.hashService,cdkOutPath:O,stackNames:[i],detectionHashes:p.currentHashes,approvalGated:U});if(!w.success)return await I(),t.onError?.(w.error),l(w.error);const f=await tt(a,n,B,t,r,L,$,k!==void 0||e.abortSignal!==void 0?{...k!==void 0?{parameters:k}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!f.success)return await I(),l(await Se(n.awsProvider,{stackNames:[i],appName:o.appName,originalError:f.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));a===R.COMPUTE&&(de=await nt(o,n,t,u,e.abortSignal));const S=p.currentHashes.get(i);S&&x.set(i,S)}if(await I(),x.size>0){const r=await n.hashService.updateStateAfterDeploy(o.path,x);if(!r.success){const a=h(r.error.message);F.debug(j,"Failed to update state file",{error:a}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${a}`,"warn")}}const ue=await n.stackService.resolveWebsiteUrl(o.appName);ue&&($.websiteUrl=ue);const De=await ut(n,o.appName,le,t,O,de,e.abortSignal);return await Et(n.awsProvider,{stackNames:[...b],appName:o.appName,onLog:P((r,a)=>t.onLog?.(r,a),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{F.debug(j,"Forget completion sweep failed",{error:h(Q(r))})}),A({target:o.appName,deploymentType:"application",outputs:Object.keys($).length>0?$:void 0,artefacts:De,durationMs:Date.now()-E})}P(wr,"deployApplication");export{wr as deployApplication,we as emitStackTargets};
+var Re=Object.defineProperty;var P=(e,n)=>Re(e,"name",{value:n,configurable:!0});import{join as fe}from"path";import{CloudFormationClient as Ce}from"@aws-sdk/client-cloudformation";import{EC2Client as Ie}from"@aws-sdk/client-ec2";import{success as A,failure as d}from"@fjall/generator";import{logger as F}from"@fjall/util/logger";import{ImageTagSchema as Oe,getErrorMessage as Q,imageTagParameterName as Ae,maskSensitiveOutput as h}from"@fjall/util";import{parseDockerDeclarationsFromManifest as Le}from"@fjall/util/manifest";import{stubCallerIdentity as Be}from"../../types/deployment/index.js";import{getApplicationDeployOrder as Me,getApplicationStackName as I,getApplicationStepName as pe,getApplicationStepId as me,APPLICATION_STACKS as R}from"../../types/operations.js";import{CdkContextBuilder as $e}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as xe,buildCapacityIdentityContext as Fe,bootstrapOrFail as je}from"../contextHelpers.js";import{resolveDeployEnvironment as Ge}from"../deployEnvironment.js";import{buildBootstrapTagsIfResolved as He}from"../bootstrapTags.js";import{hasOrganisationTierAccount as Ue}from"../../aws/organisations/accountGlobals.js";import{runDetectionPipeline as _e}from"./detectionPipeline.js";import{assertCapacityPinsSupportedByAssembly as We,assertEngineCompatibleWithAssembly as Ke}from"./engineCompat.js";import{STEP_IDS as _,STEP_NAMES as qe}from"../../types/stepDefinitions.js";import{StepRegistry as Ve}from"../../steps/stepRegistry.js";import{checkTargetReadiness as ze}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as Je}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as Ye}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as ye,runDockerBuild as Qe}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as Xe,getStackNamesToDeploy as Ze,deployParallelPhase as et,deployStackSequential as tt,runDockerPreCompute as rt,runLambdaVersionPublish as nt,createBuildCallbacks as at,willRunDockerBuild as ot}from"./applicationDeployHelpers.js";import{verifyAssemblyIntegrity as he}from"./assemblyIntegrity.js";import{captureDatabaseConnectionOutputs as it,captureServiceTaskDefinitions as st,reconcileDatabaseEndpointChange as ct}from"./databaseEndpointReconcile.js";import{deployCodeOnly as dt}from"./codeOnlyDeploy.js";import{ensureSchemaGateImage as lt}from"./schemaGateImage.js";import{checkDeployPathStackAvailability as ke}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as W}from"./leaseGate.js";import{collectFullDeployArtefacts as ut}from"./artefactCollection.js";import{CfnRegistryService as gt}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as ft}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as pt}from"./approvalGate.js";import{buildDestructionTicket as mt,runDestructionGate as yt}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as ht,signApprovalToken as kt}from"./plan/approvalToken.js";import{computeAssemblyDigest as St}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as bt}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as wt}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as Et}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as Se}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as Tt,runPinRemediation as Pt}from"../remediation/pinRemediation.js";import{degradedIdentityPinOutcomes as be,renderIdentityPinReportLines as vt}from"../remediation/migrateIdentity.js";import{runRecreatePreFlight as Nt}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as Dt}from"../remediation/recreateResource.js";const j="applicationDeploy";function Rt(e){const n=Object.entries(e);if(n.length===0)return;const a={};for(const[t,s]of n){const E=Ae(t);a[E]=s}return a}P(Rt,"buildCdkImageTagParameters");function Ct(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return d(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return d(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return d(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return d(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return d(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const n=Object.entries(e.serviceImageTags);if(n.length===0)return d(new Error("serviceImageTags must name at least one service"));for(const[a,t]of n){const s=Oe.safeParse(t);if(!s.success)return d(new Error(`serviceImageTags.${a} is not a valid image tag: ${s.error.message}`))}}return A(void 0)}P(Ct,"validateRollbackOptions");function we(e,n,a){if(e.onStackTargets===void 0||a.length===0)return;const t=n.awsProvider.getAccountId(),s=n.awsProvider.getRegion();e.onStackTargets(a.map(E=>({stackName:E,...t!==""?{accountId:t}:{},...s!==""?{region:s}:{}})))}P(we,"emitStackTargets");async function wr(e,n,a){const{callbacks:t,options:s}=e,E=Date.now(),G=s?.mode??(s?.imageTag||s?.serviceImageTags?"rollback":s?.deployOnly?"code-only":"full");if(G==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),d(r)}const X=Ct(s);if(!X.success){const r=h(X.error.message),o=new Error(r);return t.onError?.(o),d(o)}const K=Ge({orgConfig:e.orgConfig,accountId:n.awsProvider.getAccountId()});if(!K.success){const r=new Error(h(K.error.message));return t.onError?.(r),d(r)}const B=$e.buildDeploymentContext({deployType:"application",target:a.appName,path:a.path,region:n.awsProvider.getRegion(),environment:K.data,callerIdentity:Be(n.awsProvider.getAccountId()),...xe({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc}),...e.managedDomainBindings!==void 0?{managedDomainBindings:e.managedDomainBindings}:{},...e.managedDomainCoverage!==void 0?{managedDomainCoverage:e.managedDomainCoverage}:{},...Fe(e)},{verbose:s?.verbose,infraOnly:s?.infraOnly},e.orgConfig),v=n.frameworkRegistry.resolve({appPath:a.path});let Z;const M=G==="rollback";if(v&&!M){Z=v.builder.plan({appPath:a.path},v.detection);const r=at(t),o=await v.builder.build(a.path,Z,r,{skipBuild:s?.skipBuild,infraOnly:s?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!o.success){const i=new Error(h(o.error.message));return t.onError?.(i),d(i)}}if(G==="code-only"||M){t.onLog?.(M?s?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(s.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${s?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=fe(a.path,"cdk.out"),o=Ke({cdkOutPath:r,onWarning:P(f=>t.onLog?.(f,"warn"),"onWarning")});if(!o.success){const f=new Error(h(o.error.message));return t.onError?.(f),d(f)}const i=We({cdkOutPath:r,capacityIdentityWire:B.capacityIdentity,appName:a.appName});if(!i.success){const f=new Error(h(i.error.message));return t.onError?.(f),d(f)}const m=Le(r),l=m.declaresBuild,y=v?.detection.hasDockerfile===!0,g=l||y;F.debug(j,"Deploy-only branch entered",{mode:G,imageTag:s?.imageTag,serviceImageTags:s?.serviceImageTags,appName:a.appName,appPath:a.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:v?.builder.name,hasDockerfileFromManifest:l,hasDockerfileFromDisk:y,hasDockerfile:g,manifestDockerServiceCount:m.ecsServices.length,manifestDockerPaths:m.ecsServices.map(f=>f.docker.path),manifestLambdaDockerEntryCount:m.lambdaEntries.length}),!l&&!y&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const c=await ke([I(a.appName,R.COMPUTE)],n.cfnService,e.abortSignal);if(!c.success)return t.onError?.(c.error),d(c.error);we(t,n,[I(a.appName,R.COMPUTE)]);let u={},k;if(!M&&e.dockerProvider!==void 0&&g){F.debug(j,"Running Docker build before code-only deploy",{source:l?"manifest":"disk"});const f=await Qe(e,n,a,t);if(!f.success)return d(f.error);u=f.data.contentHashTagsByService,k=f.data}else F.debug(j,"Skipping Docker build",{reason:M?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const w=await W(e.assertLeaseForStack,I(a.appName,R.COMPUTE),e.abortSignal);return w!==void 0?(t.onError?.(w),d(w)):dt(e,n,a,u,k)}t.onLog?.("Analysing infrastructure\u2026","info");const H=await _e(a,n,B,t,e.abortSignal);if(!H.success){const r=new Error(h(H.error.message),{cause:H.error});return t.onError?.(r),d(r)}const p=H.data;try{await t.onDetectionComplete?.({...p,builderName:v?.builder.name??"unknown"})}catch(r){const o=new Error(h(Q(r)),{cause:r});return t.onError?.(o),d(o)}const Ee={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:s?.infraOnly??!1,hasDockerfile:p.hasDockerfile,pattern:p.pattern,resources:p.resources,...v&&{builderName:v.builder.name}},ee=Ve.getSteps(Ee),te=ee.findIndex(r=>r.id===_.TARGET_READINESS),re=await Ye(t,{stepId:_.TARGET_READINESS,stepName:qe.TARGET_READINESS,...te>=0&&{stepIndex:te,totalSteps:ee.length}},async()=>{if(s?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=n.awsProvider.getAccountId(),o=e.orgConfig?.providerAccounts.find(y=>y.id===r)?.name,i=n.awsProvider.getCredentials(),m=Je(e.orgConfig),l=await ze({cloudFormation:n.awsProvider.getClient(Ce),ec2:new Ie({region:m,...i!==void 0&&{credentials:i}})},{id:r,...o!==void 0&&{name:o}},n.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return l.success?l.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(h(l.data.advisory))}:{kind:"error",error:new Error(h(l.error.message),{cause:l.error})}},e.abortSignal);if(!re.success)return re;const N=Me({pattern:p.pattern,resources:p.resources}),L=N.length,ne=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE)&&s?.infraOnly!==!0;if(!p.hasDifferences&&!s?.force&&!ne){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(s?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE);for(let i=0;i<N.length;i++){const m=N[i];r&&m===R.COMPUTE&&(t.onStepStart?.(_.DOCKER_OPERATIONS,ye),t.onStepComplete?.(_.DOCKER_OPERATIONS,ye,"skipped"));const l=me(m,"deploy"),y=pe(m,"deploy");t.onStepStart?.(l,y,i,L),t.onStepComplete?.(l,y,"skipped",i,L)}const o=await n.stackService.resolveWebsiteUrl(a.appName);return A({target:a.appName,deploymentType:"application",outputs:o?{websiteUrl:o}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-E})}const O=fe(a.path,"cdk.out"),b=Ze({deployOrder:N,stackChanges:p.stackChanges,appName:a.appName,force:s?.force===!0,computeBuildPossible:ne});we(t,n,[...b]);const q=await ke([...b],n.cfnService,e.abortSignal);if(!q.success)return t.onError?.(q.error),d(q.error);const ae={stacksToDeploy:[...b],imageBuild:ot({stackNamesToDeploy:b,appName:a.appName,hasDockerProvider:e.dockerProvider!==void 0,hasDockerfile:p.hasDockerfile})},oe=St(p.currentHashes,ae),V=bt({cfnService:n.cfnService,cdkOutPath:O,changedStacks:[...b],assemblyDigest:oe,registry:new gt(n.awsProvider),changeSetProbe:new ft(n.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),z=await wt(n.awsProvider,{stackNames:[...b],cdkOutPath:O,cfnService:n.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(z.kind==="blocked"){const r=new Error(z.message);return t.onError?.(r),d(r)}const ie=z.verifiedAbsentByNecessity??[],U=e.approvalGate!==void 0||s?.approvalToken!==void 0&&s.approvalToken!==""||s?.planOnly===!0;if(U){const r=await pt({approvalGate:e.approvalGate,options:s??{},target:a.appName,cdkOutPath:O,detection:{stackChanges:p.stackChanges,currentHashes:p.currentHashes},scope:ae,cfnService:n.cfnService,loadPlan:V,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const o=r.data;if(o.kind==="rejected")return t.onLog?.(`Deploy rejected: ${h(o.reason)}`,"warn"),A({target:a.appName,deploymentType:"application",rejected:!0,artefacts:[],...o.planDetail!==void 0?{planDetail:o.planDetail}:{},durationMs:Date.now()-E});if(o.kind==="awaiting"){const i=await V(),m=i.success?mt(i.data,ie):void 0;return A({target:a.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:o.approvalToken,assemblyDigest:o.assemblyDigest,planDetail:o.planDetail,...m!==void 0?{destructionTicket:m}:{},artefacts:[],durationMs:Date.now()-E})}}const D=await yt({loadPlan:V,options:s??{},target:a.appName,callbacks:t,verifiedAbsentByNecessity:ie,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!D.success)return t.onError?.(D.error),d(D.error);if(D.data.kind==="withheld"){const r=U?kt({assemblyDigest:oe,ttlMs:ht}):void 0;return A({target:a.appName,deploymentType:"application",destructionPending:!0,destructionTicket:D.data.ticket,destructionOutcome:D.data.outcome,destructionHaltReasons:D.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-E})}if(b.has(I(a.appName,R.COMPUTE))){const r=await lt({awsProvider:n.awsProvider,cdkOutPath:O,onLog:P((o,i)=>t.onLog?.(o,i),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return t.onError?.(r.error),d(r.error)}if(D.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:o}=D.data,i=r.resources.filter(l=>o.get(l.physicalName)==="pin");if(i.length>0){const l=i.filter(u=>u.finding==="rename-detected"),y=i.filter(u=>u.finding!=="rename-detected");t.onLog?.(`Pin remediation for ${a.appName}: ${i.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied to AWS`,"warn");let g;if(l.length>0){if(e.identityPinRunner!==void 0)try{g=await e.identityPinRunner(l,e.abortSignal)}catch(u){g={outcomes:be(l,"unknown",`identity-pin runner failed: ${h(Q(u))} \u2014 fix the cause, then run 'fjall migrate identity'`),verified:[],clean:!1}}else g={outcomes:be(l,"unknown","this surface cannot run the identity-pin migration \u2014 run 'fjall migrate identity' to pin and validate this slot"),verified:[],clean:!1};for(const u of vt(g))t.onLog?.(u,"warn")}let c;if(y.length>0){c=await Pt(n.awsProvider,{targets:y.map(u=>({stack:u.stack,logicalId:u.logicalId,resourceType:u.resourceType,physicalName:u.physicalName,offendingProperties:u.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const u of Tt(c))t.onLog?.(u,"warn")}return i.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),A({target:a.appName,deploymentType:"application",pinPending:!0,...c!==void 0?{pinReport:c}:{},...g!==void 0?{identityPinReport:g}:{},pinDeferredConsents:r.resources.length-i.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-E})}const m=r.resources.filter(l=>l.finding==="pinned-name-replacement"&&o.get(l.physicalName)==="recreate");if(m.length>0){const l=new Map;for(const c of m){const u=l.get(c.stack)??[];u.push(c),l.set(c.stack,u)}const y=await Nt(n.awsProvider,{stacks:[...l].map(([c,u])=>({stackName:c,targets:u.map(k=>({logicalId:k.logicalId,resourceType:k.resourceType,physicalId:k.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!y.success){const c=new Error(h(y.error.message),{cause:y.error});return t.onError?.(c),d(c)}const g=[];for(const[c,u]of l){const k=await W(e.assertLeaseForStack,c,e.abortSignal,"destroy");if(k!==void 0)return g.length>0&&t.onLog?.(`Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(k),d(k);const w=u.map(S=>S.physicalName);t.onLog?.(`Recreate remediation for ${a.appName}: orchestrating the pinned-name replacement of ${w.join(", ")} on ${c}`,"warn");const f=await Dt(n.awsProvider,{stackName:c,targets:u.map(S=>({logicalId:S.logicalId,resourceType:S.resourceType,physicalId:S.physicalName})),appName:a.appName,consentedPhysicalNames:w,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:u.map(S=>S.logicalId),onProgress:P(S=>t.onLog?.(S,"info"),"onProgress"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!f.success){const S=g.length>0?` Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",T=new Error(h(`${f.error.message}${S}`));return t.onError?.(T),d(T)}g.push(`${c} (${w.join(", ")})`)}}}const Te=e.orgConfig!==void 0&&!Ue(e.orgConfig.providerAccounts),Pe=He({account:e.orgConfig?.providerAccounts.find(r=>r.id===n.awsProvider.getAccountId()),estate:Te?"solo":"org"}),se=await je(n,B,t,Pe);if(!se.success)return se;const ce=I(a.appName,R.DATABASE),J=b.has(ce),ve=J?await it(n.cfnService,a.appName,e.abortSignal):void 0,Ne=J?await st(n.ecsResolver,n.ecsService,a.appName,e.abortSignal):void 0,$={},x=new Map;let de,le={};const C=P(async()=>{!J||!x.has(ce)||await ct({appName:a.appName,connectionOutputsBefore:ve,serviceTaskDefinitionsBefore:Ne,services:{cfnService:n.cfnService,ecsService:n.ecsService,ecsResolver:n.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let r=0;r<N.length;r++){const o=N[r],i=I(a.appName,o),m=me(o,"deploy"),l=pe(o,"deploy");if(!b.has(i)){t.onStepStart?.(m,l,r,L),t.onLog?.(`Skipping ${o} \u2014 no changes detected`,"info"),t.onStepComplete?.(m,l,"skipped",r,L);continue}const y=await W(e.assertLeaseForStack,i,e.abortSignal);if(y!==void 0)return await C(),t.onError?.(y),d(y);const g=Xe(N,r,a.appName,b);if(g.length>=2){const T=await he({hashService:n.hashService,cdkOutPath:O,stackNames:g.map(Y=>I(a.appName,Y)),detectionHashes:p.currentHashes,approvalGated:U});if(!T.success)return await C(),t.onError?.(T.error),d(T.error);const ge=await et(g,a,n,B,t,r,L,p,$,x);if(!ge.success)return await C(),d(await Se(n.awsProvider,{stackNames:g.map(Y=>I(a.appName,Y)),appName:a.appName,originalError:ge.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=g.length-1;continue}const c=await rt(o,e,n,a,t,p.hasDockerfile);if(c!==null&&!c.success)return await C(),d(c.error);c!==null&&c.success&&(de=c.data);const u=c!==null&&c.success?c.data.contentHashTagsByService:{},k=Rt(u);if(c!==null){const T=await W(e.assertLeaseForStack,i,e.abortSignal);if(T!==void 0)return await C(),t.onError?.(T),d(T)}const w=await he({hashService:n.hashService,cdkOutPath:O,stackNames:[i],detectionHashes:p.currentHashes,approvalGated:U});if(!w.success)return await C(),t.onError?.(w.error),d(w.error);const f=await tt(o,n,B,t,r,L,$,k!==void 0||e.abortSignal!==void 0?{...k!==void 0?{parameters:k}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!f.success)return await C(),d(await Se(n.awsProvider,{stackNames:[i],appName:a.appName,originalError:f.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));o===R.COMPUTE&&(le=await nt(a,n,t,u,e.abortSignal));const S=p.currentHashes.get(i);S&&x.set(i,S)}if(await C(),x.size>0){const r=await n.hashService.updateStateAfterDeploy(a.path,x);if(!r.success){const o=h(r.error.message);F.debug(j,"Failed to update state file",{error:o}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${o}`,"warn")}}const ue=await n.stackService.resolveWebsiteUrl(a.appName);ue&&($.websiteUrl=ue);const De=await ut(n,a.appName,de,t,O,le,e.abortSignal);return await Et(n.awsProvider,{stackNames:[...b],appName:a.appName,onLog:P((r,o)=>t.onLog?.(r,o),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{F.debug(j,"Forget completion sweep failed",{error:h(Q(r))})}),A({target:a.appName,deploymentType:"application",outputs:Object.keys($).length>0?$:void 0,artefacts:De,durationMs:Date.now()-E})}P(wr,"deployApplication");export{wr as deployApplication,we as emitStackTargets};

package/dist/src/orchestration/domain/WorkerDomainDeployProvider.d.ts

@@ -2,6 +2,7 @@ import { type Result } from "@fjall/generator";
 import type { DeployCallbacks } from "../../types/callbacks.js";
 import type { AwsCredentials } from "../../types/credentials.js";
 import type { DomainConfig, DomainDeployProvider, DomainTakeoverSynth } from "../domainInterface.js";
+import type { DelegatedDomainDeployer } from "./delegatedDomainDeploy.js";
 /**
  * The deployment worker's `DomainDeployProvider` (P6): the cascade's domains
  * phase finally runs on webapp org deploys. Built on deploy-core's own
@@ -12,11 +13,17 @@ import type { DomainConfig, DomainDeployProvider, DomainTakeoverSynth } from "..
  * containered boundary like `infra/fjall` is unresolvable from
  * workingDirectory alone; the job payload carries it instead).
  *
- * `delegatedDeployer` is deliberately not implemented in this release: the
- * engine's documented single-shot `deployDomain` fallback handles delegated
- * entries (waves still order parents first). The D8 two-phase parity
- * (propagation gate + CAA preflight on FIRST deploys of delegated children)
- * is a recorded follow-on in the domains-completion As-built.
+ * `delegatedDeployer` gives delegated children the D8 two-phase ceremony
+ * (zone deploy, NS-propagation gate, CAA preflight, full deploy) at parity
+ * with the CLI. Parent-DelegationRole resolution is worker-shaped: a literal
+ * `parentDelegationRoleArn` in the child's infrastructure.ts wins (no
+ * network, nothing injected — the construct reads its own props), then a
+ * same-account parent resolves through its stack's delegation-role export
+ * with the job credentials. A parent registered in a DIFFERENT account
+ * fails closed with the `delegation_role_unusable` cure — the worker holds
+ * one OIDC-minted credential set and must not invent a cross-account hop.
+ * A parent absent from the registry is the externally-owned Case 3: the
+ * deploy proceeds uninjected with a loud warning, exactly like the CLI.
  */
 export interface WorkerDomainDeployProviderParams {
     /** Absolute path of the checked-out repository the job deploys from. */
@@ -68,6 +75,42 @@ export declare class WorkerDomainDeployProvider implements DomainDeployProvider
     private componentPreconditionError;
     synthForTakeover(domainName: string, callbacks: DeployCallbacks): Promise<Result<DomainTakeoverSynth>>;
     deployDomain(domainName: string, callbacks: DeployCallbacks): Promise<Result<void>>;
+    /**
+     * The one CDK deploy path both `deployDomain` and the delegated
+     * `deployPhase` ride: assembled worker context plus the caller's extra
+     * context keys (the delegated phase + resolved DelegationRole), output
+     * lines optionally prefixed so parallel wave members stay attributable.
+     */
+    private runCdkDeploy;
+    /**
+     * Parse the child component's infrastructure.ts. `undefined` on any miss
+     * (unreadable, unparsable, no Domain call) — the single-shot fallback then
+     * surfaces the real synth error instead of this layer guessing (CLI
+     * parity: `buildDelegatedDomainDeployer` behaves identically).
+     */
+    private parseDomainComponent;
+    /**
+     * The worker's cure sentence for an unusable parent DelegationRole. The
+     * CLI's trio offers `fjall connect` because the CLI can mint parent-account
+     * credentials interactively; the worker cannot, so its cures are the ones
+     * a webapp-triggered deploy can actually action.
+     */
+    private delegationCures;
+    /**
+     * Resolve the parent DelegationRole for one delegated phase, worker
+     * rungs: file literal (inject nothing) → registry-managed same-account
+     * stack export (inject) → cross-account fail-closed → unregistered parent
+     * Case-3 advisory (proceed uninjected).
+     */
+    private resolveDelegationForPhase;
+    /**
+     * D8 delegated-parity seam: the two-phase deployer for one delegated
+     * child. `undefined` when the component is not `external-delegated` (the
+     * single-phase path is then CORRECT, not a downgrade) and when the
+     * component cannot be read or parsed — the single-shot deploy surfaces
+     * the real synth error instead of this layer guessing.
+     */
+    delegatedDeployer(domainName: string): DelegatedDomainDeployer | undefined;
 }
 /**
  * The provider's public entry point: reads + validates the boundary's domain

package/dist/src/orchestration/domain/WorkerDomainDeployProvider.js

@@ -1 +1 @@
-var D=Object.defineProperty;var u=(c,e)=>D(c,"name",{value:e,configurable:!0});import{existsSync as m}from"node:fs";import{readFile as k}from"node:fs/promises";import{join as h,resolve as S}from"node:path";import{OrganizationsClient as C}from"@aws-sdk/client-organizations";import{success as l,failure as o}from"@fjall/generator";import{getDomainStackName as P,getErrorMessage as f,maskSensitiveOutput as s}from"@fjall/util";import{RootConfigReadSchema as x}from"@fjall/util/config";import{logger as y}from"@fjall/util/logger";import{SimpleAwsProvider as v}from"../../aws/SimpleAwsProvider.js";import{describeOrganisationAsMember as E}from"../../aws/organisations/organisation.js";import{CdkService as w}from"../../services/infrastructure/CdkService.js";const b="WorkerDomainDeployProvider";async function $(c,e){const n=[h(c,e,"fjall-config.json"),h(c,"fjall-config.json")].find(r=>m(r));if(n===void 0)return l([]);let a;try{a=await k(n,"utf8")}catch(r){return o(new Error(`domains phase refused: ${n} exists but could not be read (${s(f(r))}) \u2014 deploying with an unreadable domain registry is not an option.`))}let d;try{d=JSON.parse(a)}catch(r){return o(new Error(`domains phase refused: ${n} is not valid JSON (${s(f(r))}). Cure: fix the file by hand \u2014 do not regenerate it, which would discard capacity-identity pins.`))}const i=x.safeParse(d);return i.success?l((i.data.domains??[]).map(r=>({name:r.name,type:r.type,...r.parentDomain!==void 0?{parentDomain:r.parentDomain}:{},...r.account!==void 0?{account:r.account}:{},...r.region!==void 0?{region:r.region}:{}}))):o(new Error(`domains phase refused: ${n} has a malformed domains/activeTarget/capacityIdentity value \u2014 deploying from a registry that cannot be parsed is not an option. Cure: fix the file by hand.`))}u($,"readDomainsConfig");class p{static{u(this,"WorkerDomainDeployProvider")}domains;workingDirectory;boundaryDir;credentials;orgConfigSerialised;abortSignal;aws;orgDetailsPromise;constructor(e,t){this.domains=t,this.workingDirectory=e.workingDirectory,this.boundaryDir=e.boundaryDir,this.credentials=e.credentials,this.orgConfigSerialised=e.orgConfigSerialised,this.abortSignal=e.abortSignal,this.aws=new v(e.credentials)}static async create(e){const t=await $(e.workingDirectory,e.boundaryDir);return t.success?l(new p(e,t.data)):o(t.error)}getDomains(){return this.domains}componentPath(e){return h(this.workingDirectory,this.boundaryDir,"domains",e)}async assembleContext(){this.orgDetailsPromise??=(async()=>{try{const t=await E(this.aws.getClient(C),this.abortSignal);if(!t.success){y.warn(b,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:s(t.error.message)});return}return t.data===null?void 0:{orgId:t.data.orgId,managementAccountId:t.data.managementAccountId}}catch(t){y.warn(b,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:s(f(t))});return}})();const e=await this.orgDetailsPromise;return{accountId:this.credentials.accountId,region:this.credentials.region,...e!==void 0?e:{},...this.orgConfigSerialised!==void 0?{orgConfig:this.orgConfigSerialised}:{}}}cdkCredentials(){return{accessKeyId:this.credentials.accessKeyId,secretAccessKey:this.credentials.secretAccessKey,...this.credentials.sessionToken!==void 0?{sessionToken:this.credentials.sessionToken}:{}}}componentPreconditionError(e){const t=this.componentPath(e);if(!m(t))return new Error(`Domain '${e}' is registered in fjall-config.json but ${t} does not exist in this checkout \u2014 merge the scaffold PR that creates it, or remove the registry entry.`);if(!m(h(t,"infrastructure.ts")))return new Error(`Domain '${e}' has no infrastructure.ts at ${t} \u2014 merge the scaffold/import PR that creates it.`)}async synthForTakeover(e,t){const n=this.componentPreconditionError(e);if(n!==void 0)return o(n);const a=this.componentPath(e),d=await this.assembleContext(),i=new w({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const r=await i.synth(a,{outputCallback:u(g=>{t.onProgress?.({type:"info",message:s(g)})},"outputCallback"),context:d,credentials:this.cdkCredentials()});if(!r.success)return o(new Error(`CDK synth failed: ${s(f(r.error))}`))}finally{i.dispose()}return l({stackNames:[P(e)],cdkOutPath:S(a,"cdk.out")})}async deployDomain(e,t){const n=this.componentPreconditionError(e);if(n!==void 0)return o(n);const a=this.componentPath(e),d=await this.assembleContext(),i=new w({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const r=await i.deploy(a,void 0,{outputCallback:u(g=>{t.onProgress?.({type:"info",message:s(g)})},"outputCallback"),context:d,credentials:this.cdkCredentials()});if(!r.success)return o(new Error(`CDK deploy failed: ${s(f(r.error))}`))}finally{i.dispose()}return l(void 0)}}async function z(c){return p.create(c)}u(z,"createWorkerDomainDeployProvider");export{p as WorkerDomainDeployProvider,z as createWorkerDomainDeployProvider};
+var $=Object.defineProperty;var u=(l,e)=>$(l,"name",{value:e,configurable:!0});import{existsSync as m,readFileSync as Z}from"node:fs";import{readFile as x}from"node:fs/promises";import{join as h,resolve as v}from"node:path";import{CloudFormationClient as C}from"@aws-sdk/client-cloudformation";import{OrganizationsClient as E}from"@aws-sdk/client-organizations";import{success as d,failure as a,parseDomainInfrastructureSource as R}from"@fjall/generator";import{getDomainStackName as y,getErrorMessage as p,maskSensitiveOutput as c}from"@fjall/util";import{RootConfigReadSchema as A}from"@fjall/util/config";import{logger as P}from"@fjall/util/logger";import{SimpleAwsProvider as I}from"../../aws/SimpleAwsProvider.js";import{describeOrganisationAsMember as O}from"../../aws/organisations/organisation.js";import{CdkService as b}from"../../services/infrastructure/CdkService.js";import{emitWarningEvent as j}from"../contextHelpers.js";import{delegationRoleUnusableError as g,deriveZonePhaseState as N,extractDelegationRoleArn as T,readDelegatedTopologyFromProps as F,readDomainStackOutputsByExport as S}from"./delegationResolution.js";const k="WorkerDomainDeployProvider";async function z(l,e){const r=[h(l,e,"fjall-config.json"),h(l,"fjall-config.json")].find(t=>m(t));if(r===void 0)return d([]);let i;try{i=await x(r,"utf8")}catch(t){return a(new Error(`domains phase refused: ${r} exists but could not be read (${c(p(t))}) \u2014 deploying with an unreadable domain registry is not an option.`))}let s;try{s=JSON.parse(i)}catch(t){return a(new Error(`domains phase refused: ${r} is not valid JSON (${c(p(t))}). Cure: fix the file by hand \u2014 do not regenerate it, which would discard capacity-identity pins.`))}const o=A.safeParse(s);return o.success?d((o.data.domains??[]).map(t=>({name:t.name,type:t.type,...t.parentDomain!==void 0?{parentDomain:t.parentDomain}:{},...t.account!==void 0?{account:t.account}:{},...t.region!==void 0?{region:t.region}:{}}))):a(new Error(`domains phase refused: ${r} has a malformed domains/activeTarget/capacityIdentity value \u2014 deploying from a registry that cannot be parsed is not an option. Cure: fix the file by hand.`))}u(z,"readDomainsConfig");class D{static{u(this,"WorkerDomainDeployProvider")}domains;workingDirectory;boundaryDir;credentials;orgConfigSerialised;abortSignal;aws;orgDetailsPromise;constructor(e,n){this.domains=n,this.workingDirectory=e.workingDirectory,this.boundaryDir=e.boundaryDir,this.credentials=e.credentials,this.orgConfigSerialised=e.orgConfigSerialised,this.abortSignal=e.abortSignal,this.aws=new I(e.credentials)}static async create(e){const n=await z(e.workingDirectory,e.boundaryDir);return n.success?d(new D(e,n.data)):a(n.error)}getDomains(){return this.domains}componentPath(e){return h(this.workingDirectory,this.boundaryDir,"domains",e)}async assembleContext(){this.orgDetailsPromise??=(async()=>{try{const n=await O(this.aws.getClient(E),this.abortSignal);if(!n.success){P.warn(k,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:c(n.error.message)});return}return n.data===null?void 0:{orgId:n.data.orgId,managementAccountId:n.data.managementAccountId}}catch(n){P.warn(k,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:c(p(n))});return}})();const e=await this.orgDetailsPromise;return{accountId:this.credentials.accountId,region:this.credentials.region,...e!==void 0?e:{},...this.orgConfigSerialised!==void 0?{orgConfig:this.orgConfigSerialised}:{}}}cdkCredentials(){return{accessKeyId:this.credentials.accessKeyId,secretAccessKey:this.credentials.secretAccessKey,...this.credentials.sessionToken!==void 0?{sessionToken:this.credentials.sessionToken}:{}}}componentPreconditionError(e){const n=this.componentPath(e);if(!m(n))return new Error(`Domain '${e}' is registered in fjall-config.json but ${n} does not exist in this checkout \u2014 merge the scaffold PR that creates it, or remove the registry entry.`);if(!m(h(n,"infrastructure.ts")))return new Error(`Domain '${e}' has no infrastructure.ts at ${n} \u2014 merge the scaffold/import PR that creates it.`)}async synthForTakeover(e,n){const r=this.componentPreconditionError(e);if(r!==void 0)return a(r);const i=this.componentPath(e),s=await this.assembleContext(),o=new b({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const t=await o.synth(i,{outputCallback:u(f=>{n.onProgress?.({type:"info",message:c(f)})},"outputCallback"),context:s,credentials:this.cdkCredentials()});if(!t.success)return a(new Error(`CDK synth failed: ${c(p(t.error))}`))}finally{o.dispose()}return d({stackNames:[y(e)],cdkOutPath:v(i,"cdk.out")})}async deployDomain(e,n){const r=this.componentPreconditionError(e);return r!==void 0?a(r):this.runCdkDeploy(e,n,{})}async runCdkDeploy(e,n,r,i){const s=this.componentPath(e),o={...await this.assembleContext(),...r},t=new b({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const f=await t.deploy(s,void 0,{outputCallback:u(w=>{n.onProgress?.({type:"info",message:c(i!==void 0?`${i}${w}`:w)})},"outputCallback"),context:o,credentials:this.cdkCredentials()});if(!f.success)return a(new Error(`CDK deploy failed: ${c(p(f.error))}`))}finally{t.dispose()}return d(void 0)}parseDomainComponent(e){const n=h(this.componentPath(e),"infrastructure.ts");let r;try{r=Z(n,"utf-8")}catch{return}const i=R(r,n,e);return i.success?i.data:void 0}delegationCures(e,n){return`deploy the parent zone first ('fjall domain deploy ${n}' or re-run this organisation deploy after its apex phase succeeds), deploy the child from the CLI with parent-account credentials ('fjall domain deploy ${e}'), or set a literal parentDelegationRoleArn in the child's infrastructure.ts.`}async resolveDelegationForPhase(e,n,r){const i=this.parseDomainComponent(e);if(i!==void 0&&i.registrar==="external-delegated"&&i.parentDelegationRoleArn!==void 0&&i.parentDelegationRoleArn!=="")return r.onProgress?.({type:"info",message:`Using the literal parentDelegationRoleArn declared in ${e}'s infrastructure.ts for the ${n.parentZoneName} delegation`}),d({});const s=this.domains.find(f=>f.name===n.parentZoneName);if(s===void 0)return j(r,`Parent zone ${n.parentZoneName} is not a managed domain in this registry (Case 3) \u2014 no delegation record is written in-stack; delegate ${n.childZoneName} at the parent with 'fjall domain delegate ${e}' after the zone phase`),d({});if(s.account!==void 0&&s.account!==this.credentials.accountId)return a(g(n.parentZoneName,`the parent is registered in account ${s.account} but this deploy holds credentials for account ${this.credentials.accountId} only`,this.delegationCures(e,n.parentZoneName)));const o=await S(this.aws.getClient(C),n.parentZoneName,this.abortSignal);if(!o.success)return a(g(n.parentZoneName,c(o.error.message),this.delegationCures(e,n.parentZoneName)));if(o.data===void 0)return a(g(n.parentZoneName,`no deployed stack '${y(n.parentZoneName)}' in account ${this.credentials.accountId}`,this.delegationCures(e,n.parentZoneName)));const t=T(o.data,n.parentZoneName);return t===void 0?a(g(n.parentZoneName,`stack '${y(n.parentZoneName)}' publishes no delegation-role export`,this.delegationCures(e,n.parentZoneName))):d({parentDelegationRoleArn:t})}delegatedDeployer(e){const n=this.parseDomainComponent(e);if(n===void 0)return;const r=F(n);if(r!==void 0)return{zoneName:r.childZoneName,deployPhase:u(async(i,s)=>{const o=this.componentPreconditionError(e);if(o!==void 0)return a(o);const t=await this.resolveDelegationForPhase(e,r,s);return t.success?this.runCdkDeploy(e,s,{domainDeployPhase:i,...t.data},`[${r.childZoneName}] `):a(t.error)},"deployPhase"),zonePhaseState:u(async()=>{const i=await S(this.aws.getClient(C),e,this.abortSignal);return i.success?d(N(i.data,r.childZoneName)):a(i.error)},"zonePhaseState")}}}async function ee(l){return D.create(l)}u(ee,"createWorkerDomainDeployProvider");export{D as WorkerDomainDeployProvider,ee as createWorkerDomainDeployProvider};

package/dist/src/orchestration/domain/delegationResolution.d.ts

@@ -0,0 +1,46 @@
+import { type Result, type ParsedDomainProps } from "@fjall/generator";
+import type { DelegatedZonePhaseState } from "./delegatedDomainDeploy.js";
+import { DomainDelegationError } from "./types.js";
+import type { AwsSdkClientLike } from "./zoneClassifier.js";
+/** Parsed identity of a delegated child domain component. */
+export interface DelegatedDomainTopology {
+    /** The parent zone the NS delegation lives in, e.g. `example.com`. */
+    readonly parentZoneName: string;
+    /** The effective child zone, e.g. `dev.example.com`. */
+    readonly childZoneName: string;
+}
+/**
+ * Derive a delegated child's topology from its parsed Domain props.
+ * `undefined` means the component is NOT a delegated child (registrar
+ * `route53` / `external-records`) — callers route those down the
+ * single-phase path, which is then CORRECT, not a downgrade.
+ */
+export declare function readDelegatedTopologyFromProps(parsed: ParsedDomainProps): DelegatedDomainTopology | undefined;
+/**
+ * The typed fail-closed stop for a parent DelegationRole that cannot be
+ * used: proceeding would deploy a child zone whose NS delegation can never
+ * be written, stalling at the NS-propagation gate with a worse message.
+ * `cures` is host-specific — which remedies exist depends on where the
+ * deploy runs (the CLI can mint parent-account credentials; the worker
+ * cannot) — so each host names its own.
+ */
+export declare function delegationRoleUnusableError(parentZoneName: string, detail: string, cures: string): DomainDelegationError;
+/**
+ * DescribeStacks on a domain's stack, reduced to a Map keyed by EXPORT
+ * name. `success(undefined)` is the stack-not-found state; callers own its
+ * meaning (fail-closed for a managed parent, not-applicable for an audit).
+ */
+export declare function readDomainStackOutputsByExport(cloudFormation: AwsSdkClientLike, domainName: string, abortSignal?: AbortSignal): Promise<Result<Map<string, string> | undefined, Error>>;
+/**
+ * Extract the parent stack's delegation-role export from its output map.
+ * `undefined` covers both an absent export and an empty value — a stack
+ * predating the export contract publishes neither usably.
+ */
+export declare function extractDelegationRoleArn(outputs: Map<string, string>, parentZoneName: string): string | undefined;
+/**
+ * Derive the delegated child's zone-phase state from its stack outputs:
+ * the zone phase is complete when the hosted-zone-id export is present; the
+ * nameservers export feeds the propagation gate's expected-NS check.
+ * `undefined` outputs (stack not deployed) is an incomplete zone phase.
+ */
+export declare function deriveZonePhaseState(outputs: Map<string, string> | undefined, childZoneName: string): DelegatedZonePhaseState;

package/dist/src/orchestration/domain/delegationResolution.js

@@ -0,0 +1 @@
+var m=Object.defineProperty;var s=(e,t)=>m(e,"name",{value:t,configurable:!0});import{DescribeStacksCommand as c}from"@aws-sdk/client-cloudformation";import{success as d,failure as l}from"@fjall/generator";import{getDomainExportNames as u,getDomainStackName as f,getErrorMessage as p}from"@fjall/util";import{STACK_NOT_FOUND_PATTERN as g}from"../../types/constants.js";import{DomainDelegationError as N}from"./types.js";function $(e){if(e.registrar==="external-delegated")return{parentZoneName:e.zoneName,childZoneName:`${e.delegatedSubdomain}.${e.zoneName}`}}s($,"readDelegatedTopologyFromProps");function b(e,t,n){return new N(`Parent zone ${e}: its DelegationRole could not be resolved (${t}). Nothing was deployed. Cures: ${n}`,"delegation_role_unusable",{parentZoneName:e})}s(b,"delegationRoleUnusableError");async function w(e,t,n){const o=f(t);try{const a=await e.send(new c({StackName:o}),n!==void 0?{abortSignal:n}:{}),i=new Map;for(const r of a.Stacks?.[0]?.Outputs??[])r.ExportName!==void 0&&r.OutputValue!==void 0&&i.set(r.ExportName,r.OutputValue);return d(i)}catch(a){return a instanceof Error&&a.message.includes(g)?d(void 0):l(new Error(`DescribeStacks on '${o}' failed: ${p(a)}`))}}s(w,"readDomainStackOutputsByExport");function y(e,t){const n=u(t).delegationRoleArn,o=e.get(n);return o!==void 0&&o!==""?o:void 0}s(y,"extractDelegationRoleArn");function O(e,t){if(e===void 0)return{complete:!1};const n=u(t),o=e.get(n.hostedZoneId),a=o!==void 0&&o!=="",i=e.get(n.nameservers)?.split(",").map(r=>r.trim()).filter(r=>r!=="");return{complete:a,...i!==void 0&&i.length>0?{nameServers:i}:{}}}s(O,"deriveZonePhaseState");export{b as delegationRoleUnusableError,O as deriveZonePhaseState,y as extractDelegationRoleArn,$ as readDelegatedTopologyFromProps,w as readDomainStackOutputsByExport};

package/dist/src/orchestration/domain/index.d.ts

@@ -6,6 +6,7 @@
 export { DOMAIN_DELEGATION_ERROR_TYPES, DomainDelegationError, DEFAULT_PUBLIC_RESOLVER_ADDRESSES, PUBLIC_DNS_QUERY_TIMEOUT_MS, createPublicResolvers, normaliseDnsName, isDnsEmptyAnswer, type DomainDeployPhase, type DomainDelegationErrorType, type PublicCaaRecord, type PublicDnsResolver } from "./types.js";
 export { NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS, NS_PROPAGATION_DEFAULT_INTERVAL_MS, waitForNsPropagation, type NsPropagationGateParams, type NsPropagationVerdict } from "./nsPropagationGate.js";
 export { ACM_CAA_ISSUERS, caaAncestorChain, formatCaaRecord, runCaaPreflight, type CaaPreflightParams, type CaaPreflightVerdict } from "./caaPreflight.js";
+export { delegationRoleUnusableError, deriveZonePhaseState, extractDelegationRoleArn, readDelegatedTopologyFromProps, readDomainStackOutputsByExport, type DelegatedDomainTopology } from "./delegationResolution.js";
 export { deployDelegatedDomain, type DelegatedDomainDeployer, type DelegatedZonePhaseState, type DeployDelegatedDomainParams, type DelegatedDomainDeployOutcome } from "./delegatedDomainDeploy.js";
 export { CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE, templateOwnsDelegationRecord, deleteChildNsFromParent, nsDelegationPhysicalName, runDelegatedDomainDestroy, type NsDeleteOutcome, type DeleteChildNsParams, type DelegationDestroyNsOutcome, type DelegatedDomainDestroyOutcome, type DelegatedDomainDestroyParams } from "./delegationDestroyMirror.js";
 export { classifyZoneRecords, buildSatelliteRecordIndex, createSystemDnsNameProbe, systemDnsNameProbe, normaliseRecordName, type RecordClassification, type ClassifiedRecord, type ZoneClassificationReport, type ZoneClassifierClients, type ZoneClassifierPhase, type ClassifyZoneOptions, type SatelliteRecordIndex, type DelegatedChildDomain, type ChildAccountClients, type ChildAccountClientFactory, type AwsSdkClientLike, type DnsProbeVerdict, type DnsNameProbe } from "./zoneClassifier.js";

package/dist/src/orchestration/domain/index.js

@@ -1 +1 @@
-import{DOMAIN_DELEGATION_ERROR_TYPES as o,DomainDelegationError as a,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as t,PUBLIC_DNS_QUERY_TIMEOUT_MS as s,createPublicResolvers as m,normaliseDnsName as i,isDnsEmptyAnswer as D}from"./types.js";import{NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as n,NS_PROPAGATION_DEFAULT_INTERVAL_MS as d,waitForNsPropagation as c}from"./nsPropagationGate.js";import{ACM_CAA_ISSUERS as _,caaAncestorChain as E,formatCaaRecord as S,runCaaPreflight as T}from"./caaPreflight.js";import{deployDelegatedDomain as N}from"./delegatedDomainDeploy.js";import{CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as p,templateOwnsDelegationRecord as f,deleteChildNsFromParent as y,nsDelegationPhysicalName as C,runDelegatedDomainDestroy as O}from"./delegationDestroyMirror.js";import{classifyZoneRecords as I,buildSatelliteRecordIndex as U,createSystemDnsNameProbe as g,systemDnsNameProbe as L,normaliseRecordName as u}from"./zoneClassifier.js";import{isRoute53NameServer as M,isDelegatedToRoute53 as h}from"./route53Delegation.js";import{recordPhysicalName as b,parseRecordPhysicalName as F}from"./recordConsentSpelling.js";import{recordSetKey as w,deleteRecordSetsByKey as B}from"./route53Release.js";import{cascadeTakeoverDigestSeed as K,buildCascadeTakeoverTicket as V,runCascadeTakeoverGate as W}from"./domainTakeoverGate.js";import{WorkerDomainDeployProvider as X,createWorkerDomainDeployProvider as Z}from"./WorkerDomainDeployProvider.js";export{_ as ACM_CAA_ISSUERS,p as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,t as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,o as DOMAIN_DELEGATION_ERROR_TYPES,a as DomainDelegationError,d as NS_PROPAGATION_DEFAULT_INTERVAL_MS,n as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,s as PUBLIC_DNS_QUERY_TIMEOUT_MS,X as WorkerDomainDeployProvider,V as buildCascadeTakeoverTicket,U as buildSatelliteRecordIndex,E as caaAncestorChain,K as cascadeTakeoverDigestSeed,I as classifyZoneRecords,m as createPublicResolvers,g as createSystemDnsNameProbe,Z as createWorkerDomainDeployProvider,y as deleteChildNsFromParent,B as deleteRecordSetsByKey,N as deployDelegatedDomain,S as formatCaaRecord,h as isDelegatedToRoute53,D as isDnsEmptyAnswer,M as isRoute53NameServer,i as normaliseDnsName,u as normaliseRecordName,C as nsDelegationPhysicalName,F as parseRecordPhysicalName,b as recordPhysicalName,w as recordSetKey,T as runCaaPreflight,W as runCascadeTakeoverGate,O as runDelegatedDomainDestroy,L as systemDnsNameProbe,f as templateOwnsDelegationRecord,c as waitForNsPropagation};
+import{DOMAIN_DELEGATION_ERROR_TYPES as o,DomainDelegationError as a,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as t,PUBLIC_DNS_QUERY_TIMEOUT_MS as s,createPublicResolvers as m,normaliseDnsName as i,isDnsEmptyAnswer as l}from"./types.js";import{NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as D,NS_PROPAGATION_DEFAULT_INTERVAL_MS as d,waitForNsPropagation as c}from"./nsPropagationGate.js";import{ACM_CAA_ISSUERS as E,caaAncestorChain as S,formatCaaRecord as _,runCaaPreflight as p}from"./caaPreflight.js";import{delegationRoleUnusableError as T,deriveZonePhaseState as A,extractDelegationRoleArn as N,readDelegatedTopologyFromProps as y,readDomainStackOutputsByExport as f}from"./delegationResolution.js";import{deployDelegatedDomain as O}from"./delegatedDomainDeploy.js";import{CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as g,templateOwnsDelegationRecord as u,deleteChildNsFromParent as I,nsDelegationPhysicalName as U,runDelegatedDomainDestroy as L}from"./delegationDestroyMirror.js";import{classifyZoneRecords as h,buildSatelliteRecordIndex as k,createSystemDnsNameProbe as M,systemDnsNameProbe as b,normaliseRecordName as F}from"./zoneClassifier.js";import{isRoute53NameServer as B,isDelegatedToRoute53 as w}from"./route53Delegation.js";import{recordPhysicalName as K,parseRecordPhysicalName as V}from"./recordConsentSpelling.js";import{recordSetKey as Z,deleteRecordSetsByKey as Q}from"./route53Release.js";import{cascadeTakeoverDigestSeed as j,buildCascadeTakeoverTicket as q,runCascadeTakeoverGate as z}from"./domainTakeoverGate.js";import{WorkerDomainDeployProvider as J,createWorkerDomainDeployProvider as $}from"./WorkerDomainDeployProvider.js";export{E as ACM_CAA_ISSUERS,g as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,t as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,o as DOMAIN_DELEGATION_ERROR_TYPES,a as DomainDelegationError,d as NS_PROPAGATION_DEFAULT_INTERVAL_MS,D as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,s as PUBLIC_DNS_QUERY_TIMEOUT_MS,J as WorkerDomainDeployProvider,q as buildCascadeTakeoverTicket,k as buildSatelliteRecordIndex,S as caaAncestorChain,j as cascadeTakeoverDigestSeed,h as classifyZoneRecords,m as createPublicResolvers,M as createSystemDnsNameProbe,$ as createWorkerDomainDeployProvider,T as delegationRoleUnusableError,I as deleteChildNsFromParent,Q as deleteRecordSetsByKey,O as deployDelegatedDomain,A as deriveZonePhaseState,N as extractDelegationRoleArn,_ as formatCaaRecord,w as isDelegatedToRoute53,l as isDnsEmptyAnswer,B as isRoute53NameServer,i as normaliseDnsName,F as normaliseRecordName,U as nsDelegationPhysicalName,V as parseRecordPhysicalName,y as readDelegatedTopologyFromProps,f as readDomainStackOutputsByExport,K as recordPhysicalName,Z as recordSetKey,p as runCaaPreflight,z as runCascadeTakeoverGate,L as runDelegatedDomainDestroy,b as systemDnsNameProbe,u as templateOwnsDelegationRecord,c as waitForNsPropagation};

package/dist/src/services/infrastructure/CdkArgumentBuilder.js

@@ -1 +1 @@
-var s=Object.defineProperty;var d=(o,a)=>s(o,"name",{value:a,configurable:!0});import{CAPACITY_IDENTITY_CONTEXT_KEY as f,filterDangerousEnvVars as c}from"@fjall/util";class m{static{d(this,"CdkArgumentBuilder")}buildContextArgs(a){const e=[];if(a?.accountId&&e.push("-c",`accountId=${a.accountId}`),a?.environment&&e.push("-c",`environment=${a.environment}`),a?.managedAccount&&e.push("-c","managedAccount=true"),a?.accountName&&e.push("-c",`accountName=${a.accountName}`),a?.orgId&&e.push("-c",`orgId=${a.orgId}`),a?.rootId&&e.push("-c",`rootId=${a.rootId}`),a?.managementAccountId&&e.push("-c",`managementAccountId=${a.managementAccountId}`),a?.devOuId&&e.push("-c",`fjallDevOuId=${a.devOuId}`),a?.ipamPoolId&&e.push("-c",`ipamPoolId=${a.ipamPoolId}`),a?.fjallOrgId&&e.push("-c",`fjallOrgId=${a.fjallOrgId}`),a?.fjallOidcConfigured&&e.push("-c",`fjallOidcConfigured=${a.fjallOidcConfigured}`),a?.fjallAccountGlobalsConfigured&&e.push("-c",`fjallAccountGlobalsConfigured=${a.fjallAccountGlobalsConfigured}`),a?.fjallAccountTrailState&&e.push("-c",`fjallAccountTrailState=${a.fjallAccountTrailState}`),a?.orgConfig&&e.push("-c",`orgConfig=${a.orgConfig}`),a?.fjallAdoptBackupVault&&e.push("-c","fjallAdoptBackupVault=true"),a?.resolvedSecretArns&&e.push("-c",`fjallResolvedSecretArns=${a.resolvedSecretArns}`),a?.managedDomainBindings)for(const[n,i]of Object.entries(a.managedDomainBindings))i!==""&&e.push("-c",`fjall:managedDomain:${n}=${i}`);return a?.domainDeployPhase&&e.push("-c",`fjall:domainDeployPhase=${a.domainDeployPhase}`),a?.parentDelegationRoleArn&&e.push("-c",`fjall:parentDelegationRoleArn=${a.parentDelegationRoleArn}`),a?.capacityIdentity&&e.push("-c",`${f}=${a.capacityIdentity}`),e}buildParameterArgs(a,e){if(a===void 0)return[];const n=Object.entries(a);if(n.length===0)return[];const i=e!==void 0&&e!==""?`${e}:`:"",u=[];for(const[r,l]of n){if(!/^[A-Za-z][A-Za-z0-9]*$/.test(r))throw new Error(`Invalid CloudFormation parameter name "${r}": must match /^[A-Za-z][A-Za-z0-9]*$/ (alphanumeric, leading letter, no separators).`);if(l==="")throw new Error(`CloudFormation parameter "${r}" has an empty value.`);if(/[,\n\r]/.test(l))throw new Error(`CloudFormation parameter "${r}" value contains "," or newline \u2014 cdk's --parameters splits on "," so the deploy would silently fragment.`);u.push("--parameters",`${i}${r}=${l}`)}return u}injectCascadeCredentials(a,e){e&&(a.AWS_ACCESS_KEY_ID=e.accessKeyId,a.AWS_SECRET_ACCESS_KEY=e.secretAccessKey,delete a.AWS_SESSION_TOKEN,e.sessionToken&&(a.AWS_SESSION_TOKEN=e.sessionToken))}buildCdkEnv(a){const e={...c(process.env),CI:"true",FORCE_COLOR:"0",CDK_DISABLE_VERSION_CHECK:"1",NODE_NO_WARNINGS:"1"};return a?.context?.region&&(e.AWS_REGION=a.context.region,e.AWS_DEFAULT_REGION=a.context.region,e.CDK_DEFAULT_REGION=a.context.region),a?.context?.accountId&&(e.CDK_DEFAULT_ACCOUNT=a.context.accountId),a?.context?.environment&&(e.ENVIRONMENT=a.context.environment),this.injectCascadeCredentials(e,a?.credentials),e}}export{m as CdkArgumentBuilder};
+var s=Object.defineProperty;var d=(l,a)=>s(l,"name",{value:a,configurable:!0});import{CAPACITY_IDENTITY_CONTEXT_KEY as f,filterDangerousEnvVars as c}from"@fjall/util";class t{static{d(this,"CdkArgumentBuilder")}buildContextArgs(a){const e=[];if(a?.accountId&&e.push("-c",`accountId=${a.accountId}`),a?.environment&&e.push("-c",`environment=${a.environment}`),a?.managedAccount&&e.push("-c","managedAccount=true"),a?.accountName&&e.push("-c",`accountName=${a.accountName}`),a?.orgId&&e.push("-c",`orgId=${a.orgId}`),a?.rootId&&e.push("-c",`rootId=${a.rootId}`),a?.managementAccountId&&e.push("-c",`managementAccountId=${a.managementAccountId}`),a?.devOuId&&e.push("-c",`fjallDevOuId=${a.devOuId}`),a?.ipamPoolId&&e.push("-c",`ipamPoolId=${a.ipamPoolId}`),a?.fjallOrgId&&e.push("-c",`fjallOrgId=${a.fjallOrgId}`),a?.fjallOidcConfigured&&e.push("-c",`fjallOidcConfigured=${a.fjallOidcConfigured}`),a?.fjallAccountGlobalsConfigured&&e.push("-c",`fjallAccountGlobalsConfigured=${a.fjallAccountGlobalsConfigured}`),a?.fjallAccountTrailState&&e.push("-c",`fjallAccountTrailState=${a.fjallAccountTrailState}`),a?.orgConfig&&e.push("-c",`orgConfig=${a.orgConfig}`),a?.fjallAdoptBackupVault&&e.push("-c","fjallAdoptBackupVault=true"),a?.resolvedSecretArns&&e.push("-c",`fjallResolvedSecretArns=${a.resolvedSecretArns}`),a?.managedDomainBindings)for(const[n,r]of Object.entries(a.managedDomainBindings))r!==""&&e.push("-c",`fjall:managedDomain:${n}=${r}`);if(a?.managedDomainCoverage)for(const[n,r]of Object.entries(a.managedDomainCoverage))r!==""&&e.push("-c",`fjall:managedDomainCoverage:${n}=${r}`);return a?.domainDeployPhase&&e.push("-c",`fjall:domainDeployPhase=${a.domainDeployPhase}`),a?.parentDelegationRoleArn&&e.push("-c",`fjall:parentDelegationRoleArn=${a.parentDelegationRoleArn}`),a?.capacityIdentity&&e.push("-c",`${f}=${a.capacityIdentity}`),e}buildParameterArgs(a,e){if(a===void 0)return[];const n=Object.entries(a);if(n.length===0)return[];const r=e!==void 0&&e!==""?`${e}:`:"",u=[];for(const[i,o]of n){if(!/^[A-Za-z][A-Za-z0-9]*$/.test(i))throw new Error(`Invalid CloudFormation parameter name "${i}": must match /^[A-Za-z][A-Za-z0-9]*$/ (alphanumeric, leading letter, no separators).`);if(o==="")throw new Error(`CloudFormation parameter "${i}" has an empty value.`);if(/[,\n\r]/.test(o))throw new Error(`CloudFormation parameter "${i}" value contains "," or newline \u2014 cdk's --parameters splits on "," so the deploy would silently fragment.`);u.push("--parameters",`${r}${i}=${o}`)}return u}injectCascadeCredentials(a,e){e&&(a.AWS_ACCESS_KEY_ID=e.accessKeyId,a.AWS_SECRET_ACCESS_KEY=e.secretAccessKey,delete a.AWS_SESSION_TOKEN,e.sessionToken&&(a.AWS_SESSION_TOKEN=e.sessionToken))}buildCdkEnv(a){const e={...c(process.env),CI:"true",FORCE_COLOR:"0",CDK_DISABLE_VERSION_CHECK:"1",NODE_NO_WARNINGS:"1"};return a?.context?.region&&(e.AWS_REGION=a.context.region,e.AWS_DEFAULT_REGION=a.context.region,e.CDK_DEFAULT_REGION=a.context.region),a?.context?.accountId&&(e.CDK_DEFAULT_ACCOUNT=a.context.accountId),a?.context?.environment&&(e.ENVIRONMENT=a.context.environment),this.injectCascadeCredentials(e,a?.credentials),e}}export{t as CdkArgumentBuilder};

package/dist/src/services/infrastructure/CdkServiceTypes.d.ts

@@ -42,6 +42,17 @@ export interface CdkContext {
      * (MANAGED_DOMAIN_CONTEXT_PREFIX).
      */
     managedDomainBindings?: Record<string, string>;
+    /**
+     * Record<zoneName, JSON ManagedDomainCoverage> of deploy-time-resolved
+     * certificate SAN host lists (D5). Emitted as one
+     * `-c fjall:managedDomainCoverage:<zoneName>=<json>` context arg per entry
+     * and consumed by `readInjectedManagedDomainCoverage` in
+     * @fjall/components-infrastructure (`utils/managedDomainContext.ts`). Keep
+     * the key prefix literal in sync with that reader
+     * (MANAGED_DOMAIN_COVERAGE_CONTEXT_PREFIX). SEPARATE from the binding key
+     * because the binding parser fails closed on unknown fields.
+     */
+    managedDomainCoverage?: Record<string, string>;
     /**
      * Two-phase delegated-domain deploy gate (D8): `"zone"` deploys the child
      * zone + NS delegation only, `"full"` additionally issues certificates.

package/dist/src/services/infrastructure/cdkServiceHelpers.js

@@ -1 +1 @@
-var d=Object.defineProperty;var o=(a,e)=>d(a,"name",{value:e,configurable:!0});import{getApplicationStackName as l,getOrganisationStackName as u,isApplicationStack as t}from"../../types/operations.js";const f=5e3;function g(a,e){if(a&&!a.includes("*"))return a;if(a){const n=a.match(/\*?(\w+)\*?/);if(n?.[1]){const i=n[1],r=e.target;return t(i)?l(r,i):`${r}${i}`}return a}}o(g,"resolveStackName");function m(a){const e=a.deployType;return e==="organisation"||e==="platform"||e==="account"?u(e):`${a.target}Network`}o(m,"getFallbackStackName");function s(a,e,n){return{accountId:e,region:n,environment:a.environment,managedAccount:a.isManagedAccount,accountName:a.accountName,orgId:a.orgId,rootId:a.rootId,managementAccountId:a.managementAccountId,devOuId:a.devOuId,ipamPoolId:a.ipamPoolId,fjallOrgId:a.fjallOrgId,fjallOidcConfigured:a.fjallOidcConfigured?"true":void 0,fjallAccountGlobalsConfigured:a.fjallAccountGlobalsConfigured?"true":void 0,fjallAccountTrailState:a.fjallAccountTrailState,orgConfig:a.orgConfig,fjallAdoptBackupVault:a.fjallAdoptBackupVault?"true":void 0,resolvedSecretArns:a.resolvedSecretArns,managedDomainBindings:a.managedDomainBindings,capacityIdentity:a.capacityIdentity}}o(s,"buildDeploymentCdkContext");export{f as STACK_DETECTION_FALLBACK_MS,s as buildDeploymentCdkContext,m as getFallbackStackName,g as resolveStackName};
+var d=Object.defineProperty;var o=(a,e)=>d(a,"name",{value:e,configurable:!0});import{getApplicationStackName as l,getOrganisationStackName as u,isApplicationStack as c}from"../../types/operations.js";const p=5e3;function t(a,e){if(a&&!a.includes("*"))return a;if(a){const n=a.match(/\*?(\w+)\*?/);if(n?.[1]){const i=n[1],r=e.target;return c(i)?l(r,i):`${r}${i}`}return a}}o(t,"resolveStackName");function f(a){const e=a.deployType;return e==="organisation"||e==="platform"||e==="account"?u(e):`${a.target}Network`}o(f,"getFallbackStackName");function s(a,e,n){return{accountId:e,region:n,environment:a.environment,managedAccount:a.isManagedAccount,accountName:a.accountName,orgId:a.orgId,rootId:a.rootId,managementAccountId:a.managementAccountId,devOuId:a.devOuId,ipamPoolId:a.ipamPoolId,fjallOrgId:a.fjallOrgId,fjallOidcConfigured:a.fjallOidcConfigured?"true":void 0,fjallAccountGlobalsConfigured:a.fjallAccountGlobalsConfigured?"true":void 0,fjallAccountTrailState:a.fjallAccountTrailState,orgConfig:a.orgConfig,fjallAdoptBackupVault:a.fjallAdoptBackupVault?"true":void 0,resolvedSecretArns:a.resolvedSecretArns,managedDomainBindings:a.managedDomainBindings,managedDomainCoverage:a.managedDomainCoverage,capacityIdentity:a.capacityIdentity}}o(s,"buildDeploymentCdkContext");export{p as STACK_DETECTION_FALLBACK_MS,s as buildDeploymentCdkContext,f as getFallbackStackName,t as resolveStackName};

package/dist/src/services/supporting/CdkContextBuilder.d.ts

@@ -37,6 +37,7 @@ export declare class CdkContextBuilder {
         fjallAccountTrailState?: string;
         orgConfig?: string;
         managedDomainBindings?: Record<string, string>;
+        managedDomainCoverage?: Record<string, string>;
         capacityIdentity?: string;
     }, options: {
         verbose?: boolean;

package/dist/src/services/supporting/CdkContextBuilder.js

@@ -1 +1 @@
-var t=Object.defineProperty;var d=(o,a)=>t(o,"name",{value:a,configurable:!0});import{DEFAULT_REGION as r}from"@fjall/generator";class g{static{d(this,"CdkContextBuilder")}static buildDeploymentContext(a,e,l){return{deployType:a.deployType,target:a.target,path:a.path,...a.assemblyDir!==void 0?{assemblyDir:a.assemblyDir}:{},...a.environment!==void 0?{environment:a.environment}:{},options:e,stackOutputs:a.stackOutputs||{},callerIdentity:a.callerIdentity,region:a.region||l?.primaryRegion||r,isManagedAccount:a.isManagedAccount,accountName:a.accountName,logPath:a.logPath,orgId:a.orgId,rootId:a.rootId,managementAccountId:a.managementAccountId,devOuId:a.devOuId,ipamPoolId:a.ipamPoolId,fjallOrgId:a.fjallOrgId,fjallOidcConfigured:a.fjallOidcConfigured,fjallAccountGlobalsConfigured:a.fjallAccountGlobalsConfigured,fjallAccountTrailState:a.fjallAccountTrailState,orgConfig:a.orgConfig,managedDomainBindings:a.managedDomainBindings,capacityIdentity:a.capacityIdentity}}static updateContext(a,e){return{...a,...e}}}export{g as CdkContextBuilder};
+var r=Object.defineProperty;var d=(o,a)=>r(o,"name",{value:a,configurable:!0});import{DEFAULT_REGION as t}from"@fjall/generator";class g{static{d(this,"CdkContextBuilder")}static buildDeploymentContext(a,e,l){return{deployType:a.deployType,target:a.target,path:a.path,...a.assemblyDir!==void 0?{assemblyDir:a.assemblyDir}:{},...a.environment!==void 0?{environment:a.environment}:{},options:e,stackOutputs:a.stackOutputs||{},callerIdentity:a.callerIdentity,region:a.region||l?.primaryRegion||t,isManagedAccount:a.isManagedAccount,accountName:a.accountName,logPath:a.logPath,orgId:a.orgId,rootId:a.rootId,managementAccountId:a.managementAccountId,devOuId:a.devOuId,ipamPoolId:a.ipamPoolId,fjallOrgId:a.fjallOrgId,fjallOidcConfigured:a.fjallOidcConfigured,fjallAccountGlobalsConfigured:a.fjallAccountGlobalsConfigured,fjallAccountTrailState:a.fjallAccountTrailState,orgConfig:a.orgConfig,managedDomainBindings:a.managedDomainBindings,managedDomainCoverage:a.managedDomainCoverage,capacityIdentity:a.capacityIdentity}}static updateContext(a,e){return{...a,...e}}}export{g as CdkContextBuilder};

package/dist/src/types/deployment/DeploymentTypes.d.ts

@@ -29,6 +29,7 @@ export interface DeploymentContext {
     fjallAdoptBackupVault?: boolean;
     resolvedSecretArns?: string;
     managedDomainBindings?: Record<string, string>;
+    managedDomainCoverage?: Record<string, string>;
     capacityIdentity?: string;
     options: {
         verbose?: boolean;

package/dist/src/types/params.d.ts

@@ -127,6 +127,17 @@ export interface DeployParams {
      * neither omit the field and constructs fall back to explicit props.
      */
     managedDomainBindings?: Record<string, string>;
+    /**
+     * Deploy-time-resolved managed-domain certificate coverage (D5), keyed by
+     * zone name with each value the JSON-serialised `ManagedDomainCoverage`
+     * (the SAN host lists the domain stack published beside its certificate
+     * ARN exports). Threaded into synth as one
+     * `-c fjall:managedDomainCoverage:<zone>=<json>` per entry — a key
+     * SEPARATE from the binding because the binding parser fails closed on
+     * unknown fields. Fail-open by contract: zones whose domain stack predates
+     * the hosts outputs bind without coverage and constructs degrade to W1.
+     */
+    managedDomainCoverage?: Record<string, string>;
     /**
      * The resolved deploy target name (e.g. "production-use2") this deploy
      * runs against — the key `capacityIdentity` pins are recorded under in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "14.0.0",
+  "version": "14.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -96,8 +96,8 @@
     "@aws-sdk/client-ssm": "^3.1098.0",
     "@aws-sdk/client-sso-admin": "^3.1098.0",
     "@aws-sdk/client-sts": "^3.1098.0",
-    "@fjall/generator": "^14.0.0",
-    "@fjall/util": "^14.0.0",
+    "@fjall/generator": "^14.2.0",
+    "@fjall/util": "^14.2.0",
     "@smithy/node-http-handler": "^4.9.13",
     "aws-cdk": "^2.1134.0",
     "tsx": "^4.23.1",