@fjall/deploy-core 14.1.0 → 14.3.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "4b25041ecdb5c212268eb3baba19228be162db2414f049db3c164aa82ccc2716",
+  "hash": "a8f74ad747cbfe0c3f8009a31924d07b17673bdb9c1dba0291aa8ced7b5f4d7d",
   "files": {
     "src/__test-utils__/awsMockHelpers.ts": "fea371c1b1869678",
     "src/__test-utils__/index.ts": "e03cf35821157dc4",
@@ -52,9 +52,9 @@
     "src/aws/utils/regions.ts": "3a5191f4d2242a60",
     "src/aws/utils/stackStatus.ts": "55fb23ba5514bc13",
     "src/events/index.ts": "e55c022f0d9013e6",
-    "src/index.ts": "5d0887d5c3bf0fde",
+    "src/index.ts": "cd47b3c091452a0a",
     "src/orchestration/activeDeploymentGuard.ts": "e8dde742c00ea728",
-    "src/orchestration/application/applicationDeploy.ts": "867232cbc981906c",
+    "src/orchestration/application/applicationDeploy.ts": "6a4090e898f86a28",
     "src/orchestration/application/applicationDeployHelpers.ts": "bca833cc04f0b4c5",
     "src/orchestration/application/applicationDestroy.ts": "38b8ecf69c85d884",
     "src/orchestration/application/approvalGate.ts": "e4dee819c94fd15c",
@@ -106,19 +106,21 @@
     "src/orchestration/destroy.ts": "b6da154984e63a8d",
     "src/orchestration/dockerBuildParamsKeys.ts": "ac3d6ecd24d68792",
     "src/orchestration/dockerInterface.ts": "f2efc8a98d3b3d65",
-    "src/orchestration/domain/WorkerDomainDeployProvider.ts": "fa34993b4f96451a",
+    "src/orchestration/domain/WorkerDomainDeployProvider.ts": "88a06ca27ae3ebd5",
     "src/orchestration/domain/caaPreflight.ts": "4a9ab5bd9567fb41",
+    "src/orchestration/domain/cascadeDomainProviderFactory.ts": "3290e4266f5824c7",
     "src/orchestration/domain/delegatedDomainDeploy.ts": "b5e5c2db59250b8a",
     "src/orchestration/domain/delegationDestroyMirror.ts": "939f6c3cc3293d8b",
-    "src/orchestration/domain/domainTakeoverGate.ts": "70c77f8eb61b1e3d",
-    "src/orchestration/domain/index.ts": "e3c35fd95d88567e",
+    "src/orchestration/domain/delegationResolution.ts": "f2b91a8aaf284dfa",
+    "src/orchestration/domain/domainTakeoverGate.ts": "ecd9694cebc7be6c",
+    "src/orchestration/domain/index.ts": "ec421e83dd0afbd6",
     "src/orchestration/domain/nsPropagationGate.ts": "c7a443e7048d4430",
     "src/orchestration/domain/recordConsentSpelling.ts": "9869eadf39e75d98",
     "src/orchestration/domain/route53Delegation.ts": "a7149a0542e4d185",
     "src/orchestration/domain/route53Release.ts": "558363b79172ec40",
     "src/orchestration/domain/types.ts": "132972b0e1113ac1",
     "src/orchestration/domain/zoneClassifier.ts": "f9908f0b4635709e",
-    "src/orchestration/domainInterface.ts": "2887751e0ded2282",
+    "src/orchestration/domainInterface.ts": "0383f37823e24994",
     "src/orchestration/drift/classifyDriftFailure.ts": "4426ecc6545b0472",
     "src/orchestration/drift/detectStackDrift.ts": "cc38b12162e08fac",
     "src/orchestration/drift/driftPreFlight.ts": "87c6176636655ad7",
@@ -129,17 +131,17 @@
     "src/orchestration/drift/route53RecordPreflight.ts": "f4db16a6c0e69ac9",
     "src/orchestration/failure/classifyFailure.ts": "bfb80731bc7d6b95",
     "src/orchestration/failure/deploymentFailureAttachment.ts": "358d9e4d88390cfd",
-    "src/orchestration/index.ts": "405fae4d6e7ac57d",
+    "src/orchestration/index.ts": "d5a2d44746058099",
     "src/orchestration/manifestSecretParser.ts": "c5576bd88a3652f8",
     "src/orchestration/organisation/accountsConfig.ts": "a55a3306564e7b2f",
     "src/orchestration/organisation/cascadeDestroyHelpers.ts": "7f1927a00ed24767",
-    "src/orchestration/organisation/cascadeHelpers.ts": "dd36d26f3694bdfd",
+    "src/orchestration/organisation/cascadeHelpers.ts": "8412e0fdca351608",
     "src/orchestration/organisation/cascadeSummary.ts": "335be9649cea0626",
     "src/orchestration/organisation/organisationDeploy.ts": "f3fad626230d8a16",
     "src/orchestration/organisation/organisationDestroy.ts": "06076a7e76345854",
     "src/orchestration/organisation/organisationSetup.ts": "3f3415b762a83a47",
     "src/orchestration/organisation/reconcileProviderAccounts.ts": "91920b2ed61dd811",
-    "src/orchestration/organisationDeploy/cascadeExecution.ts": "67fbdbff425f6794",
+    "src/orchestration/organisationDeploy/cascadeExecution.ts": "82381e411fa25080",
     "src/orchestration/organisationDeploy/infraSteps.ts": "53880cef5020dd04",
     "src/orchestration/organisationDeploy/orgCascadeDeploy.ts": "3968db08ab9568ac",
     "src/orchestration/organisationDeploy/orgContext.ts": "635f429a7cbb7c32",
@@ -188,7 +190,7 @@
     "src/services/application/applicationStackHelpers.ts": "04e1758b97ffc5fc",
     "src/services/application/index.ts": "ee810be803dfda9c",
     "src/services/index.ts": "8c441c1b37540650",
-    "src/services/infrastructure/CdkArgumentBuilder.ts": "0427db7f4a0add33",
+    "src/services/infrastructure/CdkArgumentBuilder.ts": "6191c51028fddca0",
     "src/services/infrastructure/CdkCommandRunner.ts": "427a9c1171902e42",
     "src/services/infrastructure/CdkErrorFormatter.ts": "e2e017136108a5d1",
     "src/services/infrastructure/CdkEventMonitoring.ts": "f172272948a5db40",
@@ -196,7 +198,7 @@
     "src/services/infrastructure/CdkOutputParser.ts": "eed9f3475324118e",
     "src/services/infrastructure/CdkProcessManager.ts": "165c97be53d6de8f",
     "src/services/infrastructure/CdkService.ts": "954ac16a4c646912",
-    "src/services/infrastructure/CdkServiceTypes.ts": "c4f3075238952728",
+    "src/services/infrastructure/CdkServiceTypes.ts": "f2861947ac9481ab",
     "src/services/infrastructure/CfnRegistryService.ts": "bd4f57d97982cdda",
     "src/services/infrastructure/CloudFormationService.ts": "82ce03614feae2db",
     "src/services/infrastructure/EcrImageInspectorService.ts": "e784440b5680df74",
@@ -207,7 +209,7 @@
     "src/services/infrastructure/SsmParameterMetadataService.ts": "3ff0bb42219cec3d",
     "src/services/infrastructure/bootstrapConvergence.ts": "ca11f0bf9552ba8c",
     "src/services/infrastructure/cancelInFlightStack.ts": "8388a16a23db725a",
-    "src/services/infrastructure/cdkServiceHelpers.ts": "2db30686382e568a",
+    "src/services/infrastructure/cdkServiceHelpers.ts": "60e93898614c8b4e",
     "src/services/infrastructure/cfnRegistrySeed.ts": "b1232b66883d6f90",
     "src/services/infrastructure/changeSetProbe.ts": "5f3e100db396cf9b",
     "src/services/infrastructure/constructMapEnrichment.ts": "7400af9bcfaa0da3",
@@ -215,7 +217,7 @@
     "src/services/infrastructure/index.ts": "c45e43711bf64fa9",
     "src/services/infrastructure/infraTypecheckPreflight.ts": "09e423a8283e3b8b",
     "src/services/infrastructure/transientNetworkRecovery.ts": "264b9a16fea86869",
-    "src/services/supporting/CdkContextBuilder.ts": "dee16f4302f7312a",
+    "src/services/supporting/CdkContextBuilder.ts": "ea23e4652bb4f587",
     "src/services/supporting/TemplateHashService.ts": "9fd5351f90b5cefb",
     "src/services/supporting/helpers.ts": "81c0ba7bfdd99366",
     "src/services/supporting/index.ts": "4bf4e746399d80e3",
@@ -239,7 +241,7 @@
     "src/types/deployEventParse.ts": "16bc2371fb747d96",
     "src/types/deployEventTypeGuards.ts": "731c4e5761b13fca",
     "src/types/deployment/DeploymentServiceTypes.ts": "ba257f2e37013afd",
-    "src/types/deployment/DeploymentTypes.ts": "fc7cf47cd1061408",
+    "src/types/deployment/DeploymentTypes.ts": "68776f62040b93a5",
     "src/types/deployment/cloudformation.ts": "5a0c51e263827943",
     "src/types/deployment/index.ts": "4bdffd195379a05d",
     "src/types/deployment/parallel.ts": "c06e3ac55fb39eb7",
@@ -256,7 +258,7 @@
     "src/types/frameworkBuilder.ts": "41198a0b446f60b6",
     "src/types/index.ts": "94240086d5b486af",
     "src/types/operations.ts": "57a6c9e22a3f37ca",
-    "src/types/params.ts": "8d7e40c0e526d75e",
+    "src/types/params.ts": "f49979d6546586b0",
     "src/types/remediation.ts": "0e1138f0c8fdc6bf",
     "src/types/stepDefinitions.ts": "a5e2aa03b15011b4",
     "src/types/validation.ts": "44aa473ec0e25dc4",
@@ -267,9 +269,9 @@
     "src/util/sleepAbortable.ts": "f9cac3bf8a79a476",
     "src/version.ts": "1811a4475823b27e",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "bc10d10b287002b1",
+    "package.json": "3f1518ad61e36088",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "38ea929d2c255e9dd58e4457048ec497008d08653c94d5f5e4a32fdb484b51f1",
-  "outputFileCount": 503
+  "outputHash": "d6256046f4a1e8299e2c2274d25162d2caf93b873c05807ab141f29af96ff524",
+  "outputFileCount": 507
 }

package/dist/.minified

@@ -1 +1 @@
-251 files minified at 2026-08-17T10:22:28.396Z
+253 files minified at 2026-08-20T22:19:13.833Z

package/dist/src/index.d.ts

@@ -67,8 +67,8 @@ export { reconcileProviderAccounts, mergeReconciledProviderAccounts } from "./or
 export type { ReconcileResult } from "./orchestration/index.js";
 export { decideNextTransition, reconcileTrailMigration, decommissionMemberTrailStorage, ORG_TRAIL_BUCKET_OUTPUT_KEY, TRAIL_BUCKET_OUTPUT_KEY, TRAIL_KEY_ARN_OUTPUT_KEY } from "./orchestration/index.js";
 export type { MemberTrailFacts, TrailMigrationTransition, TrailMigrationOutcome, DecommissionClients, DecommissionInput, DecommissionOutcome } from "./orchestration/index.js";
-export { classifyDriftFailure, fetchLastOperationEvents, DriftProbe, clearDriftSuspects, defaultDriftJournalDir, readDriftSuspects, recordDriftSuspects, detectStackDrift, runDriftPreFlight, formatDriftPreFlightBlock, DRIFT_PREFLIGHT_TRIGGER_STATUSES, DRIFT_PREFLIGHT_BUDGET_MS, runRoute53RecordPreflight } from "./orchestration/index.js";
-export type { DriftProbeOptions, DriftProbeRunner, ProbeDriftSuspectsParams, DriftJournalOptions, RecordDriftSuspectsParams, DetectStackDriftDeps, DetectStackDriftParams, StackDriftReport, RunDriftPreFlightParams, DriftPreFlightBlockExtras, DriftPreFlightOutcome, Route53RecordPreflightParams, Route53RecordPreflightOutcome, Route53RecordCollision } from "./orchestration/index.js";
+export { classifyDriftFailure, fetchLastOperationEvents, DriftProbe, probePhysicalPresence, clearDriftSuspects, defaultDriftJournalDir, readDriftSuspects, recordDriftSuspects, detectStackDrift, runDriftPreFlight, formatDriftPreFlightBlock, DRIFT_PREFLIGHT_TRIGGER_STATUSES, DRIFT_PREFLIGHT_BUDGET_MS, runRoute53RecordPreflight } from "./orchestration/index.js";
+export type { DriftProbeOptions, DriftProbeRunner, PhysicalPresenceOutcome, ProbeDriftSuspectsParams, DriftJournalOptions, RecordDriftSuspectsParams, DetectStackDriftDeps, DetectStackDriftParams, StackDriftReport, RunDriftPreFlightParams, DriftPreFlightBlockExtras, DriftPreFlightOutcome, Route53RecordPreflightParams, Route53RecordPreflightOutcome, Route53RecordCollision } from "./orchestration/index.js";
 export { archiveCompletedRemediationJournal, computeRemediationOpId, defaultRemediationJournalDir, findRemediationJournalByOpId, listActiveRemediationOps, listActiveRemediationOpsForContext, readRemediationJournal, sweepExpiredRemediationJournals, writeRemediationJournal, REMEDIATION_JOURNAL_RETENTION_DAYS, captureRemediationForensics, defaultRemediationForensicsDir, applyRetainFlip, composeFlipCapabilities, computeTemplateDigest, deriveRetainFlipTemplate, findMarkedResourcesByOpId, proveFlipMetadataOnly, readRetainFlipState, verifyRetainFlipDiff, FORGET_MARKER_KEY, FORGET_FLIP_SPEC, RECREATE_MARKER_KEY, assessForgetResumability, completeForgetAfterConverge, completeForgetAfterDeploy, formatRecreateInFlightCures, partitionPreFlightByRemediation, runForgetSurgery, synthTemplateDeclaresResource, runRecreateSurgery, snapshotPolicyForType, SNAPSHOT_CAPABLE_RESOURCE_TYPES, runRecreatePreFlight, deriveRemovalTemplate, findRemovalDeletionFailures, findResourcesPresent, proveRemovalTargetsOnly, advertisableDriftVerbs, buildDriftRepairTicket, runDriftRepairGate, formatPinOutcomeDetail, pinProbeCoverage, renderPinReportLines, runPinRemediation, captureLegacySurfaces, decodeLegacyAnchor, runIdentitySurfaceGate, collectIdentityPinCandidates, degradedIdentityPinOutcomes, renderIdentityPinReportLines, runIdentityPinMigration, composePostFailureRepairOffer, formatDriftRepairOffer, DriftRepairAvailableError, checkDeployPathStackAvailability, isDeployPathBlockingStatus, StackUnavailableError, assertLeaseBeforeStack, LeaseDeniedError } from "./orchestration/index.js";
 export type { RemediationJournalContext, RemediationJournalOptions, CaptureRemediationForensicsParams, ForensicsCaptureOptions, RemediationForensicsBundle, ApplyRetainFlipOutcome, ApplyRetainFlipParams, DeriveRetainFlipParams, FlipDeletionPolicy, FlipProofResult, FlipSpec, RetainFlipDerivation, RetainFlipState, RecreateOrchestrationOptions, RecreateSurgeryParams, RecreateSurgeryReport, RecreatePreFlightStack, RunRecreatePreFlightParams, CoRemovedResource, ProveRemovalTargetsOnlyParams, RemovalDeletionFailure, RemovalDerivation, RemovalProofResult, StrippedExport, CompleteForgetAfterDeployParams, CompleteForgetOutcome, CompleteForgetParams, ForeignMarkerOperation, ForgetOrchestrationOptions, ForgetResumeAssessment, ForgetResumeSource, ForgetSurgeryParams, ForgetSurgeryReport, PreFlightRemediationDeps, PreFlightRemediationPartition, DriftRepairGateOutcome, RunDriftRepairGateParams, ComposePostFailureRepairOfferParams, PinnedProperty, PinProbeCoverage, PinRemediationReport, PinReportOnlyReason, PinResourceOutcome, PinTarget, RunPinRemediationParams, CapturedLegacySurfaces, IdentitySurfaceGateParams, IdentitySurfaceGateReport, PinnableRenamePair, IdentityPinCandidate, IdentityPinReport, IdentityPinSlotOutcome, IdentityPinVerifiedSlot, LiveTemplateLookup, RunIdentityPinMigrationParams } from "./orchestration/index.js";
 export { unlockBucket, unlockQueue } from "./orchestration/index.js";
@@ -83,11 +83,13 @@ export { parseAccountsConfiguration, flattenAccountsToEnvironments, extractAllAc
 export type { AccountsConfig } from "./orchestration/index.js";
 export { runOpenNextBuild } from "./orchestration/index.js";
 export { runOrganisationSetup, ORG_SETUP_PHASES } from "./orchestration/index.js";
-export type { OrgSetupPhase, OrgSetupCallbacks, OrgSetupConfig, OrgSetupResult, DockerProvider, DockerProgressCallback, DockerBuildParams, DockerBuildResult, ResolvedBuildSecret, ResolvedBuildSecrets, ECRInitParams, ECRInitResult, TagImagesParams, TagImagesResult, TagByDigestParams, DomainDeployProvider, DomainConfig, DomainDeployResult, DomainTakeoverSynth, DeployServices } from "./orchestration/index.js";
-export { recordPhysicalName, parseRecordPhysicalName, recordSetKey, deleteRecordSetsByKey, cascadeTakeoverDigestSeed, buildCascadeTakeoverTicket, runCascadeTakeoverGate, WorkerDomainDeployProvider, createWorkerDomainDeployProvider } from "./orchestration/index.js";
-export type { RecordConsentIdentity, DeletedRecordSet, DomainsTakeoverContext, DomainsTakeoverWithheld, DomainsTakeoverGateOutcome, WorkerDomainDeployProviderParams } from "./orchestration/index.js";
-export { DOMAIN_DELEGATION_ERROR_TYPES, DomainDelegationError, DEFAULT_PUBLIC_RESOLVER_ADDRESSES, PUBLIC_DNS_QUERY_TIMEOUT_MS, createPublicResolvers, NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS, NS_PROPAGATION_DEFAULT_INTERVAL_MS, waitForNsPropagation, ACM_CAA_ISSUERS, runCaaPreflight, deployDelegatedDomain, CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE, templateOwnsDelegationRecord, deleteChildNsFromParent, nsDelegationPhysicalName, runDelegatedDomainDestroy } from "./orchestration/index.js";
-export type { DomainDeployPhase, DomainDelegationErrorType, PublicCaaRecord, PublicDnsResolver, NsPropagationGateParams, NsPropagationVerdict, CaaPreflightParams, CaaPreflightVerdict, DelegatedDomainDeployer, DelegatedZonePhaseState, DeployDelegatedDomainParams, DelegatedDomainDeployOutcome, NsDeleteOutcome, DeleteChildNsParams, DelegationDestroyNsOutcome, DelegatedDomainDestroyOutcome, DelegatedDomainDestroyParams } from "./orchestration/index.js";
+export type { OrgSetupPhase, OrgSetupCallbacks, OrgSetupConfig, OrgSetupResult, DockerProvider, DockerProgressCallback, DockerBuildParams, DockerBuildResult, ResolvedBuildSecret, ResolvedBuildSecrets, ECRInitParams, ECRInitResult, TagImagesParams, TagImagesResult, TagByDigestParams, DomainDeployProvider, DomainConfig, DomainDeployResult, DomainTakeoverSynth, DomainHome, DomainProviderGroup, DomainProviderFactory, DeployServices } from "./orchestration/index.js";
+export { recordPhysicalName, parseRecordPhysicalName, recordSetKey, deleteRecordSetsByKey, cascadeTakeoverDigestSeed, buildCascadeTakeoverTicket, runCascadeTakeoverGate, WorkerDomainDeployProvider, createWorkerDomainDeployProvider, createCascadeDomainProviderFactory } from "./orchestration/index.js";
+export type { RecordConsentIdentity, DeletedRecordSet, DomainsTakeoverContext, DomainsTakeoverGroup, CascadeTakeoverConsentContext, DomainsTakeoverWithheld, DomainsTakeoverGateOutcome, WorkerDomainDeployProviderParams, HomeCredentialsMinter, CascadeDomainProviderFactoryParams } from "./orchestration/index.js";
+export { assumeCascadeRole } from "./orchestration/contextHelpers.js";
+export type { CascadeAssumedRole } from "./orchestration/contextHelpers.js";
+export { DOMAIN_DELEGATION_ERROR_TYPES, DomainDelegationError, DEFAULT_PUBLIC_RESOLVER_ADDRESSES, PUBLIC_DNS_QUERY_TIMEOUT_MS, createPublicResolvers, NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS, NS_PROPAGATION_DEFAULT_INTERVAL_MS, waitForNsPropagation, ACM_CAA_ISSUERS, runCaaPreflight, deployDelegatedDomain, delegationRoleUnusableError, deriveZonePhaseState, extractDelegationRoleArn, readDelegatedTopologyFromProps, readDomainStackOutputsByExport, CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE, templateOwnsDelegationRecord, deleteChildNsFromParent, nsDelegationPhysicalName, runDelegatedDomainDestroy } from "./orchestration/index.js";
+export type { DomainDeployPhase, DelegatedDomainTopology, DomainDelegationErrorType, PublicCaaRecord, PublicDnsResolver, NsPropagationGateParams, NsPropagationVerdict, CaaPreflightParams, CaaPreflightVerdict, DelegatedDomainDeployer, DelegatedZonePhaseState, DeployDelegatedDomainParams, DelegatedDomainDeployOutcome, NsDeleteOutcome, DeleteChildNsParams, DelegationDestroyNsOutcome, DelegatedDomainDestroyOutcome, DelegatedDomainDestroyParams } from "./orchestration/index.js";
 export { classifyZoneRecords, buildSatelliteRecordIndex, createSystemDnsNameProbe, systemDnsNameProbe, normaliseRecordName, isRoute53NameServer, isDelegatedToRoute53 } from "./orchestration/index.js";
 export type { RecordClassification, ClassifiedRecord, ZoneClassificationReport, ZoneClassifierClients, ZoneClassifierPhase, ClassifyZoneOptions, SatelliteRecordIndex, DelegatedChildDomain, ChildAccountClients, ChildAccountClientFactory, AwsSdkClientLike, DnsProbeVerdict, DnsNameProbe } from "./orchestration/index.js";
 export { resolveBuildSecrets, resolveSecretRefValue, resolveBuildSecretSessionProvider, sourcedRefsFromBuildArgs, resolveBuildArgs, buildBuildSecretSessionPolicy, buildDeploySessionPolicy, partitionForRegion, validateBuildGroup } from "./orchestration/index.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as i,DEPLOYMENT_EVENT_TYPES as a,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as S,CASCADE_PHASES as l,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as T,truncateUtf16Safe as _}from"./types/index.js";import{DeployEventSchema as R,StepProgressSchema as m,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as N,SUPPORTED_CONTRACT_MARKERS as C,DEPLOY_EVENT_ID_MAX as I,DEPLOY_EVENT_NAME_MAX as y,DEPLOY_EVENT_MESSAGE_MAX as L,DEPLOY_EVENT_STATUS_REASON_MAX as g,DEPLOY_EVENT_ERROR_MESSAGE_MAX as h,DEPLOY_EVENT_TRAIL_DETAIL_MAX as x,DEPLOY_EVENT_OUTPUT_MAX as v,DEPLOY_EVENT_ARN_MAX as F,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ie,probeAccountStackExists as ae}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as Se,describeOrganisation as le,enablePolicyTypes as pe,enableServiceAccess as Te,SERVICE_PRINCIPALS as _e,enableRamSharing as Ae,activateTrustedAccess as Re,enableIpamDelegatedAdmin as me,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ne,findDevelopmentOuId as Ce,activateCostAllocationTags as Ie,checkIdentityCentreStatus as ye,snapshotIdentityCentre as Le,composeSdkAbortSignal as ge,extractErrorName as he,isAborted as xe,DEFAULT_MAX_PAGES as ve,IDENTITY_STORE_PAGE_SIZE as Fe,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ir}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as Sr,verbsForDriftVerdict as lr}from"./types/index.js";import{REMEDIATION_PHASES as Tr,RemediationPhaseSchema as _r,RemediationTargetSchema as Ar,RemediationFlipProofSchema as Rr,RemediationJournalRecordSchema as mr,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Nr,APPLICATION_DEPLOY_ORDER as Cr,APPLICATION_DESTROY_ORDER as Ir,OPENNEXT_DEPLOY_ORDER as yr,OPENNEXT_DESTROY_ORDER as Lr,PARALLEL_DEPLOY_GROUPS as gr,PARALLEL_DESTROY_GROUPS as hr,OPENNEXT_PARALLEL_GROUPS as xr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Fr,isOrganisationOperation as Mr,getParallelDeployGroups as Ur,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Wr,OPENNEXT_PATTERNS as Qr,STACK_NOT_FOUND_PATTERN as jr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as at,readStateFile as nt,writeStateFile as st,createEmptyState as ct,deleteStateFile as Et,updateTemplateHash as St,getStateFilePath as lt,regionSuffix as pt}from"./types/config/FjallState.js";import{readDomainState as _t,writeDomainState as At,recordDomainDeployState as Rt,deleteDomainState as mt,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Nt,CdkProcessManager as Ct,ensureDependencyIntegrity as It,clearDependencyIntegrityCache as yt,DEPENDENCY_SYNC_TIMEOUT_MS as Lt,CdkEventMonitor as gt,startStackMonitoring as ht,DEFAULT_DEPLOY_TIMEOUT_MS as xt,isCdkError as vt,formatInfrastructureError as Ft,getStructuralHint as Mt,getSourceContext as Ut,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Wt,parseBuildPhase as Qt,buildStepContextBuildConfig as jt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as io,DeploymentError as ao,NetworkError as no,FileSystemError as so,ConfigError as co,toServiceError as Eo}from"./types/errors/index.js";import{filterDangerousEnvVars as lo,maskSensitiveOutput as po,parseShellArgs as To,sleep as _o}from"@fjall/util";import{artefactOutputKey as Ro,DeployModeSchema as mo,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as No}from"./util/sleepAbortable.js";import{createSequencedCallbacks as Io}from"./util/sequencedCallbacks.js";import{fileExists as Lo}from"@fjall/util/fsHelpers";import{success as ho,failure as xo,isSuccess as vo,isFailure as Fo}from"@fjall/generator";import{deploy as Uo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{buildParamsContext as Vo}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Bo,emitWarningEvent as Ko}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Ho}from"./util/diagnosticScopes.js";import{restart as Jo,probeSecretsDrift as Wo,probeServiceDeploymentStatus as Qo,computeSecretsDrift as jo,deriveStaleParameters as Zo,extractConsumedSsmParameters as qo}from"./orchestration/index.js";import{partitionAccounts as $o}from"./orchestration/index.js";import{buildRegionList as ri,buildAccountRegionPairs as ti,cascadeHomeRegion as oi,cascadeOperationKey as ii}from"./orchestration/index.js";import{projectScalarSummary as ni,projectAccountRows as si}from"./orchestration/index.js";import{reconcileProviderAccounts as Ei,mergeReconciledProviderAccounts as Si}from"./orchestration/index.js";import{decideNextTransition as pi,reconcileTrailMigration as Ti,decommissionMemberTrailStorage as _i,ORG_TRAIL_BUCKET_OUTPUT_KEY as Ai,TRAIL_BUCKET_OUTPUT_KEY as Ri,TRAIL_KEY_ARN_OUTPUT_KEY as mi}from"./orchestration/index.js";import{classifyDriftFailure as ui,fetchLastOperationEvents as Di,DriftProbe as Pi,clearDriftSuspects as Oi,defaultDriftJournalDir as fi,readDriftSuspects as Ni,recordDriftSuspects as Ci,detectStackDrift as Ii,runDriftPreFlight as yi,formatDriftPreFlightBlock as Li,DRIFT_PREFLIGHT_TRIGGER_STATUSES as gi,DRIFT_PREFLIGHT_BUDGET_MS as hi,runRoute53RecordPreflight as xi}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Fi,computeRemediationOpId as Mi,defaultRemediationJournalDir as Ui,findRemediationJournalByOpId as ki,listActiveRemediationOps as bi,listActiveRemediationOpsForContext as Yi,readRemediationJournal as Vi,sweepExpiredRemediationJournals as Gi,writeRemediationJournal as Bi,REMEDIATION_JOURNAL_RETENTION_DAYS as Ki,captureRemediationForensics as Xi,defaultRemediationForensicsDir as Hi,applyRetainFlip as wi,composeFlipCapabilities as Ji,computeTemplateDigest as Wi,deriveRetainFlipTemplate as Qi,findMarkedResourcesByOpId as ji,proveFlipMetadataOnly as Zi,readRetainFlipState as qi,verifyRetainFlipDiff as zi,FORGET_MARKER_KEY as $i,FORGET_FLIP_SPEC as ea,RECREATE_MARKER_KEY as ra,assessForgetResumability as ta,completeForgetAfterConverge as oa,completeForgetAfterDeploy as ia,formatRecreateInFlightCures as aa,partitionPreFlightByRemediation as na,runForgetSurgery as sa,synthTemplateDeclaresResource as ca,runRecreateSurgery as Ea,snapshotPolicyForType as Sa,SNAPSHOT_CAPABLE_RESOURCE_TYPES as la,runRecreatePreFlight as pa,deriveRemovalTemplate as Ta,findRemovalDeletionFailures as _a,findResourcesPresent as Aa,proveRemovalTargetsOnly as Ra,advertisableDriftVerbs as ma,buildDriftRepairTicket as da,runDriftRepairGate as ua,formatPinOutcomeDetail as Da,pinProbeCoverage as Pa,renderPinReportLines as Oa,runPinRemediation as fa,captureLegacySurfaces as Na,decodeLegacyAnchor as Ca,runIdentitySurfaceGate as Ia,collectIdentityPinCandidates as ya,degradedIdentityPinOutcomes as La,renderIdentityPinReportLines as ga,runIdentityPinMigration as ha,composePostFailureRepairOffer as xa,formatDriftRepairOffer as va,DriftRepairAvailableError as Fa,checkDeployPathStackAvailability as Ma,isDeployPathBlockingStatus as Ua,StackUnavailableError as ka,assertLeaseBeforeStack as ba,LeaseDeniedError as Ya}from"./orchestration/index.js";import{unlockBucket as Ga,unlockQueue as Ba}from"./orchestration/index.js";import{triageBucketPolicy as Xa,isEnforceSslStatement as Ha,toResourcePolicyStatements as wa,restoreBucketPolicy as Ja,synthesiseEnforceSslDocument as Wa,ensureEnforceSsl as Qa,restoreAndReconcileQuarantinedBucket as ja}from"./orchestration/index.js";import{verifyOrgTrailDelivery as qa}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as $a,isRootTaskPolicyArn as en,ROOT_TASK_POLICY_ARNS as rn,MAX_ROOT_SESSION_SECONDS as tn}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as an,flattenAccountsToEnvironments as nn,extractAllAccountNames as sn,accountsConfigToOUTree as cn,isStringArray as En,isAccountsConfig as Sn,isOuOnlyAccountBucket as ln,OU_ONLY_ACCOUNT_BUCKETS as pn}from"./orchestration/index.js";import{runOpenNextBuild as _n}from"./orchestration/index.js";import{runOrganisationSetup as Rn,ORG_SETUP_PHASES as mn}from"./orchestration/index.js";import{recordPhysicalName as un,parseRecordPhysicalName as Dn,recordSetKey as Pn,deleteRecordSetsByKey as On,cascadeTakeoverDigestSeed as fn,buildCascadeTakeoverTicket as Nn,runCascadeTakeoverGate as Cn,WorkerDomainDeployProvider as In,createWorkerDomainDeployProvider as yn}from"./orchestration/index.js";import{DOMAIN_DELEGATION_ERROR_TYPES as gn,DomainDelegationError as hn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as xn,PUBLIC_DNS_QUERY_TIMEOUT_MS as vn,createPublicResolvers as Fn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Mn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Un,waitForNsPropagation as kn,ACM_CAA_ISSUERS as bn,runCaaPreflight as Yn,deployDelegatedDomain as Vn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as Gn,templateOwnsDelegationRecord as Bn,deleteChildNsFromParent as Kn,nsDelegationPhysicalName as Xn,runDelegatedDomainDestroy as Hn}from"./orchestration/index.js";import{classifyZoneRecords as Jn,buildSatelliteRecordIndex as Wn,createSystemDnsNameProbe as Qn,systemDnsNameProbe as jn,normaliseRecordName as Zn,isRoute53NameServer as qn,isDelegatedToRoute53 as zn}from"./orchestration/index.js";import{resolveBuildSecrets as es,resolveSecretRefValue as rs,resolveBuildSecretSessionProvider as ts,sourcedRefsFromBuildArgs as os,resolveBuildArgs as is,buildBuildSecretSessionPolicy as as,buildDeploySessionPolicy as ns,partitionForRegion as ss,validateBuildGroup as cs}from"./orchestration/index.js";import{FrameworkRegistry as Ss}from"./orchestration/index.js";import{openNextBuilder as ps,staticSiteBuilder as Ts,dockerBuilder as _s}from"./orchestration/index.js";import{StepRegistry as Rs,getDestroyStepId as ms}from"./steps/index.js";import{buildDeployPlan as us,computeDeployPlan as Ds,computeAssemblyDigest as Ps,digestHead as Os,classifyImpact as fs,derivePropertyChanges as Ns,isDataLoss as Cs,isStatefulResourceType as Is,renderPlanSummary as ys,renderPlanLines as Ls,toWirePlanChanges as gs,signApprovalToken as hs,verifyApprovalToken as xs,DEFAULT_APPROVAL_TTL_MS as vs,APPROVAL_TOKEN_PATTERN as Fs,runApprovalGate as Ms,approvalRefusalReason as Us}from"./orchestration/index.js";import{runDestructionGate as bs,buildDestructionTicket as Ys,evaluateDestructionConsents as Vs,computeTicketDigest as Gs,legalRemediationVerbs as Bs,executableRemediationVerbs as Ks,advertisableRemediationVerbs as Xs,renderDestructionTicketLines as Hs,renderConsentVerdictLines as ws,loadDeployPlan as Js,createMemoisedPlanLoader as Ws}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as js,classifyDeployFailure as Zs,classifyFromEcsCompletion as qs,classifyFromFailureAnalysis as zs,classifyUnclassified as $s}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as rc,getDeploymentFailure as tc}from"./orchestration/failure/deploymentFailureAttachment.js";export{bn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Cr as APPLICATION_DEPLOY_ORDER,Ir as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Fs as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,io as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,l as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,Gn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Nt as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,gt as CdkEventMonitor,Ct as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,co as ConfigError,vs as DEFAULT_APPROVAL_TTL_MS,xt as DEFAULT_DEPLOY_TIMEOUT_MS,ve as DEFAULT_MAX_PAGES,xn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,Lt as DEPENDENCY_SYNC_TIMEOUT_MS,S as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,a as DEPLOYMENT_EVENT_TYPES,js as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,F as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,N as DEPLOY_EVENT_CONTRACT_MINOR,h as DEPLOY_EVENT_ERROR_MESSAGE_MAX,I as DEPLOY_EVENT_ID_MAX,L as DEPLOY_EVENT_MESSAGE_MAX,y as DEPLOY_EVENT_NAME_MAX,v as DEPLOY_EVENT_OUTPUT_MAX,g as DEPLOY_EVENT_STATUS_REASON_MAX,x as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,gn as DOMAIN_DELEGATION_ERROR_TYPES,hi as DRIFT_PREFLIGHT_BUDGET_MS,gi as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,R as DeployEventSchema,mo as DeployModeSchema,d as DeployResourceSchema,ao as DeploymentError,i as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,hn as DomainDelegationError,Er as DriftFindingSchema,Sr as DriftJournalRecordSchema,Pi as DriftProbe,Fa as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Ho as ENGINE_DIAGNOSTIC_SCOPE,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,ea as FORGET_FLIP_SPEC,$i as FORGET_MARKER_KEY,so as FileSystemError,at as FjallStateFileSchema,Ss as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,Fe as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Ya as LeaseDeniedError,tn as MAX_ROOT_SESSION_SECONDS,Un as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Mn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,yr as OPENNEXT_DEPLOY_ORDER,Lr as OPENNEXT_DESTROY_ORDER,xr as OPENNEXT_PARALLEL_GROUPS,Qr as OPENNEXT_PATTERNS,Nr as ORGANISATION_TYPES,mn as ORG_SETUP_PHASES,Ai as ORG_TRAIL_BUCKET_OUTPUT_KEY,pn as OU_ONLY_ACCOUNT_BUCKETS,gr as PARALLEL_DEPLOY_GROUPS,hr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Wt as PROGRESS_MESSAGES,vn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,ra as RECREATE_MARKER_KEY,Ki as REMEDIATION_JOURNAL_RETENTION_DAYS,Tr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,rn as ROOT_TASK_POLICY_ARNS,Rr as RemediationFlipProofSchema,mr as RemediationJournalRecordSchema,_r as RemediationPhaseSchema,Ar as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,_e as SERVICE_PRINCIPALS,la as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,jr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,C as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,ka as StackUnavailableError,m as StepProgressSchema,Rs as StepRegistry,or as TICKET_VERDICT_SOURCES,Ri as TRAIL_BUCKET_OUTPUT_KEY,mi as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,ir as TicketVerdictSourceSchema,to as ValidationError,In as WorkerDomainDeployProvider,cn as accountsConfigToOUTree,Ie as activateCostAllocationTags,Re as activateTrustedAccess,ma as advertisableDriftVerbs,Xs as advertisableRemediationVerbs,wi as applyRetainFlip,Us as approvalRefusalReason,Fi as archiveCompletedRemediationJournal,Ro as artefactOutputKey,ba as assertLeaseBeforeStack,ta as assessForgetResumability,$a as assumeRootForTask,rc as attachDeploymentFailure,ti as buildAccountRegionPairs,Ne as buildAccountToOUMap,as as buildBuildSecretSessionPolicy,Nn as buildCascadeTakeoverTicket,us as buildDeployPlan,ns as buildDeploySessionPolicy,Ys as buildDestructionTicket,da as buildDriftRepairTicket,Vo as buildParamsContext,ri as buildRegionList,Wn as buildSatelliteRecordIndex,jt as buildStepContextBuildConfig,ie as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Na as captureLegacySurfaces,Xi as captureRemediationForensics,oi as cascadeHomeRegion,ii as cascadeOperationKey,fn as cascadeTakeoverDigestSeed,Ma as checkDeployPathStackAvailability,ye as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,T as clampDeploymentEventStrings,Zs as classifyDeployFailure,ui as classifyDriftFailure,qs as classifyFromEcsCompletion,zs as classifyFromFailureAnalysis,fs as classifyImpact,$s as classifyUnclassified,Jn as classifyZoneRecords,yt as clearDependencyIntegrityCache,Oi as clearDriftSuspects,ya as collectIdentityPinCandidates,oa as completeForgetAfterConverge,ia as completeForgetAfterDeploy,Ji as composeFlipCapabilities,xa as composePostFailureRepairOffer,ge as composeSdkAbortSignal,Ps as computeAssemblyDigest,Ds as computeDeployPlan,Mi as computeRemediationOpId,jo as computeSecretsDrift,Wi as computeTemplateDigest,Gs as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,j as createDeployEmitter,ct as createEmptyState,Ws as createMemoisedPlanLoader,Fn as createPublicResolvers,Io as createSequencedCallbacks,Qn as createSystemDnsNameProbe,yn as createWorkerDomainDeployProvider,pi as decideNextTransition,Ca as decodeLegacyAnchor,_i as decommissionMemberTrailStorage,fi as defaultDriftJournalDir,Hi as defaultRemediationForensicsDir,Ui as defaultRemediationJournalDir,La as degradedIdentityPinOutcomes,Kn as deleteChildNsFromParent,mt as deleteDomainState,On as deleteRecordSetsByKey,Et as deleteStateFile,Uo as deploy,Vn as deployDelegatedDomain,Ns as derivePropertyChanges,Ta as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,Qi as deriveRetainFlipTemplate,Zo as deriveStaleParameters,le as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,Ii as detectStackDrift,Os as digestHead,_s as dockerBuilder,Me as drainPages,Jt as emitProgress,Bo as emitStepWarnings,Ko as emitWarningEvent,Ye as enableCentralisedRootAccess,me as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Ae as enableRamSharing,Te as enableServiceAccess,It as ensureDependencyIntegrity,Qa as ensureEnforceSsl,Se as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Vs as evaluateDestructionConsents,Ks as executableRemediationVerbs,sn as extractAllAccountNames,qo as extractConsumedSsmParameters,he as extractErrorName,xo as failure,Di as fetchLastOperationEvents,Lo as fileExists,lo as filterDangerousEnvVars,De as findAccount,Ce as findDevelopmentOuId,ji as findMarkedResourcesByOpId,ki as findRemediationJournalByOpId,_a as findRemovalDeletionFailures,Aa as findResourcesPresent,nn as flattenAccountsToEnvironments,Li as formatDriftPreFlightBlock,va as formatDriftRepairOffer,Ft as formatInfrastructureError,Da as formatPinOutcomeDetail,aa as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,tc as getDeploymentFailure,ms as getDestroyStepId,Gr as getOrganisationStackName,Ur as getParallelDeployGroups,kr as getParallelDestroyGroups,Ut as getSourceContext,lt as getStateFilePath,Mt as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,xe as isAborted,Sn as isAccountsConfig,Fr as isApplicationOperation,Br as isApplicationStack,vt as isCdkError,Cs as isDataLoss,zn as isDelegatedToRoute53,Ua as isDeployPathBlockingStatus,Ha as isEnforceSslStatement,Fo as isFailure,Ue as isOULeaf,Wr as isOpenNextPattern,Mr as isOrganisationOperation,ln as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,en as isRootTaskPolicyArn,qn as isRoute53NameServer,Is as isStatefulResourceType,En as isStringArray,vo as isSuccess,Bs as legalRemediationVerbs,ue as listAccounts,bi as listActiveRemediationOps,Yi as listActiveRemediationOpsForContext,Js as loadDeployPlan,po as maskSensitiveOutput,Si as mergeReconciledProviderAccounts,Zn as normaliseRecordName,Xn as nsDelegationPhysicalName,ps as openNextBuilder,an as parseAccountsConfiguration,Qt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,Dn as parseRecordPhysicalName,To as parseShellArgs,$o as partitionAccounts,ss as partitionForRegion,na as partitionPreFlightByRemediation,Pa as pinProbeCoverage,fe as placeAccountsInOUs,ae as probeAccountStackExists,Wo as probeSecretsDrift,Qo as probeServiceDeploymentStatus,si as projectAccountRows,ni as projectScalarSummary,Zi as proveFlipMetadataOnly,Ra as proveRemovalTargetsOnly,_t as readDomainState,Ni as readDriftSuspects,Vi as readRemediationJournal,qi as readRetainFlipState,nt as readStateFile,Ei as reconcileProviderAccounts,Ti as reconcileTrailMigration,Rt as recordDomainDeployState,Ci as recordDriftSuspects,un as recordPhysicalName,Pn as recordSetKey,ce as regionDisabledMessage,pt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,ws as renderConsentVerdictLines,Hs as renderDestructionTicketLines,ga as renderIdentityPinReportLines,Oa as renderPinReportLines,Ls as renderPlanLines,ys as renderPlanSummary,is as resolveBuildArgs,ts as resolveBuildSecretSessionProvider,es as resolveBuildSecrets,rs as resolveSecretRefValue,Jo as restart,ja as restoreAndReconcileQuarantinedBucket,Ja as restoreBucketPolicy,Ms as runApprovalGate,Yn as runCaaPreflight,Cn as runCascadeTakeoverGate,Hn as runDelegatedDomainDestroy,bs as runDestructionGate,yi as runDriftPreFlight,ua as runDriftRepairGate,sa as runForgetSurgery,ha as runIdentityPinMigration,Ia as runIdentitySurfaceGate,_n as runOpenNextBuild,Rn as runOrganisationSetup,fa as runPinRemediation,pa as runRecreatePreFlight,Ea as runRecreateSurgery,xi as runRoute53RecordPreflight,hs as signApprovalToken,_o as sleep,No as sleepAbortable,Le as snapshotIdentityCentre,Sa as snapshotPolicyForType,os as sourcedRefsFromBuildArgs,ht as startStackMonitoring,Ts as staticSiteBuilder,rt as stubCallerIdentity,ho as success,Gi as sweepExpiredRemediationJournals,ca as synthTemplateDeclaresResource,Wa as synthesiseEnforceSslDocument,jn as systemDnsNameProbe,Bn as templateOwnsDelegationRecord,Jr as toPascalCase,wa as toResourcePolicyStatements,Eo as toServiceError,gs as toWirePlanChanges,Xa as triageBucketPolicy,_ as truncateUtf16Safe,Ga as unlockBucket,Ba as unlockQueue,de as updateBackupGlobalSettings,St as updateTemplateHash,cs as validateBuildGroup,lr as verbsForDriftVerdict,xs as verifyApprovalToken,qa as verifyOrgTrailDelivery,zi as verifyRetainFlipDiff,kn as waitForNsPropagation,et as wrapApplicationError,At as writeDomainState,Bi as writeRemediationJournal,st as writeStateFile};
+import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as a,DEPLOYMENT_EVENT_TYPES as i,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as l,CASCADE_PHASES as S,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as T,truncateUtf16Safe as m}from"./types/index.js";import{DeployEventSchema as _,StepProgressSchema as A,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as y,DEPLOY_EVENT_NAME_MAX as g,DEPLOY_EVENT_MESSAGE_MAX as I,DEPLOY_EVENT_STATUS_REASON_MAX as L,DEPLOY_EVENT_ERROR_MESSAGE_MAX as x,DEPLOY_EVENT_TRAIL_DETAIL_MAX as h,DEPLOY_EVENT_OUTPUT_MAX as v,DEPLOY_EVENT_ARN_MAX as F,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ae,probeAccountStackExists as ie}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as le,describeOrganisation as Se,enablePolicyTypes as pe,enableServiceAccess as Te,SERVICE_PRINCIPALS as me,enableRamSharing as Re,activateTrustedAccess as _e,enableIpamDelegatedAdmin as Ae,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as ye,checkIdentityCentreStatus as ge,snapshotIdentityCentre as Ie,composeSdkAbortSignal as Le,extractErrorName as xe,isAborted as he,DEFAULT_MAX_PAGES as ve,IDENTITY_STORE_PAGE_SIZE as Fe,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ar}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as lr,verbsForDriftVerdict as Sr}from"./types/index.js";import{REMEDIATION_PHASES as Tr,RemediationPhaseSchema as mr,RemediationTargetSchema as Rr,RemediationFlipProofSchema as _r,RemediationJournalRecordSchema as Ar,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Cr,APPLICATION_DEPLOY_ORDER as Nr,APPLICATION_DESTROY_ORDER as yr,OPENNEXT_DEPLOY_ORDER as gr,OPENNEXT_DESTROY_ORDER as Ir,PARALLEL_DEPLOY_GROUPS as Lr,PARALLEL_DESTROY_GROUPS as xr,OPENNEXT_PARALLEL_GROUPS as hr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Fr,isOrganisationOperation as Mr,getParallelDeployGroups as Ur,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Wr,OPENNEXT_PATTERNS as Qr,STACK_NOT_FOUND_PATTERN as jr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as it,readStateFile as nt,writeStateFile as st,createEmptyState as ct,deleteStateFile as Et,updateTemplateHash as lt,getStateFilePath as St,regionSuffix as pt}from"./types/config/FjallState.js";import{readDomainState as mt,writeDomainState as Rt,recordDomainDeployState as _t,deleteDomainState as At,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Ct,CdkProcessManager as Nt,ensureDependencyIntegrity as yt,clearDependencyIntegrityCache as gt,DEPENDENCY_SYNC_TIMEOUT_MS as It,CdkEventMonitor as Lt,startStackMonitoring as xt,DEFAULT_DEPLOY_TIMEOUT_MS as ht,isCdkError as vt,formatInfrastructureError as Ft,getStructuralHint as Mt,getSourceContext as Ut,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Wt,parseBuildPhase as Qt,buildStepContextBuildConfig as jt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as ao,DeploymentError as io,NetworkError as no,FileSystemError as so,ConfigError as co,toServiceError as Eo}from"./types/errors/index.js";import{filterDangerousEnvVars as So,maskSensitiveOutput as po,parseShellArgs as To,sleep as mo}from"@fjall/util";import{artefactOutputKey as _o,DeployModeSchema as Ao,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as Co}from"./util/sleepAbortable.js";import{createSequencedCallbacks as yo}from"./util/sequencedCallbacks.js";import{fileExists as Io}from"@fjall/util/fsHelpers";import{success as xo,failure as ho,isSuccess as vo,isFailure as Fo}from"@fjall/generator";import{deploy as Uo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{buildParamsContext as Vo}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Bo,emitWarningEvent as Ko}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Ho}from"./util/diagnosticScopes.js";import{restart as Jo,probeSecretsDrift as Wo,probeServiceDeploymentStatus as Qo,computeSecretsDrift as jo,deriveStaleParameters as Zo,extractConsumedSsmParameters as qo}from"./orchestration/index.js";import{partitionAccounts as $o}from"./orchestration/index.js";import{buildRegionList as ra,buildAccountRegionPairs as ta,cascadeHomeRegion as oa,cascadeOperationKey as aa}from"./orchestration/index.js";import{projectScalarSummary as na,projectAccountRows as sa}from"./orchestration/index.js";import{reconcileProviderAccounts as Ea,mergeReconciledProviderAccounts as la}from"./orchestration/index.js";import{decideNextTransition as pa,reconcileTrailMigration as Ta,decommissionMemberTrailStorage as ma,ORG_TRAIL_BUCKET_OUTPUT_KEY as Ra,TRAIL_BUCKET_OUTPUT_KEY as _a,TRAIL_KEY_ARN_OUTPUT_KEY as Aa}from"./orchestration/index.js";import{classifyDriftFailure as ua,fetchLastOperationEvents as Da,DriftProbe as Pa,probePhysicalPresence as Oa,clearDriftSuspects as fa,defaultDriftJournalDir as Ca,readDriftSuspects as Na,recordDriftSuspects as ya,detectStackDrift as ga,runDriftPreFlight as Ia,formatDriftPreFlightBlock as La,DRIFT_PREFLIGHT_TRIGGER_STATUSES as xa,DRIFT_PREFLIGHT_BUDGET_MS as ha,runRoute53RecordPreflight as va}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ma,computeRemediationOpId as Ua,defaultRemediationJournalDir as ka,findRemediationJournalByOpId as ba,listActiveRemediationOps as Ya,listActiveRemediationOpsForContext as Va,readRemediationJournal as Ga,sweepExpiredRemediationJournals as Ba,writeRemediationJournal as Ka,REMEDIATION_JOURNAL_RETENTION_DAYS as Xa,captureRemediationForensics as Ha,defaultRemediationForensicsDir as wa,applyRetainFlip as Ja,composeFlipCapabilities as Wa,computeTemplateDigest as Qa,deriveRetainFlipTemplate as ja,findMarkedResourcesByOpId as Za,proveFlipMetadataOnly as qa,readRetainFlipState as za,verifyRetainFlipDiff as $a,FORGET_MARKER_KEY as ei,FORGET_FLIP_SPEC as ri,RECREATE_MARKER_KEY as ti,assessForgetResumability as oi,completeForgetAfterConverge as ai,completeForgetAfterDeploy as ii,formatRecreateInFlightCures as ni,partitionPreFlightByRemediation as si,runForgetSurgery as ci,synthTemplateDeclaresResource as Ei,runRecreateSurgery as li,snapshotPolicyForType as Si,SNAPSHOT_CAPABLE_RESOURCE_TYPES as pi,runRecreatePreFlight as Ti,deriveRemovalTemplate as mi,findRemovalDeletionFailures as Ri,findResourcesPresent as _i,proveRemovalTargetsOnly as Ai,advertisableDriftVerbs as di,buildDriftRepairTicket as ui,runDriftRepairGate as Di,formatPinOutcomeDetail as Pi,pinProbeCoverage as Oi,renderPinReportLines as fi,runPinRemediation as Ci,captureLegacySurfaces as Ni,decodeLegacyAnchor as yi,runIdentitySurfaceGate as gi,collectIdentityPinCandidates as Ii,degradedIdentityPinOutcomes as Li,renderIdentityPinReportLines as xi,runIdentityPinMigration as hi,composePostFailureRepairOffer as vi,formatDriftRepairOffer as Fi,DriftRepairAvailableError as Mi,checkDeployPathStackAvailability as Ui,isDeployPathBlockingStatus as ki,StackUnavailableError as bi,assertLeaseBeforeStack as Yi,LeaseDeniedError as Vi}from"./orchestration/index.js";import{unlockBucket as Bi,unlockQueue as Ki}from"./orchestration/index.js";import{triageBucketPolicy as Hi,isEnforceSslStatement as wi,toResourcePolicyStatements as Ji,restoreBucketPolicy as Wi,synthesiseEnforceSslDocument as Qi,ensureEnforceSsl as ji,restoreAndReconcileQuarantinedBucket as Zi}from"./orchestration/index.js";import{verifyOrgTrailDelivery as zi}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as en,isRootTaskPolicyArn as rn,ROOT_TASK_POLICY_ARNS as tn,MAX_ROOT_SESSION_SECONDS as on}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as nn,flattenAccountsToEnvironments as sn,extractAllAccountNames as cn,accountsConfigToOUTree as En,isStringArray as ln,isAccountsConfig as Sn,isOuOnlyAccountBucket as pn,OU_ONLY_ACCOUNT_BUCKETS as Tn}from"./orchestration/index.js";import{runOpenNextBuild as Rn}from"./orchestration/index.js";import{runOrganisationSetup as An,ORG_SETUP_PHASES as dn}from"./orchestration/index.js";import{recordPhysicalName as Dn,parseRecordPhysicalName as Pn,recordSetKey as On,deleteRecordSetsByKey as fn,cascadeTakeoverDigestSeed as Cn,buildCascadeTakeoverTicket as Nn,runCascadeTakeoverGate as yn,WorkerDomainDeployProvider as gn,createWorkerDomainDeployProvider as In,createCascadeDomainProviderFactory as Ln}from"./orchestration/index.js";import{assumeCascadeRole as hn}from"./orchestration/contextHelpers.js";import{DOMAIN_DELEGATION_ERROR_TYPES as Fn,DomainDelegationError as Mn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as Un,PUBLIC_DNS_QUERY_TIMEOUT_MS as kn,createPublicResolvers as bn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Yn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Vn,waitForNsPropagation as Gn,ACM_CAA_ISSUERS as Bn,runCaaPreflight as Kn,deployDelegatedDomain as Xn,delegationRoleUnusableError as Hn,deriveZonePhaseState as wn,extractDelegationRoleArn as Jn,readDelegatedTopologyFromProps as Wn,readDomainStackOutputsByExport as Qn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as jn,templateOwnsDelegationRecord as Zn,deleteChildNsFromParent as qn,nsDelegationPhysicalName as zn,runDelegatedDomainDestroy as $n}from"./orchestration/index.js";import{classifyZoneRecords as rs,buildSatelliteRecordIndex as ts,createSystemDnsNameProbe as os,systemDnsNameProbe as as,normaliseRecordName as is,isRoute53NameServer as ns,isDelegatedToRoute53 as ss}from"./orchestration/index.js";import{resolveBuildSecrets as Es,resolveSecretRefValue as ls,resolveBuildSecretSessionProvider as Ss,sourcedRefsFromBuildArgs as ps,resolveBuildArgs as Ts,buildBuildSecretSessionPolicy as ms,buildDeploySessionPolicy as Rs,partitionForRegion as _s,validateBuildGroup as As}from"./orchestration/index.js";import{FrameworkRegistry as us}from"./orchestration/index.js";import{openNextBuilder as Ps,staticSiteBuilder as Os,dockerBuilder as fs}from"./orchestration/index.js";import{StepRegistry as Ns,getDestroyStepId as ys}from"./steps/index.js";import{buildDeployPlan as Is,computeDeployPlan as Ls,computeAssemblyDigest as xs,digestHead as hs,classifyImpact as vs,derivePropertyChanges as Fs,isDataLoss as Ms,isStatefulResourceType as Us,renderPlanSummary as ks,renderPlanLines as bs,toWirePlanChanges as Ys,signApprovalToken as Vs,verifyApprovalToken as Gs,DEFAULT_APPROVAL_TTL_MS as Bs,APPROVAL_TOKEN_PATTERN as Ks,runApprovalGate as Xs,approvalRefusalReason as Hs}from"./orchestration/index.js";import{runDestructionGate as Js,buildDestructionTicket as Ws,evaluateDestructionConsents as Qs,computeTicketDigest as js,legalRemediationVerbs as Zs,executableRemediationVerbs as qs,advertisableRemediationVerbs as zs,renderDestructionTicketLines as $s,renderConsentVerdictLines as ec,loadDeployPlan as rc,createMemoisedPlanLoader as tc}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as ac,classifyDeployFailure as ic,classifyFromEcsCompletion as nc,classifyFromFailureAnalysis as sc,classifyUnclassified as cc}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as lc,getDeploymentFailure as Sc}from"./orchestration/failure/deploymentFailureAttachment.js";export{Bn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Nr as APPLICATION_DEPLOY_ORDER,yr as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Ks as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,ao as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,S as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,jn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Ct as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,Lt as CdkEventMonitor,Nt as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,co as ConfigError,Bs as DEFAULT_APPROVAL_TTL_MS,ht as DEFAULT_DEPLOY_TIMEOUT_MS,ve as DEFAULT_MAX_PAGES,Un as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,It as DEPENDENCY_SYNC_TIMEOUT_MS,l as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,i as DEPLOYMENT_EVENT_TYPES,ac as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,F as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,x as DEPLOY_EVENT_ERROR_MESSAGE_MAX,y as DEPLOY_EVENT_ID_MAX,I as DEPLOY_EVENT_MESSAGE_MAX,g as DEPLOY_EVENT_NAME_MAX,v as DEPLOY_EVENT_OUTPUT_MAX,L as DEPLOY_EVENT_STATUS_REASON_MAX,h as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,Fn as DOMAIN_DELEGATION_ERROR_TYPES,ha as DRIFT_PREFLIGHT_BUDGET_MS,xa as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,_ as DeployEventSchema,Ao as DeployModeSchema,d as DeployResourceSchema,io as DeploymentError,a as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,Mn as DomainDelegationError,Er as DriftFindingSchema,lr as DriftJournalRecordSchema,Pa as DriftProbe,Mi as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Ho as ENGINE_DIAGNOSTIC_SCOPE,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,ri as FORGET_FLIP_SPEC,ei as FORGET_MARKER_KEY,so as FileSystemError,it as FjallStateFileSchema,us as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,Fe as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Vi as LeaseDeniedError,on as MAX_ROOT_SESSION_SECONDS,Vn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Yn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,gr as OPENNEXT_DEPLOY_ORDER,Ir as OPENNEXT_DESTROY_ORDER,hr as OPENNEXT_PARALLEL_GROUPS,Qr as OPENNEXT_PATTERNS,Cr as ORGANISATION_TYPES,dn as ORG_SETUP_PHASES,Ra as ORG_TRAIL_BUCKET_OUTPUT_KEY,Tn as OU_ONLY_ACCOUNT_BUCKETS,Lr as PARALLEL_DEPLOY_GROUPS,xr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Wt as PROGRESS_MESSAGES,kn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,ti as RECREATE_MARKER_KEY,Xa as REMEDIATION_JOURNAL_RETENTION_DAYS,Tr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,tn as ROOT_TASK_POLICY_ARNS,_r as RemediationFlipProofSchema,Ar as RemediationJournalRecordSchema,mr as RemediationPhaseSchema,Rr as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,me as SERVICE_PRINCIPALS,pi as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,jr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,bi as StackUnavailableError,A as StepProgressSchema,Ns as StepRegistry,or as TICKET_VERDICT_SOURCES,_a as TRAIL_BUCKET_OUTPUT_KEY,Aa as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,ar as TicketVerdictSourceSchema,to as ValidationError,gn as WorkerDomainDeployProvider,En as accountsConfigToOUTree,ye as activateCostAllocationTags,_e as activateTrustedAccess,di as advertisableDriftVerbs,zs as advertisableRemediationVerbs,Ja as applyRetainFlip,Hs as approvalRefusalReason,Ma as archiveCompletedRemediationJournal,_o as artefactOutputKey,Yi as assertLeaseBeforeStack,oi as assessForgetResumability,hn as assumeCascadeRole,en as assumeRootForTask,lc as attachDeploymentFailure,ta as buildAccountRegionPairs,Ce as buildAccountToOUMap,ms as buildBuildSecretSessionPolicy,Nn as buildCascadeTakeoverTicket,Is as buildDeployPlan,Rs as buildDeploySessionPolicy,Ws as buildDestructionTicket,ui as buildDriftRepairTicket,Vo as buildParamsContext,ra as buildRegionList,ts as buildSatelliteRecordIndex,jt as buildStepContextBuildConfig,ae as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Ni as captureLegacySurfaces,Ha as captureRemediationForensics,oa as cascadeHomeRegion,aa as cascadeOperationKey,Cn as cascadeTakeoverDigestSeed,Ui as checkDeployPathStackAvailability,ge as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,T as clampDeploymentEventStrings,ic as classifyDeployFailure,ua as classifyDriftFailure,nc as classifyFromEcsCompletion,sc as classifyFromFailureAnalysis,vs as classifyImpact,cc as classifyUnclassified,rs as classifyZoneRecords,gt as clearDependencyIntegrityCache,fa as clearDriftSuspects,Ii as collectIdentityPinCandidates,ai as completeForgetAfterConverge,ii as completeForgetAfterDeploy,Wa as composeFlipCapabilities,vi as composePostFailureRepairOffer,Le as composeSdkAbortSignal,xs as computeAssemblyDigest,Ls as computeDeployPlan,Ua as computeRemediationOpId,jo as computeSecretsDrift,Qa as computeTemplateDigest,js as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,Ln as createCascadeDomainProviderFactory,j as createDeployEmitter,ct as createEmptyState,tc as createMemoisedPlanLoader,bn as createPublicResolvers,yo as createSequencedCallbacks,os as createSystemDnsNameProbe,In as createWorkerDomainDeployProvider,pa as decideNextTransition,yi as decodeLegacyAnchor,ma as decommissionMemberTrailStorage,Ca as defaultDriftJournalDir,wa as defaultRemediationForensicsDir,ka as defaultRemediationJournalDir,Li as degradedIdentityPinOutcomes,Hn as delegationRoleUnusableError,qn as deleteChildNsFromParent,At as deleteDomainState,fn as deleteRecordSetsByKey,Et as deleteStateFile,Uo as deploy,Xn as deployDelegatedDomain,Fs as derivePropertyChanges,mi as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,ja as deriveRetainFlipTemplate,Zo as deriveStaleParameters,wn as deriveZonePhaseState,Se as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,ga as detectStackDrift,hs as digestHead,fs as dockerBuilder,Me as drainPages,Jt as emitProgress,Bo as emitStepWarnings,Ko as emitWarningEvent,Ye as enableCentralisedRootAccess,Ae as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Re as enableRamSharing,Te as enableServiceAccess,yt as ensureDependencyIntegrity,ji as ensureEnforceSsl,le as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Qs as evaluateDestructionConsents,qs as executableRemediationVerbs,cn as extractAllAccountNames,qo as extractConsumedSsmParameters,Jn as extractDelegationRoleArn,xe as extractErrorName,ho as failure,Da as fetchLastOperationEvents,Io as fileExists,So as filterDangerousEnvVars,De as findAccount,Ne as findDevelopmentOuId,Za as findMarkedResourcesByOpId,ba as findRemediationJournalByOpId,Ri as findRemovalDeletionFailures,_i as findResourcesPresent,sn as flattenAccountsToEnvironments,La as formatDriftPreFlightBlock,Fi as formatDriftRepairOffer,Ft as formatInfrastructureError,Pi as formatPinOutcomeDetail,ni as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,Sc as getDeploymentFailure,ys as getDestroyStepId,Gr as getOrganisationStackName,Ur as getParallelDeployGroups,kr as getParallelDestroyGroups,Ut as getSourceContext,St as getStateFilePath,Mt as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,he as isAborted,Sn as isAccountsConfig,Fr as isApplicationOperation,Br as isApplicationStack,vt as isCdkError,Ms as isDataLoss,ss as isDelegatedToRoute53,ki as isDeployPathBlockingStatus,wi as isEnforceSslStatement,Fo as isFailure,Ue as isOULeaf,Wr as isOpenNextPattern,Mr as isOrganisationOperation,pn as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,rn as isRootTaskPolicyArn,ns as isRoute53NameServer,Us as isStatefulResourceType,ln as isStringArray,vo as isSuccess,Zs as legalRemediationVerbs,ue as listAccounts,Ya as listActiveRemediationOps,Va as listActiveRemediationOpsForContext,rc as loadDeployPlan,po as maskSensitiveOutput,la as mergeReconciledProviderAccounts,is as normaliseRecordName,zn as nsDelegationPhysicalName,Ps as openNextBuilder,nn as parseAccountsConfiguration,Qt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,Pn as parseRecordPhysicalName,To as parseShellArgs,$o as partitionAccounts,_s as partitionForRegion,si as partitionPreFlightByRemediation,Oi as pinProbeCoverage,fe as placeAccountsInOUs,ie as probeAccountStackExists,Oa as probePhysicalPresence,Wo as probeSecretsDrift,Qo as probeServiceDeploymentStatus,sa as projectAccountRows,na as projectScalarSummary,qa as proveFlipMetadataOnly,Ai as proveRemovalTargetsOnly,Wn as readDelegatedTopologyFromProps,Qn as readDomainStackOutputsByExport,mt as readDomainState,Na as readDriftSuspects,Ga as readRemediationJournal,za as readRetainFlipState,nt as readStateFile,Ea as reconcileProviderAccounts,Ta as reconcileTrailMigration,_t as recordDomainDeployState,ya as recordDriftSuspects,Dn as recordPhysicalName,On as recordSetKey,ce as regionDisabledMessage,pt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,ec as renderConsentVerdictLines,$s as renderDestructionTicketLines,xi as renderIdentityPinReportLines,fi as renderPinReportLines,bs as renderPlanLines,ks as renderPlanSummary,Ts as resolveBuildArgs,Ss as resolveBuildSecretSessionProvider,Es as resolveBuildSecrets,ls as resolveSecretRefValue,Jo as restart,Zi as restoreAndReconcileQuarantinedBucket,Wi as restoreBucketPolicy,Xs as runApprovalGate,Kn as runCaaPreflight,yn as runCascadeTakeoverGate,$n as runDelegatedDomainDestroy,Js as runDestructionGate,Ia as runDriftPreFlight,Di as runDriftRepairGate,ci as runForgetSurgery,hi as runIdentityPinMigration,gi as runIdentitySurfaceGate,Rn as runOpenNextBuild,An as runOrganisationSetup,Ci as runPinRemediation,Ti as runRecreatePreFlight,li as runRecreateSurgery,va as runRoute53RecordPreflight,Vs as signApprovalToken,mo as sleep,Co as sleepAbortable,Ie as snapshotIdentityCentre,Si as snapshotPolicyForType,ps as sourcedRefsFromBuildArgs,xt as startStackMonitoring,Os as staticSiteBuilder,rt as stubCallerIdentity,xo as success,Ba as sweepExpiredRemediationJournals,Ei as synthTemplateDeclaresResource,Qi as synthesiseEnforceSslDocument,as as systemDnsNameProbe,Zn as templateOwnsDelegationRecord,Jr as toPascalCase,Ji as toResourcePolicyStatements,Eo as toServiceError,Ys as toWirePlanChanges,Hi as triageBucketPolicy,m as truncateUtf16Safe,Bi as unlockBucket,Ki as unlockQueue,de as updateBackupGlobalSettings,lt as updateTemplateHash,As as validateBuildGroup,Sr as verbsForDriftVerdict,Gs as verifyApprovalToken,zi as verifyOrgTrailDelivery,$a as verifyRetainFlipDiff,Gn as waitForNsPropagation,et as wrapApplicationError,Rt as writeDomainState,Ka as writeRemediationJournal,st as writeStateFile};

package/dist/src/orchestration/application/applicationDeploy.js

@@ -1 +1 @@
-var Re=Object.defineProperty;var P=(e,n)=>Re(e,"name",{value:n,configurable:!0});import{join as fe}from"path";import{CloudFormationClient as Ie}from"@aws-sdk/client-cloudformation";import{EC2Client as Ce}from"@aws-sdk/client-ec2";import{success as A,failure as l}from"@fjall/generator";import{logger as F}from"@fjall/util/logger";import{ImageTagSchema as Oe,getErrorMessage as Q,imageTagParameterName as Ae,maskSensitiveOutput as h}from"@fjall/util";import{parseDockerDeclarationsFromManifest as Le}from"@fjall/util/manifest";import{stubCallerIdentity as Be}from"../../types/deployment/index.js";import{getApplicationDeployOrder as Me,getApplicationStackName as C,getApplicationStepName as pe,getApplicationStepId as me,APPLICATION_STACKS as R}from"../../types/operations.js";import{CdkContextBuilder as $e}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as xe,buildCapacityIdentityContext as Fe,bootstrapOrFail as je}from"../contextHelpers.js";import{resolveDeployEnvironment as Ge}from"../deployEnvironment.js";import{buildBootstrapTagsIfResolved as He}from"../bootstrapTags.js";import{hasOrganisationTierAccount as Ue}from"../../aws/organisations/accountGlobals.js";import{runDetectionPipeline as _e}from"./detectionPipeline.js";import{assertCapacityPinsSupportedByAssembly as We,assertEngineCompatibleWithAssembly as Ke}from"./engineCompat.js";import{STEP_IDS as _,STEP_NAMES as qe}from"../../types/stepDefinitions.js";import{StepRegistry as Ve}from"../../steps/stepRegistry.js";import{checkTargetReadiness as ze}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as Je}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as Ye}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as ye,runDockerBuild as Qe}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as Xe,getStackNamesToDeploy as Ze,deployParallelPhase as et,deployStackSequential as tt,runDockerPreCompute as rt,runLambdaVersionPublish as nt,createBuildCallbacks as ot,willRunDockerBuild as at}from"./applicationDeployHelpers.js";import{verifyAssemblyIntegrity as he}from"./assemblyIntegrity.js";import{captureDatabaseConnectionOutputs as it,captureServiceTaskDefinitions as st,reconcileDatabaseEndpointChange as ct}from"./databaseEndpointReconcile.js";import{deployCodeOnly as lt}from"./codeOnlyDeploy.js";import{ensureSchemaGateImage as dt}from"./schemaGateImage.js";import{checkDeployPathStackAvailability as ke}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as W}from"./leaseGate.js";import{collectFullDeployArtefacts as ut}from"./artefactCollection.js";import{CfnRegistryService as gt}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as ft}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as pt}from"./approvalGate.js";import{buildDestructionTicket as mt,runDestructionGate as yt}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as ht,signApprovalToken as kt}from"./plan/approvalToken.js";import{computeAssemblyDigest as St}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as bt}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as wt}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as Et}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as Se}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as Tt,runPinRemediation as Pt}from"../remediation/pinRemediation.js";import{degradedIdentityPinOutcomes as be,renderIdentityPinReportLines as vt}from"../remediation/migrateIdentity.js";import{runRecreatePreFlight as Nt}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as Dt}from"../remediation/recreateResource.js";const j="applicationDeploy";function Rt(e){const n=Object.entries(e);if(n.length===0)return;const o={};for(const[t,s]of n){const E=Ae(t);o[E]=s}return o}P(Rt,"buildCdkImageTagParameters");function It(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return l(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return l(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return l(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return l(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return l(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const n=Object.entries(e.serviceImageTags);if(n.length===0)return l(new Error("serviceImageTags must name at least one service"));for(const[o,t]of n){const s=Oe.safeParse(t);if(!s.success)return l(new Error(`serviceImageTags.${o} is not a valid image tag: ${s.error.message}`))}}return A(void 0)}P(It,"validateRollbackOptions");function we(e,n,o){if(e.onStackTargets===void 0||o.length===0)return;const t=n.awsProvider.getAccountId(),s=n.awsProvider.getRegion();e.onStackTargets(o.map(E=>({stackName:E,...t!==""?{accountId:t}:{},...s!==""?{region:s}:{}})))}P(we,"emitStackTargets");async function wr(e,n,o){const{callbacks:t,options:s}=e,E=Date.now(),G=s?.mode??(s?.imageTag||s?.serviceImageTags?"rollback":s?.deployOnly?"code-only":"full");if(G==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),l(r)}const X=It(s);if(!X.success){const r=h(X.error.message),a=new Error(r);return t.onError?.(a),l(a)}const K=Ge({orgConfig:e.orgConfig,accountId:n.awsProvider.getAccountId()});if(!K.success){const r=new Error(h(K.error.message));return t.onError?.(r),l(r)}const B=$e.buildDeploymentContext({deployType:"application",target:o.appName,path:o.path,region:n.awsProvider.getRegion(),environment:K.data,callerIdentity:Be(n.awsProvider.getAccountId()),...xe({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc}),...e.managedDomainBindings!==void 0?{managedDomainBindings:e.managedDomainBindings}:{},...Fe(e)},{verbose:s?.verbose,infraOnly:s?.infraOnly},e.orgConfig),v=n.frameworkRegistry.resolve({appPath:o.path});let Z;const M=G==="rollback";if(v&&!M){Z=v.builder.plan({appPath:o.path},v.detection);const r=ot(t),a=await v.builder.build(o.path,Z,r,{skipBuild:s?.skipBuild,infraOnly:s?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!a.success){const i=new Error(h(a.error.message));return t.onError?.(i),l(i)}}if(G==="code-only"||M){t.onLog?.(M?s?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(s.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${s?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=fe(o.path,"cdk.out"),a=Ke({cdkOutPath:r,onWarning:P(f=>t.onLog?.(f,"warn"),"onWarning")});if(!a.success){const f=new Error(h(a.error.message));return t.onError?.(f),l(f)}const i=We({cdkOutPath:r,capacityIdentityWire:B.capacityIdentity,appName:o.appName});if(!i.success){const f=new Error(h(i.error.message));return t.onError?.(f),l(f)}const m=Le(r),d=m.declaresBuild,y=v?.detection.hasDockerfile===!0,g=d||y;F.debug(j,"Deploy-only branch entered",{mode:G,imageTag:s?.imageTag,serviceImageTags:s?.serviceImageTags,appName:o.appName,appPath:o.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:v?.builder.name,hasDockerfileFromManifest:d,hasDockerfileFromDisk:y,hasDockerfile:g,manifestDockerServiceCount:m.ecsServices.length,manifestDockerPaths:m.ecsServices.map(f=>f.docker.path),manifestLambdaDockerEntryCount:m.lambdaEntries.length}),!d&&!y&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const c=await ke([C(o.appName,R.COMPUTE)],n.cfnService,e.abortSignal);if(!c.success)return t.onError?.(c.error),l(c.error);we(t,n,[C(o.appName,R.COMPUTE)]);let u={},k;if(!M&&e.dockerProvider!==void 0&&g){F.debug(j,"Running Docker build before code-only deploy",{source:d?"manifest":"disk"});const f=await Qe(e,n,o,t);if(!f.success)return l(f.error);u=f.data.contentHashTagsByService,k=f.data}else F.debug(j,"Skipping Docker build",{reason:M?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const w=await W(e.assertLeaseForStack,C(o.appName,R.COMPUTE),e.abortSignal);return w!==void 0?(t.onError?.(w),l(w)):lt(e,n,o,u,k)}t.onLog?.("Analysing infrastructure\u2026","info");const H=await _e(o,n,B,t,e.abortSignal);if(!H.success){const r=new Error(h(H.error.message),{cause:H.error});return t.onError?.(r),l(r)}const p=H.data;try{await t.onDetectionComplete?.({...p,builderName:v?.builder.name??"unknown"})}catch(r){const a=new Error(h(Q(r)),{cause:r});return t.onError?.(a),l(a)}const Ee={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:s?.infraOnly??!1,hasDockerfile:p.hasDockerfile,pattern:p.pattern,resources:p.resources,...v&&{builderName:v.builder.name}},ee=Ve.getSteps(Ee),te=ee.findIndex(r=>r.id===_.TARGET_READINESS),re=await Ye(t,{stepId:_.TARGET_READINESS,stepName:qe.TARGET_READINESS,...te>=0&&{stepIndex:te,totalSteps:ee.length}},async()=>{if(s?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=n.awsProvider.getAccountId(),a=e.orgConfig?.providerAccounts.find(y=>y.id===r)?.name,i=n.awsProvider.getCredentials(),m=Je(e.orgConfig),d=await ze({cloudFormation:n.awsProvider.getClient(Ie),ec2:new Ce({region:m,...i!==void 0&&{credentials:i}})},{id:r,...a!==void 0&&{name:a}},n.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return d.success?d.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(h(d.data.advisory))}:{kind:"error",error:new Error(h(d.error.message),{cause:d.error})}},e.abortSignal);if(!re.success)return re;const N=Me({pattern:p.pattern,resources:p.resources}),L=N.length,ne=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE)&&s?.infraOnly!==!0;if(!p.hasDifferences&&!s?.force&&!ne){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(s?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE);for(let i=0;i<N.length;i++){const m=N[i];r&&m===R.COMPUTE&&(t.onStepStart?.(_.DOCKER_OPERATIONS,ye),t.onStepComplete?.(_.DOCKER_OPERATIONS,ye,"skipped"));const d=me(m,"deploy"),y=pe(m,"deploy");t.onStepStart?.(d,y,i,L),t.onStepComplete?.(d,y,"skipped",i,L)}const a=await n.stackService.resolveWebsiteUrl(o.appName);return A({target:o.appName,deploymentType:"application",outputs:a?{websiteUrl:a}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-E})}const O=fe(o.path,"cdk.out"),b=Ze({deployOrder:N,stackChanges:p.stackChanges,appName:o.appName,force:s?.force===!0,computeBuildPossible:ne});we(t,n,[...b]);const q=await ke([...b],n.cfnService,e.abortSignal);if(!q.success)return t.onError?.(q.error),l(q.error);const oe={stacksToDeploy:[...b],imageBuild:at({stackNamesToDeploy:b,appName:o.appName,hasDockerProvider:e.dockerProvider!==void 0,hasDockerfile:p.hasDockerfile})},ae=St(p.currentHashes,oe),V=bt({cfnService:n.cfnService,cdkOutPath:O,changedStacks:[...b],assemblyDigest:ae,registry:new gt(n.awsProvider),changeSetProbe:new ft(n.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),z=await wt(n.awsProvider,{stackNames:[...b],cdkOutPath:O,cfnService:n.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(z.kind==="blocked"){const r=new Error(z.message);return t.onError?.(r),l(r)}const ie=z.verifiedAbsentByNecessity??[],U=e.approvalGate!==void 0||s?.approvalToken!==void 0&&s.approvalToken!==""||s?.planOnly===!0;if(U){const r=await pt({approvalGate:e.approvalGate,options:s??{},target:o.appName,cdkOutPath:O,detection:{stackChanges:p.stackChanges,currentHashes:p.currentHashes},scope:oe,cfnService:n.cfnService,loadPlan:V,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const a=r.data;if(a.kind==="rejected")return t.onLog?.(`Deploy rejected: ${h(a.reason)}`,"warn"),A({target:o.appName,deploymentType:"application",rejected:!0,artefacts:[],...a.planDetail!==void 0?{planDetail:a.planDetail}:{},durationMs:Date.now()-E});if(a.kind==="awaiting"){const i=await V(),m=i.success?mt(i.data,ie):void 0;return A({target:o.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:a.approvalToken,assemblyDigest:a.assemblyDigest,planDetail:a.planDetail,...m!==void 0?{destructionTicket:m}:{},artefacts:[],durationMs:Date.now()-E})}}const D=await yt({loadPlan:V,options:s??{},target:o.appName,callbacks:t,verifiedAbsentByNecessity:ie,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!D.success)return t.onError?.(D.error),l(D.error);if(D.data.kind==="withheld"){const r=U?kt({assemblyDigest:ae,ttlMs:ht}):void 0;return A({target:o.appName,deploymentType:"application",destructionPending:!0,destructionTicket:D.data.ticket,destructionOutcome:D.data.outcome,destructionHaltReasons:D.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-E})}if(b.has(C(o.appName,R.COMPUTE))){const r=await dt({awsProvider:n.awsProvider,cdkOutPath:O,onLog:P((a,i)=>t.onLog?.(a,i),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return t.onError?.(r.error),l(r.error)}if(D.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:a}=D.data,i=r.resources.filter(d=>a.get(d.physicalName)==="pin");if(i.length>0){const d=i.filter(u=>u.finding==="rename-detected"),y=i.filter(u=>u.finding!=="rename-detected");t.onLog?.(`Pin remediation for ${o.appName}: ${i.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied to AWS`,"warn");let g;if(d.length>0){if(e.identityPinRunner!==void 0)try{g=await e.identityPinRunner(d,e.abortSignal)}catch(u){g={outcomes:be(d,"unknown",`identity-pin runner failed: ${h(Q(u))} \u2014 fix the cause, then run 'fjall migrate identity'`),verified:[],clean:!1}}else g={outcomes:be(d,"unknown","this surface cannot run the identity-pin migration \u2014 run 'fjall migrate identity' to pin and validate this slot"),verified:[],clean:!1};for(const u of vt(g))t.onLog?.(u,"warn")}let c;if(y.length>0){c=await Pt(n.awsProvider,{targets:y.map(u=>({stack:u.stack,logicalId:u.logicalId,resourceType:u.resourceType,physicalName:u.physicalName,offendingProperties:u.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const u of Tt(c))t.onLog?.(u,"warn")}return i.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),A({target:o.appName,deploymentType:"application",pinPending:!0,...c!==void 0?{pinReport:c}:{},...g!==void 0?{identityPinReport:g}:{},pinDeferredConsents:r.resources.length-i.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-E})}const m=r.resources.filter(d=>d.finding==="pinned-name-replacement"&&a.get(d.physicalName)==="recreate");if(m.length>0){const d=new Map;for(const c of m){const u=d.get(c.stack)??[];u.push(c),d.set(c.stack,u)}const y=await Nt(n.awsProvider,{stacks:[...d].map(([c,u])=>({stackName:c,targets:u.map(k=>({logicalId:k.logicalId,resourceType:k.resourceType,physicalId:k.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!y.success){const c=new Error(h(y.error.message),{cause:y.error});return t.onError?.(c),l(c)}const g=[];for(const[c,u]of d){const k=await W(e.assertLeaseForStack,c,e.abortSignal,"destroy");if(k!==void 0)return g.length>0&&t.onLog?.(`Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(k),l(k);const w=u.map(S=>S.physicalName);t.onLog?.(`Recreate remediation for ${o.appName}: orchestrating the pinned-name replacement of ${w.join(", ")} on ${c}`,"warn");const f=await Dt(n.awsProvider,{stackName:c,targets:u.map(S=>({logicalId:S.logicalId,resourceType:S.resourceType,physicalId:S.physicalName})),appName:o.appName,consentedPhysicalNames:w,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:u.map(S=>S.logicalId),onProgress:P(S=>t.onLog?.(S,"info"),"onProgress"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!f.success){const S=g.length>0?` Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",T=new Error(h(`${f.error.message}${S}`));return t.onError?.(T),l(T)}g.push(`${c} (${w.join(", ")})`)}}}const Te=e.orgConfig!==void 0&&!Ue(e.orgConfig.providerAccounts),Pe=He({account:e.orgConfig?.providerAccounts.find(r=>r.id===n.awsProvider.getAccountId()),estate:Te?"solo":"org"}),se=await je(n,B,t,Pe);if(!se.success)return se;const ce=C(o.appName,R.DATABASE),J=b.has(ce),ve=J?await it(n.cfnService,o.appName,e.abortSignal):void 0,Ne=J?await st(n.ecsResolver,n.ecsService,o.appName,e.abortSignal):void 0,$={},x=new Map;let le,de={};const I=P(async()=>{!J||!x.has(ce)||await ct({appName:o.appName,connectionOutputsBefore:ve,serviceTaskDefinitionsBefore:Ne,services:{cfnService:n.cfnService,ecsService:n.ecsService,ecsResolver:n.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let r=0;r<N.length;r++){const a=N[r],i=C(o.appName,a),m=me(a,"deploy"),d=pe(a,"deploy");if(!b.has(i)){t.onStepStart?.(m,d,r,L),t.onLog?.(`Skipping ${a} \u2014 no changes detected`,"info"),t.onStepComplete?.(m,d,"skipped",r,L);continue}const y=await W(e.assertLeaseForStack,i,e.abortSignal);if(y!==void 0)return await I(),t.onError?.(y),l(y);const g=Xe(N,r,o.appName,b);if(g.length>=2){const T=await he({hashService:n.hashService,cdkOutPath:O,stackNames:g.map(Y=>C(o.appName,Y)),detectionHashes:p.currentHashes,approvalGated:U});if(!T.success)return await I(),t.onError?.(T.error),l(T.error);const ge=await et(g,o,n,B,t,r,L,p,$,x);if(!ge.success)return await I(),l(await Se(n.awsProvider,{stackNames:g.map(Y=>C(o.appName,Y)),appName:o.appName,originalError:ge.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=g.length-1;continue}const c=await rt(a,e,n,o,t,p.hasDockerfile);if(c!==null&&!c.success)return await I(),l(c.error);c!==null&&c.success&&(le=c.data);const u=c!==null&&c.success?c.data.contentHashTagsByService:{},k=Rt(u);if(c!==null){const T=await W(e.assertLeaseForStack,i,e.abortSignal);if(T!==void 0)return await I(),t.onError?.(T),l(T)}const w=await he({hashService:n.hashService,cdkOutPath:O,stackNames:[i],detectionHashes:p.currentHashes,approvalGated:U});if(!w.success)return await I(),t.onError?.(w.error),l(w.error);const f=await tt(a,n,B,t,r,L,$,k!==void 0||e.abortSignal!==void 0?{...k!==void 0?{parameters:k}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!f.success)return await I(),l(await Se(n.awsProvider,{stackNames:[i],appName:o.appName,originalError:f.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));a===R.COMPUTE&&(de=await nt(o,n,t,u,e.abortSignal));const S=p.currentHashes.get(i);S&&x.set(i,S)}if(await I(),x.size>0){const r=await n.hashService.updateStateAfterDeploy(o.path,x);if(!r.success){const a=h(r.error.message);F.debug(j,"Failed to update state file",{error:a}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${a}`,"warn")}}const ue=await n.stackService.resolveWebsiteUrl(o.appName);ue&&($.websiteUrl=ue);const De=await ut(n,o.appName,le,t,O,de,e.abortSignal);return await Et(n.awsProvider,{stackNames:[...b],appName:o.appName,onLog:P((r,a)=>t.onLog?.(r,a),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{F.debug(j,"Forget completion sweep failed",{error:h(Q(r))})}),A({target:o.appName,deploymentType:"application",outputs:Object.keys($).length>0?$:void 0,artefacts:De,durationMs:Date.now()-E})}P(wr,"deployApplication");export{wr as deployApplication,we as emitStackTargets};
+var Re=Object.defineProperty;var P=(e,n)=>Re(e,"name",{value:n,configurable:!0});import{join as fe}from"path";import{CloudFormationClient as Ce}from"@aws-sdk/client-cloudformation";import{EC2Client as Ie}from"@aws-sdk/client-ec2";import{success as A,failure as d}from"@fjall/generator";import{logger as F}from"@fjall/util/logger";import{ImageTagSchema as Oe,getErrorMessage as Q,imageTagParameterName as Ae,maskSensitiveOutput as h}from"@fjall/util";import{parseDockerDeclarationsFromManifest as Le}from"@fjall/util/manifest";import{stubCallerIdentity as Be}from"../../types/deployment/index.js";import{getApplicationDeployOrder as Me,getApplicationStackName as I,getApplicationStepName as pe,getApplicationStepId as me,APPLICATION_STACKS as R}from"../../types/operations.js";import{CdkContextBuilder as $e}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as xe,buildCapacityIdentityContext as Fe,bootstrapOrFail as je}from"../contextHelpers.js";import{resolveDeployEnvironment as Ge}from"../deployEnvironment.js";import{buildBootstrapTagsIfResolved as He}from"../bootstrapTags.js";import{hasOrganisationTierAccount as Ue}from"../../aws/organisations/accountGlobals.js";import{runDetectionPipeline as _e}from"./detectionPipeline.js";import{assertCapacityPinsSupportedByAssembly as We,assertEngineCompatibleWithAssembly as Ke}from"./engineCompat.js";import{STEP_IDS as _,STEP_NAMES as qe}from"../../types/stepDefinitions.js";import{StepRegistry as Ve}from"../../steps/stepRegistry.js";import{checkTargetReadiness as ze}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as Je}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as Ye}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as ye,runDockerBuild as Qe}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as Xe,getStackNamesToDeploy as Ze,deployParallelPhase as et,deployStackSequential as tt,runDockerPreCompute as rt,runLambdaVersionPublish as nt,createBuildCallbacks as at,willRunDockerBuild as ot}from"./applicationDeployHelpers.js";import{verifyAssemblyIntegrity as he}from"./assemblyIntegrity.js";import{captureDatabaseConnectionOutputs as it,captureServiceTaskDefinitions as st,reconcileDatabaseEndpointChange as ct}from"./databaseEndpointReconcile.js";import{deployCodeOnly as dt}from"./codeOnlyDeploy.js";import{ensureSchemaGateImage as lt}from"./schemaGateImage.js";import{checkDeployPathStackAvailability as ke}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as W}from"./leaseGate.js";import{collectFullDeployArtefacts as ut}from"./artefactCollection.js";import{CfnRegistryService as gt}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as ft}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as pt}from"./approvalGate.js";import{buildDestructionTicket as mt,runDestructionGate as yt}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as ht,signApprovalToken as kt}from"./plan/approvalToken.js";import{computeAssemblyDigest as St}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as bt}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as wt}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as Et}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as Se}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as Tt,runPinRemediation as Pt}from"../remediation/pinRemediation.js";import{degradedIdentityPinOutcomes as be,renderIdentityPinReportLines as vt}from"../remediation/migrateIdentity.js";import{runRecreatePreFlight as Nt}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as Dt}from"../remediation/recreateResource.js";const j="applicationDeploy";function Rt(e){const n=Object.entries(e);if(n.length===0)return;const a={};for(const[t,s]of n){const E=Ae(t);a[E]=s}return a}P(Rt,"buildCdkImageTagParameters");function Ct(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return d(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return d(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return d(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return d(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return d(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const n=Object.entries(e.serviceImageTags);if(n.length===0)return d(new Error("serviceImageTags must name at least one service"));for(const[a,t]of n){const s=Oe.safeParse(t);if(!s.success)return d(new Error(`serviceImageTags.${a} is not a valid image tag: ${s.error.message}`))}}return A(void 0)}P(Ct,"validateRollbackOptions");function we(e,n,a){if(e.onStackTargets===void 0||a.length===0)return;const t=n.awsProvider.getAccountId(),s=n.awsProvider.getRegion();e.onStackTargets(a.map(E=>({stackName:E,...t!==""?{accountId:t}:{},...s!==""?{region:s}:{}})))}P(we,"emitStackTargets");async function wr(e,n,a){const{callbacks:t,options:s}=e,E=Date.now(),G=s?.mode??(s?.imageTag||s?.serviceImageTags?"rollback":s?.deployOnly?"code-only":"full");if(G==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),d(r)}const X=Ct(s);if(!X.success){const r=h(X.error.message),o=new Error(r);return t.onError?.(o),d(o)}const K=Ge({orgConfig:e.orgConfig,accountId:n.awsProvider.getAccountId()});if(!K.success){const r=new Error(h(K.error.message));return t.onError?.(r),d(r)}const B=$e.buildDeploymentContext({deployType:"application",target:a.appName,path:a.path,region:n.awsProvider.getRegion(),environment:K.data,callerIdentity:Be(n.awsProvider.getAccountId()),...xe({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc}),...e.managedDomainBindings!==void 0?{managedDomainBindings:e.managedDomainBindings}:{},...e.managedDomainCoverage!==void 0?{managedDomainCoverage:e.managedDomainCoverage}:{},...Fe(e)},{verbose:s?.verbose,infraOnly:s?.infraOnly},e.orgConfig),v=n.frameworkRegistry.resolve({appPath:a.path});let Z;const M=G==="rollback";if(v&&!M){Z=v.builder.plan({appPath:a.path},v.detection);const r=at(t),o=await v.builder.build(a.path,Z,r,{skipBuild:s?.skipBuild,infraOnly:s?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!o.success){const i=new Error(h(o.error.message));return t.onError?.(i),d(i)}}if(G==="code-only"||M){t.onLog?.(M?s?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(s.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${s?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=fe(a.path,"cdk.out"),o=Ke({cdkOutPath:r,onWarning:P(f=>t.onLog?.(f,"warn"),"onWarning")});if(!o.success){const f=new Error(h(o.error.message));return t.onError?.(f),d(f)}const i=We({cdkOutPath:r,capacityIdentityWire:B.capacityIdentity,appName:a.appName});if(!i.success){const f=new Error(h(i.error.message));return t.onError?.(f),d(f)}const m=Le(r),l=m.declaresBuild,y=v?.detection.hasDockerfile===!0,g=l||y;F.debug(j,"Deploy-only branch entered",{mode:G,imageTag:s?.imageTag,serviceImageTags:s?.serviceImageTags,appName:a.appName,appPath:a.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:v?.builder.name,hasDockerfileFromManifest:l,hasDockerfileFromDisk:y,hasDockerfile:g,manifestDockerServiceCount:m.ecsServices.length,manifestDockerPaths:m.ecsServices.map(f=>f.docker.path),manifestLambdaDockerEntryCount:m.lambdaEntries.length}),!l&&!y&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const c=await ke([I(a.appName,R.COMPUTE)],n.cfnService,e.abortSignal);if(!c.success)return t.onError?.(c.error),d(c.error);we(t,n,[I(a.appName,R.COMPUTE)]);let u={},k;if(!M&&e.dockerProvider!==void 0&&g){F.debug(j,"Running Docker build before code-only deploy",{source:l?"manifest":"disk"});const f=await Qe(e,n,a,t);if(!f.success)return d(f.error);u=f.data.contentHashTagsByService,k=f.data}else F.debug(j,"Skipping Docker build",{reason:M?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const w=await W(e.assertLeaseForStack,I(a.appName,R.COMPUTE),e.abortSignal);return w!==void 0?(t.onError?.(w),d(w)):dt(e,n,a,u,k)}t.onLog?.("Analysing infrastructure\u2026","info");const H=await _e(a,n,B,t,e.abortSignal);if(!H.success){const r=new Error(h(H.error.message),{cause:H.error});return t.onError?.(r),d(r)}const p=H.data;try{await t.onDetectionComplete?.({...p,builderName:v?.builder.name??"unknown"})}catch(r){const o=new Error(h(Q(r)),{cause:r});return t.onError?.(o),d(o)}const Ee={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:s?.infraOnly??!1,hasDockerfile:p.hasDockerfile,pattern:p.pattern,resources:p.resources,...v&&{builderName:v.builder.name}},ee=Ve.getSteps(Ee),te=ee.findIndex(r=>r.id===_.TARGET_READINESS),re=await Ye(t,{stepId:_.TARGET_READINESS,stepName:qe.TARGET_READINESS,...te>=0&&{stepIndex:te,totalSteps:ee.length}},async()=>{if(s?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=n.awsProvider.getAccountId(),o=e.orgConfig?.providerAccounts.find(y=>y.id===r)?.name,i=n.awsProvider.getCredentials(),m=Je(e.orgConfig),l=await ze({cloudFormation:n.awsProvider.getClient(Ce),ec2:new Ie({region:m,...i!==void 0&&{credentials:i}})},{id:r,...o!==void 0&&{name:o}},n.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return l.success?l.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(h(l.data.advisory))}:{kind:"error",error:new Error(h(l.error.message),{cause:l.error})}},e.abortSignal);if(!re.success)return re;const N=Me({pattern:p.pattern,resources:p.resources}),L=N.length,ne=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE)&&s?.infraOnly!==!0;if(!p.hasDifferences&&!s?.force&&!ne){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(s?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE);for(let i=0;i<N.length;i++){const m=N[i];r&&m===R.COMPUTE&&(t.onStepStart?.(_.DOCKER_OPERATIONS,ye),t.onStepComplete?.(_.DOCKER_OPERATIONS,ye,"skipped"));const l=me(m,"deploy"),y=pe(m,"deploy");t.onStepStart?.(l,y,i,L),t.onStepComplete?.(l,y,"skipped",i,L)}const o=await n.stackService.resolveWebsiteUrl(a.appName);return A({target:a.appName,deploymentType:"application",outputs:o?{websiteUrl:o}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-E})}const O=fe(a.path,"cdk.out"),b=Ze({deployOrder:N,stackChanges:p.stackChanges,appName:a.appName,force:s?.force===!0,computeBuildPossible:ne});we(t,n,[...b]);const q=await ke([...b],n.cfnService,e.abortSignal);if(!q.success)return t.onError?.(q.error),d(q.error);const ae={stacksToDeploy:[...b],imageBuild:ot({stackNamesToDeploy:b,appName:a.appName,hasDockerProvider:e.dockerProvider!==void 0,hasDockerfile:p.hasDockerfile})},oe=St(p.currentHashes,ae),V=bt({cfnService:n.cfnService,cdkOutPath:O,changedStacks:[...b],assemblyDigest:oe,registry:new gt(n.awsProvider),changeSetProbe:new ft(n.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),z=await wt(n.awsProvider,{stackNames:[...b],cdkOutPath:O,cfnService:n.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(z.kind==="blocked"){const r=new Error(z.message);return t.onError?.(r),d(r)}const ie=z.verifiedAbsentByNecessity??[],U=e.approvalGate!==void 0||s?.approvalToken!==void 0&&s.approvalToken!==""||s?.planOnly===!0;if(U){const r=await pt({approvalGate:e.approvalGate,options:s??{},target:a.appName,cdkOutPath:O,detection:{stackChanges:p.stackChanges,currentHashes:p.currentHashes},scope:ae,cfnService:n.cfnService,loadPlan:V,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const o=r.data;if(o.kind==="rejected")return t.onLog?.(`Deploy rejected: ${h(o.reason)}`,"warn"),A({target:a.appName,deploymentType:"application",rejected:!0,artefacts:[],...o.planDetail!==void 0?{planDetail:o.planDetail}:{},durationMs:Date.now()-E});if(o.kind==="awaiting"){const i=await V(),m=i.success?mt(i.data,ie):void 0;return A({target:a.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:o.approvalToken,assemblyDigest:o.assemblyDigest,planDetail:o.planDetail,...m!==void 0?{destructionTicket:m}:{},artefacts:[],durationMs:Date.now()-E})}}const D=await yt({loadPlan:V,options:s??{},target:a.appName,callbacks:t,verifiedAbsentByNecessity:ie,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!D.success)return t.onError?.(D.error),d(D.error);if(D.data.kind==="withheld"){const r=U?kt({assemblyDigest:oe,ttlMs:ht}):void 0;return A({target:a.appName,deploymentType:"application",destructionPending:!0,destructionTicket:D.data.ticket,destructionOutcome:D.data.outcome,destructionHaltReasons:D.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-E})}if(b.has(I(a.appName,R.COMPUTE))){const r=await lt({awsProvider:n.awsProvider,cdkOutPath:O,onLog:P((o,i)=>t.onLog?.(o,i),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return t.onError?.(r.error),d(r.error)}if(D.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:o}=D.data,i=r.resources.filter(l=>o.get(l.physicalName)==="pin");if(i.length>0){const l=i.filter(u=>u.finding==="rename-detected"),y=i.filter(u=>u.finding!=="rename-detected");t.onLog?.(`Pin remediation for ${a.appName}: ${i.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied to AWS`,"warn");let g;if(l.length>0){if(e.identityPinRunner!==void 0)try{g=await e.identityPinRunner(l,e.abortSignal)}catch(u){g={outcomes:be(l,"unknown",`identity-pin runner failed: ${h(Q(u))} \u2014 fix the cause, then run 'fjall migrate identity'`),verified:[],clean:!1}}else g={outcomes:be(l,"unknown","this surface cannot run the identity-pin migration \u2014 run 'fjall migrate identity' to pin and validate this slot"),verified:[],clean:!1};for(const u of vt(g))t.onLog?.(u,"warn")}let c;if(y.length>0){c=await Pt(n.awsProvider,{targets:y.map(u=>({stack:u.stack,logicalId:u.logicalId,resourceType:u.resourceType,physicalName:u.physicalName,offendingProperties:u.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const u of Tt(c))t.onLog?.(u,"warn")}return i.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),A({target:a.appName,deploymentType:"application",pinPending:!0,...c!==void 0?{pinReport:c}:{},...g!==void 0?{identityPinReport:g}:{},pinDeferredConsents:r.resources.length-i.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-E})}const m=r.resources.filter(l=>l.finding==="pinned-name-replacement"&&o.get(l.physicalName)==="recreate");if(m.length>0){const l=new Map;for(const c of m){const u=l.get(c.stack)??[];u.push(c),l.set(c.stack,u)}const y=await Nt(n.awsProvider,{stacks:[...l].map(([c,u])=>({stackName:c,targets:u.map(k=>({logicalId:k.logicalId,resourceType:k.resourceType,physicalId:k.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!y.success){const c=new Error(h(y.error.message),{cause:y.error});return t.onError?.(c),d(c)}const g=[];for(const[c,u]of l){const k=await W(e.assertLeaseForStack,c,e.abortSignal,"destroy");if(k!==void 0)return g.length>0&&t.onLog?.(`Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(k),d(k);const w=u.map(S=>S.physicalName);t.onLog?.(`Recreate remediation for ${a.appName}: orchestrating the pinned-name replacement of ${w.join(", ")} on ${c}`,"warn");const f=await Dt(n.awsProvider,{stackName:c,targets:u.map(S=>({logicalId:S.logicalId,resourceType:S.resourceType,physicalId:S.physicalName})),appName:a.appName,consentedPhysicalNames:w,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:u.map(S=>S.logicalId),onProgress:P(S=>t.onLog?.(S,"info"),"onProgress"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!f.success){const S=g.length>0?` Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",T=new Error(h(`${f.error.message}${S}`));return t.onError?.(T),d(T)}g.push(`${c} (${w.join(", ")})`)}}}const Te=e.orgConfig!==void 0&&!Ue(e.orgConfig.providerAccounts),Pe=He({account:e.orgConfig?.providerAccounts.find(r=>r.id===n.awsProvider.getAccountId()),estate:Te?"solo":"org"}),se=await je(n,B,t,Pe);if(!se.success)return se;const ce=I(a.appName,R.DATABASE),J=b.has(ce),ve=J?await it(n.cfnService,a.appName,e.abortSignal):void 0,Ne=J?await st(n.ecsResolver,n.ecsService,a.appName,e.abortSignal):void 0,$={},x=new Map;let de,le={};const C=P(async()=>{!J||!x.has(ce)||await ct({appName:a.appName,connectionOutputsBefore:ve,serviceTaskDefinitionsBefore:Ne,services:{cfnService:n.cfnService,ecsService:n.ecsService,ecsResolver:n.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let r=0;r<N.length;r++){const o=N[r],i=I(a.appName,o),m=me(o,"deploy"),l=pe(o,"deploy");if(!b.has(i)){t.onStepStart?.(m,l,r,L),t.onLog?.(`Skipping ${o} \u2014 no changes detected`,"info"),t.onStepComplete?.(m,l,"skipped",r,L);continue}const y=await W(e.assertLeaseForStack,i,e.abortSignal);if(y!==void 0)return await C(),t.onError?.(y),d(y);const g=Xe(N,r,a.appName,b);if(g.length>=2){const T=await he({hashService:n.hashService,cdkOutPath:O,stackNames:g.map(Y=>I(a.appName,Y)),detectionHashes:p.currentHashes,approvalGated:U});if(!T.success)return await C(),t.onError?.(T.error),d(T.error);const ge=await et(g,a,n,B,t,r,L,p,$,x);if(!ge.success)return await C(),d(await Se(n.awsProvider,{stackNames:g.map(Y=>I(a.appName,Y)),appName:a.appName,originalError:ge.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=g.length-1;continue}const c=await rt(o,e,n,a,t,p.hasDockerfile);if(c!==null&&!c.success)return await C(),d(c.error);c!==null&&c.success&&(de=c.data);const u=c!==null&&c.success?c.data.contentHashTagsByService:{},k=Rt(u);if(c!==null){const T=await W(e.assertLeaseForStack,i,e.abortSignal);if(T!==void 0)return await C(),t.onError?.(T),d(T)}const w=await he({hashService:n.hashService,cdkOutPath:O,stackNames:[i],detectionHashes:p.currentHashes,approvalGated:U});if(!w.success)return await C(),t.onError?.(w.error),d(w.error);const f=await tt(o,n,B,t,r,L,$,k!==void 0||e.abortSignal!==void 0?{...k!==void 0?{parameters:k}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!f.success)return await C(),d(await Se(n.awsProvider,{stackNames:[i],appName:a.appName,originalError:f.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));o===R.COMPUTE&&(le=await nt(a,n,t,u,e.abortSignal));const S=p.currentHashes.get(i);S&&x.set(i,S)}if(await C(),x.size>0){const r=await n.hashService.updateStateAfterDeploy(a.path,x);if(!r.success){const o=h(r.error.message);F.debug(j,"Failed to update state file",{error:o}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${o}`,"warn")}}const ue=await n.stackService.resolveWebsiteUrl(a.appName);ue&&($.websiteUrl=ue);const De=await ut(n,a.appName,de,t,O,le,e.abortSignal);return await Et(n.awsProvider,{stackNames:[...b],appName:a.appName,onLog:P((r,o)=>t.onLog?.(r,o),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{F.debug(j,"Forget completion sweep failed",{error:h(Q(r))})}),A({target:a.appName,deploymentType:"application",outputs:Object.keys($).length>0?$:void 0,artefacts:De,durationMs:Date.now()-E})}P(wr,"deployApplication");export{wr as deployApplication,we as emitStackTargets};

package/dist/src/orchestration/domain/WorkerDomainDeployProvider.d.ts

@@ -1,7 +1,9 @@
+import { CloudFormationClient } from "@aws-sdk/client-cloudformation";
 import { type Result } from "@fjall/generator";
 import type { DeployCallbacks } from "../../types/callbacks.js";
 import type { AwsCredentials } from "../../types/credentials.js";
 import type { DomainConfig, DomainDeployProvider, DomainTakeoverSynth } from "../domainInterface.js";
+import type { DelegatedDomainDeployer } from "./delegatedDomainDeploy.js";
 /**
  * The deployment worker's `DomainDeployProvider` (P6): the cascade's domains
  * phase finally runs on webapp org deploys. Built on deploy-core's own
@@ -12,11 +14,20 @@ import type { DomainConfig, DomainDeployProvider, DomainTakeoverSynth } from "..
  * containered boundary like `infra/fjall` is unresolvable from
  * workingDirectory alone; the job payload carries it instead).
  *
- * `delegatedDeployer` is deliberately not implemented in this release: the
- * engine's documented single-shot `deployDomain` fallback handles delegated
- * entries (waves still order parents first). The D8 two-phase parity
- * (propagation gate + CAA preflight on FIRST deploys of delegated children)
- * is a recorded follow-on in the domains-completion As-built.
+ * `delegatedDeployer` gives delegated children the D8 two-phase ceremony
+ * (zone deploy, NS-propagation gate, CAA preflight, full deploy) at parity
+ * with the CLI. Parent-DelegationRole resolution is worker-shaped: a literal
+ * `parentDelegationRoleArn` in the child's infrastructure.ts wins (no
+ * network, nothing injected — the construct reads its own props), then a
+ * same-account parent resolves through its stack's delegation-role export
+ * with the job credentials. A parent registered in a DIFFERENT account
+ * resolves through `resolveForeignParentCfn` when the T2 factory wiring
+ * supplied one (per-home credentials exist, so the export is read in the
+ * parent's own account), and otherwise fails closed with the
+ * `delegation_role_unusable` cure — this provider holds one OIDC-minted
+ * credential set and must not invent a cross-account hop itself.
+ * A parent absent from the registry is the externally-owned Case 3: the
+ * deploy proceeds uninjected with a loud warning, exactly like the CLI.
  */
 export interface WorkerDomainDeployProviderParams {
     /** Absolute path of the checked-out repository the job deploys from. */
@@ -35,6 +46,17 @@ export interface WorkerDomainDeployProviderParams {
      * the CLI's `assembleSynthContext` threads its own fetch.
      */
     orgConfigSerialised?: string;
+    /**
+     * T2 account routing: resolve a CloudFormation reader for a SIBLING
+     * group's account, so a delegated child whose parent zone lives in
+     * another home can read the parent's delegation-role export THERE instead
+     * of failing closed. Supplied by the factory wiring that minted per-home
+     * credentials (it holds every group's client); this provider never mints
+     * a credential hop itself. Absent, or returning `undefined` for the
+     * parent's account: the cross-account rung fails closed exactly as
+     * before.
+     */
+    resolveForeignParentCfn?: (accountId: string) => Pick<CloudFormationClient, "send"> | undefined;
     abortSignal?: AbortSignal;
 }
 export declare class WorkerDomainDeployProvider implements DomainDeployProvider {
@@ -43,6 +65,7 @@ export declare class WorkerDomainDeployProvider implements DomainDeployProvider
     private readonly boundaryDir;
     private readonly credentials;
     private readonly orgConfigSerialised;
+    private readonly resolveForeignParentCfn;
     private readonly abortSignal;
     private readonly aws;
     /** Memoised org lookup — one Organizations call per job, not per domain. */
@@ -68,6 +91,42 @@ export declare class WorkerDomainDeployProvider implements DomainDeployProvider
     private componentPreconditionError;
     synthForTakeover(domainName: string, callbacks: DeployCallbacks): Promise<Result<DomainTakeoverSynth>>;
     deployDomain(domainName: string, callbacks: DeployCallbacks): Promise<Result<void>>;
+    /**
+     * The one CDK deploy path both `deployDomain` and the delegated
+     * `deployPhase` ride: assembled worker context plus the caller's extra
+     * context keys (the delegated phase + resolved DelegationRole), output
+     * lines optionally prefixed so parallel wave members stay attributable.
+     */
+    private runCdkDeploy;
+    /**
+     * Parse the child component's infrastructure.ts. `undefined` on any miss
+     * (unreadable, unparsable, no Domain call) — the single-shot fallback then
+     * surfaces the real synth error instead of this layer guessing (CLI
+     * parity: `buildDelegatedDomainDeployer` behaves identically).
+     */
+    private parseDomainComponent;
+    /**
+     * The worker's cure sentence for an unusable parent DelegationRole. The
+     * CLI's trio offers `fjall connect` because the CLI can mint parent-account
+     * credentials interactively; the worker cannot, so its cures are the ones
+     * a webapp-triggered deploy can actually action.
+     */
+    private delegationCures;
+    /**
+     * Resolve the parent DelegationRole for one delegated phase, worker
+     * rungs: file literal (inject nothing) → registry-managed same-account
+     * stack export (inject) → cross-account fail-closed → unregistered parent
+     * Case-3 advisory (proceed uninjected).
+     */
+    private resolveDelegationForPhase;
+    /**
+     * D8 delegated-parity seam: the two-phase deployer for one delegated
+     * child. `undefined` when the component is not `external-delegated` (the
+     * single-phase path is then CORRECT, not a downgrade) and when the
+     * component cannot be read or parsed — the single-shot deploy surfaces
+     * the real synth error instead of this layer guessing.
+     */
+    delegatedDeployer(domainName: string): DelegatedDomainDeployer | undefined;
 }
 /**
  * The provider's public entry point: reads + validates the boundary's domain

package/dist/src/orchestration/domain/WorkerDomainDeployProvider.js

@@ -1 +1 @@
-var D=Object.defineProperty;var u=(c,e)=>D(c,"name",{value:e,configurable:!0});import{existsSync as m}from"node:fs";import{readFile as k}from"node:fs/promises";import{join as h,resolve as S}from"node:path";import{OrganizationsClient as C}from"@aws-sdk/client-organizations";import{success as l,failure as o}from"@fjall/generator";import{getDomainStackName as P,getErrorMessage as f,maskSensitiveOutput as s}from"@fjall/util";import{RootConfigReadSchema as x}from"@fjall/util/config";import{logger as y}from"@fjall/util/logger";import{SimpleAwsProvider as v}from"../../aws/SimpleAwsProvider.js";import{describeOrganisationAsMember as E}from"../../aws/organisations/organisation.js";import{CdkService as w}from"../../services/infrastructure/CdkService.js";const b="WorkerDomainDeployProvider";async function $(c,e){const n=[h(c,e,"fjall-config.json"),h(c,"fjall-config.json")].find(r=>m(r));if(n===void 0)return l([]);let a;try{a=await k(n,"utf8")}catch(r){return o(new Error(`domains phase refused: ${n} exists but could not be read (${s(f(r))}) \u2014 deploying with an unreadable domain registry is not an option.`))}let d;try{d=JSON.parse(a)}catch(r){return o(new Error(`domains phase refused: ${n} is not valid JSON (${s(f(r))}). Cure: fix the file by hand \u2014 do not regenerate it, which would discard capacity-identity pins.`))}const i=x.safeParse(d);return i.success?l((i.data.domains??[]).map(r=>({name:r.name,type:r.type,...r.parentDomain!==void 0?{parentDomain:r.parentDomain}:{},...r.account!==void 0?{account:r.account}:{},...r.region!==void 0?{region:r.region}:{}}))):o(new Error(`domains phase refused: ${n} has a malformed domains/activeTarget/capacityIdentity value \u2014 deploying from a registry that cannot be parsed is not an option. Cure: fix the file by hand.`))}u($,"readDomainsConfig");class p{static{u(this,"WorkerDomainDeployProvider")}domains;workingDirectory;boundaryDir;credentials;orgConfigSerialised;abortSignal;aws;orgDetailsPromise;constructor(e,t){this.domains=t,this.workingDirectory=e.workingDirectory,this.boundaryDir=e.boundaryDir,this.credentials=e.credentials,this.orgConfigSerialised=e.orgConfigSerialised,this.abortSignal=e.abortSignal,this.aws=new v(e.credentials)}static async create(e){const t=await $(e.workingDirectory,e.boundaryDir);return t.success?l(new p(e,t.data)):o(t.error)}getDomains(){return this.domains}componentPath(e){return h(this.workingDirectory,this.boundaryDir,"domains",e)}async assembleContext(){this.orgDetailsPromise??=(async()=>{try{const t=await E(this.aws.getClient(C),this.abortSignal);if(!t.success){y.warn(b,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:s(t.error.message)});return}return t.data===null?void 0:{orgId:t.data.orgId,managementAccountId:t.data.managementAccountId}}catch(t){y.warn(b,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:s(f(t))});return}})();const e=await this.orgDetailsPromise;return{accountId:this.credentials.accountId,region:this.credentials.region,...e!==void 0?e:{},...this.orgConfigSerialised!==void 0?{orgConfig:this.orgConfigSerialised}:{}}}cdkCredentials(){return{accessKeyId:this.credentials.accessKeyId,secretAccessKey:this.credentials.secretAccessKey,...this.credentials.sessionToken!==void 0?{sessionToken:this.credentials.sessionToken}:{}}}componentPreconditionError(e){const t=this.componentPath(e);if(!m(t))return new Error(`Domain '${e}' is registered in fjall-config.json but ${t} does not exist in this checkout \u2014 merge the scaffold PR that creates it, or remove the registry entry.`);if(!m(h(t,"infrastructure.ts")))return new Error(`Domain '${e}' has no infrastructure.ts at ${t} \u2014 merge the scaffold/import PR that creates it.`)}async synthForTakeover(e,t){const n=this.componentPreconditionError(e);if(n!==void 0)return o(n);const a=this.componentPath(e),d=await this.assembleContext(),i=new w({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const r=await i.synth(a,{outputCallback:u(g=>{t.onProgress?.({type:"info",message:s(g)})},"outputCallback"),context:d,credentials:this.cdkCredentials()});if(!r.success)return o(new Error(`CDK synth failed: ${s(f(r.error))}`))}finally{i.dispose()}return l({stackNames:[P(e)],cdkOutPath:S(a,"cdk.out")})}async deployDomain(e,t){const n=this.componentPreconditionError(e);if(n!==void 0)return o(n);const a=this.componentPath(e),d=await this.assembleContext(),i=new w({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const r=await i.deploy(a,void 0,{outputCallback:u(g=>{t.onProgress?.({type:"info",message:s(g)})},"outputCallback"),context:d,credentials:this.cdkCredentials()});if(!r.success)return o(new Error(`CDK deploy failed: ${s(f(r.error))}`))}finally{i.dispose()}return l(void 0)}}async function z(c){return p.create(c)}u(z,"createWorkerDomainDeployProvider");export{p as WorkerDomainDeployProvider,z as createWorkerDomainDeployProvider};
+var v=Object.defineProperty;var l=(f,e)=>v(f,"name",{value:e,configurable:!0});import{existsSync as C,readFileSync as Z}from"node:fs";import{readFile as x}from"node:fs/promises";import{join as p,resolve as E}from"node:path";import{CloudFormationClient as P}from"@aws-sdk/client-cloudformation";import{OrganizationsClient as R}from"@aws-sdk/client-organizations";import{success as c,failure as a,parseDomainInfrastructureSource as A}from"@fjall/generator";import{getDomainStackName as D,getErrorMessage as g,maskSensitiveOutput as u}from"@fjall/util";import{RootConfigReadSchema as I}from"@fjall/util/config";import{logger as b}from"@fjall/util/logger";import{SimpleAwsProvider as F}from"../../aws/SimpleAwsProvider.js";import{describeOrganisationAsMember as O}from"../../aws/organisations/organisation.js";import{CdkService as S}from"../../services/infrastructure/CdkService.js";import{emitWarningEvent as j}from"../contextHelpers.js";import{delegationRoleUnusableError as y,deriveZonePhaseState as N,extractDelegationRoleArn as T,readDelegatedTopologyFromProps as z,readDomainStackOutputsByExport as k}from"./delegationResolution.js";const $="WorkerDomainDeployProvider";async function K(f,e){const r=[p(f,e,"fjall-config.json"),p(f,"fjall-config.json")].find(t=>C(t));if(r===void 0)return c([]);let i;try{i=await x(r,"utf8")}catch(t){return a(new Error(`domains phase refused: ${r} exists but could not be read (${u(g(t))}) \u2014 deploying with an unreadable domain registry is not an option.`))}let o;try{o=JSON.parse(i)}catch(t){return a(new Error(`domains phase refused: ${r} is not valid JSON (${u(g(t))}). Cure: fix the file by hand \u2014 do not regenerate it, which would discard capacity-identity pins.`))}const s=I.safeParse(o);return s.success?c((s.data.domains??[]).map(t=>({name:t.name,type:t.type,...t.parentDomain!==void 0?{parentDomain:t.parentDomain}:{},...t.account!==void 0?{account:t.account}:{},...t.region!==void 0?{region:t.region}:{}}))):a(new Error(`domains phase refused: ${r} has a malformed domains/activeTarget/capacityIdentity value \u2014 deploying from a registry that cannot be parsed is not an option. Cure: fix the file by hand.`))}l(K,"readDomainsConfig");class w{static{l(this,"WorkerDomainDeployProvider")}domains;workingDirectory;boundaryDir;credentials;orgConfigSerialised;resolveForeignParentCfn;abortSignal;aws;orgDetailsPromise;constructor(e,n){this.domains=n,this.workingDirectory=e.workingDirectory,this.boundaryDir=e.boundaryDir,this.credentials=e.credentials,this.orgConfigSerialised=e.orgConfigSerialised,this.resolveForeignParentCfn=e.resolveForeignParentCfn,this.abortSignal=e.abortSignal,this.aws=new F(e.credentials)}static async create(e){const n=await K(e.workingDirectory,e.boundaryDir);return n.success?c(new w(e,n.data)):a(n.error)}getDomains(){return this.domains}componentPath(e){return p(this.workingDirectory,this.boundaryDir,"domains",e)}async assembleContext(){this.orgDetailsPromise??=(async()=>{try{const n=await O(this.aws.getClient(R),this.abortSignal);if(!n.success){b.warn($,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:u(n.error.message)});return}return n.data===null?void 0:{orgId:n.data.orgId,managementAccountId:n.data.managementAccountId}}catch(n){b.warn($,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:u(g(n))});return}})();const e=await this.orgDetailsPromise;return{accountId:this.credentials.accountId,region:this.credentials.region,...e!==void 0?e:{},...this.orgConfigSerialised!==void 0?{orgConfig:this.orgConfigSerialised}:{}}}cdkCredentials(){return{accessKeyId:this.credentials.accessKeyId,secretAccessKey:this.credentials.secretAccessKey,...this.credentials.sessionToken!==void 0?{sessionToken:this.credentials.sessionToken}:{}}}componentPreconditionError(e){const n=this.componentPath(e);if(!C(n))return new Error(`Domain '${e}' is registered in fjall-config.json but ${n} does not exist in this checkout \u2014 merge the scaffold PR that creates it, or remove the registry entry.`);if(!C(p(n,"infrastructure.ts")))return new Error(`Domain '${e}' has no infrastructure.ts at ${n} \u2014 merge the scaffold/import PR that creates it.`)}async synthForTakeover(e,n){const r=this.componentPreconditionError(e);if(r!==void 0)return a(r);const i=this.componentPath(e),o=await this.assembleContext(),s=new S({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const t=await s.synth(i,{outputCallback:l(d=>{n.onProgress?.({type:"info",message:u(d)})},"outputCallback"),context:o,credentials:this.cdkCredentials()});if(!t.success)return a(new Error(`CDK synth failed: ${u(g(t.error))}`))}finally{s.dispose()}return c({stackNames:[D(e)],cdkOutPath:E(i,"cdk.out")})}async deployDomain(e,n){const r=this.componentPreconditionError(e);return r!==void 0?a(r):this.runCdkDeploy(e,n,{})}async runCdkDeploy(e,n,r,i){const o=this.componentPath(e),s={...await this.assembleContext(),...r},t=new S({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const d=await t.deploy(o,void 0,{outputCallback:l(h=>{n.onProgress?.({type:"info",message:u(i!==void 0?`${i}${h}`:h)})},"outputCallback"),context:s,credentials:this.cdkCredentials()});if(!d.success)return a(new Error(`CDK deploy failed: ${u(g(d.error))}`))}finally{t.dispose()}return c(void 0)}parseDomainComponent(e){const n=p(this.componentPath(e),"infrastructure.ts");let r;try{r=Z(n,"utf-8")}catch{return}const i=A(r,n,e);return i.success?i.data:void 0}delegationCures(e,n){return`deploy the parent zone first ('fjall domain deploy ${n}' or re-run this organisation deploy after its apex phase succeeds), deploy the child from the CLI with parent-account credentials ('fjall domain deploy ${e}'), or set a literal parentDelegationRoleArn in the child's infrastructure.ts.`}async resolveDelegationForPhase(e,n,r){const i=this.parseDomainComponent(e);if(i!==void 0&&i.registrar==="external-delegated"&&i.parentDelegationRoleArn!==void 0&&i.parentDelegationRoleArn!=="")return r.onProgress?.({type:"info",message:`Using the literal parentDelegationRoleArn declared in ${e}'s infrastructure.ts for the ${n.parentZoneName} delegation`}),c({});const o=this.domains.find(m=>m.name===n.parentZoneName);if(o===void 0)return j(r,`Parent zone ${n.parentZoneName} is not a managed domain in this registry (Case 3) \u2014 no delegation record is written in-stack; delegate ${n.childZoneName} at the parent with 'fjall domain delegate ${e}' after the zone phase`),c({});let s=this.aws.getClient(P),t=this.credentials.accountId;if(o.account!==void 0&&o.account!==this.credentials.accountId){const m=this.resolveForeignParentCfn?.(o.account);if(m===void 0)return a(y(n.parentZoneName,`the parent is registered in account ${o.account} but this deploy holds credentials for account ${this.credentials.accountId} only`,this.delegationCures(e,n.parentZoneName)));s=m,t=o.account}const d=await k(s,n.parentZoneName,this.abortSignal);if(!d.success)return a(y(n.parentZoneName,u(d.error.message),this.delegationCures(e,n.parentZoneName)));if(d.data===void 0)return a(y(n.parentZoneName,`no deployed stack '${D(n.parentZoneName)}' in account ${t}`,this.delegationCures(e,n.parentZoneName)));const h=T(d.data,n.parentZoneName);return h===void 0?a(y(n.parentZoneName,`stack '${D(n.parentZoneName)}' publishes no delegation-role export`,this.delegationCures(e,n.parentZoneName))):c({parentDelegationRoleArn:h})}delegatedDeployer(e){const n=this.parseDomainComponent(e);if(n===void 0)return;const r=z(n);if(r!==void 0)return{zoneName:r.childZoneName,deployPhase:l(async(i,o)=>{const s=this.componentPreconditionError(e);if(s!==void 0)return a(s);const t=await this.resolveDelegationForPhase(e,r,o);return t.success?this.runCdkDeploy(e,o,{domainDeployPhase:i,...t.data},`[${r.childZoneName}] `):a(t.error)},"deployPhase"),zonePhaseState:l(async()=>{const i=await k(this.aws.getClient(P),e,this.abortSignal);return i.success?c(N(i.data,r.childZoneName)):a(i.error)},"zonePhaseState")}}}async function ne(f){return w.create(f)}l(ne,"createWorkerDomainDeployProvider");export{w as WorkerDomainDeployProvider,ne as createWorkerDomainDeployProvider};