@fjall/deploy-core 14.2.0 → 14.3.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "deed7718acaf53ae067e715be43fb2680a50ccf7438edac6d5b04253379dd0b0",
+  "hash": "a8f74ad747cbfe0c3f8009a31924d07b17673bdb9c1dba0291aa8ced7b5f4d7d",
   "files": {
     "src/__test-utils__/awsMockHelpers.ts": "fea371c1b1869678",
     "src/__test-utils__/index.ts": "e03cf35821157dc4",
@@ -52,7 +52,7 @@
     "src/aws/utils/regions.ts": "3a5191f4d2242a60",
     "src/aws/utils/stackStatus.ts": "55fb23ba5514bc13",
     "src/events/index.ts": "e55c022f0d9013e6",
-    "src/index.ts": "7c0f630c1434c8a2",
+    "src/index.ts": "cd47b3c091452a0a",
     "src/orchestration/activeDeploymentGuard.ts": "e8dde742c00ea728",
     "src/orchestration/application/applicationDeploy.ts": "6a4090e898f86a28",
     "src/orchestration/application/applicationDeployHelpers.ts": "bca833cc04f0b4c5",
@@ -106,20 +106,21 @@
     "src/orchestration/destroy.ts": "b6da154984e63a8d",
     "src/orchestration/dockerBuildParamsKeys.ts": "ac3d6ecd24d68792",
     "src/orchestration/dockerInterface.ts": "f2efc8a98d3b3d65",
-    "src/orchestration/domain/WorkerDomainDeployProvider.ts": "bf31cc0454abb0f3",
+    "src/orchestration/domain/WorkerDomainDeployProvider.ts": "88a06ca27ae3ebd5",
     "src/orchestration/domain/caaPreflight.ts": "4a9ab5bd9567fb41",
+    "src/orchestration/domain/cascadeDomainProviderFactory.ts": "3290e4266f5824c7",
     "src/orchestration/domain/delegatedDomainDeploy.ts": "b5e5c2db59250b8a",
     "src/orchestration/domain/delegationDestroyMirror.ts": "939f6c3cc3293d8b",
     "src/orchestration/domain/delegationResolution.ts": "f2b91a8aaf284dfa",
-    "src/orchestration/domain/domainTakeoverGate.ts": "70c77f8eb61b1e3d",
-    "src/orchestration/domain/index.ts": "4380d473c1990efe",
+    "src/orchestration/domain/domainTakeoverGate.ts": "ecd9694cebc7be6c",
+    "src/orchestration/domain/index.ts": "ec421e83dd0afbd6",
     "src/orchestration/domain/nsPropagationGate.ts": "c7a443e7048d4430",
     "src/orchestration/domain/recordConsentSpelling.ts": "9869eadf39e75d98",
     "src/orchestration/domain/route53Delegation.ts": "a7149a0542e4d185",
     "src/orchestration/domain/route53Release.ts": "558363b79172ec40",
     "src/orchestration/domain/types.ts": "132972b0e1113ac1",
     "src/orchestration/domain/zoneClassifier.ts": "f9908f0b4635709e",
-    "src/orchestration/domainInterface.ts": "2887751e0ded2282",
+    "src/orchestration/domainInterface.ts": "0383f37823e24994",
     "src/orchestration/drift/classifyDriftFailure.ts": "4426ecc6545b0472",
     "src/orchestration/drift/detectStackDrift.ts": "cc38b12162e08fac",
     "src/orchestration/drift/driftPreFlight.ts": "87c6176636655ad7",
@@ -130,17 +131,17 @@
     "src/orchestration/drift/route53RecordPreflight.ts": "f4db16a6c0e69ac9",
     "src/orchestration/failure/classifyFailure.ts": "bfb80731bc7d6b95",
     "src/orchestration/failure/deploymentFailureAttachment.ts": "358d9e4d88390cfd",
-    "src/orchestration/index.ts": "405fae4d6e7ac57d",
+    "src/orchestration/index.ts": "d5a2d44746058099",
     "src/orchestration/manifestSecretParser.ts": "c5576bd88a3652f8",
     "src/orchestration/organisation/accountsConfig.ts": "a55a3306564e7b2f",
     "src/orchestration/organisation/cascadeDestroyHelpers.ts": "7f1927a00ed24767",
-    "src/orchestration/organisation/cascadeHelpers.ts": "dd36d26f3694bdfd",
+    "src/orchestration/organisation/cascadeHelpers.ts": "8412e0fdca351608",
     "src/orchestration/organisation/cascadeSummary.ts": "335be9649cea0626",
     "src/orchestration/organisation/organisationDeploy.ts": "f3fad626230d8a16",
     "src/orchestration/organisation/organisationDestroy.ts": "06076a7e76345854",
     "src/orchestration/organisation/organisationSetup.ts": "3f3415b762a83a47",
     "src/orchestration/organisation/reconcileProviderAccounts.ts": "91920b2ed61dd811",
-    "src/orchestration/organisationDeploy/cascadeExecution.ts": "67fbdbff425f6794",
+    "src/orchestration/organisationDeploy/cascadeExecution.ts": "82381e411fa25080",
     "src/orchestration/organisationDeploy/infraSteps.ts": "53880cef5020dd04",
     "src/orchestration/organisationDeploy/orgCascadeDeploy.ts": "3968db08ab9568ac",
     "src/orchestration/organisationDeploy/orgContext.ts": "635f429a7cbb7c32",
@@ -257,7 +258,7 @@
     "src/types/frameworkBuilder.ts": "41198a0b446f60b6",
     "src/types/index.ts": "94240086d5b486af",
     "src/types/operations.ts": "57a6c9e22a3f37ca",
-    "src/types/params.ts": "891244c0081aec2e",
+    "src/types/params.ts": "f49979d6546586b0",
     "src/types/remediation.ts": "0e1138f0c8fdc6bf",
     "src/types/stepDefinitions.ts": "a5e2aa03b15011b4",
     "src/types/validation.ts": "44aa473ec0e25dc4",
@@ -268,9 +269,9 @@
     "src/util/sleepAbortable.ts": "f9cac3bf8a79a476",
     "src/version.ts": "1811a4475823b27e",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "fe8702fc3e63acd8",
+    "package.json": "3f1518ad61e36088",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "79e8b33d2a72cbd79bb5778269bc6628a2c5ab8a2a6e14952346e77ad0265184",
-  "outputFileCount": 505
+  "outputHash": "d6256046f4a1e8299e2c2274d25162d2caf93b873c05807ab141f29af96ff524",
+  "outputFileCount": 507
 }

package/dist/.minified

@@ -1 +1 @@
-252 files minified at 2026-08-18T14:33:26.650Z
+253 files minified at 2026-08-20T22:19:13.833Z

package/dist/src/index.d.ts

@@ -67,8 +67,8 @@ export { reconcileProviderAccounts, mergeReconciledProviderAccounts } from "./or
 export type { ReconcileResult } from "./orchestration/index.js";
 export { decideNextTransition, reconcileTrailMigration, decommissionMemberTrailStorage, ORG_TRAIL_BUCKET_OUTPUT_KEY, TRAIL_BUCKET_OUTPUT_KEY, TRAIL_KEY_ARN_OUTPUT_KEY } from "./orchestration/index.js";
 export type { MemberTrailFacts, TrailMigrationTransition, TrailMigrationOutcome, DecommissionClients, DecommissionInput, DecommissionOutcome } from "./orchestration/index.js";
-export { classifyDriftFailure, fetchLastOperationEvents, DriftProbe, clearDriftSuspects, defaultDriftJournalDir, readDriftSuspects, recordDriftSuspects, detectStackDrift, runDriftPreFlight, formatDriftPreFlightBlock, DRIFT_PREFLIGHT_TRIGGER_STATUSES, DRIFT_PREFLIGHT_BUDGET_MS, runRoute53RecordPreflight } from "./orchestration/index.js";
-export type { DriftProbeOptions, DriftProbeRunner, ProbeDriftSuspectsParams, DriftJournalOptions, RecordDriftSuspectsParams, DetectStackDriftDeps, DetectStackDriftParams, StackDriftReport, RunDriftPreFlightParams, DriftPreFlightBlockExtras, DriftPreFlightOutcome, Route53RecordPreflightParams, Route53RecordPreflightOutcome, Route53RecordCollision } from "./orchestration/index.js";
+export { classifyDriftFailure, fetchLastOperationEvents, DriftProbe, probePhysicalPresence, clearDriftSuspects, defaultDriftJournalDir, readDriftSuspects, recordDriftSuspects, detectStackDrift, runDriftPreFlight, formatDriftPreFlightBlock, DRIFT_PREFLIGHT_TRIGGER_STATUSES, DRIFT_PREFLIGHT_BUDGET_MS, runRoute53RecordPreflight } from "./orchestration/index.js";
+export type { DriftProbeOptions, DriftProbeRunner, PhysicalPresenceOutcome, ProbeDriftSuspectsParams, DriftJournalOptions, RecordDriftSuspectsParams, DetectStackDriftDeps, DetectStackDriftParams, StackDriftReport, RunDriftPreFlightParams, DriftPreFlightBlockExtras, DriftPreFlightOutcome, Route53RecordPreflightParams, Route53RecordPreflightOutcome, Route53RecordCollision } from "./orchestration/index.js";
 export { archiveCompletedRemediationJournal, computeRemediationOpId, defaultRemediationJournalDir, findRemediationJournalByOpId, listActiveRemediationOps, listActiveRemediationOpsForContext, readRemediationJournal, sweepExpiredRemediationJournals, writeRemediationJournal, REMEDIATION_JOURNAL_RETENTION_DAYS, captureRemediationForensics, defaultRemediationForensicsDir, applyRetainFlip, composeFlipCapabilities, computeTemplateDigest, deriveRetainFlipTemplate, findMarkedResourcesByOpId, proveFlipMetadataOnly, readRetainFlipState, verifyRetainFlipDiff, FORGET_MARKER_KEY, FORGET_FLIP_SPEC, RECREATE_MARKER_KEY, assessForgetResumability, completeForgetAfterConverge, completeForgetAfterDeploy, formatRecreateInFlightCures, partitionPreFlightByRemediation, runForgetSurgery, synthTemplateDeclaresResource, runRecreateSurgery, snapshotPolicyForType, SNAPSHOT_CAPABLE_RESOURCE_TYPES, runRecreatePreFlight, deriveRemovalTemplate, findRemovalDeletionFailures, findResourcesPresent, proveRemovalTargetsOnly, advertisableDriftVerbs, buildDriftRepairTicket, runDriftRepairGate, formatPinOutcomeDetail, pinProbeCoverage, renderPinReportLines, runPinRemediation, captureLegacySurfaces, decodeLegacyAnchor, runIdentitySurfaceGate, collectIdentityPinCandidates, degradedIdentityPinOutcomes, renderIdentityPinReportLines, runIdentityPinMigration, composePostFailureRepairOffer, formatDriftRepairOffer, DriftRepairAvailableError, checkDeployPathStackAvailability, isDeployPathBlockingStatus, StackUnavailableError, assertLeaseBeforeStack, LeaseDeniedError } from "./orchestration/index.js";
 export type { RemediationJournalContext, RemediationJournalOptions, CaptureRemediationForensicsParams, ForensicsCaptureOptions, RemediationForensicsBundle, ApplyRetainFlipOutcome, ApplyRetainFlipParams, DeriveRetainFlipParams, FlipDeletionPolicy, FlipProofResult, FlipSpec, RetainFlipDerivation, RetainFlipState, RecreateOrchestrationOptions, RecreateSurgeryParams, RecreateSurgeryReport, RecreatePreFlightStack, RunRecreatePreFlightParams, CoRemovedResource, ProveRemovalTargetsOnlyParams, RemovalDeletionFailure, RemovalDerivation, RemovalProofResult, StrippedExport, CompleteForgetAfterDeployParams, CompleteForgetOutcome, CompleteForgetParams, ForeignMarkerOperation, ForgetOrchestrationOptions, ForgetResumeAssessment, ForgetResumeSource, ForgetSurgeryParams, ForgetSurgeryReport, PreFlightRemediationDeps, PreFlightRemediationPartition, DriftRepairGateOutcome, RunDriftRepairGateParams, ComposePostFailureRepairOfferParams, PinnedProperty, PinProbeCoverage, PinRemediationReport, PinReportOnlyReason, PinResourceOutcome, PinTarget, RunPinRemediationParams, CapturedLegacySurfaces, IdentitySurfaceGateParams, IdentitySurfaceGateReport, PinnableRenamePair, IdentityPinCandidate, IdentityPinReport, IdentityPinSlotOutcome, IdentityPinVerifiedSlot, LiveTemplateLookup, RunIdentityPinMigrationParams } from "./orchestration/index.js";
 export { unlockBucket, unlockQueue } from "./orchestration/index.js";
@@ -83,9 +83,11 @@ export { parseAccountsConfiguration, flattenAccountsToEnvironments, extractAllAc
 export type { AccountsConfig } from "./orchestration/index.js";
 export { runOpenNextBuild } from "./orchestration/index.js";
 export { runOrganisationSetup, ORG_SETUP_PHASES } from "./orchestration/index.js";
-export type { OrgSetupPhase, OrgSetupCallbacks, OrgSetupConfig, OrgSetupResult, DockerProvider, DockerProgressCallback, DockerBuildParams, DockerBuildResult, ResolvedBuildSecret, ResolvedBuildSecrets, ECRInitParams, ECRInitResult, TagImagesParams, TagImagesResult, TagByDigestParams, DomainDeployProvider, DomainConfig, DomainDeployResult, DomainTakeoverSynth, DeployServices } from "./orchestration/index.js";
-export { recordPhysicalName, parseRecordPhysicalName, recordSetKey, deleteRecordSetsByKey, cascadeTakeoverDigestSeed, buildCascadeTakeoverTicket, runCascadeTakeoverGate, WorkerDomainDeployProvider, createWorkerDomainDeployProvider } from "./orchestration/index.js";
-export type { RecordConsentIdentity, DeletedRecordSet, DomainsTakeoverContext, DomainsTakeoverWithheld, DomainsTakeoverGateOutcome, WorkerDomainDeployProviderParams } from "./orchestration/index.js";
+export type { OrgSetupPhase, OrgSetupCallbacks, OrgSetupConfig, OrgSetupResult, DockerProvider, DockerProgressCallback, DockerBuildParams, DockerBuildResult, ResolvedBuildSecret, ResolvedBuildSecrets, ECRInitParams, ECRInitResult, TagImagesParams, TagImagesResult, TagByDigestParams, DomainDeployProvider, DomainConfig, DomainDeployResult, DomainTakeoverSynth, DomainHome, DomainProviderGroup, DomainProviderFactory, DeployServices } from "./orchestration/index.js";
+export { recordPhysicalName, parseRecordPhysicalName, recordSetKey, deleteRecordSetsByKey, cascadeTakeoverDigestSeed, buildCascadeTakeoverTicket, runCascadeTakeoverGate, WorkerDomainDeployProvider, createWorkerDomainDeployProvider, createCascadeDomainProviderFactory } from "./orchestration/index.js";
+export type { RecordConsentIdentity, DeletedRecordSet, DomainsTakeoverContext, DomainsTakeoverGroup, CascadeTakeoverConsentContext, DomainsTakeoverWithheld, DomainsTakeoverGateOutcome, WorkerDomainDeployProviderParams, HomeCredentialsMinter, CascadeDomainProviderFactoryParams } from "./orchestration/index.js";
+export { assumeCascadeRole } from "./orchestration/contextHelpers.js";
+export type { CascadeAssumedRole } from "./orchestration/contextHelpers.js";
 export { DOMAIN_DELEGATION_ERROR_TYPES, DomainDelegationError, DEFAULT_PUBLIC_RESOLVER_ADDRESSES, PUBLIC_DNS_QUERY_TIMEOUT_MS, createPublicResolvers, NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS, NS_PROPAGATION_DEFAULT_INTERVAL_MS, waitForNsPropagation, ACM_CAA_ISSUERS, runCaaPreflight, deployDelegatedDomain, delegationRoleUnusableError, deriveZonePhaseState, extractDelegationRoleArn, readDelegatedTopologyFromProps, readDomainStackOutputsByExport, CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE, templateOwnsDelegationRecord, deleteChildNsFromParent, nsDelegationPhysicalName, runDelegatedDomainDestroy } from "./orchestration/index.js";
 export type { DomainDeployPhase, DelegatedDomainTopology, DomainDelegationErrorType, PublicCaaRecord, PublicDnsResolver, NsPropagationGateParams, NsPropagationVerdict, CaaPreflightParams, CaaPreflightVerdict, DelegatedDomainDeployer, DelegatedZonePhaseState, DeployDelegatedDomainParams, DelegatedDomainDeployOutcome, NsDeleteOutcome, DeleteChildNsParams, DelegationDestroyNsOutcome, DelegatedDomainDestroyOutcome, DelegatedDomainDestroyParams } from "./orchestration/index.js";
 export { classifyZoneRecords, buildSatelliteRecordIndex, createSystemDnsNameProbe, systemDnsNameProbe, normaliseRecordName, isRoute53NameServer, isDelegatedToRoute53 } from "./orchestration/index.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as a,DEPLOYMENT_EVENT_TYPES as i,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as S,CASCADE_PHASES as l,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as T,truncateUtf16Safe as _}from"./types/index.js";import{DeployEventSchema as R,StepProgressSchema as m,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as N,SUPPORTED_CONTRACT_MARKERS as C,DEPLOY_EVENT_ID_MAX as g,DEPLOY_EVENT_NAME_MAX as I,DEPLOY_EVENT_MESSAGE_MAX as y,DEPLOY_EVENT_STATUS_REASON_MAX as L,DEPLOY_EVENT_ERROR_MESSAGE_MAX as x,DEPLOY_EVENT_TRAIL_DETAIL_MAX as h,DEPLOY_EVENT_OUTPUT_MAX as v,DEPLOY_EVENT_ARN_MAX as F,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ae,probeAccountStackExists as ie}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as Se,describeOrganisation as le,enablePolicyTypes as pe,enableServiceAccess as Te,SERVICE_PRINCIPALS as _e,enableRamSharing as Ae,activateTrustedAccess as Re,enableIpamDelegatedAdmin as me,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ne,findDevelopmentOuId as Ce,activateCostAllocationTags as ge,checkIdentityCentreStatus as Ie,snapshotIdentityCentre as ye,composeSdkAbortSignal as Le,extractErrorName as xe,isAborted as he,DEFAULT_MAX_PAGES as ve,IDENTITY_STORE_PAGE_SIZE as Fe,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ar}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as Sr,verbsForDriftVerdict as lr}from"./types/index.js";import{REMEDIATION_PHASES as Tr,RemediationPhaseSchema as _r,RemediationTargetSchema as Ar,RemediationFlipProofSchema as Rr,RemediationJournalRecordSchema as mr,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Nr,APPLICATION_DEPLOY_ORDER as Cr,APPLICATION_DESTROY_ORDER as gr,OPENNEXT_DEPLOY_ORDER as Ir,OPENNEXT_DESTROY_ORDER as yr,PARALLEL_DEPLOY_GROUPS as Lr,PARALLEL_DESTROY_GROUPS as xr,OPENNEXT_PARALLEL_GROUPS as hr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Fr,isOrganisationOperation as Mr,getParallelDeployGroups as Ur,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Wr,OPENNEXT_PATTERNS as Qr,STACK_NOT_FOUND_PATTERN as jr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as it,readStateFile as nt,writeStateFile as st,createEmptyState as ct,deleteStateFile as Et,updateTemplateHash as St,getStateFilePath as lt,regionSuffix as pt}from"./types/config/FjallState.js";import{readDomainState as _t,writeDomainState as At,recordDomainDeployState as Rt,deleteDomainState as mt,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Nt,CdkProcessManager as Ct,ensureDependencyIntegrity as gt,clearDependencyIntegrityCache as It,DEPENDENCY_SYNC_TIMEOUT_MS as yt,CdkEventMonitor as Lt,startStackMonitoring as xt,DEFAULT_DEPLOY_TIMEOUT_MS as ht,isCdkError as vt,formatInfrastructureError as Ft,getStructuralHint as Mt,getSourceContext as Ut,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Wt,parseBuildPhase as Qt,buildStepContextBuildConfig as jt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as ao,DeploymentError as io,NetworkError as no,FileSystemError as so,ConfigError as co,toServiceError as Eo}from"./types/errors/index.js";import{filterDangerousEnvVars as lo,maskSensitiveOutput as po,parseShellArgs as To,sleep as _o}from"@fjall/util";import{artefactOutputKey as Ro,DeployModeSchema as mo,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as No}from"./util/sleepAbortable.js";import{createSequencedCallbacks as go}from"./util/sequencedCallbacks.js";import{fileExists as yo}from"@fjall/util/fsHelpers";import{success as xo,failure as ho,isSuccess as vo,isFailure as Fo}from"@fjall/generator";import{deploy as Uo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{buildParamsContext as Vo}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Bo,emitWarningEvent as Ko}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Ho}from"./util/diagnosticScopes.js";import{restart as Jo,probeSecretsDrift as Wo,probeServiceDeploymentStatus as Qo,computeSecretsDrift as jo,deriveStaleParameters as Zo,extractConsumedSsmParameters as qo}from"./orchestration/index.js";import{partitionAccounts as $o}from"./orchestration/index.js";import{buildRegionList as ra,buildAccountRegionPairs as ta,cascadeHomeRegion as oa,cascadeOperationKey as aa}from"./orchestration/index.js";import{projectScalarSummary as na,projectAccountRows as sa}from"./orchestration/index.js";import{reconcileProviderAccounts as Ea,mergeReconciledProviderAccounts as Sa}from"./orchestration/index.js";import{decideNextTransition as pa,reconcileTrailMigration as Ta,decommissionMemberTrailStorage as _a,ORG_TRAIL_BUCKET_OUTPUT_KEY as Aa,TRAIL_BUCKET_OUTPUT_KEY as Ra,TRAIL_KEY_ARN_OUTPUT_KEY as ma}from"./orchestration/index.js";import{classifyDriftFailure as ua,fetchLastOperationEvents as Da,DriftProbe as Pa,clearDriftSuspects as Oa,defaultDriftJournalDir as fa,readDriftSuspects as Na,recordDriftSuspects as Ca,detectStackDrift as ga,runDriftPreFlight as Ia,formatDriftPreFlightBlock as ya,DRIFT_PREFLIGHT_TRIGGER_STATUSES as La,DRIFT_PREFLIGHT_BUDGET_MS as xa,runRoute53RecordPreflight as ha}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Fa,computeRemediationOpId as Ma,defaultRemediationJournalDir as Ua,findRemediationJournalByOpId as ka,listActiveRemediationOps as ba,listActiveRemediationOpsForContext as Ya,readRemediationJournal as Va,sweepExpiredRemediationJournals as Ga,writeRemediationJournal as Ba,REMEDIATION_JOURNAL_RETENTION_DAYS as Ka,captureRemediationForensics as Xa,defaultRemediationForensicsDir as Ha,applyRetainFlip as wa,composeFlipCapabilities as Ja,computeTemplateDigest as Wa,deriveRetainFlipTemplate as Qa,findMarkedResourcesByOpId as ja,proveFlipMetadataOnly as Za,readRetainFlipState as qa,verifyRetainFlipDiff as za,FORGET_MARKER_KEY as $a,FORGET_FLIP_SPEC as ei,RECREATE_MARKER_KEY as ri,assessForgetResumability as ti,completeForgetAfterConverge as oi,completeForgetAfterDeploy as ai,formatRecreateInFlightCures as ii,partitionPreFlightByRemediation as ni,runForgetSurgery as si,synthTemplateDeclaresResource as ci,runRecreateSurgery as Ei,snapshotPolicyForType as Si,SNAPSHOT_CAPABLE_RESOURCE_TYPES as li,runRecreatePreFlight as pi,deriveRemovalTemplate as Ti,findRemovalDeletionFailures as _i,findResourcesPresent as Ai,proveRemovalTargetsOnly as Ri,advertisableDriftVerbs as mi,buildDriftRepairTicket as di,runDriftRepairGate as ui,formatPinOutcomeDetail as Di,pinProbeCoverage as Pi,renderPinReportLines as Oi,runPinRemediation as fi,captureLegacySurfaces as Ni,decodeLegacyAnchor as Ci,runIdentitySurfaceGate as gi,collectIdentityPinCandidates as Ii,degradedIdentityPinOutcomes as yi,renderIdentityPinReportLines as Li,runIdentityPinMigration as xi,composePostFailureRepairOffer as hi,formatDriftRepairOffer as vi,DriftRepairAvailableError as Fi,checkDeployPathStackAvailability as Mi,isDeployPathBlockingStatus as Ui,StackUnavailableError as ki,assertLeaseBeforeStack as bi,LeaseDeniedError as Yi}from"./orchestration/index.js";import{unlockBucket as Gi,unlockQueue as Bi}from"./orchestration/index.js";import{triageBucketPolicy as Xi,isEnforceSslStatement as Hi,toResourcePolicyStatements as wi,restoreBucketPolicy as Ji,synthesiseEnforceSslDocument as Wi,ensureEnforceSsl as Qi,restoreAndReconcileQuarantinedBucket as ji}from"./orchestration/index.js";import{verifyOrgTrailDelivery as qi}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as $i,isRootTaskPolicyArn as en,ROOT_TASK_POLICY_ARNS as rn,MAX_ROOT_SESSION_SECONDS as tn}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as an,flattenAccountsToEnvironments as nn,extractAllAccountNames as sn,accountsConfigToOUTree as cn,isStringArray as En,isAccountsConfig as Sn,isOuOnlyAccountBucket as ln,OU_ONLY_ACCOUNT_BUCKETS as pn}from"./orchestration/index.js";import{runOpenNextBuild as _n}from"./orchestration/index.js";import{runOrganisationSetup as Rn,ORG_SETUP_PHASES as mn}from"./orchestration/index.js";import{recordPhysicalName as un,parseRecordPhysicalName as Dn,recordSetKey as Pn,deleteRecordSetsByKey as On,cascadeTakeoverDigestSeed as fn,buildCascadeTakeoverTicket as Nn,runCascadeTakeoverGate as Cn,WorkerDomainDeployProvider as gn,createWorkerDomainDeployProvider as In}from"./orchestration/index.js";import{DOMAIN_DELEGATION_ERROR_TYPES as Ln,DomainDelegationError as xn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as hn,PUBLIC_DNS_QUERY_TIMEOUT_MS as vn,createPublicResolvers as Fn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Mn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Un,waitForNsPropagation as kn,ACM_CAA_ISSUERS as bn,runCaaPreflight as Yn,deployDelegatedDomain as Vn,delegationRoleUnusableError as Gn,deriveZonePhaseState as Bn,extractDelegationRoleArn as Kn,readDelegatedTopologyFromProps as Xn,readDomainStackOutputsByExport as Hn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as wn,templateOwnsDelegationRecord as Jn,deleteChildNsFromParent as Wn,nsDelegationPhysicalName as Qn,runDelegatedDomainDestroy as jn}from"./orchestration/index.js";import{classifyZoneRecords as qn,buildSatelliteRecordIndex as zn,createSystemDnsNameProbe as $n,systemDnsNameProbe as es,normaliseRecordName as rs,isRoute53NameServer as ts,isDelegatedToRoute53 as os}from"./orchestration/index.js";import{resolveBuildSecrets as is,resolveSecretRefValue as ns,resolveBuildSecretSessionProvider as ss,sourcedRefsFromBuildArgs as cs,resolveBuildArgs as Es,buildBuildSecretSessionPolicy as Ss,buildDeploySessionPolicy as ls,partitionForRegion as ps,validateBuildGroup as Ts}from"./orchestration/index.js";import{FrameworkRegistry as As}from"./orchestration/index.js";import{openNextBuilder as ms,staticSiteBuilder as ds,dockerBuilder as us}from"./orchestration/index.js";import{StepRegistry as Ps,getDestroyStepId as Os}from"./steps/index.js";import{buildDeployPlan as Ns,computeDeployPlan as Cs,computeAssemblyDigest as gs,digestHead as Is,classifyImpact as ys,derivePropertyChanges as Ls,isDataLoss as xs,isStatefulResourceType as hs,renderPlanSummary as vs,renderPlanLines as Fs,toWirePlanChanges as Ms,signApprovalToken as Us,verifyApprovalToken as ks,DEFAULT_APPROVAL_TTL_MS as bs,APPROVAL_TOKEN_PATTERN as Ys,runApprovalGate as Vs,approvalRefusalReason as Gs}from"./orchestration/index.js";import{runDestructionGate as Ks,buildDestructionTicket as Xs,evaluateDestructionConsents as Hs,computeTicketDigest as ws,legalRemediationVerbs as Js,executableRemediationVerbs as Ws,advertisableRemediationVerbs as Qs,renderDestructionTicketLines as js,renderConsentVerdictLines as Zs,loadDeployPlan as qs,createMemoisedPlanLoader as zs}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as ec,classifyDeployFailure as rc,classifyFromEcsCompletion as tc,classifyFromFailureAnalysis as oc,classifyUnclassified as ac}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as nc,getDeploymentFailure as sc}from"./orchestration/failure/deploymentFailureAttachment.js";export{bn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Cr as APPLICATION_DEPLOY_ORDER,gr as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Ys as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,ao as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,l as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,wn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Nt as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,Lt as CdkEventMonitor,Ct as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,co as ConfigError,bs as DEFAULT_APPROVAL_TTL_MS,ht as DEFAULT_DEPLOY_TIMEOUT_MS,ve as DEFAULT_MAX_PAGES,hn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,yt as DEPENDENCY_SYNC_TIMEOUT_MS,S as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,i as DEPLOYMENT_EVENT_TYPES,ec as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,F as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,N as DEPLOY_EVENT_CONTRACT_MINOR,x as DEPLOY_EVENT_ERROR_MESSAGE_MAX,g as DEPLOY_EVENT_ID_MAX,y as DEPLOY_EVENT_MESSAGE_MAX,I as DEPLOY_EVENT_NAME_MAX,v as DEPLOY_EVENT_OUTPUT_MAX,L as DEPLOY_EVENT_STATUS_REASON_MAX,h as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,Ln as DOMAIN_DELEGATION_ERROR_TYPES,xa as DRIFT_PREFLIGHT_BUDGET_MS,La as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,R as DeployEventSchema,mo as DeployModeSchema,d as DeployResourceSchema,io as DeploymentError,a as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,xn as DomainDelegationError,Er as DriftFindingSchema,Sr as DriftJournalRecordSchema,Pa as DriftProbe,Fi as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Ho as ENGINE_DIAGNOSTIC_SCOPE,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,ei as FORGET_FLIP_SPEC,$a as FORGET_MARKER_KEY,so as FileSystemError,it as FjallStateFileSchema,As as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,Fe as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Yi as LeaseDeniedError,tn as MAX_ROOT_SESSION_SECONDS,Un as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Mn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,Ir as OPENNEXT_DEPLOY_ORDER,yr as OPENNEXT_DESTROY_ORDER,hr as OPENNEXT_PARALLEL_GROUPS,Qr as OPENNEXT_PATTERNS,Nr as ORGANISATION_TYPES,mn as ORG_SETUP_PHASES,Aa as ORG_TRAIL_BUCKET_OUTPUT_KEY,pn as OU_ONLY_ACCOUNT_BUCKETS,Lr as PARALLEL_DEPLOY_GROUPS,xr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Wt as PROGRESS_MESSAGES,vn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,ri as RECREATE_MARKER_KEY,Ka as REMEDIATION_JOURNAL_RETENTION_DAYS,Tr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,rn as ROOT_TASK_POLICY_ARNS,Rr as RemediationFlipProofSchema,mr as RemediationJournalRecordSchema,_r as RemediationPhaseSchema,Ar as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,_e as SERVICE_PRINCIPALS,li as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,jr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,C as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,ki as StackUnavailableError,m as StepProgressSchema,Ps as StepRegistry,or as TICKET_VERDICT_SOURCES,Ra as TRAIL_BUCKET_OUTPUT_KEY,ma as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,ar as TicketVerdictSourceSchema,to as ValidationError,gn as WorkerDomainDeployProvider,cn as accountsConfigToOUTree,ge as activateCostAllocationTags,Re as activateTrustedAccess,mi as advertisableDriftVerbs,Qs as advertisableRemediationVerbs,wa as applyRetainFlip,Gs as approvalRefusalReason,Fa as archiveCompletedRemediationJournal,Ro as artefactOutputKey,bi as assertLeaseBeforeStack,ti as assessForgetResumability,$i as assumeRootForTask,nc as attachDeploymentFailure,ta as buildAccountRegionPairs,Ne as buildAccountToOUMap,Ss as buildBuildSecretSessionPolicy,Nn as buildCascadeTakeoverTicket,Ns as buildDeployPlan,ls as buildDeploySessionPolicy,Xs as buildDestructionTicket,di as buildDriftRepairTicket,Vo as buildParamsContext,ra as buildRegionList,zn as buildSatelliteRecordIndex,jt as buildStepContextBuildConfig,ae as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Ni as captureLegacySurfaces,Xa as captureRemediationForensics,oa as cascadeHomeRegion,aa as cascadeOperationKey,fn as cascadeTakeoverDigestSeed,Mi as checkDeployPathStackAvailability,Ie as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,T as clampDeploymentEventStrings,rc as classifyDeployFailure,ua as classifyDriftFailure,tc as classifyFromEcsCompletion,oc as classifyFromFailureAnalysis,ys as classifyImpact,ac as classifyUnclassified,qn as classifyZoneRecords,It as clearDependencyIntegrityCache,Oa as clearDriftSuspects,Ii as collectIdentityPinCandidates,oi as completeForgetAfterConverge,ai as completeForgetAfterDeploy,Ja as composeFlipCapabilities,hi as composePostFailureRepairOffer,Le as composeSdkAbortSignal,gs as computeAssemblyDigest,Cs as computeDeployPlan,Ma as computeRemediationOpId,jo as computeSecretsDrift,Wa as computeTemplateDigest,ws as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,j as createDeployEmitter,ct as createEmptyState,zs as createMemoisedPlanLoader,Fn as createPublicResolvers,go as createSequencedCallbacks,$n as createSystemDnsNameProbe,In as createWorkerDomainDeployProvider,pa as decideNextTransition,Ci as decodeLegacyAnchor,_a as decommissionMemberTrailStorage,fa as defaultDriftJournalDir,Ha as defaultRemediationForensicsDir,Ua as defaultRemediationJournalDir,yi as degradedIdentityPinOutcomes,Gn as delegationRoleUnusableError,Wn as deleteChildNsFromParent,mt as deleteDomainState,On as deleteRecordSetsByKey,Et as deleteStateFile,Uo as deploy,Vn as deployDelegatedDomain,Ls as derivePropertyChanges,Ti as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,Qa as deriveRetainFlipTemplate,Zo as deriveStaleParameters,Bn as deriveZonePhaseState,le as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,ga as detectStackDrift,Is as digestHead,us as dockerBuilder,Me as drainPages,Jt as emitProgress,Bo as emitStepWarnings,Ko as emitWarningEvent,Ye as enableCentralisedRootAccess,me as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Ae as enableRamSharing,Te as enableServiceAccess,gt as ensureDependencyIntegrity,Qi as ensureEnforceSsl,Se as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Hs as evaluateDestructionConsents,Ws as executableRemediationVerbs,sn as extractAllAccountNames,qo as extractConsumedSsmParameters,Kn as extractDelegationRoleArn,xe as extractErrorName,ho as failure,Da as fetchLastOperationEvents,yo as fileExists,lo as filterDangerousEnvVars,De as findAccount,Ce as findDevelopmentOuId,ja as findMarkedResourcesByOpId,ka as findRemediationJournalByOpId,_i as findRemovalDeletionFailures,Ai as findResourcesPresent,nn as flattenAccountsToEnvironments,ya as formatDriftPreFlightBlock,vi as formatDriftRepairOffer,Ft as formatInfrastructureError,Di as formatPinOutcomeDetail,ii as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,sc as getDeploymentFailure,Os as getDestroyStepId,Gr as getOrganisationStackName,Ur as getParallelDeployGroups,kr as getParallelDestroyGroups,Ut as getSourceContext,lt as getStateFilePath,Mt as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,he as isAborted,Sn as isAccountsConfig,Fr as isApplicationOperation,Br as isApplicationStack,vt as isCdkError,xs as isDataLoss,os as isDelegatedToRoute53,Ui as isDeployPathBlockingStatus,Hi as isEnforceSslStatement,Fo as isFailure,Ue as isOULeaf,Wr as isOpenNextPattern,Mr as isOrganisationOperation,ln as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,en as isRootTaskPolicyArn,ts as isRoute53NameServer,hs as isStatefulResourceType,En as isStringArray,vo as isSuccess,Js as legalRemediationVerbs,ue as listAccounts,ba as listActiveRemediationOps,Ya as listActiveRemediationOpsForContext,qs as loadDeployPlan,po as maskSensitiveOutput,Sa as mergeReconciledProviderAccounts,rs as normaliseRecordName,Qn as nsDelegationPhysicalName,ms as openNextBuilder,an as parseAccountsConfiguration,Qt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,Dn as parseRecordPhysicalName,To as parseShellArgs,$o as partitionAccounts,ps as partitionForRegion,ni as partitionPreFlightByRemediation,Pi as pinProbeCoverage,fe as placeAccountsInOUs,ie as probeAccountStackExists,Wo as probeSecretsDrift,Qo as probeServiceDeploymentStatus,sa as projectAccountRows,na as projectScalarSummary,Za as proveFlipMetadataOnly,Ri as proveRemovalTargetsOnly,Xn as readDelegatedTopologyFromProps,Hn as readDomainStackOutputsByExport,_t as readDomainState,Na as readDriftSuspects,Va as readRemediationJournal,qa as readRetainFlipState,nt as readStateFile,Ea as reconcileProviderAccounts,Ta as reconcileTrailMigration,Rt as recordDomainDeployState,Ca as recordDriftSuspects,un as recordPhysicalName,Pn as recordSetKey,ce as regionDisabledMessage,pt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,Zs as renderConsentVerdictLines,js as renderDestructionTicketLines,Li as renderIdentityPinReportLines,Oi as renderPinReportLines,Fs as renderPlanLines,vs as renderPlanSummary,Es as resolveBuildArgs,ss as resolveBuildSecretSessionProvider,is as resolveBuildSecrets,ns as resolveSecretRefValue,Jo as restart,ji as restoreAndReconcileQuarantinedBucket,Ji as restoreBucketPolicy,Vs as runApprovalGate,Yn as runCaaPreflight,Cn as runCascadeTakeoverGate,jn as runDelegatedDomainDestroy,Ks as runDestructionGate,Ia as runDriftPreFlight,ui as runDriftRepairGate,si as runForgetSurgery,xi as runIdentityPinMigration,gi as runIdentitySurfaceGate,_n as runOpenNextBuild,Rn as runOrganisationSetup,fi as runPinRemediation,pi as runRecreatePreFlight,Ei as runRecreateSurgery,ha as runRoute53RecordPreflight,Us as signApprovalToken,_o as sleep,No as sleepAbortable,ye as snapshotIdentityCentre,Si as snapshotPolicyForType,cs as sourcedRefsFromBuildArgs,xt as startStackMonitoring,ds as staticSiteBuilder,rt as stubCallerIdentity,xo as success,Ga as sweepExpiredRemediationJournals,ci as synthTemplateDeclaresResource,Wi as synthesiseEnforceSslDocument,es as systemDnsNameProbe,Jn as templateOwnsDelegationRecord,Jr as toPascalCase,wi as toResourcePolicyStatements,Eo as toServiceError,Ms as toWirePlanChanges,Xi as triageBucketPolicy,_ as truncateUtf16Safe,Gi as unlockBucket,Bi as unlockQueue,de as updateBackupGlobalSettings,St as updateTemplateHash,Ts as validateBuildGroup,lr as verbsForDriftVerdict,ks as verifyApprovalToken,qi as verifyOrgTrailDelivery,za as verifyRetainFlipDiff,kn as waitForNsPropagation,et as wrapApplicationError,At as writeDomainState,Ba as writeRemediationJournal,st as writeStateFile};
+import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as a,DEPLOYMENT_EVENT_TYPES as i,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as l,CASCADE_PHASES as S,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as T,truncateUtf16Safe as m}from"./types/index.js";import{DeployEventSchema as _,StepProgressSchema as A,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as y,DEPLOY_EVENT_NAME_MAX as g,DEPLOY_EVENT_MESSAGE_MAX as I,DEPLOY_EVENT_STATUS_REASON_MAX as L,DEPLOY_EVENT_ERROR_MESSAGE_MAX as x,DEPLOY_EVENT_TRAIL_DETAIL_MAX as h,DEPLOY_EVENT_OUTPUT_MAX as v,DEPLOY_EVENT_ARN_MAX as F,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ae,probeAccountStackExists as ie}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as le,describeOrganisation as Se,enablePolicyTypes as pe,enableServiceAccess as Te,SERVICE_PRINCIPALS as me,enableRamSharing as Re,activateTrustedAccess as _e,enableIpamDelegatedAdmin as Ae,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as ye,checkIdentityCentreStatus as ge,snapshotIdentityCentre as Ie,composeSdkAbortSignal as Le,extractErrorName as xe,isAborted as he,DEFAULT_MAX_PAGES as ve,IDENTITY_STORE_PAGE_SIZE as Fe,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ar}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as lr,verbsForDriftVerdict as Sr}from"./types/index.js";import{REMEDIATION_PHASES as Tr,RemediationPhaseSchema as mr,RemediationTargetSchema as Rr,RemediationFlipProofSchema as _r,RemediationJournalRecordSchema as Ar,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Cr,APPLICATION_DEPLOY_ORDER as Nr,APPLICATION_DESTROY_ORDER as yr,OPENNEXT_DEPLOY_ORDER as gr,OPENNEXT_DESTROY_ORDER as Ir,PARALLEL_DEPLOY_GROUPS as Lr,PARALLEL_DESTROY_GROUPS as xr,OPENNEXT_PARALLEL_GROUPS as hr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Fr,isOrganisationOperation as Mr,getParallelDeployGroups as Ur,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Wr,OPENNEXT_PATTERNS as Qr,STACK_NOT_FOUND_PATTERN as jr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as it,readStateFile as nt,writeStateFile as st,createEmptyState as ct,deleteStateFile as Et,updateTemplateHash as lt,getStateFilePath as St,regionSuffix as pt}from"./types/config/FjallState.js";import{readDomainState as mt,writeDomainState as Rt,recordDomainDeployState as _t,deleteDomainState as At,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Ct,CdkProcessManager as Nt,ensureDependencyIntegrity as yt,clearDependencyIntegrityCache as gt,DEPENDENCY_SYNC_TIMEOUT_MS as It,CdkEventMonitor as Lt,startStackMonitoring as xt,DEFAULT_DEPLOY_TIMEOUT_MS as ht,isCdkError as vt,formatInfrastructureError as Ft,getStructuralHint as Mt,getSourceContext as Ut,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Wt,parseBuildPhase as Qt,buildStepContextBuildConfig as jt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as ao,DeploymentError as io,NetworkError as no,FileSystemError as so,ConfigError as co,toServiceError as Eo}from"./types/errors/index.js";import{filterDangerousEnvVars as So,maskSensitiveOutput as po,parseShellArgs as To,sleep as mo}from"@fjall/util";import{artefactOutputKey as _o,DeployModeSchema as Ao,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as Co}from"./util/sleepAbortable.js";import{createSequencedCallbacks as yo}from"./util/sequencedCallbacks.js";import{fileExists as Io}from"@fjall/util/fsHelpers";import{success as xo,failure as ho,isSuccess as vo,isFailure as Fo}from"@fjall/generator";import{deploy as Uo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{buildParamsContext as Vo}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Bo,emitWarningEvent as Ko}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Ho}from"./util/diagnosticScopes.js";import{restart as Jo,probeSecretsDrift as Wo,probeServiceDeploymentStatus as Qo,computeSecretsDrift as jo,deriveStaleParameters as Zo,extractConsumedSsmParameters as qo}from"./orchestration/index.js";import{partitionAccounts as $o}from"./orchestration/index.js";import{buildRegionList as ra,buildAccountRegionPairs as ta,cascadeHomeRegion as oa,cascadeOperationKey as aa}from"./orchestration/index.js";import{projectScalarSummary as na,projectAccountRows as sa}from"./orchestration/index.js";import{reconcileProviderAccounts as Ea,mergeReconciledProviderAccounts as la}from"./orchestration/index.js";import{decideNextTransition as pa,reconcileTrailMigration as Ta,decommissionMemberTrailStorage as ma,ORG_TRAIL_BUCKET_OUTPUT_KEY as Ra,TRAIL_BUCKET_OUTPUT_KEY as _a,TRAIL_KEY_ARN_OUTPUT_KEY as Aa}from"./orchestration/index.js";import{classifyDriftFailure as ua,fetchLastOperationEvents as Da,DriftProbe as Pa,probePhysicalPresence as Oa,clearDriftSuspects as fa,defaultDriftJournalDir as Ca,readDriftSuspects as Na,recordDriftSuspects as ya,detectStackDrift as ga,runDriftPreFlight as Ia,formatDriftPreFlightBlock as La,DRIFT_PREFLIGHT_TRIGGER_STATUSES as xa,DRIFT_PREFLIGHT_BUDGET_MS as ha,runRoute53RecordPreflight as va}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ma,computeRemediationOpId as Ua,defaultRemediationJournalDir as ka,findRemediationJournalByOpId as ba,listActiveRemediationOps as Ya,listActiveRemediationOpsForContext as Va,readRemediationJournal as Ga,sweepExpiredRemediationJournals as Ba,writeRemediationJournal as Ka,REMEDIATION_JOURNAL_RETENTION_DAYS as Xa,captureRemediationForensics as Ha,defaultRemediationForensicsDir as wa,applyRetainFlip as Ja,composeFlipCapabilities as Wa,computeTemplateDigest as Qa,deriveRetainFlipTemplate as ja,findMarkedResourcesByOpId as Za,proveFlipMetadataOnly as qa,readRetainFlipState as za,verifyRetainFlipDiff as $a,FORGET_MARKER_KEY as ei,FORGET_FLIP_SPEC as ri,RECREATE_MARKER_KEY as ti,assessForgetResumability as oi,completeForgetAfterConverge as ai,completeForgetAfterDeploy as ii,formatRecreateInFlightCures as ni,partitionPreFlightByRemediation as si,runForgetSurgery as ci,synthTemplateDeclaresResource as Ei,runRecreateSurgery as li,snapshotPolicyForType as Si,SNAPSHOT_CAPABLE_RESOURCE_TYPES as pi,runRecreatePreFlight as Ti,deriveRemovalTemplate as mi,findRemovalDeletionFailures as Ri,findResourcesPresent as _i,proveRemovalTargetsOnly as Ai,advertisableDriftVerbs as di,buildDriftRepairTicket as ui,runDriftRepairGate as Di,formatPinOutcomeDetail as Pi,pinProbeCoverage as Oi,renderPinReportLines as fi,runPinRemediation as Ci,captureLegacySurfaces as Ni,decodeLegacyAnchor as yi,runIdentitySurfaceGate as gi,collectIdentityPinCandidates as Ii,degradedIdentityPinOutcomes as Li,renderIdentityPinReportLines as xi,runIdentityPinMigration as hi,composePostFailureRepairOffer as vi,formatDriftRepairOffer as Fi,DriftRepairAvailableError as Mi,checkDeployPathStackAvailability as Ui,isDeployPathBlockingStatus as ki,StackUnavailableError as bi,assertLeaseBeforeStack as Yi,LeaseDeniedError as Vi}from"./orchestration/index.js";import{unlockBucket as Bi,unlockQueue as Ki}from"./orchestration/index.js";import{triageBucketPolicy as Hi,isEnforceSslStatement as wi,toResourcePolicyStatements as Ji,restoreBucketPolicy as Wi,synthesiseEnforceSslDocument as Qi,ensureEnforceSsl as ji,restoreAndReconcileQuarantinedBucket as Zi}from"./orchestration/index.js";import{verifyOrgTrailDelivery as zi}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as en,isRootTaskPolicyArn as rn,ROOT_TASK_POLICY_ARNS as tn,MAX_ROOT_SESSION_SECONDS as on}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as nn,flattenAccountsToEnvironments as sn,extractAllAccountNames as cn,accountsConfigToOUTree as En,isStringArray as ln,isAccountsConfig as Sn,isOuOnlyAccountBucket as pn,OU_ONLY_ACCOUNT_BUCKETS as Tn}from"./orchestration/index.js";import{runOpenNextBuild as Rn}from"./orchestration/index.js";import{runOrganisationSetup as An,ORG_SETUP_PHASES as dn}from"./orchestration/index.js";import{recordPhysicalName as Dn,parseRecordPhysicalName as Pn,recordSetKey as On,deleteRecordSetsByKey as fn,cascadeTakeoverDigestSeed as Cn,buildCascadeTakeoverTicket as Nn,runCascadeTakeoverGate as yn,WorkerDomainDeployProvider as gn,createWorkerDomainDeployProvider as In,createCascadeDomainProviderFactory as Ln}from"./orchestration/index.js";import{assumeCascadeRole as hn}from"./orchestration/contextHelpers.js";import{DOMAIN_DELEGATION_ERROR_TYPES as Fn,DomainDelegationError as Mn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as Un,PUBLIC_DNS_QUERY_TIMEOUT_MS as kn,createPublicResolvers as bn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Yn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Vn,waitForNsPropagation as Gn,ACM_CAA_ISSUERS as Bn,runCaaPreflight as Kn,deployDelegatedDomain as Xn,delegationRoleUnusableError as Hn,deriveZonePhaseState as wn,extractDelegationRoleArn as Jn,readDelegatedTopologyFromProps as Wn,readDomainStackOutputsByExport as Qn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as jn,templateOwnsDelegationRecord as Zn,deleteChildNsFromParent as qn,nsDelegationPhysicalName as zn,runDelegatedDomainDestroy as $n}from"./orchestration/index.js";import{classifyZoneRecords as rs,buildSatelliteRecordIndex as ts,createSystemDnsNameProbe as os,systemDnsNameProbe as as,normaliseRecordName as is,isRoute53NameServer as ns,isDelegatedToRoute53 as ss}from"./orchestration/index.js";import{resolveBuildSecrets as Es,resolveSecretRefValue as ls,resolveBuildSecretSessionProvider as Ss,sourcedRefsFromBuildArgs as ps,resolveBuildArgs as Ts,buildBuildSecretSessionPolicy as ms,buildDeploySessionPolicy as Rs,partitionForRegion as _s,validateBuildGroup as As}from"./orchestration/index.js";import{FrameworkRegistry as us}from"./orchestration/index.js";import{openNextBuilder as Ps,staticSiteBuilder as Os,dockerBuilder as fs}from"./orchestration/index.js";import{StepRegistry as Ns,getDestroyStepId as ys}from"./steps/index.js";import{buildDeployPlan as Is,computeDeployPlan as Ls,computeAssemblyDigest as xs,digestHead as hs,classifyImpact as vs,derivePropertyChanges as Fs,isDataLoss as Ms,isStatefulResourceType as Us,renderPlanSummary as ks,renderPlanLines as bs,toWirePlanChanges as Ys,signApprovalToken as Vs,verifyApprovalToken as Gs,DEFAULT_APPROVAL_TTL_MS as Bs,APPROVAL_TOKEN_PATTERN as Ks,runApprovalGate as Xs,approvalRefusalReason as Hs}from"./orchestration/index.js";import{runDestructionGate as Js,buildDestructionTicket as Ws,evaluateDestructionConsents as Qs,computeTicketDigest as js,legalRemediationVerbs as Zs,executableRemediationVerbs as qs,advertisableRemediationVerbs as zs,renderDestructionTicketLines as $s,renderConsentVerdictLines as ec,loadDeployPlan as rc,createMemoisedPlanLoader as tc}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as ac,classifyDeployFailure as ic,classifyFromEcsCompletion as nc,classifyFromFailureAnalysis as sc,classifyUnclassified as cc}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as lc,getDeploymentFailure as Sc}from"./orchestration/failure/deploymentFailureAttachment.js";export{Bn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Nr as APPLICATION_DEPLOY_ORDER,yr as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Ks as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,ao as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,S as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,jn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Ct as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,Lt as CdkEventMonitor,Nt as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,co as ConfigError,Bs as DEFAULT_APPROVAL_TTL_MS,ht as DEFAULT_DEPLOY_TIMEOUT_MS,ve as DEFAULT_MAX_PAGES,Un as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,It as DEPENDENCY_SYNC_TIMEOUT_MS,l as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,i as DEPLOYMENT_EVENT_TYPES,ac as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,F as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,x as DEPLOY_EVENT_ERROR_MESSAGE_MAX,y as DEPLOY_EVENT_ID_MAX,I as DEPLOY_EVENT_MESSAGE_MAX,g as DEPLOY_EVENT_NAME_MAX,v as DEPLOY_EVENT_OUTPUT_MAX,L as DEPLOY_EVENT_STATUS_REASON_MAX,h as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,Fn as DOMAIN_DELEGATION_ERROR_TYPES,ha as DRIFT_PREFLIGHT_BUDGET_MS,xa as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,_ as DeployEventSchema,Ao as DeployModeSchema,d as DeployResourceSchema,io as DeploymentError,a as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,Mn as DomainDelegationError,Er as DriftFindingSchema,lr as DriftJournalRecordSchema,Pa as DriftProbe,Mi as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Ho as ENGINE_DIAGNOSTIC_SCOPE,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,ri as FORGET_FLIP_SPEC,ei as FORGET_MARKER_KEY,so as FileSystemError,it as FjallStateFileSchema,us as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,Fe as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Vi as LeaseDeniedError,on as MAX_ROOT_SESSION_SECONDS,Vn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Yn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,gr as OPENNEXT_DEPLOY_ORDER,Ir as OPENNEXT_DESTROY_ORDER,hr as OPENNEXT_PARALLEL_GROUPS,Qr as OPENNEXT_PATTERNS,Cr as ORGANISATION_TYPES,dn as ORG_SETUP_PHASES,Ra as ORG_TRAIL_BUCKET_OUTPUT_KEY,Tn as OU_ONLY_ACCOUNT_BUCKETS,Lr as PARALLEL_DEPLOY_GROUPS,xr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Wt as PROGRESS_MESSAGES,kn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,ti as RECREATE_MARKER_KEY,Xa as REMEDIATION_JOURNAL_RETENTION_DAYS,Tr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,tn as ROOT_TASK_POLICY_ARNS,_r as RemediationFlipProofSchema,Ar as RemediationJournalRecordSchema,mr as RemediationPhaseSchema,Rr as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,me as SERVICE_PRINCIPALS,pi as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,jr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,bi as StackUnavailableError,A as StepProgressSchema,Ns as StepRegistry,or as TICKET_VERDICT_SOURCES,_a as TRAIL_BUCKET_OUTPUT_KEY,Aa as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,ar as TicketVerdictSourceSchema,to as ValidationError,gn as WorkerDomainDeployProvider,En as accountsConfigToOUTree,ye as activateCostAllocationTags,_e as activateTrustedAccess,di as advertisableDriftVerbs,zs as advertisableRemediationVerbs,Ja as applyRetainFlip,Hs as approvalRefusalReason,Ma as archiveCompletedRemediationJournal,_o as artefactOutputKey,Yi as assertLeaseBeforeStack,oi as assessForgetResumability,hn as assumeCascadeRole,en as assumeRootForTask,lc as attachDeploymentFailure,ta as buildAccountRegionPairs,Ce as buildAccountToOUMap,ms as buildBuildSecretSessionPolicy,Nn as buildCascadeTakeoverTicket,Is as buildDeployPlan,Rs as buildDeploySessionPolicy,Ws as buildDestructionTicket,ui as buildDriftRepairTicket,Vo as buildParamsContext,ra as buildRegionList,ts as buildSatelliteRecordIndex,jt as buildStepContextBuildConfig,ae as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Ni as captureLegacySurfaces,Ha as captureRemediationForensics,oa as cascadeHomeRegion,aa as cascadeOperationKey,Cn as cascadeTakeoverDigestSeed,Ui as checkDeployPathStackAvailability,ge as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,T as clampDeploymentEventStrings,ic as classifyDeployFailure,ua as classifyDriftFailure,nc as classifyFromEcsCompletion,sc as classifyFromFailureAnalysis,vs as classifyImpact,cc as classifyUnclassified,rs as classifyZoneRecords,gt as clearDependencyIntegrityCache,fa as clearDriftSuspects,Ii as collectIdentityPinCandidates,ai as completeForgetAfterConverge,ii as completeForgetAfterDeploy,Wa as composeFlipCapabilities,vi as composePostFailureRepairOffer,Le as composeSdkAbortSignal,xs as computeAssemblyDigest,Ls as computeDeployPlan,Ua as computeRemediationOpId,jo as computeSecretsDrift,Qa as computeTemplateDigest,js as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,Ln as createCascadeDomainProviderFactory,j as createDeployEmitter,ct as createEmptyState,tc as createMemoisedPlanLoader,bn as createPublicResolvers,yo as createSequencedCallbacks,os as createSystemDnsNameProbe,In as createWorkerDomainDeployProvider,pa as decideNextTransition,yi as decodeLegacyAnchor,ma as decommissionMemberTrailStorage,Ca as defaultDriftJournalDir,wa as defaultRemediationForensicsDir,ka as defaultRemediationJournalDir,Li as degradedIdentityPinOutcomes,Hn as delegationRoleUnusableError,qn as deleteChildNsFromParent,At as deleteDomainState,fn as deleteRecordSetsByKey,Et as deleteStateFile,Uo as deploy,Xn as deployDelegatedDomain,Fs as derivePropertyChanges,mi as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,ja as deriveRetainFlipTemplate,Zo as deriveStaleParameters,wn as deriveZonePhaseState,Se as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,ga as detectStackDrift,hs as digestHead,fs as dockerBuilder,Me as drainPages,Jt as emitProgress,Bo as emitStepWarnings,Ko as emitWarningEvent,Ye as enableCentralisedRootAccess,Ae as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Re as enableRamSharing,Te as enableServiceAccess,yt as ensureDependencyIntegrity,ji as ensureEnforceSsl,le as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Qs as evaluateDestructionConsents,qs as executableRemediationVerbs,cn as extractAllAccountNames,qo as extractConsumedSsmParameters,Jn as extractDelegationRoleArn,xe as extractErrorName,ho as failure,Da as fetchLastOperationEvents,Io as fileExists,So as filterDangerousEnvVars,De as findAccount,Ne as findDevelopmentOuId,Za as findMarkedResourcesByOpId,ba as findRemediationJournalByOpId,Ri as findRemovalDeletionFailures,_i as findResourcesPresent,sn as flattenAccountsToEnvironments,La as formatDriftPreFlightBlock,Fi as formatDriftRepairOffer,Ft as formatInfrastructureError,Pi as formatPinOutcomeDetail,ni as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,Sc as getDeploymentFailure,ys as getDestroyStepId,Gr as getOrganisationStackName,Ur as getParallelDeployGroups,kr as getParallelDestroyGroups,Ut as getSourceContext,St as getStateFilePath,Mt as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,he as isAborted,Sn as isAccountsConfig,Fr as isApplicationOperation,Br as isApplicationStack,vt as isCdkError,Ms as isDataLoss,ss as isDelegatedToRoute53,ki as isDeployPathBlockingStatus,wi as isEnforceSslStatement,Fo as isFailure,Ue as isOULeaf,Wr as isOpenNextPattern,Mr as isOrganisationOperation,pn as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,rn as isRootTaskPolicyArn,ns as isRoute53NameServer,Us as isStatefulResourceType,ln as isStringArray,vo as isSuccess,Zs as legalRemediationVerbs,ue as listAccounts,Ya as listActiveRemediationOps,Va as listActiveRemediationOpsForContext,rc as loadDeployPlan,po as maskSensitiveOutput,la as mergeReconciledProviderAccounts,is as normaliseRecordName,zn as nsDelegationPhysicalName,Ps as openNextBuilder,nn as parseAccountsConfiguration,Qt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,Pn as parseRecordPhysicalName,To as parseShellArgs,$o as partitionAccounts,_s as partitionForRegion,si as partitionPreFlightByRemediation,Oi as pinProbeCoverage,fe as placeAccountsInOUs,ie as probeAccountStackExists,Oa as probePhysicalPresence,Wo as probeSecretsDrift,Qo as probeServiceDeploymentStatus,sa as projectAccountRows,na as projectScalarSummary,qa as proveFlipMetadataOnly,Ai as proveRemovalTargetsOnly,Wn as readDelegatedTopologyFromProps,Qn as readDomainStackOutputsByExport,mt as readDomainState,Na as readDriftSuspects,Ga as readRemediationJournal,za as readRetainFlipState,nt as readStateFile,Ea as reconcileProviderAccounts,Ta as reconcileTrailMigration,_t as recordDomainDeployState,ya as recordDriftSuspects,Dn as recordPhysicalName,On as recordSetKey,ce as regionDisabledMessage,pt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,ec as renderConsentVerdictLines,$s as renderDestructionTicketLines,xi as renderIdentityPinReportLines,fi as renderPinReportLines,bs as renderPlanLines,ks as renderPlanSummary,Ts as resolveBuildArgs,Ss as resolveBuildSecretSessionProvider,Es as resolveBuildSecrets,ls as resolveSecretRefValue,Jo as restart,Zi as restoreAndReconcileQuarantinedBucket,Wi as restoreBucketPolicy,Xs as runApprovalGate,Kn as runCaaPreflight,yn as runCascadeTakeoverGate,$n as runDelegatedDomainDestroy,Js as runDestructionGate,Ia as runDriftPreFlight,Di as runDriftRepairGate,ci as runForgetSurgery,hi as runIdentityPinMigration,gi as runIdentitySurfaceGate,Rn as runOpenNextBuild,An as runOrganisationSetup,Ci as runPinRemediation,Ti as runRecreatePreFlight,li as runRecreateSurgery,va as runRoute53RecordPreflight,Vs as signApprovalToken,mo as sleep,Co as sleepAbortable,Ie as snapshotIdentityCentre,Si as snapshotPolicyForType,ps as sourcedRefsFromBuildArgs,xt as startStackMonitoring,Os as staticSiteBuilder,rt as stubCallerIdentity,xo as success,Ba as sweepExpiredRemediationJournals,Ei as synthTemplateDeclaresResource,Qi as synthesiseEnforceSslDocument,as as systemDnsNameProbe,Zn as templateOwnsDelegationRecord,Jr as toPascalCase,Ji as toResourcePolicyStatements,Eo as toServiceError,Ys as toWirePlanChanges,Hi as triageBucketPolicy,m as truncateUtf16Safe,Bi as unlockBucket,Ki as unlockQueue,de as updateBackupGlobalSettings,lt as updateTemplateHash,As as validateBuildGroup,Sr as verbsForDriftVerdict,Gs as verifyApprovalToken,zi as verifyOrgTrailDelivery,$a as verifyRetainFlipDiff,Gn as waitForNsPropagation,et as wrapApplicationError,Rt as writeDomainState,Ka as writeRemediationJournal,st as writeStateFile};

package/dist/src/orchestration/domain/WorkerDomainDeployProvider.d.ts

@@ -1,3 +1,4 @@
+import { CloudFormationClient } from "@aws-sdk/client-cloudformation";
 import { type Result } from "@fjall/generator";
 import type { DeployCallbacks } from "../../types/callbacks.js";
 import type { AwsCredentials } from "../../types/credentials.js";
@@ -20,8 +21,11 @@ import type { DelegatedDomainDeployer } from "./delegatedDomainDeploy.js";
  * network, nothing injected — the construct reads its own props), then a
  * same-account parent resolves through its stack's delegation-role export
  * with the job credentials. A parent registered in a DIFFERENT account
- * fails closed with the `delegation_role_unusable` cure — the worker holds
- * one OIDC-minted credential set and must not invent a cross-account hop.
+ * resolves through `resolveForeignParentCfn` when the T2 factory wiring
+ * supplied one (per-home credentials exist, so the export is read in the
+ * parent's own account), and otherwise fails closed with the
+ * `delegation_role_unusable` cure — this provider holds one OIDC-minted
+ * credential set and must not invent a cross-account hop itself.
  * A parent absent from the registry is the externally-owned Case 3: the
  * deploy proceeds uninjected with a loud warning, exactly like the CLI.
  */
@@ -42,6 +46,17 @@ export interface WorkerDomainDeployProviderParams {
      * the CLI's `assembleSynthContext` threads its own fetch.
      */
     orgConfigSerialised?: string;
+    /**
+     * T2 account routing: resolve a CloudFormation reader for a SIBLING
+     * group's account, so a delegated child whose parent zone lives in
+     * another home can read the parent's delegation-role export THERE instead
+     * of failing closed. Supplied by the factory wiring that minted per-home
+     * credentials (it holds every group's client); this provider never mints
+     * a credential hop itself. Absent, or returning `undefined` for the
+     * parent's account: the cross-account rung fails closed exactly as
+     * before.
+     */
+    resolveForeignParentCfn?: (accountId: string) => Pick<CloudFormationClient, "send"> | undefined;
     abortSignal?: AbortSignal;
 }
 export declare class WorkerDomainDeployProvider implements DomainDeployProvider {
@@ -50,6 +65,7 @@ export declare class WorkerDomainDeployProvider implements DomainDeployProvider
     private readonly boundaryDir;
     private readonly credentials;
     private readonly orgConfigSerialised;
+    private readonly resolveForeignParentCfn;
     private readonly abortSignal;
     private readonly aws;
     /** Memoised org lookup — one Organizations call per job, not per domain. */

package/dist/src/orchestration/domain/WorkerDomainDeployProvider.js

@@ -1 +1 @@
-var $=Object.defineProperty;var u=(l,e)=>$(l,"name",{value:e,configurable:!0});import{existsSync as m,readFileSync as Z}from"node:fs";import{readFile as x}from"node:fs/promises";import{join as h,resolve as v}from"node:path";import{CloudFormationClient as C}from"@aws-sdk/client-cloudformation";import{OrganizationsClient as E}from"@aws-sdk/client-organizations";import{success as d,failure as a,parseDomainInfrastructureSource as R}from"@fjall/generator";import{getDomainStackName as y,getErrorMessage as p,maskSensitiveOutput as c}from"@fjall/util";import{RootConfigReadSchema as A}from"@fjall/util/config";import{logger as P}from"@fjall/util/logger";import{SimpleAwsProvider as I}from"../../aws/SimpleAwsProvider.js";import{describeOrganisationAsMember as O}from"../../aws/organisations/organisation.js";import{CdkService as b}from"../../services/infrastructure/CdkService.js";import{emitWarningEvent as j}from"../contextHelpers.js";import{delegationRoleUnusableError as g,deriveZonePhaseState as N,extractDelegationRoleArn as T,readDelegatedTopologyFromProps as F,readDomainStackOutputsByExport as S}from"./delegationResolution.js";const k="WorkerDomainDeployProvider";async function z(l,e){const r=[h(l,e,"fjall-config.json"),h(l,"fjall-config.json")].find(t=>m(t));if(r===void 0)return d([]);let i;try{i=await x(r,"utf8")}catch(t){return a(new Error(`domains phase refused: ${r} exists but could not be read (${c(p(t))}) \u2014 deploying with an unreadable domain registry is not an option.`))}let s;try{s=JSON.parse(i)}catch(t){return a(new Error(`domains phase refused: ${r} is not valid JSON (${c(p(t))}). Cure: fix the file by hand \u2014 do not regenerate it, which would discard capacity-identity pins.`))}const o=A.safeParse(s);return o.success?d((o.data.domains??[]).map(t=>({name:t.name,type:t.type,...t.parentDomain!==void 0?{parentDomain:t.parentDomain}:{},...t.account!==void 0?{account:t.account}:{},...t.region!==void 0?{region:t.region}:{}}))):a(new Error(`domains phase refused: ${r} has a malformed domains/activeTarget/capacityIdentity value \u2014 deploying from a registry that cannot be parsed is not an option. Cure: fix the file by hand.`))}u(z,"readDomainsConfig");class D{static{u(this,"WorkerDomainDeployProvider")}domains;workingDirectory;boundaryDir;credentials;orgConfigSerialised;abortSignal;aws;orgDetailsPromise;constructor(e,n){this.domains=n,this.workingDirectory=e.workingDirectory,this.boundaryDir=e.boundaryDir,this.credentials=e.credentials,this.orgConfigSerialised=e.orgConfigSerialised,this.abortSignal=e.abortSignal,this.aws=new I(e.credentials)}static async create(e){const n=await z(e.workingDirectory,e.boundaryDir);return n.success?d(new D(e,n.data)):a(n.error)}getDomains(){return this.domains}componentPath(e){return h(this.workingDirectory,this.boundaryDir,"domains",e)}async assembleContext(){this.orgDetailsPromise??=(async()=>{try{const n=await O(this.aws.getClient(E),this.abortSignal);if(!n.success){P.warn(k,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:c(n.error.message)});return}return n.data===null?void 0:{orgId:n.data.orgId,managementAccountId:n.data.managementAccountId}}catch(n){P.warn(k,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:c(p(n))});return}})();const e=await this.orgDetailsPromise;return{accountId:this.credentials.accountId,region:this.credentials.region,...e!==void 0?e:{},...this.orgConfigSerialised!==void 0?{orgConfig:this.orgConfigSerialised}:{}}}cdkCredentials(){return{accessKeyId:this.credentials.accessKeyId,secretAccessKey:this.credentials.secretAccessKey,...this.credentials.sessionToken!==void 0?{sessionToken:this.credentials.sessionToken}:{}}}componentPreconditionError(e){const n=this.componentPath(e);if(!m(n))return new Error(`Domain '${e}' is registered in fjall-config.json but ${n} does not exist in this checkout \u2014 merge the scaffold PR that creates it, or remove the registry entry.`);if(!m(h(n,"infrastructure.ts")))return new Error(`Domain '${e}' has no infrastructure.ts at ${n} \u2014 merge the scaffold/import PR that creates it.`)}async synthForTakeover(e,n){const r=this.componentPreconditionError(e);if(r!==void 0)return a(r);const i=this.componentPath(e),s=await this.assembleContext(),o=new b({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const t=await o.synth(i,{outputCallback:u(f=>{n.onProgress?.({type:"info",message:c(f)})},"outputCallback"),context:s,credentials:this.cdkCredentials()});if(!t.success)return a(new Error(`CDK synth failed: ${c(p(t.error))}`))}finally{o.dispose()}return d({stackNames:[y(e)],cdkOutPath:v(i,"cdk.out")})}async deployDomain(e,n){const r=this.componentPreconditionError(e);return r!==void 0?a(r):this.runCdkDeploy(e,n,{})}async runCdkDeploy(e,n,r,i){const s=this.componentPath(e),o={...await this.assembleContext(),...r},t=new b({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const f=await t.deploy(s,void 0,{outputCallback:u(w=>{n.onProgress?.({type:"info",message:c(i!==void 0?`${i}${w}`:w)})},"outputCallback"),context:o,credentials:this.cdkCredentials()});if(!f.success)return a(new Error(`CDK deploy failed: ${c(p(f.error))}`))}finally{t.dispose()}return d(void 0)}parseDomainComponent(e){const n=h(this.componentPath(e),"infrastructure.ts");let r;try{r=Z(n,"utf-8")}catch{return}const i=R(r,n,e);return i.success?i.data:void 0}delegationCures(e,n){return`deploy the parent zone first ('fjall domain deploy ${n}' or re-run this organisation deploy after its apex phase succeeds), deploy the child from the CLI with parent-account credentials ('fjall domain deploy ${e}'), or set a literal parentDelegationRoleArn in the child's infrastructure.ts.`}async resolveDelegationForPhase(e,n,r){const i=this.parseDomainComponent(e);if(i!==void 0&&i.registrar==="external-delegated"&&i.parentDelegationRoleArn!==void 0&&i.parentDelegationRoleArn!=="")return r.onProgress?.({type:"info",message:`Using the literal parentDelegationRoleArn declared in ${e}'s infrastructure.ts for the ${n.parentZoneName} delegation`}),d({});const s=this.domains.find(f=>f.name===n.parentZoneName);if(s===void 0)return j(r,`Parent zone ${n.parentZoneName} is not a managed domain in this registry (Case 3) \u2014 no delegation record is written in-stack; delegate ${n.childZoneName} at the parent with 'fjall domain delegate ${e}' after the zone phase`),d({});if(s.account!==void 0&&s.account!==this.credentials.accountId)return a(g(n.parentZoneName,`the parent is registered in account ${s.account} but this deploy holds credentials for account ${this.credentials.accountId} only`,this.delegationCures(e,n.parentZoneName)));const o=await S(this.aws.getClient(C),n.parentZoneName,this.abortSignal);if(!o.success)return a(g(n.parentZoneName,c(o.error.message),this.delegationCures(e,n.parentZoneName)));if(o.data===void 0)return a(g(n.parentZoneName,`no deployed stack '${y(n.parentZoneName)}' in account ${this.credentials.accountId}`,this.delegationCures(e,n.parentZoneName)));const t=T(o.data,n.parentZoneName);return t===void 0?a(g(n.parentZoneName,`stack '${y(n.parentZoneName)}' publishes no delegation-role export`,this.delegationCures(e,n.parentZoneName))):d({parentDelegationRoleArn:t})}delegatedDeployer(e){const n=this.parseDomainComponent(e);if(n===void 0)return;const r=F(n);if(r!==void 0)return{zoneName:r.childZoneName,deployPhase:u(async(i,s)=>{const o=this.componentPreconditionError(e);if(o!==void 0)return a(o);const t=await this.resolveDelegationForPhase(e,r,s);return t.success?this.runCdkDeploy(e,s,{domainDeployPhase:i,...t.data},`[${r.childZoneName}] `):a(t.error)},"deployPhase"),zonePhaseState:u(async()=>{const i=await S(this.aws.getClient(C),e,this.abortSignal);return i.success?d(N(i.data,r.childZoneName)):a(i.error)},"zonePhaseState")}}}async function ee(l){return D.create(l)}u(ee,"createWorkerDomainDeployProvider");export{D as WorkerDomainDeployProvider,ee as createWorkerDomainDeployProvider};
+var v=Object.defineProperty;var l=(f,e)=>v(f,"name",{value:e,configurable:!0});import{existsSync as C,readFileSync as Z}from"node:fs";import{readFile as x}from"node:fs/promises";import{join as p,resolve as E}from"node:path";import{CloudFormationClient as P}from"@aws-sdk/client-cloudformation";import{OrganizationsClient as R}from"@aws-sdk/client-organizations";import{success as c,failure as a,parseDomainInfrastructureSource as A}from"@fjall/generator";import{getDomainStackName as D,getErrorMessage as g,maskSensitiveOutput as u}from"@fjall/util";import{RootConfigReadSchema as I}from"@fjall/util/config";import{logger as b}from"@fjall/util/logger";import{SimpleAwsProvider as F}from"../../aws/SimpleAwsProvider.js";import{describeOrganisationAsMember as O}from"../../aws/organisations/organisation.js";import{CdkService as S}from"../../services/infrastructure/CdkService.js";import{emitWarningEvent as j}from"../contextHelpers.js";import{delegationRoleUnusableError as y,deriveZonePhaseState as N,extractDelegationRoleArn as T,readDelegatedTopologyFromProps as z,readDomainStackOutputsByExport as k}from"./delegationResolution.js";const $="WorkerDomainDeployProvider";async function K(f,e){const r=[p(f,e,"fjall-config.json"),p(f,"fjall-config.json")].find(t=>C(t));if(r===void 0)return c([]);let i;try{i=await x(r,"utf8")}catch(t){return a(new Error(`domains phase refused: ${r} exists but could not be read (${u(g(t))}) \u2014 deploying with an unreadable domain registry is not an option.`))}let o;try{o=JSON.parse(i)}catch(t){return a(new Error(`domains phase refused: ${r} is not valid JSON (${u(g(t))}). Cure: fix the file by hand \u2014 do not regenerate it, which would discard capacity-identity pins.`))}const s=I.safeParse(o);return s.success?c((s.data.domains??[]).map(t=>({name:t.name,type:t.type,...t.parentDomain!==void 0?{parentDomain:t.parentDomain}:{},...t.account!==void 0?{account:t.account}:{},...t.region!==void 0?{region:t.region}:{}}))):a(new Error(`domains phase refused: ${r} has a malformed domains/activeTarget/capacityIdentity value \u2014 deploying from a registry that cannot be parsed is not an option. Cure: fix the file by hand.`))}l(K,"readDomainsConfig");class w{static{l(this,"WorkerDomainDeployProvider")}domains;workingDirectory;boundaryDir;credentials;orgConfigSerialised;resolveForeignParentCfn;abortSignal;aws;orgDetailsPromise;constructor(e,n){this.domains=n,this.workingDirectory=e.workingDirectory,this.boundaryDir=e.boundaryDir,this.credentials=e.credentials,this.orgConfigSerialised=e.orgConfigSerialised,this.resolveForeignParentCfn=e.resolveForeignParentCfn,this.abortSignal=e.abortSignal,this.aws=new F(e.credentials)}static async create(e){const n=await K(e.workingDirectory,e.boundaryDir);return n.success?c(new w(e,n.data)):a(n.error)}getDomains(){return this.domains}componentPath(e){return p(this.workingDirectory,this.boundaryDir,"domains",e)}async assembleContext(){this.orgDetailsPromise??=(async()=>{try{const n=await O(this.aws.getClient(R),this.abortSignal);if(!n.success){b.warn($,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:u(n.error.message)});return}return n.data===null?void 0:{orgId:n.data.orgId,managementAccountId:n.data.managementAccountId}}catch(n){b.warn($,"Organisation lookup failed \u2014 domain deploy proceeds without org context",{error:u(g(n))});return}})();const e=await this.orgDetailsPromise;return{accountId:this.credentials.accountId,region:this.credentials.region,...e!==void 0?e:{},...this.orgConfigSerialised!==void 0?{orgConfig:this.orgConfigSerialised}:{}}}cdkCredentials(){return{accessKeyId:this.credentials.accessKeyId,secretAccessKey:this.credentials.secretAccessKey,...this.credentials.sessionToken!==void 0?{sessionToken:this.credentials.sessionToken}:{}}}componentPreconditionError(e){const n=this.componentPath(e);if(!C(n))return new Error(`Domain '${e}' is registered in fjall-config.json but ${n} does not exist in this checkout \u2014 merge the scaffold PR that creates it, or remove the registry entry.`);if(!C(p(n,"infrastructure.ts")))return new Error(`Domain '${e}' has no infrastructure.ts at ${n} \u2014 merge the scaffold/import PR that creates it.`)}async synthForTakeover(e,n){const r=this.componentPreconditionError(e);if(r!==void 0)return a(r);const i=this.componentPath(e),o=await this.assembleContext(),s=new S({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const t=await s.synth(i,{outputCallback:l(d=>{n.onProgress?.({type:"info",message:u(d)})},"outputCallback"),context:o,credentials:this.cdkCredentials()});if(!t.success)return a(new Error(`CDK synth failed: ${u(g(t.error))}`))}finally{s.dispose()}return c({stackNames:[D(e)],cdkOutPath:E(i,"cdk.out")})}async deployDomain(e,n){const r=this.componentPreconditionError(e);return r!==void 0?a(r):this.runCdkDeploy(e,n,{})}async runCdkDeploy(e,n,r,i){const o=this.componentPath(e),s={...await this.assembleContext(),...r},t=new S({...this.abortSignal!==void 0?{abortSignal:this.abortSignal}:{}});try{const d=await t.deploy(o,void 0,{outputCallback:l(h=>{n.onProgress?.({type:"info",message:u(i!==void 0?`${i}${h}`:h)})},"outputCallback"),context:s,credentials:this.cdkCredentials()});if(!d.success)return a(new Error(`CDK deploy failed: ${u(g(d.error))}`))}finally{t.dispose()}return c(void 0)}parseDomainComponent(e){const n=p(this.componentPath(e),"infrastructure.ts");let r;try{r=Z(n,"utf-8")}catch{return}const i=A(r,n,e);return i.success?i.data:void 0}delegationCures(e,n){return`deploy the parent zone first ('fjall domain deploy ${n}' or re-run this organisation deploy after its apex phase succeeds), deploy the child from the CLI with parent-account credentials ('fjall domain deploy ${e}'), or set a literal parentDelegationRoleArn in the child's infrastructure.ts.`}async resolveDelegationForPhase(e,n,r){const i=this.parseDomainComponent(e);if(i!==void 0&&i.registrar==="external-delegated"&&i.parentDelegationRoleArn!==void 0&&i.parentDelegationRoleArn!=="")return r.onProgress?.({type:"info",message:`Using the literal parentDelegationRoleArn declared in ${e}'s infrastructure.ts for the ${n.parentZoneName} delegation`}),c({});const o=this.domains.find(m=>m.name===n.parentZoneName);if(o===void 0)return j(r,`Parent zone ${n.parentZoneName} is not a managed domain in this registry (Case 3) \u2014 no delegation record is written in-stack; delegate ${n.childZoneName} at the parent with 'fjall domain delegate ${e}' after the zone phase`),c({});let s=this.aws.getClient(P),t=this.credentials.accountId;if(o.account!==void 0&&o.account!==this.credentials.accountId){const m=this.resolveForeignParentCfn?.(o.account);if(m===void 0)return a(y(n.parentZoneName,`the parent is registered in account ${o.account} but this deploy holds credentials for account ${this.credentials.accountId} only`,this.delegationCures(e,n.parentZoneName)));s=m,t=o.account}const d=await k(s,n.parentZoneName,this.abortSignal);if(!d.success)return a(y(n.parentZoneName,u(d.error.message),this.delegationCures(e,n.parentZoneName)));if(d.data===void 0)return a(y(n.parentZoneName,`no deployed stack '${D(n.parentZoneName)}' in account ${t}`,this.delegationCures(e,n.parentZoneName)));const h=T(d.data,n.parentZoneName);return h===void 0?a(y(n.parentZoneName,`stack '${D(n.parentZoneName)}' publishes no delegation-role export`,this.delegationCures(e,n.parentZoneName))):c({parentDelegationRoleArn:h})}delegatedDeployer(e){const n=this.parseDomainComponent(e);if(n===void 0)return;const r=z(n);if(r!==void 0)return{zoneName:r.childZoneName,deployPhase:l(async(i,o)=>{const s=this.componentPreconditionError(e);if(s!==void 0)return a(s);const t=await this.resolveDelegationForPhase(e,r,o);return t.success?this.runCdkDeploy(e,o,{domainDeployPhase:i,...t.data},`[${r.childZoneName}] `):a(t.error)},"deployPhase"),zonePhaseState:l(async()=>{const i=await k(this.aws.getClient(P),e,this.abortSignal);return i.success?c(N(i.data,r.childZoneName)):a(i.error)},"zonePhaseState")}}}async function ne(f){return w.create(f)}l(ne,"createWorkerDomainDeployProvider");export{w as WorkerDomainDeployProvider,ne as createWorkerDomainDeployProvider};

package/dist/src/orchestration/domain/cascadeDomainProviderFactory.d.ts

@@ -0,0 +1,61 @@
+import { CloudFormationClient } from "@aws-sdk/client-cloudformation";
+import { type Result } from "@fjall/generator";
+import type { AwsCredentials } from "../../types/credentials.js";
+import type { DomainHome, DomainProviderFactory, DomainDeployProvider } from "../domainInterface.js";
+import { WorkerDomainDeployProvider } from "./WorkerDomainDeployProvider.js";
+/**
+ * Per-home credential strategy for `createCascadeDomainProviderFactory`. The
+ * returned credentials MUST be bound to the home they were minted for
+ * (`accountId`/`region` echo the home) — the factory refuses a mismatch
+ * fail-closed rather than deploy one home under another home's identity.
+ *
+ * CLI: assumes the home's CascadeDeploymentRole from the ambient management
+ * identity (`assumeCascadeRole`). Worker: mints a per-home OIDC session.
+ */
+export type HomeCredentialsMinter = (home: DomainHome) => Promise<Result<AwsCredentials>>;
+export interface CascadeDomainProviderFactoryParams {
+    /** Injected credential strategy — the only surface-specific ingredient. */
+    mintHomeCredentials: HomeCredentialsMinter;
+    /** Absolute path of the checkout the cascade deploys domain components from. */
+    workingDirectory: string;
+    /** Repo-relative boundary directory (e.g. `fjall`) holding fjall-config.json. */
+    boundaryDir: string;
+    /** Serialised org config threaded into each provider's CDK context. */
+    orgConfigSerialised?: string;
+    /**
+     * The EXECUTING identity's CloudFormation reader, seeded into the
+     * foreign-parent registry. The executing home never passes through the
+     * factory, yet it is the most common PARENT home of all: a routed child
+     * whose apex lives with the management account resolves the delegation-role
+     * export through this seed.
+     */
+    executingParentReader?: {
+        accountId: string;
+        cfn: Pick<CloudFormationClient, "send">;
+    };
+    /**
+     * Surface-specific wrap of each minted provider — e.g. the CLI's
+     * deploy-state + P6 reporting decorator. The concrete worker type is
+     * deliberate: decorators may rely on every provider seam being present.
+     */
+    decorateProvider?: (provider: WorkerDomainDeployProvider, home: DomainHome) => DomainDeployProvider;
+    abortSignal?: AbortSignal;
+}
+/**
+ * T2 account routing, shared assembly: build a `DomainProviderFactory` whose
+ * groups deploy through `WorkerDomainDeployProvider` under per-home
+ * credentials. The credential strategy is injected; everything
+ * strategy-independent lives here once — provider construction, the group's
+ * AwsProvider, and the shared foreign-parent reader registry.
+ *
+ * The registry is the subtle part: a routed child whose PARENT zone lives in
+ * another home needs a CloudFormation reader for the parent's account to read
+ * the delegation-role export there (`resolveForeignParentCfn` rung). Every
+ * minted home registers its client; resolution happens at DEPLOY time, after
+ * the engine's pass-1 minting loop has registered every home, so a group
+ * minted early still sees clients registered later. First-mint-wins keeps the
+ * registry deterministic (homes mint in config first-appearance order) and
+ * keeps the executing seed authoritative when a foreign home shares the
+ * executing ACCOUNT under another region.
+ */
+export declare function createCascadeDomainProviderFactory(params: CascadeDomainProviderFactoryParams): DomainProviderFactory;

package/dist/src/orchestration/domain/cascadeDomainProviderFactory.js

@@ -0,0 +1 @@
+var u=Object.defineProperty;var i=(e,t)=>u(e,"name",{value:t,configurable:!0});import{CloudFormationClient as g}from"@aws-sdk/client-cloudformation";import{success as s,failure as a}from"@fjall/generator";import{SimpleAwsProvider as f}from"../../aws/SimpleAwsProvider.js";import{WorkerDomainDeployProvider as l}from"./WorkerDomainDeployProvider.js";function D(e){const t=new Map;e.executingParentReader!==void 0&&t.set(e.executingParentReader.accountId,e.executingParentReader.cfn);const c=i(r=>t.get(r),"resolveForeignParentCfn");return async r=>{const n=await e.mintHomeCredentials(r);if(!n.success)return a(n.error);if(n.data.accountId!==r.accountId||n.data.region!==r.region)return a(new Error(`account routing refused: credentials minted for home ${r.accountId}/${r.region} report ${n.data.accountId}/${n.data.region} \u2014 deploying a home under another home's identity is not an option.`));const d=new f(n.data),o=await l.create({workingDirectory:e.workingDirectory,boundaryDir:e.boundaryDir,credentials:n.data,...e.orgConfigSerialised!==void 0?{orgConfigSerialised:e.orgConfigSerialised}:{},resolveForeignParentCfn:c,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});return o.success?(t.has(r.accountId)||t.set(r.accountId,d.getClient(g)),s({provider:e.decorateProvider?.(o.data,r)??o.data,aws:d})):a(o.error)}}i(D,"createCascadeDomainProviderFactory");export{D as createCascadeDomainProviderFactory};

package/dist/src/orchestration/domain/domainTakeoverGate.d.ts

@@ -24,7 +24,12 @@ import { type DeletedRecordSet } from "./route53Release.js";
  * keeps its richer per-domain interactive ceremony; this gate is the floor,
  * not a replacement.
  */
-/** Everything the gate needs from the cascade's execution context. */
+/**
+ * Everything the gate needs from the cascade's execution context. This is the
+ * EXECUTING identity's context (plus the cascade-scoped consent inputs) —
+ * `deployDomains` widens it into one `DomainsTakeoverGroup` per home when a
+ * `DomainProviderFactory` routes foreign-pinned domains (T2).
+ */
 export interface DomainsTakeoverContext {
     aws: AwsProvider;
     cfnService: Pick<CloudFormationService, "getTemplate">;
@@ -38,6 +43,36 @@ export interface DomainsTakeoverContext {
     route53Client?: Pick<Route53Client, "send">;
     abortSignal?: AbortSignal;
 }
+/**
+ * One home's slice of the gate (T2 account routing): its domains are synthed
+ * by ITS provider, their deployed templates read through ITS CloudFormation
+ * service, and consented releases deleted through ITS Route53 credentials —
+ * a foreign zone's records exist only in the foreign account, so running any
+ * arm through the executing identity would probe/mutate the wrong account.
+ * Consent stays cascade-scoped (`CascadeTakeoverConsentContext`): the
+ * operator answers ONE ticket for the whole cascade, however many homes it
+ * spans.
+ */
+export interface DomainsTakeoverGroup {
+    /** The home this group deploys into — for diagnostics grammar. */
+    readonly home: {
+        readonly accountId?: string;
+        readonly region?: string;
+    };
+    readonly provider: DomainDeployProvider;
+    readonly aws: AwsProvider;
+    readonly cfnService: Pick<CloudFormationService, "getTemplate">;
+    /** Injectable Route53 client for this group's release arm (tests). */
+    readonly route53Client?: Pick<Route53Client, "send">;
+    readonly domains: readonly DomainConfig[];
+}
+/** The cascade-scoped consent inputs — shared across every group. */
+export interface CascadeTakeoverConsentContext {
+    readonly consents?: readonly DestructionConsent[];
+    readonly consentDigest?: string;
+    readonly consentGate?: DestructionConsentGate;
+    readonly abortSignal?: AbortSignal;
+}
 export interface DomainsTakeoverWithheld {
     readonly ticket: DestructionTicket;
     readonly outcome: DestructionOutcome;
@@ -67,5 +102,13 @@ export declare function buildCascadeTakeoverTicket(zoneNames: readonly string[],
  * `abort` verb is an operator withhold, no blanket flag exists, and every
  * withheld path renders the full ticket + verdict table through the warning
  * seam so non-interactive runs stop naming the exact consent spelling.
+ *
+ * T2 account routing: assessment and release run PER GROUP through each
+ * group's own credentials, but the ticket unions every group's collisions
+ * and consent is evaluated ONCE against it — one cascade, one ceremony,
+ * however many homes the domains span. Groups assess sequentially (in the
+ * caller's order) so warning output stays deterministic, and one group's
+ * fail-closed assessment refuses the WHOLE phase: a cascade that cannot
+ * assess every eligible domain must not deploy any of them.
  */
-export declare function runCascadeTakeoverGate(provider: DomainDeployProvider, domains: readonly DomainConfig[], callbacks: DeployCallbacks, context: DomainsTakeoverContext): Promise<Result<DomainsTakeoverGateOutcome>>;
+export declare function runCascadeTakeoverGate(groups: readonly DomainsTakeoverGroup[], callbacks: DeployCallbacks, context: CascadeTakeoverConsentContext): Promise<Result<DomainsTakeoverGateOutcome>>;

package/dist/src/orchestration/domain/domainTakeoverGate.js

@@ -1,2 +1,2 @@
-var E=Object.defineProperty;var p=(s,l)=>E(s,"name",{value:l,configurable:!0});import{Route53Client as N}from"@aws-sdk/client-route-53";import{success as y,failure as g}from"@fjall/generator";import{maskSensitiveOutput as b}from"@fjall/util";import{computeTicketDigest as R,evaluateDestructionConsents as C,renderConsentVerdictLines as I,renderDestructionTicketLines as P}from"../application/destructionGate.js";import{emitWarningEvent as m}from"../contextHelpers.js";import{runRoute53RecordPreflight as z}from"../drift/route53RecordPreflight.js";import{recordPhysicalName as S}from"./recordConsentSpelling.js";import{deleteRecordSetsByKey as L,recordSetKey as F}from"./route53Release.js";function M(s){return`domain-deploy-takeover:${[...s].sort().join(",")}`}p(M,"cascadeTakeoverDigestSeed");function j(s,l){const o=l.map(e=>{const r=S(e.canonicalName,e.type,e.liveSetIdentifier);return{stack:`zone/${e.zoneId}`,logicalId:`Takeover ${r}`,resourceType:"AWS::Route53::RecordSet",physicalName:r,finding:"data-loss-delete",cause:b(`live record in zone ${e.zoneId} (${e.liveDescription}) is not owned by this stack's previous template \u2014 consenting RELEASES it: the live record is deleted so this deploy's CloudFormation stack recreates '${e.declaredName}' (${e.type}) from the declaration, a short DNS gap bounded by the deploy; consent with --remediate '${r}'=recreate`),offendingProperties:[],verdictSource:"drift-probe",dataLossRisk:!0,verbs:["abort","recreate"]}});return{ticketDigest:R(M(s),o),resources:o}}p(j,"buildCascadeTakeoverTicket");async function G(s,l,o,e){if(s.synthForTakeover===void 0)return g(new Error("domains phase refused: this DomainDeployProvider does not implement synthForTakeover, so the record-takeover gate cannot assess collisions \u2014 deploying ungated is not an option. Cure: implement synthForTakeover on the provider (CliDomainDeployProvider and WorkerDomainDeployProvider both do)."));const r=[];for(const c of l){const f=await s.synthForTakeover(c.name,o);if(!f.success)return g(new Error(`[${c.name}] takeover assessment synth failed: ${b(f.error.message)}`));const u=await z(e.aws,{stackNames:f.data.stackNames,cdkOutPath:f.data.cdkOutPath,cfnService:e.cfnService,onLog:p(n=>m(o,n),"onLog"),onUnreadableSynthTemplate:"block",...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(u.kind==="proceed")continue;const i=u.collisions,h=(i??[]).filter(n=>!n.consentable);if(i===void 0||h.length>0){const n=h.map(a=>`  - ${S(a.canonicalName,a.type,a.liveSetIdentifier)}: ${a.nonConsentableReason??"not consentable"}`);return g(new Error([`[${c.name}] ${u.message}`,...n].join(`
-`)))}r.push({domain:c,collisions:i})}return y(r)}p(G,"assessEligibleDomains");async function q(s,l,o,e){const r=await G(s,l,o,e);if(!r.success)return g(r.error);const c=r.data;if(c.length===0)return e.consents!==void 0&&e.consents.length>0&&m(o,"no record collisions \u2014 supplied consents were not needed"),y({kind:"clear",released:[]});const f=c.map(t=>t.domain.name),u=c.flatMap(t=>t.collisions),i=j(f,u),h=e.consents??[];let n=C({ticket:i,consents:h,...e.consentDigest!==void 0?{consentDigest:e.consentDigest}:{}});const a=[];if(!n.satisfied&&e.consentGate!==void 0&&h.length===0&&e.consentDigest===void 0){const t=await e.consentGate.resolve({target:`${f.join(", ")} record takeover`,ticket:i});t.kind==="abort"?a.push("declined at the interactive destruction ceremony \u2014 nothing was deleted, nothing was deployed"):n=C({ticket:i,consents:t.consents,consentDigest:t.ticketDigest})}const D=n.satisfied&&n.rows.some(t=>t.verdict==="matched"&&t.verb==="abort");if(!n.satisfied||D||a.length>0){const t=a.length>0||D?"declined":n.rows.length>0||n.digestMismatch?"consents-invalid":"awaiting-consent";for(const d of P(i))m(o,d);for(const d of I(n))m(o,d);for(const d of a)m(o,d);return t!=="declined"&&m(o,`Consent with --remediate '<name>/<TYPE>[@<setIdentifier>]'=recreate for EVERY row on the ticket (e.g. --remediate '${i.resources[0]?.physicalName??"<name>/<TYPE>"}'=recreate) (exact, case-sensitive). No blanket flag exists: --auto-approve, --skip-confirmation and approval tokens never satisfy this gate.`),y({kind:"withheld",withheld:{ticket:i,outcome:t,...n.rows.length>0||n.digestMismatch?{report:n}:{},reasons:a}})}const T=e.route53Client??e.aws.getClient(N),k=new Map;for(const t of u){const d=k.get(t.zoneId)??new Set;d.add(F(t.canonicalName,t.type,t.liveSetIdentifier)),k.set(t.zoneId,d)}const $=[];for(const[t,d]of k){const v=await L(T,t,d,e.abortSignal);if(!v.success)return g(v.error);for(const w of v.data)m(o,`Released live record ${S(w.name,w.type,w.setIdentifier)} from zone ${t} \u2014 this deploy's stack recreates it from the declaration`);$.push(...v.data)}return y({kind:"clear",released:$})}p(q,"runCascadeTakeoverGate");export{j as buildCascadeTakeoverTicket,M as cascadeTakeoverDigestSeed,q as runCascadeTakeoverGate};
+var N=Object.defineProperty;var g=(s,r)=>N(s,"name",{value:r,configurable:!0});import{Route53Client as R}from"@aws-sdk/client-route-53";import{success as w,failure as v}from"@fjall/generator";import{maskSensitiveOutput as C}from"@fjall/util";import{computeTicketDigest as E,evaluateDestructionConsents as T,renderConsentVerdictLines as I,renderDestructionTicketLines as P}from"../application/destructionGate.js";import{emitWarningEvent as u}from"../contextHelpers.js";import{runRoute53RecordPreflight as z}from"../drift/route53RecordPreflight.js";import{recordPhysicalName as $}from"./recordConsentSpelling.js";import{deleteRecordSetsByKey as L,recordSetKey as F}from"./route53Release.js";function M(s){return`domain-deploy-takeover:${[...s].sort().join(",")}`}g(M,"cascadeTakeoverDigestSeed");function G(s,r){const n=r.map(t=>{const c=$(t.canonicalName,t.type,t.liveSetIdentifier);return{stack:`zone/${t.zoneId}`,logicalId:`Takeover ${c}`,resourceType:"AWS::Route53::RecordSet",physicalName:c,finding:"data-loss-delete",cause:C(`live record in zone ${t.zoneId} (${t.liveDescription}) is not owned by this stack's previous template \u2014 consenting RELEASES it: the live record is deleted so this deploy's CloudFormation stack recreates '${t.declaredName}' (${t.type}) from the declaration, a short DNS gap bounded by the deploy; consent with --remediate '${c}'=recreate`),offendingProperties:[],verdictSource:"drift-probe",dataLossRisk:!0,verbs:["abort","recreate"]}});return{ticketDigest:E(M(s),n),resources:n}}g(G,"buildCascadeTakeoverTicket");async function j(s,r,n){const{provider:t}=s;if(t.synthForTakeover===void 0)return v(new Error("domains phase refused: this DomainDeployProvider does not implement synthForTakeover, so the record-takeover gate cannot assess collisions \u2014 deploying ungated is not an option. Cure: implement synthForTakeover on the provider (CliDomainDeployProvider and WorkerDomainDeployProvider both do)."));const c=[];for(const p of s.domains){const d=await t.synthForTakeover(p.name,r);if(!d.success)return v(new Error(`[${p.name}] takeover assessment synth failed: ${C(d.error.message)}`));const h=await z(s.aws,{stackNames:d.data.stackNames,cdkOutPath:d.data.cdkOutPath,cfnService:s.cfnService,onLog:g(l=>u(r,l),"onLog"),onUnreadableSynthTemplate:"block",...n!==void 0?{abortSignal:n}:{}});if(h.kind==="proceed")continue;const o=h.collisions,f=(o??[]).filter(l=>!l.consentable);if(o===void 0||f.length>0){const l=f.map(m=>`  - ${$(m.canonicalName,m.type,m.liveSetIdentifier)}: ${m.nonConsentableReason??"not consentable"}`);return v(new Error([`[${p.name}] ${h.message}`,...l].join(`
+`)))}c.push({group:s,domain:p,collisions:o})}return w(c)}g(j,"assessGroupDomains");async function q(s,r,n){const t=[];for(const e of s){const i=await j(e,r,n.abortSignal);if(!i.success)return v(i.error);t.push(...i.data)}if(t.length===0)return n.consents!==void 0&&n.consents.length>0&&u(r,"no record collisions \u2014 supplied consents were not needed"),w({kind:"clear",released:[]});const c=t.map(e=>e.domain.name),p=t.flatMap(e=>e.collisions),d=G(c,p),h=n.consents??[];let o=T({ticket:d,consents:h,...n.consentDigest!==void 0?{consentDigest:n.consentDigest}:{}});const f=[];if(!o.satisfied&&n.consentGate!==void 0&&h.length===0&&n.consentDigest===void 0){const e=await n.consentGate.resolve({target:`${c.join(", ")} record takeover`,ticket:d});e.kind==="abort"?f.push("declined at the interactive destruction ceremony \u2014 nothing was deleted, nothing was deployed"):o=T({ticket:d,consents:e.consents,consentDigest:e.ticketDigest})}const l=o.satisfied&&o.rows.some(e=>e.verdict==="matched"&&e.verb==="abort");if(!o.satisfied||l||f.length>0){const e=f.length>0||l?"declined":o.rows.length>0||o.digestMismatch?"consents-invalid":"awaiting-consent";for(const i of P(d))u(r,i);for(const i of I(o))u(r,i);for(const i of f)u(r,i);return e!=="declined"&&u(r,`Consent with --remediate '<name>/<TYPE>[@<setIdentifier>]'=recreate for EVERY row on the ticket (e.g. --remediate '${d.resources[0]?.physicalName??"<name>/<TYPE>"}'=recreate) (exact, case-sensitive). No blanket flag exists: --auto-approve, --skip-confirmation and approval tokens never satisfy this gate.`),w({kind:"withheld",withheld:{ticket:d,outcome:e,...o.rows.length>0||o.digestMismatch?{report:o}:{},reasons:f}})}const m=[];for(const e of s){const i=t.filter(a=>a.group===e).flatMap(a=>a.collisions);if(i.length===0)continue;const b=e.route53Client??e.aws.getClient(R),D=new Map;for(const a of i){const y=D.get(a.zoneId)??new Set;y.add(F(a.canonicalName,a.type,a.liveSetIdentifier)),D.set(a.zoneId,y)}for(const[a,y]of D){const k=await L(b,a,y,n.abortSignal);if(!k.success)return v(k.error);for(const S of k.data)u(r,`Released live record ${$(S.name,S.type,S.setIdentifier)} from zone ${a} \u2014 this deploy's stack recreates it from the declaration`);m.push(...k.data)}}return w({kind:"clear",released:m})}g(q,"runCascadeTakeoverGate");export{G as buildCascadeTakeoverTicket,M as cascadeTakeoverDigestSeed,q as runCascadeTakeoverGate};

package/dist/src/orchestration/domain/index.d.ts

@@ -13,5 +13,6 @@ export { classifyZoneRecords, buildSatelliteRecordIndex, createSystemDnsNameProb
 export { isRoute53NameServer, isDelegatedToRoute53 } from "./route53Delegation.js";
 export { recordPhysicalName, parseRecordPhysicalName, type RecordConsentIdentity } from "./recordConsentSpelling.js";
 export { recordSetKey, deleteRecordSetsByKey, type DeletedRecordSet } from "./route53Release.js";
-export { cascadeTakeoverDigestSeed, buildCascadeTakeoverTicket, runCascadeTakeoverGate, type DomainsTakeoverContext, type DomainsTakeoverWithheld, type DomainsTakeoverGateOutcome } from "./domainTakeoverGate.js";
+export { cascadeTakeoverDigestSeed, buildCascadeTakeoverTicket, runCascadeTakeoverGate, type DomainsTakeoverContext, type DomainsTakeoverGroup, type CascadeTakeoverConsentContext, type DomainsTakeoverWithheld, type DomainsTakeoverGateOutcome } from "./domainTakeoverGate.js";
 export { WorkerDomainDeployProvider, createWorkerDomainDeployProvider, type WorkerDomainDeployProviderParams } from "./WorkerDomainDeployProvider.js";
+export { createCascadeDomainProviderFactory, type HomeCredentialsMinter, type CascadeDomainProviderFactoryParams } from "./cascadeDomainProviderFactory.js";

package/dist/src/orchestration/domain/index.js

@@ -1 +1 @@
-import{DOMAIN_DELEGATION_ERROR_TYPES as o,DomainDelegationError as a,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as t,PUBLIC_DNS_QUERY_TIMEOUT_MS as s,createPublicResolvers as m,normaliseDnsName as i,isDnsEmptyAnswer as l}from"./types.js";import{NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as D,NS_PROPAGATION_DEFAULT_INTERVAL_MS as d,waitForNsPropagation as c}from"./nsPropagationGate.js";import{ACM_CAA_ISSUERS as E,caaAncestorChain as S,formatCaaRecord as _,runCaaPreflight as p}from"./caaPreflight.js";import{delegationRoleUnusableError as T,deriveZonePhaseState as A,extractDelegationRoleArn as N,readDelegatedTopologyFromProps as y,readDomainStackOutputsByExport as f}from"./delegationResolution.js";import{deployDelegatedDomain as O}from"./delegatedDomainDeploy.js";import{CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as g,templateOwnsDelegationRecord as u,deleteChildNsFromParent as I,nsDelegationPhysicalName as U,runDelegatedDomainDestroy as L}from"./delegationDestroyMirror.js";import{classifyZoneRecords as h,buildSatelliteRecordIndex as k,createSystemDnsNameProbe as M,systemDnsNameProbe as b,normaliseRecordName as F}from"./zoneClassifier.js";import{isRoute53NameServer as B,isDelegatedToRoute53 as w}from"./route53Delegation.js";import{recordPhysicalName as K,parseRecordPhysicalName as V}from"./recordConsentSpelling.js";import{recordSetKey as Z,deleteRecordSetsByKey as Q}from"./route53Release.js";import{cascadeTakeoverDigestSeed as j,buildCascadeTakeoverTicket as q,runCascadeTakeoverGate as z}from"./domainTakeoverGate.js";import{WorkerDomainDeployProvider as J,createWorkerDomainDeployProvider as $}from"./WorkerDomainDeployProvider.js";export{E as ACM_CAA_ISSUERS,g as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,t as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,o as DOMAIN_DELEGATION_ERROR_TYPES,a as DomainDelegationError,d as NS_PROPAGATION_DEFAULT_INTERVAL_MS,D as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,s as PUBLIC_DNS_QUERY_TIMEOUT_MS,J as WorkerDomainDeployProvider,q as buildCascadeTakeoverTicket,k as buildSatelliteRecordIndex,S as caaAncestorChain,j as cascadeTakeoverDigestSeed,h as classifyZoneRecords,m as createPublicResolvers,M as createSystemDnsNameProbe,$ as createWorkerDomainDeployProvider,T as delegationRoleUnusableError,I as deleteChildNsFromParent,Q as deleteRecordSetsByKey,O as deployDelegatedDomain,A as deriveZonePhaseState,N as extractDelegationRoleArn,_ as formatCaaRecord,w as isDelegatedToRoute53,l as isDnsEmptyAnswer,B as isRoute53NameServer,i as normaliseDnsName,F as normaliseRecordName,U as nsDelegationPhysicalName,V as parseRecordPhysicalName,y as readDelegatedTopologyFromProps,f as readDomainStackOutputsByExport,K as recordPhysicalName,Z as recordSetKey,p as runCaaPreflight,z as runCascadeTakeoverGate,L as runDelegatedDomainDestroy,b as systemDnsNameProbe,u as templateOwnsDelegationRecord,c as waitForNsPropagation};
+import{DOMAIN_DELEGATION_ERROR_TYPES as o,DomainDelegationError as a,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as t,PUBLIC_DNS_QUERY_TIMEOUT_MS as s,createPublicResolvers as m,normaliseDnsName as i,isDnsEmptyAnswer as l}from"./types.js";import{NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as d,NS_PROPAGATION_DEFAULT_INTERVAL_MS as D,waitForNsPropagation as c}from"./nsPropagationGate.js";import{ACM_CAA_ISSUERS as E,caaAncestorChain as S,formatCaaRecord as p,runCaaPreflight as _}from"./caaPreflight.js";import{delegationRoleUnusableError as T,deriveZonePhaseState as A,extractDelegationRoleArn as N,readDelegatedTopologyFromProps as y,readDomainStackOutputsByExport as f}from"./delegationResolution.js";import{deployDelegatedDomain as C}from"./delegatedDomainDeploy.js";import{CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as g,templateOwnsDelegationRecord as u,deleteChildNsFromParent as I,nsDelegationPhysicalName as U,runDelegatedDomainDestroy as v}from"./delegationDestroyMirror.js";import{classifyZoneRecords as h,buildSatelliteRecordIndex as k,createSystemDnsNameProbe as F,systemDnsNameProbe as M,normaliseRecordName as b}from"./zoneClassifier.js";import{isRoute53NameServer as B,isDelegatedToRoute53 as w}from"./route53Delegation.js";import{recordPhysicalName as K,parseRecordPhysicalName as V}from"./recordConsentSpelling.js";import{recordSetKey as Z,deleteRecordSetsByKey as Q}from"./route53Release.js";import{cascadeTakeoverDigestSeed as j,buildCascadeTakeoverTicket as q,runCascadeTakeoverGate as z}from"./domainTakeoverGate.js";import{WorkerDomainDeployProvider as J,createWorkerDomainDeployProvider as $}from"./WorkerDomainDeployProvider.js";import{createCascadeDomainProviderFactory as re}from"./cascadeDomainProviderFactory.js";export{E as ACM_CAA_ISSUERS,g as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,t as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,o as DOMAIN_DELEGATION_ERROR_TYPES,a as DomainDelegationError,D as NS_PROPAGATION_DEFAULT_INTERVAL_MS,d as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,s as PUBLIC_DNS_QUERY_TIMEOUT_MS,J as WorkerDomainDeployProvider,q as buildCascadeTakeoverTicket,k as buildSatelliteRecordIndex,S as caaAncestorChain,j as cascadeTakeoverDigestSeed,h as classifyZoneRecords,re as createCascadeDomainProviderFactory,m as createPublicResolvers,F as createSystemDnsNameProbe,$ as createWorkerDomainDeployProvider,T as delegationRoleUnusableError,I as deleteChildNsFromParent,Q as deleteRecordSetsByKey,C as deployDelegatedDomain,A as deriveZonePhaseState,N as extractDelegationRoleArn,p as formatCaaRecord,w as isDelegatedToRoute53,l as isDnsEmptyAnswer,B as isRoute53NameServer,i as normaliseDnsName,b as normaliseRecordName,U as nsDelegationPhysicalName,V as parseRecordPhysicalName,y as readDelegatedTopologyFromProps,f as readDomainStackOutputsByExport,K as recordPhysicalName,Z as recordSetKey,_ as runCaaPreflight,z as runCascadeTakeoverGate,v as runDelegatedDomainDestroy,M as systemDnsNameProbe,u as templateOwnsDelegationRecord,c as waitForNsPropagation};

package/dist/src/orchestration/domainInterface.d.ts

@@ -1,4 +1,5 @@
 import type { Result } from "@fjall/generator";
+import type { AwsProvider } from "../aws/AwsProvider.js";
 import type { DeployCallbacks } from "../types/callbacks.js";
 import type { DelegatedDomainDeployer } from "./domain/delegatedDomainDeploy.js";
 import type { DomainsTakeoverWithheld } from "./domain/domainTakeoverGate.js";
@@ -93,6 +94,37 @@ export interface DomainDeployProvider {
      */
     synthForTakeover?(domainName: string, callbacks: DeployCallbacks): Promise<Result<DomainTakeoverSynth>>;
 }
+/**
+ * The resolved home of a domain group: each pin key defaulted to the
+ * cascade's executing identity, so two entries pinning only `account` to the
+ * same value land in one group. Always fully resolved — the factory never
+ * sees a partial pin.
+ */
+export interface DomainHome {
+    readonly accountId: string;
+    readonly region: string;
+}
+/**
+ * Group-scoped execution context minted by a `DomainProviderFactory`: the
+ * provider deploys INTO the home, and the AWS provider holds credentials FOR
+ * it (the takeover gate's template reads and record releases run through this,
+ * never through the cascade's executing identity). Derived services
+ * (CloudFormationService) are constructed engine-side from `aws`.
+ */
+export interface DomainProviderGroup {
+    readonly provider: DomainDeployProvider;
+    readonly aws: AwsProvider;
+}
+/**
+ * T2 account routing: mint a provider context for a home OTHER than the one
+ * the cascade executes under. `deployDomains` calls this once per distinct
+ * foreign `(account, region)` pin among the configured domains — the caller
+ * decides HOW to reach the home (worker: per-account OIDC role; CLI:
+ * OrganizationAccountAccessRole from a management identity). A failure
+ * degrades that home's domains to the pre-routing skip-with-warning, never to
+ * a phase error: routing is an upgrade over the skip, not a new way to fail.
+ */
+export type DomainProviderFactory = (home: DomainHome) => Promise<Result<DomainProviderGroup>>;
 /** Assembly facts the takeover preflight reads for one domain. */
 export interface DomainTakeoverSynth {
     /** Stack artifact names whose templates claim Route53 record sets. */

package/dist/src/orchestration/index.d.ts

@@ -39,7 +39,7 @@ export { buildBuildSecretSessionPolicy, partitionForRegion, type BuildSecretRef,
 export { buildDeploySessionPolicy, type DeploySessionContext } from "./application/deploySessionPolicy.js";
 export { resolveBuildArgs, type ResolveBuildArgsContext, type ResolveBuildArgsResult, type SourcedBuildArgResolver } from "./application/buildArgResolver.js";
 export { validateBuildGroup, type ValidateBuildGroupInput, type BuildGroupMemberInputs } from "./application/buildGroupValidator.js";
-export type { DomainDeployProvider, DomainConfig, DomainDeployResult, DomainTakeoverSynth } from "./domainInterface.js";
+export type { DomainDeployProvider, DomainConfig, DomainDeployResult, DomainTakeoverSynth, DomainHome, DomainProviderGroup, DomainProviderFactory } from "./domainInterface.js";
 export * from "./domain/index.js";
 export type { DeployServices } from "./serviceFactory.js";
 export type { DetectionResult } from "./application/detectionPipeline.js";
@@ -53,7 +53,7 @@ export { runApprovalGate, approvalRefusalReason, type RunApprovalGateParams, typ
 export { runDestructionGate, buildDestructionTicket, evaluateDestructionConsents, computeTicketDigest, legalRemediationVerbs, executableRemediationVerbs, advertisableRemediationVerbs, renderDestructionTicketLines, renderConsentVerdictLines, type RunDestructionGateParams, type DestructionGateOutcome, type EvaluateDestructionConsentsParams } from "./application/destructionGate.js";
 export { loadDeployPlan, createMemoisedPlanLoader, type LoadDeployPlanParams, type DeployPlanLoader } from "./application/plan/loadDeployPlan.js";
 export { classifyDriftFailure, fetchLastOperationEvents } from "./drift/classifyDriftFailure.js";
-export { DriftProbe, type DriftProbeOptions, type DriftProbeRunner, type ProbeDriftSuspectsParams } from "./drift/driftProbe.js";
+export { DriftProbe, probePhysicalPresence, type DriftProbeOptions, type DriftProbeRunner, type PhysicalPresenceOutcome, type ProbeDriftSuspectsParams } from "./drift/driftProbe.js";
 export { clearDriftSuspects, defaultDriftJournalDir, readDriftSuspects, recordDriftSuspects, type DriftJournalOptions, type RecordDriftSuspectsParams } from "./drift/driftSuspectJournal.js";
 export { detectStackDrift, type DetectStackDriftDeps, type DetectStackDriftParams, type StackDriftReport } from "./drift/detectStackDrift.js";
 export { runDriftPreFlight, formatDriftPreFlightBlock, DRIFT_PREFLIGHT_TRIGGER_STATUSES, DRIFT_PREFLIGHT_BUDGET_MS, type RunDriftPreFlightParams, type DriftPreFlightBlockExtras, type DriftPreFlightOutcome } from "./drift/driftPreFlight.js";

package/dist/src/orchestration/index.js

@@ -1 +1 @@
-import{deploy as t}from"./deploy.js";import{destroy as i}from"./destroy.js";import{restart as n,probeSecretsDrift as s,probeServiceDeploymentStatus as c}from"./restart/restartApplication.js";import{computeSecretsDrift as p,deriveStaleParameters as m,extractConsumedSsmParameters as u,ssmParameterNameFromValueFrom as f}from"./restart/secretsDrift.js";import{deployOrganisation as R}from"./organisation/organisationDeploy.js";import{destroyOrganisation as x}from"./organisation/organisationDestroy.js";import{cleanupFailedStack as T,emptyS3Bucket as y,preEmptyStackBuckets as A,formatQuarantineSuspectedMessage as E,formatRetainedBucketsMessage as D,isQuarantineDetail as g,isRetainedBucketsDetail as _,PRE_EMPTY_TAG_KEYS as O,isCleanableState as v,SAFE_CLEANUP_STATES as F}from"./stackCleanup.js";import{partitionAccounts as B,buildRegionList as L,buildAccountRegionPairs as b,cascadeHomeRegion as C,cascadeOperationKey as I}from"./organisation/cascadeHelpers.js";import{projectScalarSummary as h,projectAccountRows as G}from"./organisation/cascadeSummary.js";import{reconcileProviderAccounts as K,mergeReconciledProviderAccounts as M}from"./organisation/reconcileProviderAccounts.js";import{decideNextTransition as V,reconcileTrailMigration as J,ORG_TRAIL_BUCKET_OUTPUT_KEY as H,TRAIL_BUCKET_OUTPUT_KEY as Q,TRAIL_KEY_ARN_OUTPUT_KEY as w}from"./trailMigration/trailMigration.js";import{decommissionMemberTrailStorage as W}from"./trailMigration/memberTrailCleanup.js";import{unlockBucket as z}from"./unlock/unlockBucket.js";import{unlockQueue as Z}from"./unlock/unlockQueue.js";import{triageBucketPolicy as ee,isEnforceSslStatement as re}from"./unlock/bucketPolicyTriage.js";import{toResourcePolicyStatements as oe}from"./unlock/toResourcePolicyStatements.js";import{restoreBucketPolicy as ae,synthesiseEnforceSslDocument as ne,ensureEnforceSsl as se}from"./unlock/restoreBucketPolicy.js";import{restoreAndReconcileQuarantinedBucket as le}from"./unlock/restoreAndReconcileQuarantinedBucket.js";import{parseAccountsConfiguration as me,flattenAccountsToEnvironments as ue,extractAllAccountNames as fe,accountsConfigToOUTree as de,isStringArray as Re,isAccountsConfig as Se,isOuOnlyAccountBucket as xe,OU_ONLY_ACCOUNT_BUCKETS as Pe}from"./organisation/accountsConfig.js";import{resolveBuildSecrets as ye,resolveSecretRefValue as Ae,resolveBuildSecretSessionProvider as Ee,sourcedRefsFromBuildArgs as De}from"./application/buildSecretResolver.js";import{buildBuildSecretSessionPolicy as _e,partitionForRegion as Oe}from"./application/buildSecretSession.js";import{buildDeploySessionPolicy as Fe}from"./application/deploySessionPolicy.js";import{resolveBuildArgs as Be}from"./application/buildArgResolver.js";import{validateBuildGroup as be}from"./application/buildGroupValidator.js";export*from"./domain/index.js";import{runOpenNextBuild as Ue}from"./application/openNextBuild.js";import{runOrganisationSetup as Ge,ORG_SETUP_PHASES as Ne}from"./organisation/organisationSetup.js";export*from"./builders/index.js";import{buildDeployPlan as Ye,computeDeployPlan as Ve,computeAssemblyDigest as Je,digestHead as He,classifyImpact as Qe,derivePropertyChanges as we,isDataLoss as je,isStatefulResourceType as We,renderPlanSummary as qe,renderPlanLines as ze,toWirePlanChanges as Xe,signApprovalToken as Ze,verifyApprovalToken as $e,DEFAULT_APPROVAL_TTL_MS as er,APPROVAL_TOKEN_PATTERN as rr}from"./application/plan/index.js";import{runApprovalGate as or,approvalRefusalReason as ir}from"./application/approvalGate.js";import{runDestructionGate as nr,buildDestructionTicket as sr,evaluateDestructionConsents as cr,computeTicketDigest as lr,legalRemediationVerbs as pr,executableRemediationVerbs as mr,advertisableRemediationVerbs as ur,renderDestructionTicketLines as fr,renderConsentVerdictLines as dr}from"./application/destructionGate.js";import{loadDeployPlan as Sr,createMemoisedPlanLoader as xr}from"./application/plan/loadDeployPlan.js";import{classifyDriftFailure as Tr,fetchLastOperationEvents as yr}from"./drift/classifyDriftFailure.js";import{DriftProbe as Er}from"./drift/driftProbe.js";import{clearDriftSuspects as gr,defaultDriftJournalDir as _r,readDriftSuspects as Or,recordDriftSuspects as vr}from"./drift/driftSuspectJournal.js";import{detectStackDrift as kr}from"./drift/detectStackDrift.js";import{runDriftPreFlight as Lr,formatDriftPreFlightBlock as br,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Cr,DRIFT_PREFLIGHT_BUDGET_MS as Ir}from"./drift/driftPreFlight.js";import{runRoute53RecordPreflight as hr}from"./drift/route53RecordPreflight.js";import{archiveCompletedRemediationJournal as Nr,computeRemediationOpId as Kr,defaultRemediationJournalDir as Mr,findRemediationJournalByOpId as Yr,listActiveRemediationOps as Vr,listActiveRemediationOpsForContext as Jr,readRemediationJournal as Hr,sweepExpiredRemediationJournals as Qr,writeRemediationJournal as wr,REMEDIATION_JOURNAL_RETENTION_DAYS as jr}from"./remediation/remediationJournal.js";import{captureRemediationForensics as qr,defaultRemediationForensicsDir as zr}from"./remediation/forensicsCapture.js";import{applyRetainFlip as Zr,composeFlipCapabilities as $r,computeTemplateDigest as et,deriveRetainFlipTemplate as rt,findMarkedResourcesByOpId as tt,proveFlipMetadataOnly as ot,readRetainFlipState as it,verifyRetainFlipDiff as at,FORGET_MARKER_KEY as nt,FORGET_FLIP_SPEC as st,RECREATE_MARKER_KEY as ct}from"./remediation/retainFlip.js";import{assessForgetResumability as pt,completeForgetAfterConverge as mt,completeForgetAfterDeploy as ut,formatRecreateInFlightCures as ft,partitionPreFlightByRemediation as dt,runForgetSurgery as Rt,synthTemplateDeclaresResource as St}from"./remediation/forgetResource.js";import{runRecreateSurgery as Pt,snapshotPolicyForType as Tt,SNAPSHOT_CAPABLE_RESOURCE_TYPES as yt}from"./remediation/recreateResource.js";import{runRecreatePreFlight as Et}from"./remediation/recreatePreFlight.js";import{deriveRemovalTemplate as gt,findRemovalDeletionFailures as _t,findResourcesPresent as Ot,proveRemovalTargetsOnly as vt}from"./remediation/removalUpdate.js";import{advertisableDriftVerbs as kt,buildDriftRepairTicket as Bt,runDriftRepairGate as Lt}from"./remediation/driftRepairGate.js";import{formatPinOutcomeDetail as Ct,pinProbeCoverage as It,renderPinReportLines as Ut,runPinRemediation as ht}from"./remediation/pinRemediation.js";import{composePostFailureRepairOffer as Nt,formatDriftRepairOffer as Kt,DriftRepairAvailableError as Mt}from"./remediation/postFailureRepairOffer.js";import{captureLegacySurfaces as Vt,decodeLegacyAnchor as Jt,runIdentitySurfaceGate as Ht}from"./remediation/pinIdentity.js";import{collectIdentityPinCandidates as wt,degradedIdentityPinOutcomes as jt,renderIdentityPinReportLines as Wt,runIdentityPinMigration as qt}from"./remediation/migrateIdentity.js";import{checkDeployPathStackAvailability as Xt,isDeployPathBlockingStatus as Zt,StackUnavailableError as $t}from"./activeDeploymentGuard.js";import{assertLeaseBeforeStack as ro,LeaseDeniedError as to}from"./application/leaseGate.js";export{rr as APPROVAL_TOKEN_PATTERN,er as DEFAULT_APPROVAL_TTL_MS,Ir as DRIFT_PREFLIGHT_BUDGET_MS,Cr as DRIFT_PREFLIGHT_TRIGGER_STATUSES,Er as DriftProbe,Mt as DriftRepairAvailableError,st as FORGET_FLIP_SPEC,nt as FORGET_MARKER_KEY,to as LeaseDeniedError,Ne as ORG_SETUP_PHASES,H as ORG_TRAIL_BUCKET_OUTPUT_KEY,Pe as OU_ONLY_ACCOUNT_BUCKETS,O as PRE_EMPTY_TAG_KEYS,ct as RECREATE_MARKER_KEY,jr as REMEDIATION_JOURNAL_RETENTION_DAYS,F as SAFE_CLEANUP_STATES,yt as SNAPSHOT_CAPABLE_RESOURCE_TYPES,$t as StackUnavailableError,Q as TRAIL_BUCKET_OUTPUT_KEY,w as TRAIL_KEY_ARN_OUTPUT_KEY,de as accountsConfigToOUTree,kt as advertisableDriftVerbs,ur as advertisableRemediationVerbs,Zr as applyRetainFlip,ir as approvalRefusalReason,Nr as archiveCompletedRemediationJournal,ro as assertLeaseBeforeStack,pt as assessForgetResumability,b as buildAccountRegionPairs,_e as buildBuildSecretSessionPolicy,Ye as buildDeployPlan,Fe as buildDeploySessionPolicy,sr as buildDestructionTicket,Bt as buildDriftRepairTicket,L as buildRegionList,Vt as captureLegacySurfaces,qr as captureRemediationForensics,C as cascadeHomeRegion,I as cascadeOperationKey,Xt as checkDeployPathStackAvailability,Tr as classifyDriftFailure,Qe as classifyImpact,T as cleanupFailedStack,gr as clearDriftSuspects,wt as collectIdentityPinCandidates,mt as completeForgetAfterConverge,ut as completeForgetAfterDeploy,$r as composeFlipCapabilities,Nt as composePostFailureRepairOffer,Je as computeAssemblyDigest,Ve as computeDeployPlan,Kr as computeRemediationOpId,p as computeSecretsDrift,et as computeTemplateDigest,lr as computeTicketDigest,xr as createMemoisedPlanLoader,V as decideNextTransition,Jt as decodeLegacyAnchor,W as decommissionMemberTrailStorage,_r as defaultDriftJournalDir,zr as defaultRemediationForensicsDir,Mr as defaultRemediationJournalDir,jt as degradedIdentityPinOutcomes,t as deploy,R as deployOrganisation,we as derivePropertyChanges,gt as deriveRemovalTemplate,rt as deriveRetainFlipTemplate,m as deriveStaleParameters,i as destroy,x as destroyOrganisation,kr as detectStackDrift,He as digestHead,y as emptyS3Bucket,se as ensureEnforceSsl,cr as evaluateDestructionConsents,mr as executableRemediationVerbs,fe as extractAllAccountNames,u as extractConsumedSsmParameters,yr as fetchLastOperationEvents,tt as findMarkedResourcesByOpId,Yr as findRemediationJournalByOpId,_t as findRemovalDeletionFailures,Ot as findResourcesPresent,ue as flattenAccountsToEnvironments,br as formatDriftPreFlightBlock,Kt as formatDriftRepairOffer,Ct as formatPinOutcomeDetail,E as formatQuarantineSuspectedMessage,ft as formatRecreateInFlightCures,D as formatRetainedBucketsMessage,Se as isAccountsConfig,v as isCleanableState,je as isDataLoss,Zt as isDeployPathBlockingStatus,re as isEnforceSslStatement,xe as isOuOnlyAccountBucket,g as isQuarantineDetail,_ as isRetainedBucketsDetail,We as isStatefulResourceType,Re as isStringArray,pr as legalRemediationVerbs,Vr as listActiveRemediationOps,Jr as listActiveRemediationOpsForContext,Sr as loadDeployPlan,M as mergeReconciledProviderAccounts,me as parseAccountsConfiguration,B as partitionAccounts,Oe as partitionForRegion,dt as partitionPreFlightByRemediation,It as pinProbeCoverage,A as preEmptyStackBuckets,s as probeSecretsDrift,c as probeServiceDeploymentStatus,G as projectAccountRows,h as projectScalarSummary,ot as proveFlipMetadataOnly,vt as proveRemovalTargetsOnly,Or as readDriftSuspects,Hr as readRemediationJournal,it as readRetainFlipState,K as reconcileProviderAccounts,J as reconcileTrailMigration,vr as recordDriftSuspects,dr as renderConsentVerdictLines,fr as renderDestructionTicketLines,Wt as renderIdentityPinReportLines,Ut as renderPinReportLines,ze as renderPlanLines,qe as renderPlanSummary,Be as resolveBuildArgs,Ee as resolveBuildSecretSessionProvider,ye as resolveBuildSecrets,Ae as resolveSecretRefValue,n as restart,le as restoreAndReconcileQuarantinedBucket,ae as restoreBucketPolicy,or as runApprovalGate,nr as runDestructionGate,Lr as runDriftPreFlight,Lt as runDriftRepairGate,Rt as runForgetSurgery,qt as runIdentityPinMigration,Ht as runIdentitySurfaceGate,Ue as runOpenNextBuild,Ge as runOrganisationSetup,ht as runPinRemediation,Et as runRecreatePreFlight,Pt as runRecreateSurgery,hr as runRoute53RecordPreflight,Ze as signApprovalToken,Tt as snapshotPolicyForType,De as sourcedRefsFromBuildArgs,f as ssmParameterNameFromValueFrom,Qr as sweepExpiredRemediationJournals,St as synthTemplateDeclaresResource,ne as synthesiseEnforceSslDocument,oe as toResourcePolicyStatements,Xe as toWirePlanChanges,ee as triageBucketPolicy,z as unlockBucket,Z as unlockQueue,be as validateBuildGroup,$e as verifyApprovalToken,at as verifyRetainFlipDiff,wr as writeRemediationJournal};
+import{deploy as t}from"./deploy.js";import{destroy as i}from"./destroy.js";import{restart as n,probeSecretsDrift as s,probeServiceDeploymentStatus as c}from"./restart/restartApplication.js";import{computeSecretsDrift as p,deriveStaleParameters as m,extractConsumedSsmParameters as u,ssmParameterNameFromValueFrom as f}from"./restart/secretsDrift.js";import{deployOrganisation as R}from"./organisation/organisationDeploy.js";import{destroyOrganisation as P}from"./organisation/organisationDestroy.js";import{cleanupFailedStack as T,emptyS3Bucket as y,preEmptyStackBuckets as A,formatQuarantineSuspectedMessage as E,formatRetainedBucketsMessage as D,isQuarantineDetail as g,isRetainedBucketsDetail as _,PRE_EMPTY_TAG_KEYS as O,isCleanableState as v,SAFE_CLEANUP_STATES as F}from"./stackCleanup.js";import{partitionAccounts as k,buildRegionList as B,buildAccountRegionPairs as L,cascadeHomeRegion as C,cascadeOperationKey as I}from"./organisation/cascadeHelpers.js";import{projectScalarSummary as h,projectAccountRows as G}from"./organisation/cascadeSummary.js";import{reconcileProviderAccounts as K,mergeReconciledProviderAccounts as M}from"./organisation/reconcileProviderAccounts.js";import{decideNextTransition as V,reconcileTrailMigration as J,ORG_TRAIL_BUCKET_OUTPUT_KEY as H,TRAIL_BUCKET_OUTPUT_KEY as Q,TRAIL_KEY_ARN_OUTPUT_KEY as w}from"./trailMigration/trailMigration.js";import{decommissionMemberTrailStorage as W}from"./trailMigration/memberTrailCleanup.js";import{unlockBucket as z}from"./unlock/unlockBucket.js";import{unlockQueue as Z}from"./unlock/unlockQueue.js";import{triageBucketPolicy as ee,isEnforceSslStatement as re}from"./unlock/bucketPolicyTriage.js";import{toResourcePolicyStatements as oe}from"./unlock/toResourcePolicyStatements.js";import{restoreBucketPolicy as ae,synthesiseEnforceSslDocument as ne,ensureEnforceSsl as se}from"./unlock/restoreBucketPolicy.js";import{restoreAndReconcileQuarantinedBucket as le}from"./unlock/restoreAndReconcileQuarantinedBucket.js";import{parseAccountsConfiguration as me,flattenAccountsToEnvironments as ue,extractAllAccountNames as fe,accountsConfigToOUTree as de,isStringArray as Re,isAccountsConfig as Se,isOuOnlyAccountBucket as Pe,OU_ONLY_ACCOUNT_BUCKETS as xe}from"./organisation/accountsConfig.js";import{resolveBuildSecrets as ye,resolveSecretRefValue as Ae,resolveBuildSecretSessionProvider as Ee,sourcedRefsFromBuildArgs as De}from"./application/buildSecretResolver.js";import{buildBuildSecretSessionPolicy as _e,partitionForRegion as Oe}from"./application/buildSecretSession.js";import{buildDeploySessionPolicy as Fe}from"./application/deploySessionPolicy.js";import{resolveBuildArgs as ke}from"./application/buildArgResolver.js";import{validateBuildGroup as Le}from"./application/buildGroupValidator.js";export*from"./domain/index.js";import{runOpenNextBuild as Ue}from"./application/openNextBuild.js";import{runOrganisationSetup as Ge,ORG_SETUP_PHASES as Ne}from"./organisation/organisationSetup.js";export*from"./builders/index.js";import{buildDeployPlan as Ye,computeDeployPlan as Ve,computeAssemblyDigest as Je,digestHead as He,classifyImpact as Qe,derivePropertyChanges as we,isDataLoss as je,isStatefulResourceType as We,renderPlanSummary as qe,renderPlanLines as ze,toWirePlanChanges as Xe,signApprovalToken as Ze,verifyApprovalToken as $e,DEFAULT_APPROVAL_TTL_MS as er,APPROVAL_TOKEN_PATTERN as rr}from"./application/plan/index.js";import{runApprovalGate as or,approvalRefusalReason as ir}from"./application/approvalGate.js";import{runDestructionGate as nr,buildDestructionTicket as sr,evaluateDestructionConsents as cr,computeTicketDigest as lr,legalRemediationVerbs as pr,executableRemediationVerbs as mr,advertisableRemediationVerbs as ur,renderDestructionTicketLines as fr,renderConsentVerdictLines as dr}from"./application/destructionGate.js";import{loadDeployPlan as Sr,createMemoisedPlanLoader as Pr}from"./application/plan/loadDeployPlan.js";import{classifyDriftFailure as Tr,fetchLastOperationEvents as yr}from"./drift/classifyDriftFailure.js";import{DriftProbe as Er,probePhysicalPresence as Dr}from"./drift/driftProbe.js";import{clearDriftSuspects as _r,defaultDriftJournalDir as Or,readDriftSuspects as vr,recordDriftSuspects as Fr}from"./drift/driftSuspectJournal.js";import{detectStackDrift as kr}from"./drift/detectStackDrift.js";import{runDriftPreFlight as Lr,formatDriftPreFlightBlock as Cr,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Ir,DRIFT_PREFLIGHT_BUDGET_MS as Ur}from"./drift/driftPreFlight.js";import{runRoute53RecordPreflight as Gr}from"./drift/route53RecordPreflight.js";import{archiveCompletedRemediationJournal as Kr,computeRemediationOpId as Mr,defaultRemediationJournalDir as Yr,findRemediationJournalByOpId as Vr,listActiveRemediationOps as Jr,listActiveRemediationOpsForContext as Hr,readRemediationJournal as Qr,sweepExpiredRemediationJournals as wr,writeRemediationJournal as jr,REMEDIATION_JOURNAL_RETENTION_DAYS as Wr}from"./remediation/remediationJournal.js";import{captureRemediationForensics as zr,defaultRemediationForensicsDir as Xr}from"./remediation/forensicsCapture.js";import{applyRetainFlip as $r,composeFlipCapabilities as et,computeTemplateDigest as rt,deriveRetainFlipTemplate as tt,findMarkedResourcesByOpId as ot,proveFlipMetadataOnly as it,readRetainFlipState as at,verifyRetainFlipDiff as nt,FORGET_MARKER_KEY as st,FORGET_FLIP_SPEC as ct,RECREATE_MARKER_KEY as lt}from"./remediation/retainFlip.js";import{assessForgetResumability as mt,completeForgetAfterConverge as ut,completeForgetAfterDeploy as ft,formatRecreateInFlightCures as dt,partitionPreFlightByRemediation as Rt,runForgetSurgery as St,synthTemplateDeclaresResource as Pt}from"./remediation/forgetResource.js";import{runRecreateSurgery as Tt,snapshotPolicyForType as yt,SNAPSHOT_CAPABLE_RESOURCE_TYPES as At}from"./remediation/recreateResource.js";import{runRecreatePreFlight as Dt}from"./remediation/recreatePreFlight.js";import{deriveRemovalTemplate as _t,findRemovalDeletionFailures as Ot,findResourcesPresent as vt,proveRemovalTargetsOnly as Ft}from"./remediation/removalUpdate.js";import{advertisableDriftVerbs as kt,buildDriftRepairTicket as Bt,runDriftRepairGate as Lt}from"./remediation/driftRepairGate.js";import{formatPinOutcomeDetail as It,pinProbeCoverage as Ut,renderPinReportLines as ht,runPinRemediation as Gt}from"./remediation/pinRemediation.js";import{composePostFailureRepairOffer as Kt,formatDriftRepairOffer as Mt,DriftRepairAvailableError as Yt}from"./remediation/postFailureRepairOffer.js";import{captureLegacySurfaces as Jt,decodeLegacyAnchor as Ht,runIdentitySurfaceGate as Qt}from"./remediation/pinIdentity.js";import{collectIdentityPinCandidates as jt,degradedIdentityPinOutcomes as Wt,renderIdentityPinReportLines as qt,runIdentityPinMigration as zt}from"./remediation/migrateIdentity.js";import{checkDeployPathStackAvailability as Zt,isDeployPathBlockingStatus as $t,StackUnavailableError as eo}from"./activeDeploymentGuard.js";import{assertLeaseBeforeStack as to,LeaseDeniedError as oo}from"./application/leaseGate.js";export{rr as APPROVAL_TOKEN_PATTERN,er as DEFAULT_APPROVAL_TTL_MS,Ur as DRIFT_PREFLIGHT_BUDGET_MS,Ir as DRIFT_PREFLIGHT_TRIGGER_STATUSES,Er as DriftProbe,Yt as DriftRepairAvailableError,ct as FORGET_FLIP_SPEC,st as FORGET_MARKER_KEY,oo as LeaseDeniedError,Ne as ORG_SETUP_PHASES,H as ORG_TRAIL_BUCKET_OUTPUT_KEY,xe as OU_ONLY_ACCOUNT_BUCKETS,O as PRE_EMPTY_TAG_KEYS,lt as RECREATE_MARKER_KEY,Wr as REMEDIATION_JOURNAL_RETENTION_DAYS,F as SAFE_CLEANUP_STATES,At as SNAPSHOT_CAPABLE_RESOURCE_TYPES,eo as StackUnavailableError,Q as TRAIL_BUCKET_OUTPUT_KEY,w as TRAIL_KEY_ARN_OUTPUT_KEY,de as accountsConfigToOUTree,kt as advertisableDriftVerbs,ur as advertisableRemediationVerbs,$r as applyRetainFlip,ir as approvalRefusalReason,Kr as archiveCompletedRemediationJournal,to as assertLeaseBeforeStack,mt as assessForgetResumability,L as buildAccountRegionPairs,_e as buildBuildSecretSessionPolicy,Ye as buildDeployPlan,Fe as buildDeploySessionPolicy,sr as buildDestructionTicket,Bt as buildDriftRepairTicket,B as buildRegionList,Jt as captureLegacySurfaces,zr as captureRemediationForensics,C as cascadeHomeRegion,I as cascadeOperationKey,Zt as checkDeployPathStackAvailability,Tr as classifyDriftFailure,Qe as classifyImpact,T as cleanupFailedStack,_r as clearDriftSuspects,jt as collectIdentityPinCandidates,ut as completeForgetAfterConverge,ft as completeForgetAfterDeploy,et as composeFlipCapabilities,Kt as composePostFailureRepairOffer,Je as computeAssemblyDigest,Ve as computeDeployPlan,Mr as computeRemediationOpId,p as computeSecretsDrift,rt as computeTemplateDigest,lr as computeTicketDigest,Pr as createMemoisedPlanLoader,V as decideNextTransition,Ht as decodeLegacyAnchor,W as decommissionMemberTrailStorage,Or as defaultDriftJournalDir,Xr as defaultRemediationForensicsDir,Yr as defaultRemediationJournalDir,Wt as degradedIdentityPinOutcomes,t as deploy,R as deployOrganisation,we as derivePropertyChanges,_t as deriveRemovalTemplate,tt as deriveRetainFlipTemplate,m as deriveStaleParameters,i as destroy,P as destroyOrganisation,kr as detectStackDrift,He as digestHead,y as emptyS3Bucket,se as ensureEnforceSsl,cr as evaluateDestructionConsents,mr as executableRemediationVerbs,fe as extractAllAccountNames,u as extractConsumedSsmParameters,yr as fetchLastOperationEvents,ot as findMarkedResourcesByOpId,Vr as findRemediationJournalByOpId,Ot as findRemovalDeletionFailures,vt as findResourcesPresent,ue as flattenAccountsToEnvironments,Cr as formatDriftPreFlightBlock,Mt as formatDriftRepairOffer,It as formatPinOutcomeDetail,E as formatQuarantineSuspectedMessage,dt as formatRecreateInFlightCures,D as formatRetainedBucketsMessage,Se as isAccountsConfig,v as isCleanableState,je as isDataLoss,$t as isDeployPathBlockingStatus,re as isEnforceSslStatement,Pe as isOuOnlyAccountBucket,g as isQuarantineDetail,_ as isRetainedBucketsDetail,We as isStatefulResourceType,Re as isStringArray,pr as legalRemediationVerbs,Jr as listActiveRemediationOps,Hr as listActiveRemediationOpsForContext,Sr as loadDeployPlan,M as mergeReconciledProviderAccounts,me as parseAccountsConfiguration,k as partitionAccounts,Oe as partitionForRegion,Rt as partitionPreFlightByRemediation,Ut as pinProbeCoverage,A as preEmptyStackBuckets,Dr as probePhysicalPresence,s as probeSecretsDrift,c as probeServiceDeploymentStatus,G as projectAccountRows,h as projectScalarSummary,it as proveFlipMetadataOnly,Ft as proveRemovalTargetsOnly,vr as readDriftSuspects,Qr as readRemediationJournal,at as readRetainFlipState,K as reconcileProviderAccounts,J as reconcileTrailMigration,Fr as recordDriftSuspects,dr as renderConsentVerdictLines,fr as renderDestructionTicketLines,qt as renderIdentityPinReportLines,ht as renderPinReportLines,ze as renderPlanLines,qe as renderPlanSummary,ke as resolveBuildArgs,Ee as resolveBuildSecretSessionProvider,ye as resolveBuildSecrets,Ae as resolveSecretRefValue,n as restart,le as restoreAndReconcileQuarantinedBucket,ae as restoreBucketPolicy,or as runApprovalGate,nr as runDestructionGate,Lr as runDriftPreFlight,Lt as runDriftRepairGate,St as runForgetSurgery,zt as runIdentityPinMigration,Qt as runIdentitySurfaceGate,Ue as runOpenNextBuild,Ge as runOrganisationSetup,Gt as runPinRemediation,Dt as runRecreatePreFlight,Tt as runRecreateSurgery,Gr as runRoute53RecordPreflight,Ze as signApprovalToken,yt as snapshotPolicyForType,De as sourcedRefsFromBuildArgs,f as ssmParameterNameFromValueFrom,wr as sweepExpiredRemediationJournals,Pt as synthTemplateDeclaresResource,ne as synthesiseEnforceSslDocument,oe as toResourcePolicyStatements,Xe as toWirePlanChanges,ee as triageBucketPolicy,z as unlockBucket,Z as unlockQueue,Le as validateBuildGroup,$e as verifyApprovalToken,nt as verifyRetainFlipDiff,jr as writeRemediationJournal};

package/dist/src/orchestration/organisation/cascadeHelpers.d.ts

@@ -4,7 +4,7 @@ import type { OrgConfig } from "../../types/config/orgConfig.js";
 import type { DeployCallbacks } from "../../types/callbacks.js";
 import type { OrganisationOperation } from "../../types/operations.js";
 import type { DeployServices } from "../serviceFactory.js";
-import type { DomainConfig, DomainDeployProvider, DomainDeployResult } from "../domainInterface.js";
+import type { DomainConfig, DomainDeployProvider, DomainDeployResult, DomainProviderFactory } from "../domainInterface.js";
 import { type DomainsTakeoverContext } from "../domain/domainTakeoverGate.js";
 import type { ProviderAccount } from "@fjall/util/config";
 /**
@@ -156,6 +156,17 @@ export interface DeployDomainsOptions {
      * every provider, CLI and worker alike).
      */
     takeover?: DomainsTakeoverContext;
+    /**
+     * T2 account routing: mints a group-scoped provider context per distinct
+     * foreign `(account, region)` pin, so pinned domains DEPLOY into their
+     * recorded homes instead of being skipped — the "<accountname>.<domain>"
+     * children the registry knows about stop depending on which account the
+     * operator happened to run the cascade from. Absent: today's
+     * skip-with-warning partition, byte for byte. A factory failure for one
+     * home degrades THAT home's domains to the same skip — routing is an
+     * upgrade over the skip, never a new way to fail the phase.
+     */
+    domainProviderFactory?: DomainProviderFactory;
 }
 /**
  * Order delegated domains into parent-first topological waves keyed on
@@ -180,5 +191,13 @@ export declare function planDelegatedDomainWaves(delegatedDomains: readonly Doma
  * ceremony deploys nothing (assess-first mirrors the application path's
  * withhold-before-mutation semantics). `deployedZones` names exactly the
  * zones that deployed — the only honest per-zone retirement signal.
+ *
+ * T2 account routing: with `options.domainProviderFactory`, domains pinned to
+ * a foreign `(account, region)` home deploy through a home-scoped provider
+ * context instead of being skipped. The partition, the takeover gate and the
+ * wave plan all stay GLOBAL — one pin check, one consent ceremony, one
+ * parent-first order across every home — while synth, template reads, record
+ * releases and deploys run through each domain's own group. No factory (or a
+ * factory failure for a home) keeps the skip-with-warning behaviour.
  */
 export declare function deployDomains(provider: DomainDeployProvider, callbacks: DeployCallbacks, options?: DeployDomainsOptions): Promise<DomainDeployResult>;

package/dist/src/orchestration/organisation/cascadeHelpers.js

@@ -1 +1 @@
-var Y=Object.defineProperty;var g=(e,n)=>Y(e,"name",{value:n,configurable:!0});import{join as H}from"path";import{success as E,failure as $}from"@fjall/generator";import{logger as P}from"@fjall/util/logger";import{maskSensitiveOutput as S,mapSettledWithConcurrency as Z,resolveSynthEnvironment as X}from"@fjall/util";import{ORGANISATION_TYPES as A,getOrganisationStackName as G}from"../../types/operations.js";import{CdkContextBuilder as q}from"../../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as J}from"../../types/deployment/index.js";import{CloudFormationService as V}from"../../services/infrastructure/CloudFormationService.js";import{getCascadeStateFilePath as Q,regionSuffix as ee}from"../../types/config/FjallState.js";import{BackupClient as te}from"@aws-sdk/client-backup";import{accountHasDisasterRecovery as ne,describeBackupVaultExists as oe}from"../../aws/organisations/backup.js";import{assertAssemblyEngineCompat as re,buildParamsContext as ae,collectStackOutputs as W,assumeCascadeRole as N,emitStepWarnings as se,emitWarningEvent as ie,forwardOutput as j,reconcileOidcProviderIfCarried as U}from"../contextHelpers.js";import{assertLeaseBeforeStack as ce}from"../application/leaseGate.js";import{runCascadeTakeoverGate as de}from"../domain/domainTakeoverGate.js";import{deployDelegatedDomain as ue}from"../domain/delegatedDomainDeploy.js";import{normaliseRecordName as F}from"../domain/zoneClassifier.js";import{runDriftPreFlightGate as fe}from"../drift/preFlightGate.js";import{accountTier as _}from"@fjall/util";import{buildBootstrapTagsIfResolved as le}from"../bootstrapTags.js";import{hasOrganisationTierAccount as pe}from"../../aws/organisations/accountGlobals.js";import{DEFAULT_REGION as K}from"../../aws/utils/regions.js";const me=4;function Ge(e){const n=e.find(o=>_(o)==="platform"),c=e.filter(o=>_(o)==="account");return{platformAccount:n,memberAccounts:c}}g(Ge,"partitionAccounts");function ge(e){const n=e?.primaryRegion??K,c=e?.secondaryRegions??[],o=new Set([n,...c]),i=e?.disasterRecoveryRegion;return i&&o.add(i),[...o]}g(ge,"buildRegionList");function Ve(e){return ge(e)[0]??K}g(Ve,"cascadeHomeRegion");function he(e,n){return`${e} (${n})`}g(he,"cascadeOperationKey");function We(e,n){const c=[];for(const o of n)for(const i of e)c.push({account:i,region:o});return c}g(We,"buildAccountRegionPairs");import{buildCascadeRoleArn as Xe}from"../contextHelpers.js";async function Ue(e,n,c,o){c.onLog?.(`Verifying cascade role access for ${n.length} account(s)\u2026`,"info");const i=await Z(n,me,async a=>N(e.awsProvider,a.id,a.region??e.awsProvider.getRegion(),`fjall-preflight-${a.name}`,o)),t=[];return i.forEach((a,s)=>{const r=n[s];if(r){if(a.status==="rejected"){t.push({accountId:r.id,accountName:r.name,error:a.reason instanceof Error?a.reason.message:String(a.reason)});return}a.value.success||t.push({accountId:r.id,accountName:r.name,error:a.value.error.message})}}),t.length===0&&c.onLog?.(`Cascade role access verified for ${n.length} account(s)`,"info"),t}g(Ue,"probeCascadeRoles");async function _e(e,n,c,o,i,t,a){const s=a?.region??o.region??n.awsProvider.getRegion(),r=he(o.name,s),u=a?.orgConfig??e.orgConfig,l=a?.ipamPoolId;t.onCascadeAccountStart?.(r,o.id,s,i);const p=await N(n.awsProvider,o.id,s,`fjall-cascade-${o.name}`,e.abortSignal);if(!p.success)return t.onCascadeAccountComplete?.(r,!1,S(p.error.message),s),$(new Error(`Failed to assume role for ${o.name}: ${S(p.error.message)}`));const{provider:h,credentials:d}=p.data,C=H(e.workingDirectory,"fjall",i==="platform"?A.PLATFORM:A.ACCOUNT),y=H(C,`cdk.out.${o.id}.${ee(s)}`),f=q.buildDeploymentContext({deployType:i,target:c.target,path:C,assemblyDir:y,environment:X(o),region:s,accountName:o.name,callerIdentity:J(o.id),ipamPoolId:l,...ae({orgConfig:u,identity:e.identity,skipOidc:e.options?.skipOidc,region:s,primaryRegion:a?.primaryRegion,trailLifecycle:o.trailLifecycle})},{verbose:e.options?.verbose},u);if(ne(o.environment,u?.disasterRecoveryRegion)){const m=await oe(h.getClient(te),e.abortSignal);if(!m.success)return t.onCascadeAccountComplete?.(r,!1,S(m.error.message),s),$(new Error(`Backup vault probe failed for ${o.name}: ${S(m.error.message)}`));f.fjallAdoptBackupVault=m.data}t.onCascadeAccountPhaseChange?.(r,"synth",s);const R=await n.cdkService.runCdkSynth(f,j(t),d);if(!R.success)return t.onCascadeAccountComplete?.(r,!1,S(`Synth failed: ${R.error}`),s),$(new Error(`Synth failed for ${o.name}: ${S(R.error)}`));se(t,R.data);const v=re(y,t);if(!v.success){const m=S(v.error.message);return t.onCascadeAccountComplete?.(r,!1,m,s),$(new Error(`Engine compatibility check failed for ${o.name}: ${m}`))}const w=G(i==="platform"?A.PLATFORM:A.ACCOUNT),L=Q(C,o.id,s),D=new V(h),{changed:z,currentHash:b}=await n.hashService.compareCascadeStack(y,w,L);if(!z&&e.options?.force!==!0&&await D.stackExists(w,void 0,e.abortSignal)){const m=await D.getStackOutputs(w,void 0,e.abortSignal);m.success||P.debug("cascadeHelpers","Failed to read outputs for skipped cascade account (non-critical)",{stackName:w,account:o.name});const T=W(m);return await U(f,h,t,e.abortSignal),t.onLog?.(`${o.name}: no infrastructure changes \u2014 skipping deploy`,"info"),t.onCascadeAccountComplete?.(r,!0,void 0,s,T,!0),E({outputs:T,skipped:!0})}const x=await fe(h,{stackNames:[w],cdkOutPath:y,cfnService:D,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(x.kind==="blocked")return t.onCascadeAccountComplete?.(r,!1,x.message,s),$(new Error(x.message));const O=await ce(e.assertLeaseForStack,w,e.abortSignal);if(O!==void 0)return t.onCascadeAccountComplete?.(r,!1,O.message,s),$(O);t.onCascadeAccountPhaseChange?.(r,"bootstrap",s);const k=await n.cdkService.runCdkBootstrap(f,j(t),d,void 0,le({account:o,estate:pe(u?.providerAccounts)?"org":"solo",...a?.orgId!==void 0?{orgId:a.orgId}:{}}));if(!k.success)return t.onCascadeAccountComplete?.(r,!1,S(`Bootstrap failed: ${k.error}`),s),$(new Error(`Bootstrap failed for ${o.name}: ${S(k.error)}`));t.onCascadeAccountPhaseChange?.(r,"deploy",s);const I=await n.cdkService.runCdkDeploy(f,w,j(t),m=>t.onCascadeAccountResourceProgress?.(r,m,s),h,d);if(!I.success)return t.onCascadeAccountComplete?.(r,!1,S(I.error),s),$(new Error(S(I.error)));const M=await D.getStackOutputs(w,void 0,e.abortSignal);M.success||P.debug("cascadeHelpers","Failed to read cascade account stack outputs (non-critical)",{stackName:w,account:o.name});const B=W(M);return await U(f,h,t,e.abortSignal),b!==void 0&&((await n.hashService.persistCascadeStack(L,w,b)).success||P.debug("cascadeHelpers","Failed to persist cascade hash state (non-critical)",{stackName:w,account:o.name})),t.onCascadeAccountComplete?.(r,!0,void 0,s,B,!1),E({outputs:B,skipped:!1})}g(_e,"deployCascadeAccount");async function Ke(e,n,c,o){const i=new Map,t=e.awsProvider.getRegion(),a=await N(e.awsProvider,n.id,t,`fjall-ipam-read-${n.name}`,o);if(!a.success)return P.debug("organisationDeploy",`Cannot read Platform outputs: ${a.error.message}`),i;const s=new V(a.data.provider),r=G(A.PLATFORM),u=await s.getStackOutputs(r);if(!u.success)return P.debug("organisationDeploy",`Failed to read Platform stack outputs: ${u.error.message}`),i;const l=/^IpamPoolId(\d{12})(\w+)$/;for(const p of u.data){const h=p.OutputKey?.match(l);if(h&&p.OutputValue){const d=`${h[1]}-${h[2]}`;i.set(d,p.OutputValue)}}return i.size>0&&c.onLog?.(`Read ${i.size} IPAM pool ID(s) from Platform stack`,"info"),i}g(Ke,"readPlatformIpamPoolIds");function Ce(e,n){const c=e.account!==void 0&&n?.executingAccountId!==void 0&&e.account!==n.executingAccountId,o=e.region!==void 0&&n?.executingRegion!==void 0&&e.region!==n.executingRegion;if(c)return`[${e.name}] skipped: its fjall-config.json entry records account ${e.account} as its home, but this cascade runs in account ${n?.executingAccountId} - deploy it separately with 'fjall domain deploy ${e.name} -t <target in account ${e.account}>' or run the cascade under that account.`;if(o)return`[${e.name}] skipped: its fjall-config.json entry records region ${e.region} as its home, but this cascade runs in region ${n?.executingRegion} - deploy it separately with 'fjall domain deploy ${e.name} --region ${e.region}', or update the entry's "region" key if this move is intentional.`}g(Ce,"foreignDomainSkipReason");function ye(e){const n=new Map;for(const t of e)n.set(F(t.name),t);const c=new Map,o=g((t,a)=>{const s=c.get(t);if(s!==void 0)return s;if(a.includes(t))return[...a.slice(a.indexOf(t)),t];const r=n.get(t);if(r===void 0)return-1;const u=r.parentDomain!==void 0?F(r.parentDomain):void 0,l=u===void 0?-1:o(u,[...a,t]);if(Array.isArray(l))return l;const p=l+1;return c.set(t,p),p},"resolveDepth"),i=[];for(const t of e){const a=o(F(t.name),[]);if(Array.isArray(a)){const s=a.map(r=>n.get(r)?.name??r).join(" -> ");return $(new Error(`Delegated domain ordering: fjall-config.json declares a parentDomain cycle (${s}) - no deploy order satisfies it. Nothing was deployed. Cure: correct the "parentDomain" of one entry in that cycle so parents form a chain, then re-run.`))}(i[a]??=[]).push(t)}return E(i.filter(t=>t.length>0))}g(ye,"planDelegatedDomainWaves");async function ze(e,n,c){const o=e.getDomains();if(o.length===0)return{domainsDeployed:0,domainsSkipped:0,errors:[],deployedZones:[]};n.onCascadePhaseStart?.("domains");const i=[];let t=0;for(const d of o){const C=Ce(d,c);if(C!==void 0){t++,ie(n,C);continue}i.push(d)}const a=i.filter(d=>d.type==="apex"),s=i.filter(d=>d.type==="delegated");let r=0;const u=[],l=[],p=ye(s);if(!p.success)return u.push(p.error.message),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:r,domainsSkipped:t,errors:u,deployedZones:l};const h=p.data;if(i.length>0){if(c?.takeover===void 0)return u.push("domains phase refused: the cascade executed without a takeover-gate context, so record collisions cannot be assessed \u2014 deploying ungated is not an option. This is a caller wiring defect (executeCascade threads services + consent inputs into DeployDomainsOptions.takeover)."),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:r,domainsSkipped:t,errors:u,deployedZones:l};const d=await de(e,i,n,c.takeover);if(!d.success)return u.push(d.error.message),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:r,domainsSkipped:t,errors:u,deployedZones:l};if(d.data.kind==="withheld")return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:r,domainsSkipped:t,errors:u,deployedZones:l,takeover:d.data.withheld}}for(const d of a){const C=await e.deployDomain(d.name,n);C.success?(r++,l.push(d.name)):u.push(`${d.name}: ${C.error.message}`)}for(const d of h){const C=await Promise.allSettled(d.map(y=>{const f=e.delegatedDeployer?.(y.name);return f!==void 0?ue({deployer:f,callbacks:n,...c?.abortSignal!==void 0?{abortSignal:c.abortSignal}:{},...c?.skipCaaPreflight!==void 0?{skipCaaPreflight:c.skipCaaPreflight}:{}}):e.deployDomain(y.name,n)}));for(let y=0;y<C.length;y++){const f=C[y],R=d[y];if(!(!f||!R))if(f.status==="fulfilled")f.value.success?(r++,l.push(R.name)):u.push(`${R.name}: ${f.value.error.message}`);else{const v=f.reason instanceof Error?f.reason.message:String(f.reason);u.push(`${R.name}: ${v}`)}}}return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:r,domainsSkipped:t,errors:u,deployedZones:l}}g(ze,"deployDomains");export{me as CASCADE_MAX_CONCURRENCY,We as buildAccountRegionPairs,Xe as buildCascadeRoleArn,ge as buildRegionList,Ve as cascadeHomeRegion,he as cascadeOperationKey,_e as deployCascadeAccount,ze as deployDomains,Ge as partitionAccounts,ye as planDelegatedDomainWaves,Ue as probeCascadeRoles,Ke as readPlatformIpamPoolIds};
+var X=Object.defineProperty;var C=(e,n)=>X(e,"name",{value:n,configurable:!0});import{join as K}from"path";import{success as b,failure as D}from"@fjall/generator";import{logger as N}from"@fjall/util/logger";import{maskSensitiveOutput as P,mapSettledWithConcurrency as q,resolveSynthEnvironment as J}from"@fjall/util";import{ORGANISATION_TYPES as j,getOrganisationStackName as V}from"../../types/operations.js";import{CdkContextBuilder as Q}from"../../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as ee}from"../../types/deployment/index.js";import{CloudFormationService as F}from"../../services/infrastructure/CloudFormationService.js";import{getCascadeStateFilePath as te,regionSuffix as ne}from"../../types/config/FjallState.js";import{BackupClient as oe}from"@aws-sdk/client-backup";import{accountHasDisasterRecovery as re,describeBackupVaultExists as se}from"../../aws/organisations/backup.js";import{assertAssemblyEngineCompat as ie,buildParamsContext as ae,collectStackOutputs as W,assumeCascadeRole as M,emitStepWarnings as ce,emitWarningEvent as U,forwardOutput as L,reconcileOidcProviderIfCarried as _}from"../contextHelpers.js";import{assertLeaseBeforeStack as de}from"../application/leaseGate.js";import{runCascadeTakeoverGate as ue}from"../domain/domainTakeoverGate.js";import{deployDelegatedDomain as fe}from"../domain/delegatedDomainDeploy.js";import{normaliseRecordName as B}from"../domain/zoneClassifier.js";import{runDriftPreFlightGate as ge}from"../drift/preFlightGate.js";import{accountTier as z}from"@fjall/util";import{buildBootstrapTagsIfResolved as me}from"../bootstrapTags.js";import{hasOrganisationTierAccount as le}from"../../aws/organisations/accountGlobals.js";import{DEFAULT_REGION as Y}from"../../aws/utils/regions.js";const pe=4;function He(e){const n=e.find(r=>z(r)==="platform"),i=e.filter(r=>z(r)==="account");return{platformAccount:n,memberAccounts:i}}C(He,"partitionAccounts");function he(e){const n=e?.primaryRegion??Y,i=e?.secondaryRegions??[],r=new Set([n,...i]),f=e?.disasterRecoveryRegion;return f&&r.add(f),[...r]}C(he,"buildRegionList");function Ke(e){return he(e)[0]??Y}C(Ke,"cascadeHomeRegion");function ye(e,n){return`${e} (${n})`}C(ye,"cascadeOperationKey");function Ve(e,n){const i=[];for(const r of n)for(const f of e)i.push({account:f,region:r});return i}C(Ve,"buildAccountRegionPairs");import{buildCascadeRoleArn as Xe}from"../contextHelpers.js";async function We(e,n,i,r){i.onLog?.(`Verifying cascade role access for ${n.length} account(s)\u2026`,"info");const f=await q(n,pe,async c=>M(e.awsProvider,c.id,c.region??e.awsProvider.getRegion(),`fjall-preflight-${c.name}`,r)),t=[];return f.forEach((c,s)=>{const a=n[s];if(a){if(c.status==="rejected"){t.push({accountId:a.id,accountName:a.name,error:c.reason instanceof Error?c.reason.message:String(c.reason)});return}c.value.success||t.push({accountId:a.id,accountName:a.name,error:c.value.error.message})}}),t.length===0&&i.onLog?.(`Cascade role access verified for ${n.length} account(s)`,"info"),t}C(We,"probeCascadeRoles");async function Ue(e,n,i,r,f,t,c){const s=c?.region??r.region??n.awsProvider.getRegion(),a=ye(r.name,s),l=c?.orgConfig??e.orgConfig,v=c?.ipamPoolId;t.onCascadeAccountStart?.(a,r.id,s,f);const y=await M(n.awsProvider,r.id,s,`fjall-cascade-${r.name}`,e.abortSignal);if(!y.success)return t.onCascadeAccountComplete?.(a,!1,P(y.error.message),s),D(new Error(`Failed to assume role for ${r.name}: ${P(y.error.message)}`));const{provider:h,credentials:k}=y.data,E=K(e.workingDirectory,"fjall",f==="platform"?j.PLATFORM:j.ACCOUNT),R=K(E,`cdk.out.${r.id}.${ne(s)}`),p=Q.buildDeploymentContext({deployType:f,target:i.target,path:E,assemblyDir:R,environment:J(r),region:s,accountName:r.name,callerIdentity:ee(r.id),ipamPoolId:v,...ae({orgConfig:l,identity:e.identity,skipOidc:e.options?.skipOidc,region:s,primaryRegion:c?.primaryRegion,trailLifecycle:r.trailLifecycle})},{verbose:e.options?.verbose},l);if(re(r.environment,l?.disasterRecoveryRegion)){const S=await se(h.getClient(oe),e.abortSignal);if(!S.success)return t.onCascadeAccountComplete?.(a,!1,P(S.error.message),s),D(new Error(`Backup vault probe failed for ${r.name}: ${P(S.error.message)}`));p.fjallAdoptBackupVault=S.data}t.onCascadeAccountPhaseChange?.(a,"synth",s);const $=await n.cdkService.runCdkSynth(p,L(t),k);if(!$.success)return t.onCascadeAccountComplete?.(a,!1,P(`Synth failed: ${$.error}`),s),D(new Error(`Synth failed for ${r.name}: ${P($.error)}`));ce(t,$.data);const I=ie(R,t);if(!I.success){const S=P(I.error.message);return t.onCascadeAccountComplete?.(a,!1,S,s),D(new Error(`Engine compatibility check failed for ${r.name}: ${S}`))}const w=V(f==="platform"?j.PLATFORM:j.ACCOUNT),o=te(E,r.id,s),u=new F(h),{changed:d,currentHash:g}=await n.hashService.compareCascadeStack(R,w,o);if(!d&&e.options?.force!==!0&&await u.stackExists(w,void 0,e.abortSignal)){const S=await u.getStackOutputs(w,void 0,e.abortSignal);S.success||N.debug("cascadeHelpers","Failed to read outputs for skipped cascade account (non-critical)",{stackName:w,account:r.name});const H=W(S);return await _(p,h,t,e.abortSignal),t.onLog?.(`${r.name}: no infrastructure changes \u2014 skipping deploy`,"info"),t.onCascadeAccountComplete?.(a,!0,void 0,s,H,!0),b({outputs:H,skipped:!0})}const m=await ge(h,{stackNames:[w],cdkOutPath:R,cfnService:u,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(m.kind==="blocked")return t.onCascadeAccountComplete?.(a,!1,m.message,s),D(new Error(m.message));const A=await de(e.assertLeaseForStack,w,e.abortSignal);if(A!==void 0)return t.onCascadeAccountComplete?.(a,!1,A.message,s),D(A);t.onCascadeAccountPhaseChange?.(a,"bootstrap",s);const x=await n.cdkService.runCdkBootstrap(p,L(t),k,void 0,me({account:r,estate:le(l?.providerAccounts)?"org":"solo",...c?.orgId!==void 0?{orgId:c.orgId}:{}}));if(!x.success)return t.onCascadeAccountComplete?.(a,!1,P(`Bootstrap failed: ${x.error}`),s),D(new Error(`Bootstrap failed for ${r.name}: ${P(x.error)}`));t.onCascadeAccountPhaseChange?.(a,"deploy",s);const O=await n.cdkService.runCdkDeploy(p,w,L(t),S=>t.onCascadeAccountResourceProgress?.(a,S,s),h,k);if(!O.success)return t.onCascadeAccountComplete?.(a,!1,P(O.error),s),D(new Error(P(O.error)));const G=await u.getStackOutputs(w,void 0,e.abortSignal);G.success||N.debug("cascadeHelpers","Failed to read cascade account stack outputs (non-critical)",{stackName:w,account:r.name});const T=W(G);return await _(p,h,t,e.abortSignal),g!==void 0&&((await n.hashService.persistCascadeStack(o,w,g)).success||N.debug("cascadeHelpers","Failed to persist cascade hash state (non-critical)",{stackName:w,account:r.name})),t.onCascadeAccountComplete?.(a,!0,void 0,s,T,!1),b({outputs:T,skipped:!1})}C(Ue,"deployCascadeAccount");async function _e(e,n,i,r){const f=new Map,t=e.awsProvider.getRegion(),c=await M(e.awsProvider,n.id,t,`fjall-ipam-read-${n.name}`,r);if(!c.success)return N.debug("organisationDeploy",`Cannot read Platform outputs: ${c.error.message}`),f;const s=new F(c.data.provider),a=V(j.PLATFORM),l=await s.getStackOutputs(a);if(!l.success)return N.debug("organisationDeploy",`Failed to read Platform stack outputs: ${l.error.message}`),f;const v=/^IpamPoolId(\d{12})(\w+)$/;for(const y of l.data){const h=y.OutputKey?.match(v);if(h&&y.OutputValue){const k=`${h[1]}-${h[2]}`;f.set(k,y.OutputValue)}}return f.size>0&&i.onLog?.(`Read ${f.size} IPAM pool ID(s) from Platform stack`,"info"),f}C(_e,"readPlatformIpamPoolIds");function Z(e,n){const i=e.account!==void 0&&n?.executingAccountId!==void 0&&e.account!==n.executingAccountId,r=e.region!==void 0&&n?.executingRegion!==void 0&&e.region!==n.executingRegion;if(i)return`[${e.name}] skipped: its fjall-config.json entry records account ${e.account} as its home, but this cascade runs in account ${n?.executingAccountId} - deploy it separately with 'fjall domain deploy ${e.name} -t <target in account ${e.account}>' or run the cascade under that account.`;if(r)return`[${e.name}] skipped: its fjall-config.json entry records region ${e.region} as its home, but this cascade runs in region ${n?.executingRegion} - deploy it separately with 'fjall domain deploy ${e.name} --region ${e.region}', or update the entry's "region" key if this move is intentional.`}C(Z,"foreignDomainSkipReason");function Ce(e){const n=new Map;for(const t of e)n.set(B(t.name),t);const i=new Map,r=C((t,c)=>{const s=i.get(t);if(s!==void 0)return s;if(c.includes(t))return[...c.slice(c.indexOf(t)),t];const a=n.get(t);if(a===void 0)return-1;const l=a.parentDomain!==void 0?B(a.parentDomain):void 0,v=l===void 0?-1:r(l,[...c,t]);if(Array.isArray(v))return v;const y=v+1;return i.set(t,y),y},"resolveDepth"),f=[];for(const t of e){const c=r(B(t.name),[]);if(Array.isArray(c)){const s=c.map(a=>n.get(a)?.name??a).join(" -> ");return D(new Error(`Delegated domain ordering: fjall-config.json declares a parentDomain cycle (${s}) - no deploy order satisfies it. Nothing was deployed. Cure: correct the "parentDomain" of one entry in that cycle so parents form a chain, then re-run.`))}(f[c]??=[]).push(t)}return b(f.filter(t=>t.length>0))}C(Ce,"planDelegatedDomainWaves");async function ze(e,n,i){const r=e.getDomains();if(r.length===0)return{domainsDeployed:0,domainsSkipped:0,errors:[],deployedZones:[]};n.onCascadePhaseStart?.("domains");const f=C(o=>{const u=o.account??i?.executingAccountId,d=o.region??i?.executingRegion;if(!(u===void 0||d===void 0))return{accountId:u,region:d}},"resolveHome"),t=C(o=>`${o.accountId}\0${o.region}`,"homeKey"),c=i?.domainProviderFactory,s=new Map;if(c!==void 0)for(const o of r){if(Z(o,i)===void 0)continue;const u=f(o);if(u===void 0)continue;const d=t(u);s.has(d)||s.set(d,u)}const a=new Map;for(const[o,u]of s){const d=await c?.(u);d!==void 0&&(d.success?a.set(o,d.data):U(n,`[domains] account routing for home ${u.accountId}/${u.region} unavailable (${P(d.error.message)}) \u2014 its domains are skipped exactly as they were before routing existed.`))}const l=[],v=new Map,y=new Map;let h=0;for(const o of r){const u=Z(o,i);if(u===void 0){l.push(o);continue}const d=f(o),g=d!==void 0?a.get(t(d)):void 0;if(g!==void 0&&d!==void 0){l.push(o),v.set(o.name,g.provider);const m=t(d),A=y.get(m)??[];A.push(o),y.set(m,A);continue}h++,U(n,u)}const k=l.filter(o=>o.type==="apex"),E=l.filter(o=>o.type==="delegated");let R=0;const p=[],$=[],I=Ce(E);if(!I.success)return p.push(I.error.message),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$};const w=I.data;if(l.length>0){if(i?.takeover===void 0)return p.push("domains phase refused: the cascade executed without a takeover-gate context, so record collisions cannot be assessed \u2014 deploying ungated is not an option. This is a caller wiring defect (executeCascade threads services + consent inputs into DeployDomainsOptions.takeover)."),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$};const o=i.takeover,u=l.filter(m=>!v.has(m.name)),d=[];u.length>0&&d.push({home:{...i.executingAccountId!==void 0?{accountId:i.executingAccountId}:{},...i.executingRegion!==void 0?{region:i.executingRegion}:{}},provider:e,aws:o.aws,cfnService:o.cfnService,...o.route53Client!==void 0?{route53Client:o.route53Client}:{},domains:u});for(const[m,A]of s){const x=a.get(m),O=y.get(m);x===void 0||O===void 0||d.push({home:A,provider:x.provider,aws:x.aws,cfnService:new F(x.aws),domains:O})}const g=await ue(d,n,{...o.consents!==void 0?{consents:o.consents}:{},...o.consentDigest!==void 0?{consentDigest:o.consentDigest}:{},...o.consentGate!==void 0?{consentGate:o.consentGate}:{},...o.abortSignal!==void 0?{abortSignal:o.abortSignal}:{}});if(!g.success)return p.push(g.error.message),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$};if(g.data.kind==="withheld")return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$,takeover:g.data.withheld}}for(const o of k){const d=await(v.get(o.name)??e).deployDomain(o.name,n);d.success?(R++,$.push(o.name)):p.push(`${o.name}: ${d.error.message}`)}for(const o of w){const u=await Promise.allSettled(o.map(d=>{const g=v.get(d.name)??e,m=g.delegatedDeployer?.(d.name);return m!==void 0?fe({deployer:m,callbacks:n,...i?.abortSignal!==void 0?{abortSignal:i.abortSignal}:{},...i?.skipCaaPreflight!==void 0?{skipCaaPreflight:i.skipCaaPreflight}:{}}):g.deployDomain(d.name,n)}));for(let d=0;d<u.length;d++){const g=u[d],m=o[d];if(!(!g||!m))if(g.status==="fulfilled")g.value.success?(R++,$.push(m.name)):p.push(`${m.name}: ${g.value.error.message}`);else{const A=g.reason instanceof Error?g.reason.message:String(g.reason);p.push(`${m.name}: ${A}`)}}}return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$}}C(ze,"deployDomains");export{pe as CASCADE_MAX_CONCURRENCY,Ve as buildAccountRegionPairs,Xe as buildCascadeRoleArn,he as buildRegionList,Ke as cascadeHomeRegion,ye as cascadeOperationKey,Ue as deployCascadeAccount,ze as deployDomains,He as partitionAccounts,Ce as planDelegatedDomainWaves,We as probeCascadeRoles,_e as readPlatformIpamPoolIds};

package/dist/src/orchestration/organisationDeploy/cascadeExecution.js

@@ -1 +1 @@
-var Z=Object.defineProperty;var E=(t,d)=>Z(t,"name",{value:d,configurable:!0});import{failure as $}from"@fjall/generator";import{regionSuffix as X}from"../../types/config/FjallState.js";import{partitionAccounts as Y,deployCascadeAccount as U,readPlatformIpamPoolIds as z,deployDomains as B,buildRegionList as J,buildAccountRegionPairs as K,cascadeHomeRegion as Q,CASCADE_MAX_CONCURRENCY as V}from"../organisation/cascadeHelpers.js";import{projectScalarSummary as M}from"../organisation/cascadeSummary.js";import{getErrorMessage as ee,maskSensitiveOutput as C,mapSettledWithConcurrency as te}from"@fjall/util";import{INFRA_STEPS as N}from"./infraSteps.js";async function ue(t,d,v,j){const{callbacks:e}=t,{providerAccounts:W,effectiveOrgConfig:O,totalSteps:p,cascadeErrors:f,allCascadeOutputs:L,orgId:x}=j;let S=!1;e.onCascadeStart?.();const _=Date.now();let u=2,P=!1,h,w=!1;const I=[],y=E(o=>({members:I,...h!==void 0?{platform:h}:{},domainsDeployed:w,errors:f,totalDurationMs:o}),"buildLedger"),{platformAccount:a,memberAccounts:k}=Y(W),F=Q(t.orgConfig);if(a){const{id:o,name:n}=N.CASCADE_PLATFORM;e.onStepStart?.(o,n,u,p),e.onCascadePhaseStart?.("platform");let c;const A=Date.now();try{c=await U(t,d,v,a,"platform",e,{orgConfig:O,primaryRegion:F,orgId:x})}catch(i){const r=C(ee(i));f.push({accountId:a.id,error:r}),e.onCascadePhaseComplete?.("platform"),e.onStepComplete?.(o,n,"error",u,p),c=$(new Error(r))}const R=Date.now()-A;if(c.success){P=!0;const i=c.data.skipped===!0;i||(S=!0),c.data.outputs&&L.push({accountId:a.id,outputs:c.data.outputs}),e.onCascadePhaseComplete?.("platform"),e.onStepComplete?.(o,n,i?"skipped":"completed",u,p),h={accountId:a.id,result:i?"skipped":"succeeded",durationMs:R}}else f.some(i=>i.accountId===a.id)||(f.push({accountId:a.id,error:C(c.error.message)}),e.onCascadePhaseComplete?.("platform"),e.onStepComplete?.(o,n,"error",u,p)),h={accountId:a.id,result:"failed",durationMs:R,error:C(c.error.message)};u++}let T=new Map;P&&a&&(T=await z(d,a,e,t.abortSignal));let b=[],H;if(t.domainProvider){const o=await B(t.domainProvider,e,{executingAccountId:d.awsProvider.getAccountId(),executingRegion:d.awsProvider.getRegion(),takeover:{aws:d.awsProvider,cfnService:d.cfnService,...t.options?.destructionConsents!==void 0?{consents:t.options.destructionConsents}:{},...t.options?.destructionConsentDigest!==void 0?{consentDigest:t.options.destructionConsentDigest}:{},...t.destructionConsentGate!==void 0?{consentGate:t.destructionConsentGate}:{},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{},...t.options?.skipCaaPreflight!==void 0?{skipCaaPreflight:t.options.skipCaaPreflight}:{}});w=o.domainsDeployed>0,w&&(S=!0),b=o.deployedZones;for(const n of o.errors)f.push({accountId:"domains",error:C(n)});if(o.takeover!==void 0){H=o.takeover,e.onLog?.("Member-account cascade skipped \u2014 domain record takeover consent is pending. Consent to the ticket and re-run; nothing was deployed in the domains phase.","warn");const n=y(Date.now()-_);return e.onCascadeComplete?.(M(n)),e.onCascadeLedger?.(n),{anyCascadeDeployHappened:S,deployedDomainZones:b,domainsTakeover:H}}}if(a!==void 0&&!P&&k.length>0){const{id:o,name:n}=N.CASCADE_ACCOUNTS;e.onStepStart?.(o,n,u,p),e.onStepComplete?.(o,n,"skipped",u,p),e.onLog?.("Skipping account cascade \u2014 platform deployment failed; platform is a prerequisite for member accounts.","warn")}else if(k.length>0){const{id:o,name:n}=N.CASCADE_ACCOUNTS;e.onStepStart?.(o,n,u,p),e.onCascadePhaseStart?.("accounts");const c=J(t.orgConfig),A=K(k,c);(await te(A,V,async({account:r,region:D})=>{const m=T.get(`${r.id}-${X(D)}`),s=Date.now();return{result:await U(t,d,v,r,"account",e,{ipamPoolId:m,orgConfig:O,region:D,primaryRegion:F,orgId:x}),durationMs:Date.now()-s}})).forEach((r,D)=>{const m=A[D];if(!m)return;const s=m.account;if(r.status==="rejected"){const l=C(r.reason instanceof Error?r.reason.message:String(r.reason));I.push({accountId:s.id,accountName:s.name,region:m.region,result:"failed",durationMs:0,error:l}),f.push({accountId:s.id,error:l});return}const{result:g,durationMs:G}=r.value;if(g.success){const l=g.data.skipped===!0;l||(S=!0),g.data.outputs&&L.push({accountId:s.id,outputs:g.data.outputs}),I.push({accountId:s.id,accountName:s.name,region:m.region,result:l?"skipped":"succeeded",durationMs:G})}else{const l=C(g.error.message);I.push({accountId:s.id,accountName:s.name,region:m.region,result:"failed",durationMs:G,error:l}),f.push({accountId:s.id,error:l})}});const i=M(y(0));e.onCascadePhaseComplete?.("accounts"),e.onStepComplete?.(o,n,i.accountsFailed>0?"error":i.accountsSkipped===k.length?"skipped":"completed",u,p)}const q=y(Date.now()-_);return e.onCascadeComplete?.(M(q)),e.onCascadeLedger?.(q),{anyCascadeDeployHappened:S,deployedDomainZones:b}}E(ue,"executeCascade");export{ue as executeCascade};
+var Z=Object.defineProperty;var R=(t,d)=>Z(t,"name",{value:d,configurable:!0});import{failure as $}from"@fjall/generator";import{regionSuffix as X}from"../../types/config/FjallState.js";import{partitionAccounts as Y,deployCascadeAccount as U,readPlatformIpamPoolIds as z,deployDomains as B,buildRegionList as J,buildAccountRegionPairs as K,cascadeHomeRegion as Q,CASCADE_MAX_CONCURRENCY as V}from"../organisation/cascadeHelpers.js";import{projectScalarSummary as E}from"../organisation/cascadeSummary.js";import{getErrorMessage as ee,maskSensitiveOutput as C,mapSettledWithConcurrency as te}from"@fjall/util";import{INFRA_STEPS as M}from"./infraSteps.js";async function ue(t,d,N,j){const{callbacks:e}=t,{providerAccounts:W,effectiveOrgConfig:F,totalSteps:p,cascadeErrors:f,allCascadeOutputs:O,orgId:L}=j;let S=!1;e.onCascadeStart?.();const x=Date.now();let u=2,A=!1,h,D=!1;const P=[],w=R(o=>({members:P,...h!==void 0?{platform:h}:{},domainsDeployed:D,errors:f,totalDurationMs:o}),"buildLedger"),{platformAccount:a,memberAccounts:y}=Y(W),_=Q(t.orgConfig);if(a){const{id:o,name:n}=M.CASCADE_PLATFORM;e.onStepStart?.(o,n,u,p),e.onCascadePhaseStart?.("platform");let i;const I=Date.now();try{i=await U(t,d,N,a,"platform",e,{orgConfig:F,primaryRegion:_,orgId:L})}catch(c){const r=C(ee(c));f.push({accountId:a.id,error:r}),e.onCascadePhaseComplete?.("platform"),e.onStepComplete?.(o,n,"error",u,p),i=$(new Error(r))}const v=Date.now()-I;if(i.success){A=!0;const c=i.data.skipped===!0;c||(S=!0),i.data.outputs&&O.push({accountId:a.id,outputs:i.data.outputs}),e.onCascadePhaseComplete?.("platform"),e.onStepComplete?.(o,n,c?"skipped":"completed",u,p),h={accountId:a.id,result:c?"skipped":"succeeded",durationMs:v}}else f.some(c=>c.accountId===a.id)||(f.push({accountId:a.id,error:C(i.error.message)}),e.onCascadePhaseComplete?.("platform"),e.onStepComplete?.(o,n,"error",u,p)),h={accountId:a.id,result:"failed",durationMs:v,error:C(i.error.message)};u++}let T=new Map;A&&a&&(T=await z(d,a,e,t.abortSignal));let b=[],H;if(t.domainProvider){const o=await B(t.domainProvider,e,{executingAccountId:d.awsProvider.getAccountId(),executingRegion:d.awsProvider.getRegion(),takeover:{aws:d.awsProvider,cfnService:d.cfnService,...t.options?.destructionConsents!==void 0?{consents:t.options.destructionConsents}:{},...t.options?.destructionConsentDigest!==void 0?{consentDigest:t.options.destructionConsentDigest}:{},...t.destructionConsentGate!==void 0?{consentGate:t.destructionConsentGate}:{},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{},...t.options?.skipCaaPreflight!==void 0?{skipCaaPreflight:t.options.skipCaaPreflight}:{},...t.domainProviderFactory!==void 0?{domainProviderFactory:t.domainProviderFactory}:{}});D=o.domainsDeployed>0,D&&(S=!0),b=o.deployedZones;for(const n of o.errors)f.push({accountId:"domains",error:C(n)});if(o.takeover!==void 0){H=o.takeover,e.onLog?.("Member-account cascade skipped \u2014 domain record takeover consent is pending. Consent to the ticket and re-run; nothing was deployed in the domains phase.","warn");const n=w(Date.now()-x);return e.onCascadeComplete?.(E(n)),e.onCascadeLedger?.(n),{anyCascadeDeployHappened:S,deployedDomainZones:b,domainsTakeover:H}}}if(a!==void 0&&!A&&y.length>0){const{id:o,name:n}=M.CASCADE_ACCOUNTS;e.onStepStart?.(o,n,u,p),e.onStepComplete?.(o,n,"skipped",u,p),e.onLog?.("Skipping account cascade \u2014 platform deployment failed; platform is a prerequisite for member accounts.","warn")}else if(y.length>0){const{id:o,name:n}=M.CASCADE_ACCOUNTS;e.onStepStart?.(o,n,u,p),e.onCascadePhaseStart?.("accounts");const i=J(t.orgConfig),I=K(y,i);(await te(I,V,async({account:r,region:k})=>{const m=T.get(`${r.id}-${X(k)}`),s=Date.now();return{result:await U(t,d,N,r,"account",e,{ipamPoolId:m,orgConfig:F,region:k,primaryRegion:_,orgId:L}),durationMs:Date.now()-s}})).forEach((r,k)=>{const m=I[k];if(!m)return;const s=m.account;if(r.status==="rejected"){const l=C(r.reason instanceof Error?r.reason.message:String(r.reason));P.push({accountId:s.id,accountName:s.name,region:m.region,result:"failed",durationMs:0,error:l}),f.push({accountId:s.id,error:l});return}const{result:g,durationMs:G}=r.value;if(g.success){const l=g.data.skipped===!0;l||(S=!0),g.data.outputs&&O.push({accountId:s.id,outputs:g.data.outputs}),P.push({accountId:s.id,accountName:s.name,region:m.region,result:l?"skipped":"succeeded",durationMs:G})}else{const l=C(g.error.message);P.push({accountId:s.id,accountName:s.name,region:m.region,result:"failed",durationMs:G,error:l}),f.push({accountId:s.id,error:l})}});const c=E(w(0));e.onCascadePhaseComplete?.("accounts"),e.onStepComplete?.(o,n,c.accountsFailed>0?"error":c.accountsSkipped===y.length?"skipped":"completed",u,p)}const q=w(Date.now()-x);return e.onCascadeComplete?.(E(q)),e.onCascadeLedger?.(q),{anyCascadeDeployHappened:S,deployedDomainZones:b}}R(ue,"executeCascade");export{ue as executeCascade};

package/dist/src/types/params.d.ts

@@ -5,7 +5,7 @@ import type { DeployCallbacks } from "./callbacks.js";
 import type { ApiClientInterface } from "./apiClient.js";
 import type { OrgConfig } from "./config/orgConfig.js";
 import type { DockerProvider } from "../orchestration/dockerInterface.js";
-import type { DomainDeployProvider } from "../orchestration/domainInterface.js";
+import type { DomainDeployProvider, DomainProviderFactory } from "../orchestration/domainInterface.js";
 import type { PinRemediationReport } from "../orchestration/remediation/pinRemediation.js";
 import type { IdentityPinReport } from "../orchestration/remediation/migrateIdentity.js";
 import type { DestructionTicketResource } from "./destruction.js";
@@ -66,6 +66,16 @@ export interface DeployParams {
      * If omitted, the domains cascade phase is skipped.
      */
     domainProvider?: DomainDeployProvider;
+    /**
+     * Optional account-routing factory beside `domainProvider` (T2): mints a
+     * home-scoped provider context per distinct foreign `(account, region)`
+     * pin among the configured domains, so pinned domains deploy into their
+     * recorded homes instead of being skipped. The caller owns the credential
+     * path (worker: per-account OIDC role; CLI: OrganizationAccountAccessRole
+     * from a management identity). Omitted: foreign-pinned domains keep the
+     * skip-with-warning partition.
+     */
+    domainProviderFactory?: DomainProviderFactory;
     /**
      * Caller shutdown signal. Long-running SDK probes (org-trail delivery
      * verification, member-trail cleanup) compose this with their own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "14.2.0",
+  "version": "14.3.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -96,8 +96,8 @@
     "@aws-sdk/client-ssm": "^3.1098.0",
     "@aws-sdk/client-sso-admin": "^3.1098.0",
     "@aws-sdk/client-sts": "^3.1098.0",
-    "@fjall/generator": "^14.2.0",
-    "@fjall/util": "^14.2.0",
+    "@fjall/generator": "^14.3.0",
+    "@fjall/util": "^14.3.0",
     "@smithy/node-http-handler": "^4.9.13",
     "aws-cdk": "^2.1134.0",
     "tsx": "^4.23.1",