@fjall/deploy-core 14.3.0 → 16.0.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "a8f74ad747cbfe0c3f8009a31924d07b17673bdb9c1dba0291aa8ced7b5f4d7d",
+  "hash": "8e0931d5a8c25f837f240534e078e28952da9c72e8daa6688f8a86f3649dc8eb",
   "files": {
     "src/__test-utils__/awsMockHelpers.ts": "fea371c1b1869678",
     "src/__test-utils__/index.ts": "e03cf35821157dc4",
@@ -52,7 +52,7 @@
     "src/aws/utils/regions.ts": "3a5191f4d2242a60",
     "src/aws/utils/stackStatus.ts": "55fb23ba5514bc13",
     "src/events/index.ts": "e55c022f0d9013e6",
-    "src/index.ts": "cd47b3c091452a0a",
+    "src/index.ts": "d814918718c23e2b",
     "src/orchestration/activeDeploymentGuard.ts": "e8dde742c00ea728",
     "src/orchestration/application/applicationDeploy.ts": "6a4090e898f86a28",
     "src/orchestration/application/applicationDeployHelpers.ts": "bca833cc04f0b4c5",
@@ -66,7 +66,7 @@
     "src/orchestration/application/buildSecretSession.ts": "b45265140a3a781a",
     "src/orchestration/application/codeOnlyDeploy.ts": "062b0acdad1dcf08",
     "src/orchestration/application/databaseEndpointReconcile.ts": "27b14ee41524c632",
-    "src/orchestration/application/deploySessionPolicy.ts": "8052c64ce050c2b8",
+    "src/orchestration/application/deploySessionPolicy.ts": "e2653f4c0aae2ef2",
     "src/orchestration/application/destroyPreFlight.ts": "cc4978dec60b033e",
     "src/orchestration/application/destructionGate.ts": "5fbaa6ef69eb3ae1",
     "src/orchestration/application/detectionPipeline.ts": "69b7dfcedf22fe01",
@@ -112,6 +112,7 @@
     "src/orchestration/domain/delegatedDomainDeploy.ts": "b5e5c2db59250b8a",
     "src/orchestration/domain/delegationDestroyMirror.ts": "939f6c3cc3293d8b",
     "src/orchestration/domain/delegationResolution.ts": "f2b91a8aaf284dfa",
+    "src/orchestration/domain/domainSessionPolicy.ts": "c8603d5ddf19d7ea",
     "src/orchestration/domain/domainTakeoverGate.ts": "ecd9694cebc7be6c",
     "src/orchestration/domain/index.ts": "ec421e83dd0afbd6",
     "src/orchestration/domain/nsPropagationGate.ts": "c7a443e7048d4430",
@@ -131,11 +132,11 @@
     "src/orchestration/drift/route53RecordPreflight.ts": "f4db16a6c0e69ac9",
     "src/orchestration/failure/classifyFailure.ts": "bfb80731bc7d6b95",
     "src/orchestration/failure/deploymentFailureAttachment.ts": "358d9e4d88390cfd",
-    "src/orchestration/index.ts": "d5a2d44746058099",
+    "src/orchestration/index.ts": "8468dd8028eb8772",
     "src/orchestration/manifestSecretParser.ts": "c5576bd88a3652f8",
     "src/orchestration/organisation/accountsConfig.ts": "a55a3306564e7b2f",
     "src/orchestration/organisation/cascadeDestroyHelpers.ts": "7f1927a00ed24767",
-    "src/orchestration/organisation/cascadeHelpers.ts": "8412e0fdca351608",
+    "src/orchestration/organisation/cascadeHelpers.ts": "0c678f3db4dbd38b",
     "src/orchestration/organisation/cascadeSummary.ts": "335be9649cea0626",
     "src/orchestration/organisation/organisationDeploy.ts": "f3fad626230d8a16",
     "src/orchestration/organisation/organisationDestroy.ts": "06076a7e76345854",
@@ -228,8 +229,8 @@
     "src/types/application/ApplicationServiceTypes.ts": "e5185e9ef24a1625",
     "src/types/application/index.ts": "c44d78d2209c4b09",
     "src/types/approval.ts": "d5b7741f677d5f21",
-    "src/types/callbackKeys.ts": "6122dbe3502abd97",
-    "src/types/callbacks.ts": "195275d1eb5dfb5e",
+    "src/types/callbackKeys.ts": "12daa729d3ee3286",
+    "src/types/callbacks.ts": "f529521bf1ca0f4d",
     "src/types/config/DomainState.ts": "76a076a1735ac6cd",
     "src/types/config/FjallState.ts": "e586d9c72c177dea",
     "src/types/config/entitlements.ts": "f69ad28847b67e9a",
@@ -269,9 +270,9 @@
     "src/util/sleepAbortable.ts": "f9cac3bf8a79a476",
     "src/version.ts": "1811a4475823b27e",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "3f1518ad61e36088",
+    "package.json": "e3682cf5a74756a9",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "d6256046f4a1e8299e2c2274d25162d2caf93b873c05807ab141f29af96ff524",
-  "outputFileCount": 507
+  "outputHash": "60e4e430ac1fd73b86c6a9b8e8bc95f5c45ec8c0cf8d8a918e7ceb938defeb20",
+  "outputFileCount": 509
 }

package/dist/.minified

@@ -1 +1 @@
-253 files minified at 2026-08-20T22:19:13.833Z
+254 files minified at 2026-08-22T02:35:01.083Z

package/dist/src/index.d.ts

@@ -58,9 +58,9 @@ export { emitStepWarnings, emitWarningEvent } from "./orchestration/contextHelpe
 export { ENGINE_DIAGNOSTIC_SCOPE } from "./util/diagnosticScopes.js";
 export { restart, probeSecretsDrift, probeServiceDeploymentStatus, computeSecretsDrift, deriveStaleParameters, extractConsumedSsmParameters } from "./orchestration/index.js";
 export type { RestartParams, RestartResult, SecretsDriftProbeParams, ServiceDeploymentStatus, ApplicationServiceStatus, ApplicationSecretsDrift, ServiceSecretsDrift, StaleParameter } from "./orchestration/index.js";
-export { partitionAccounts } from "./orchestration/index.js";
+export { partitionAccounts, deployDomains } from "./orchestration/index.js";
 export { buildRegionList, buildAccountRegionPairs, cascadeHomeRegion, cascadeOperationKey } from "./orchestration/index.js";
-export type { AccountRegionPair } from "./orchestration/index.js";
+export type { AccountRegionPair, DeployDomainsOptions } from "./orchestration/index.js";
 export { projectScalarSummary, projectAccountRows } from "./orchestration/index.js";
 export type { CascadeOutcomeResult, CascadeMemberOutcome, CascadePlatformOutcome, CascadeLedger, CascadeAccountRow, CascadePlatformRow, CascadeAccountProjection } from "./orchestration/index.js";
 export { reconcileProviderAccounts, mergeReconciledProviderAccounts } from "./orchestration/index.js";
@@ -92,8 +92,8 @@ export { DOMAIN_DELEGATION_ERROR_TYPES, DomainDelegationError, DEFAULT_PUBLIC_RE
 export type { DomainDeployPhase, DelegatedDomainTopology, DomainDelegationErrorType, PublicCaaRecord, PublicDnsResolver, NsPropagationGateParams, NsPropagationVerdict, CaaPreflightParams, CaaPreflightVerdict, DelegatedDomainDeployer, DelegatedZonePhaseState, DeployDelegatedDomainParams, DelegatedDomainDeployOutcome, NsDeleteOutcome, DeleteChildNsParams, DelegationDestroyNsOutcome, DelegatedDomainDestroyOutcome, DelegatedDomainDestroyParams } from "./orchestration/index.js";
 export { classifyZoneRecords, buildSatelliteRecordIndex, createSystemDnsNameProbe, systemDnsNameProbe, normaliseRecordName, isRoute53NameServer, isDelegatedToRoute53 } from "./orchestration/index.js";
 export type { RecordClassification, ClassifiedRecord, ZoneClassificationReport, ZoneClassifierClients, ZoneClassifierPhase, ClassifyZoneOptions, SatelliteRecordIndex, DelegatedChildDomain, ChildAccountClients, ChildAccountClientFactory, AwsSdkClientLike, DnsProbeVerdict, DnsNameProbe } from "./orchestration/index.js";
-export { resolveBuildSecrets, resolveSecretRefValue, resolveBuildSecretSessionProvider, sourcedRefsFromBuildArgs, resolveBuildArgs, buildBuildSecretSessionPolicy, buildDeploySessionPolicy, partitionForRegion, validateBuildGroup } from "./orchestration/index.js";
-export type { ResolveBuildArgsContext, ResolveBuildArgsResult, SourcedBuildArgResolver, BuildSecretRef, BuildSecretSessionContext, DeploySessionContext, ValidateBuildGroupInput, BuildGroupMemberInputs } from "./orchestration/index.js";
+export { resolveBuildSecrets, resolveSecretRefValue, resolveBuildSecretSessionProvider, sourcedRefsFromBuildArgs, resolveBuildArgs, buildBuildSecretSessionPolicy, buildDeploySessionPolicy, buildDomainSessionPolicy, partitionForRegion, validateBuildGroup } from "./orchestration/index.js";
+export type { ResolveBuildArgsContext, ResolveBuildArgsResult, SourcedBuildArgResolver, BuildSecretRef, BuildSecretSessionContext, DeploySessionContext, DomainSessionContext, ValidateBuildGroupInput, BuildGroupMemberInputs } from "./orchestration/index.js";
 export type { FrameworkBuilder, FrameworkDetection, BuildPlan, BuildCommand, BuildCallbacks, DetectionContext, BuildOptions } from "./types/index.js";
 export { FrameworkRegistry, type ResolvedBuilder } from "./orchestration/index.js";
 export { openNextBuilder, staticSiteBuilder, dockerBuilder } from "./orchestration/index.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as a,DEPLOYMENT_EVENT_TYPES as i,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as l,CASCADE_PHASES as S,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as T,truncateUtf16Safe as m}from"./types/index.js";import{DeployEventSchema as _,StepProgressSchema as A,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as y,DEPLOY_EVENT_NAME_MAX as g,DEPLOY_EVENT_MESSAGE_MAX as I,DEPLOY_EVENT_STATUS_REASON_MAX as L,DEPLOY_EVENT_ERROR_MESSAGE_MAX as x,DEPLOY_EVENT_TRAIL_DETAIL_MAX as h,DEPLOY_EVENT_OUTPUT_MAX as v,DEPLOY_EVENT_ARN_MAX as F,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ae,probeAccountStackExists as ie}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as le,describeOrganisation as Se,enablePolicyTypes as pe,enableServiceAccess as Te,SERVICE_PRINCIPALS as me,enableRamSharing as Re,activateTrustedAccess as _e,enableIpamDelegatedAdmin as Ae,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as ye,checkIdentityCentreStatus as ge,snapshotIdentityCentre as Ie,composeSdkAbortSignal as Le,extractErrorName as xe,isAborted as he,DEFAULT_MAX_PAGES as ve,IDENTITY_STORE_PAGE_SIZE as Fe,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ar}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as lr,verbsForDriftVerdict as Sr}from"./types/index.js";import{REMEDIATION_PHASES as Tr,RemediationPhaseSchema as mr,RemediationTargetSchema as Rr,RemediationFlipProofSchema as _r,RemediationJournalRecordSchema as Ar,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Cr,APPLICATION_DEPLOY_ORDER as Nr,APPLICATION_DESTROY_ORDER as yr,OPENNEXT_DEPLOY_ORDER as gr,OPENNEXT_DESTROY_ORDER as Ir,PARALLEL_DEPLOY_GROUPS as Lr,PARALLEL_DESTROY_GROUPS as xr,OPENNEXT_PARALLEL_GROUPS as hr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Fr,isOrganisationOperation as Mr,getParallelDeployGroups as Ur,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Wr,OPENNEXT_PATTERNS as Qr,STACK_NOT_FOUND_PATTERN as jr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as it,readStateFile as nt,writeStateFile as st,createEmptyState as ct,deleteStateFile as Et,updateTemplateHash as lt,getStateFilePath as St,regionSuffix as pt}from"./types/config/FjallState.js";import{readDomainState as mt,writeDomainState as Rt,recordDomainDeployState as _t,deleteDomainState as At,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Ct,CdkProcessManager as Nt,ensureDependencyIntegrity as yt,clearDependencyIntegrityCache as gt,DEPENDENCY_SYNC_TIMEOUT_MS as It,CdkEventMonitor as Lt,startStackMonitoring as xt,DEFAULT_DEPLOY_TIMEOUT_MS as ht,isCdkError as vt,formatInfrastructureError as Ft,getStructuralHint as Mt,getSourceContext as Ut,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Wt,parseBuildPhase as Qt,buildStepContextBuildConfig as jt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as ao,DeploymentError as io,NetworkError as no,FileSystemError as so,ConfigError as co,toServiceError as Eo}from"./types/errors/index.js";import{filterDangerousEnvVars as So,maskSensitiveOutput as po,parseShellArgs as To,sleep as mo}from"@fjall/util";import{artefactOutputKey as _o,DeployModeSchema as Ao,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as Co}from"./util/sleepAbortable.js";import{createSequencedCallbacks as yo}from"./util/sequencedCallbacks.js";import{fileExists as Io}from"@fjall/util/fsHelpers";import{success as xo,failure as ho,isSuccess as vo,isFailure as Fo}from"@fjall/generator";import{deploy as Uo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{buildParamsContext as Vo}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Bo,emitWarningEvent as Ko}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Ho}from"./util/diagnosticScopes.js";import{restart as Jo,probeSecretsDrift as Wo,probeServiceDeploymentStatus as Qo,computeSecretsDrift as jo,deriveStaleParameters as Zo,extractConsumedSsmParameters as qo}from"./orchestration/index.js";import{partitionAccounts as $o}from"./orchestration/index.js";import{buildRegionList as ra,buildAccountRegionPairs as ta,cascadeHomeRegion as oa,cascadeOperationKey as aa}from"./orchestration/index.js";import{projectScalarSummary as na,projectAccountRows as sa}from"./orchestration/index.js";import{reconcileProviderAccounts as Ea,mergeReconciledProviderAccounts as la}from"./orchestration/index.js";import{decideNextTransition as pa,reconcileTrailMigration as Ta,decommissionMemberTrailStorage as ma,ORG_TRAIL_BUCKET_OUTPUT_KEY as Ra,TRAIL_BUCKET_OUTPUT_KEY as _a,TRAIL_KEY_ARN_OUTPUT_KEY as Aa}from"./orchestration/index.js";import{classifyDriftFailure as ua,fetchLastOperationEvents as Da,DriftProbe as Pa,probePhysicalPresence as Oa,clearDriftSuspects as fa,defaultDriftJournalDir as Ca,readDriftSuspects as Na,recordDriftSuspects as ya,detectStackDrift as ga,runDriftPreFlight as Ia,formatDriftPreFlightBlock as La,DRIFT_PREFLIGHT_TRIGGER_STATUSES as xa,DRIFT_PREFLIGHT_BUDGET_MS as ha,runRoute53RecordPreflight as va}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ma,computeRemediationOpId as Ua,defaultRemediationJournalDir as ka,findRemediationJournalByOpId as ba,listActiveRemediationOps as Ya,listActiveRemediationOpsForContext as Va,readRemediationJournal as Ga,sweepExpiredRemediationJournals as Ba,writeRemediationJournal as Ka,REMEDIATION_JOURNAL_RETENTION_DAYS as Xa,captureRemediationForensics as Ha,defaultRemediationForensicsDir as wa,applyRetainFlip as Ja,composeFlipCapabilities as Wa,computeTemplateDigest as Qa,deriveRetainFlipTemplate as ja,findMarkedResourcesByOpId as Za,proveFlipMetadataOnly as qa,readRetainFlipState as za,verifyRetainFlipDiff as $a,FORGET_MARKER_KEY as ei,FORGET_FLIP_SPEC as ri,RECREATE_MARKER_KEY as ti,assessForgetResumability as oi,completeForgetAfterConverge as ai,completeForgetAfterDeploy as ii,formatRecreateInFlightCures as ni,partitionPreFlightByRemediation as si,runForgetSurgery as ci,synthTemplateDeclaresResource as Ei,runRecreateSurgery as li,snapshotPolicyForType as Si,SNAPSHOT_CAPABLE_RESOURCE_TYPES as pi,runRecreatePreFlight as Ti,deriveRemovalTemplate as mi,findRemovalDeletionFailures as Ri,findResourcesPresent as _i,proveRemovalTargetsOnly as Ai,advertisableDriftVerbs as di,buildDriftRepairTicket as ui,runDriftRepairGate as Di,formatPinOutcomeDetail as Pi,pinProbeCoverage as Oi,renderPinReportLines as fi,runPinRemediation as Ci,captureLegacySurfaces as Ni,decodeLegacyAnchor as yi,runIdentitySurfaceGate as gi,collectIdentityPinCandidates as Ii,degradedIdentityPinOutcomes as Li,renderIdentityPinReportLines as xi,runIdentityPinMigration as hi,composePostFailureRepairOffer as vi,formatDriftRepairOffer as Fi,DriftRepairAvailableError as Mi,checkDeployPathStackAvailability as Ui,isDeployPathBlockingStatus as ki,StackUnavailableError as bi,assertLeaseBeforeStack as Yi,LeaseDeniedError as Vi}from"./orchestration/index.js";import{unlockBucket as Bi,unlockQueue as Ki}from"./orchestration/index.js";import{triageBucketPolicy as Hi,isEnforceSslStatement as wi,toResourcePolicyStatements as Ji,restoreBucketPolicy as Wi,synthesiseEnforceSslDocument as Qi,ensureEnforceSsl as ji,restoreAndReconcileQuarantinedBucket as Zi}from"./orchestration/index.js";import{verifyOrgTrailDelivery as zi}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as en,isRootTaskPolicyArn as rn,ROOT_TASK_POLICY_ARNS as tn,MAX_ROOT_SESSION_SECONDS as on}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as nn,flattenAccountsToEnvironments as sn,extractAllAccountNames as cn,accountsConfigToOUTree as En,isStringArray as ln,isAccountsConfig as Sn,isOuOnlyAccountBucket as pn,OU_ONLY_ACCOUNT_BUCKETS as Tn}from"./orchestration/index.js";import{runOpenNextBuild as Rn}from"./orchestration/index.js";import{runOrganisationSetup as An,ORG_SETUP_PHASES as dn}from"./orchestration/index.js";import{recordPhysicalName as Dn,parseRecordPhysicalName as Pn,recordSetKey as On,deleteRecordSetsByKey as fn,cascadeTakeoverDigestSeed as Cn,buildCascadeTakeoverTicket as Nn,runCascadeTakeoverGate as yn,WorkerDomainDeployProvider as gn,createWorkerDomainDeployProvider as In,createCascadeDomainProviderFactory as Ln}from"./orchestration/index.js";import{assumeCascadeRole as hn}from"./orchestration/contextHelpers.js";import{DOMAIN_DELEGATION_ERROR_TYPES as Fn,DomainDelegationError as Mn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as Un,PUBLIC_DNS_QUERY_TIMEOUT_MS as kn,createPublicResolvers as bn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Yn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Vn,waitForNsPropagation as Gn,ACM_CAA_ISSUERS as Bn,runCaaPreflight as Kn,deployDelegatedDomain as Xn,delegationRoleUnusableError as Hn,deriveZonePhaseState as wn,extractDelegationRoleArn as Jn,readDelegatedTopologyFromProps as Wn,readDomainStackOutputsByExport as Qn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as jn,templateOwnsDelegationRecord as Zn,deleteChildNsFromParent as qn,nsDelegationPhysicalName as zn,runDelegatedDomainDestroy as $n}from"./orchestration/index.js";import{classifyZoneRecords as rs,buildSatelliteRecordIndex as ts,createSystemDnsNameProbe as os,systemDnsNameProbe as as,normaliseRecordName as is,isRoute53NameServer as ns,isDelegatedToRoute53 as ss}from"./orchestration/index.js";import{resolveBuildSecrets as Es,resolveSecretRefValue as ls,resolveBuildSecretSessionProvider as Ss,sourcedRefsFromBuildArgs as ps,resolveBuildArgs as Ts,buildBuildSecretSessionPolicy as ms,buildDeploySessionPolicy as Rs,partitionForRegion as _s,validateBuildGroup as As}from"./orchestration/index.js";import{FrameworkRegistry as us}from"./orchestration/index.js";import{openNextBuilder as Ps,staticSiteBuilder as Os,dockerBuilder as fs}from"./orchestration/index.js";import{StepRegistry as Ns,getDestroyStepId as ys}from"./steps/index.js";import{buildDeployPlan as Is,computeDeployPlan as Ls,computeAssemblyDigest as xs,digestHead as hs,classifyImpact as vs,derivePropertyChanges as Fs,isDataLoss as Ms,isStatefulResourceType as Us,renderPlanSummary as ks,renderPlanLines as bs,toWirePlanChanges as Ys,signApprovalToken as Vs,verifyApprovalToken as Gs,DEFAULT_APPROVAL_TTL_MS as Bs,APPROVAL_TOKEN_PATTERN as Ks,runApprovalGate as Xs,approvalRefusalReason as Hs}from"./orchestration/index.js";import{runDestructionGate as Js,buildDestructionTicket as Ws,evaluateDestructionConsents as Qs,computeTicketDigest as js,legalRemediationVerbs as Zs,executableRemediationVerbs as qs,advertisableRemediationVerbs as zs,renderDestructionTicketLines as $s,renderConsentVerdictLines as ec,loadDeployPlan as rc,createMemoisedPlanLoader as tc}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as ac,classifyDeployFailure as ic,classifyFromEcsCompletion as nc,classifyFromFailureAnalysis as sc,classifyUnclassified as cc}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as lc,getDeploymentFailure as Sc}from"./orchestration/failure/deploymentFailureAttachment.js";export{Bn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Nr as APPLICATION_DEPLOY_ORDER,yr as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Ks as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,ao as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,S as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,jn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Ct as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,Lt as CdkEventMonitor,Nt as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,co as ConfigError,Bs as DEFAULT_APPROVAL_TTL_MS,ht as DEFAULT_DEPLOY_TIMEOUT_MS,ve as DEFAULT_MAX_PAGES,Un as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,It as DEPENDENCY_SYNC_TIMEOUT_MS,l as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,i as DEPLOYMENT_EVENT_TYPES,ac as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,F as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,x as DEPLOY_EVENT_ERROR_MESSAGE_MAX,y as DEPLOY_EVENT_ID_MAX,I as DEPLOY_EVENT_MESSAGE_MAX,g as DEPLOY_EVENT_NAME_MAX,v as DEPLOY_EVENT_OUTPUT_MAX,L as DEPLOY_EVENT_STATUS_REASON_MAX,h as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,Fn as DOMAIN_DELEGATION_ERROR_TYPES,ha as DRIFT_PREFLIGHT_BUDGET_MS,xa as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,_ as DeployEventSchema,Ao as DeployModeSchema,d as DeployResourceSchema,io as DeploymentError,a as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,Mn as DomainDelegationError,Er as DriftFindingSchema,lr as DriftJournalRecordSchema,Pa as DriftProbe,Mi as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Ho as ENGINE_DIAGNOSTIC_SCOPE,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,ri as FORGET_FLIP_SPEC,ei as FORGET_MARKER_KEY,so as FileSystemError,it as FjallStateFileSchema,us as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,Fe as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Vi as LeaseDeniedError,on as MAX_ROOT_SESSION_SECONDS,Vn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Yn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,gr as OPENNEXT_DEPLOY_ORDER,Ir as OPENNEXT_DESTROY_ORDER,hr as OPENNEXT_PARALLEL_GROUPS,Qr as OPENNEXT_PATTERNS,Cr as ORGANISATION_TYPES,dn as ORG_SETUP_PHASES,Ra as ORG_TRAIL_BUCKET_OUTPUT_KEY,Tn as OU_ONLY_ACCOUNT_BUCKETS,Lr as PARALLEL_DEPLOY_GROUPS,xr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Wt as PROGRESS_MESSAGES,kn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,ti as RECREATE_MARKER_KEY,Xa as REMEDIATION_JOURNAL_RETENTION_DAYS,Tr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,tn as ROOT_TASK_POLICY_ARNS,_r as RemediationFlipProofSchema,Ar as RemediationJournalRecordSchema,mr as RemediationPhaseSchema,Rr as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,me as SERVICE_PRINCIPALS,pi as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,jr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,bi as StackUnavailableError,A as StepProgressSchema,Ns as StepRegistry,or as TICKET_VERDICT_SOURCES,_a as TRAIL_BUCKET_OUTPUT_KEY,Aa as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,ar as TicketVerdictSourceSchema,to as ValidationError,gn as WorkerDomainDeployProvider,En as accountsConfigToOUTree,ye as activateCostAllocationTags,_e as activateTrustedAccess,di as advertisableDriftVerbs,zs as advertisableRemediationVerbs,Ja as applyRetainFlip,Hs as approvalRefusalReason,Ma as archiveCompletedRemediationJournal,_o as artefactOutputKey,Yi as assertLeaseBeforeStack,oi as assessForgetResumability,hn as assumeCascadeRole,en as assumeRootForTask,lc as attachDeploymentFailure,ta as buildAccountRegionPairs,Ce as buildAccountToOUMap,ms as buildBuildSecretSessionPolicy,Nn as buildCascadeTakeoverTicket,Is as buildDeployPlan,Rs as buildDeploySessionPolicy,Ws as buildDestructionTicket,ui as buildDriftRepairTicket,Vo as buildParamsContext,ra as buildRegionList,ts as buildSatelliteRecordIndex,jt as buildStepContextBuildConfig,ae as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Ni as captureLegacySurfaces,Ha as captureRemediationForensics,oa as cascadeHomeRegion,aa as cascadeOperationKey,Cn as cascadeTakeoverDigestSeed,Ui as checkDeployPathStackAvailability,ge as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,T as clampDeploymentEventStrings,ic as classifyDeployFailure,ua as classifyDriftFailure,nc as classifyFromEcsCompletion,sc as classifyFromFailureAnalysis,vs as classifyImpact,cc as classifyUnclassified,rs as classifyZoneRecords,gt as clearDependencyIntegrityCache,fa as clearDriftSuspects,Ii as collectIdentityPinCandidates,ai as completeForgetAfterConverge,ii as completeForgetAfterDeploy,Wa as composeFlipCapabilities,vi as composePostFailureRepairOffer,Le as composeSdkAbortSignal,xs as computeAssemblyDigest,Ls as computeDeployPlan,Ua as computeRemediationOpId,jo as computeSecretsDrift,Qa as computeTemplateDigest,js as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,Ln as createCascadeDomainProviderFactory,j as createDeployEmitter,ct as createEmptyState,tc as createMemoisedPlanLoader,bn as createPublicResolvers,yo as createSequencedCallbacks,os as createSystemDnsNameProbe,In as createWorkerDomainDeployProvider,pa as decideNextTransition,yi as decodeLegacyAnchor,ma as decommissionMemberTrailStorage,Ca as defaultDriftJournalDir,wa as defaultRemediationForensicsDir,ka as defaultRemediationJournalDir,Li as degradedIdentityPinOutcomes,Hn as delegationRoleUnusableError,qn as deleteChildNsFromParent,At as deleteDomainState,fn as deleteRecordSetsByKey,Et as deleteStateFile,Uo as deploy,Xn as deployDelegatedDomain,Fs as derivePropertyChanges,mi as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,ja as deriveRetainFlipTemplate,Zo as deriveStaleParameters,wn as deriveZonePhaseState,Se as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,ga as detectStackDrift,hs as digestHead,fs as dockerBuilder,Me as drainPages,Jt as emitProgress,Bo as emitStepWarnings,Ko as emitWarningEvent,Ye as enableCentralisedRootAccess,Ae as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Re as enableRamSharing,Te as enableServiceAccess,yt as ensureDependencyIntegrity,ji as ensureEnforceSsl,le as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Qs as evaluateDestructionConsents,qs as executableRemediationVerbs,cn as extractAllAccountNames,qo as extractConsumedSsmParameters,Jn as extractDelegationRoleArn,xe as extractErrorName,ho as failure,Da as fetchLastOperationEvents,Io as fileExists,So as filterDangerousEnvVars,De as findAccount,Ne as findDevelopmentOuId,Za as findMarkedResourcesByOpId,ba as findRemediationJournalByOpId,Ri as findRemovalDeletionFailures,_i as findResourcesPresent,sn as flattenAccountsToEnvironments,La as formatDriftPreFlightBlock,Fi as formatDriftRepairOffer,Ft as formatInfrastructureError,Pi as formatPinOutcomeDetail,ni as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,Sc as getDeploymentFailure,ys as getDestroyStepId,Gr as getOrganisationStackName,Ur as getParallelDeployGroups,kr as getParallelDestroyGroups,Ut as getSourceContext,St as getStateFilePath,Mt as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,he as isAborted,Sn as isAccountsConfig,Fr as isApplicationOperation,Br as isApplicationStack,vt as isCdkError,Ms as isDataLoss,ss as isDelegatedToRoute53,ki as isDeployPathBlockingStatus,wi as isEnforceSslStatement,Fo as isFailure,Ue as isOULeaf,Wr as isOpenNextPattern,Mr as isOrganisationOperation,pn as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,rn as isRootTaskPolicyArn,ns as isRoute53NameServer,Us as isStatefulResourceType,ln as isStringArray,vo as isSuccess,Zs as legalRemediationVerbs,ue as listAccounts,Ya as listActiveRemediationOps,Va as listActiveRemediationOpsForContext,rc as loadDeployPlan,po as maskSensitiveOutput,la as mergeReconciledProviderAccounts,is as normaliseRecordName,zn as nsDelegationPhysicalName,Ps as openNextBuilder,nn as parseAccountsConfiguration,Qt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,Pn as parseRecordPhysicalName,To as parseShellArgs,$o as partitionAccounts,_s as partitionForRegion,si as partitionPreFlightByRemediation,Oi as pinProbeCoverage,fe as placeAccountsInOUs,ie as probeAccountStackExists,Oa as probePhysicalPresence,Wo as probeSecretsDrift,Qo as probeServiceDeploymentStatus,sa as projectAccountRows,na as projectScalarSummary,qa as proveFlipMetadataOnly,Ai as proveRemovalTargetsOnly,Wn as readDelegatedTopologyFromProps,Qn as readDomainStackOutputsByExport,mt as readDomainState,Na as readDriftSuspects,Ga as readRemediationJournal,za as readRetainFlipState,nt as readStateFile,Ea as reconcileProviderAccounts,Ta as reconcileTrailMigration,_t as recordDomainDeployState,ya as recordDriftSuspects,Dn as recordPhysicalName,On as recordSetKey,ce as regionDisabledMessage,pt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,ec as renderConsentVerdictLines,$s as renderDestructionTicketLines,xi as renderIdentityPinReportLines,fi as renderPinReportLines,bs as renderPlanLines,ks as renderPlanSummary,Ts as resolveBuildArgs,Ss as resolveBuildSecretSessionProvider,Es as resolveBuildSecrets,ls as resolveSecretRefValue,Jo as restart,Zi as restoreAndReconcileQuarantinedBucket,Wi as restoreBucketPolicy,Xs as runApprovalGate,Kn as runCaaPreflight,yn as runCascadeTakeoverGate,$n as runDelegatedDomainDestroy,Js as runDestructionGate,Ia as runDriftPreFlight,Di as runDriftRepairGate,ci as runForgetSurgery,hi as runIdentityPinMigration,gi as runIdentitySurfaceGate,Rn as runOpenNextBuild,An as runOrganisationSetup,Ci as runPinRemediation,Ti as runRecreatePreFlight,li as runRecreateSurgery,va as runRoute53RecordPreflight,Vs as signApprovalToken,mo as sleep,Co as sleepAbortable,Ie as snapshotIdentityCentre,Si as snapshotPolicyForType,ps as sourcedRefsFromBuildArgs,xt as startStackMonitoring,Os as staticSiteBuilder,rt as stubCallerIdentity,xo as success,Ba as sweepExpiredRemediationJournals,Ei as synthTemplateDeclaresResource,Qi as synthesiseEnforceSslDocument,as as systemDnsNameProbe,Zn as templateOwnsDelegationRecord,Jr as toPascalCase,Ji as toResourcePolicyStatements,Eo as toServiceError,Ys as toWirePlanChanges,Hi as triageBucketPolicy,m as truncateUtf16Safe,Bi as unlockBucket,Ki as unlockQueue,de as updateBackupGlobalSettings,lt as updateTemplateHash,As as validateBuildGroup,Sr as verbsForDriftVerdict,Gs as verifyApprovalToken,zi as verifyOrgTrailDelivery,$a as verifyRetainFlipDiff,Gn as waitForNsPropagation,et as wrapApplicationError,Rt as writeDomainState,Ka as writeRemediationJournal,st as writeStateFile};
+import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as a,DEPLOYMENT_EVENT_TYPES as i,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as l,CASCADE_PHASES as S,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as m,truncateUtf16Safe as T}from"./types/index.js";import{DeployEventSchema as _,StepProgressSchema as A,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as y,DEPLOY_EVENT_NAME_MAX as g,DEPLOY_EVENT_MESSAGE_MAX as I,DEPLOY_EVENT_STATUS_REASON_MAX as L,DEPLOY_EVENT_ERROR_MESSAGE_MAX as x,DEPLOY_EVENT_TRAIL_DETAIL_MAX as h,DEPLOY_EVENT_OUTPUT_MAX as v,DEPLOY_EVENT_ARN_MAX as F,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ae,probeAccountStackExists as ie}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as le,describeOrganisation as Se,enablePolicyTypes as pe,enableServiceAccess as me,SERVICE_PRINCIPALS as Te,enableRamSharing as Re,activateTrustedAccess as _e,enableIpamDelegatedAdmin as Ae,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as ye,checkIdentityCentreStatus as ge,snapshotIdentityCentre as Ie,composeSdkAbortSignal as Le,extractErrorName as xe,isAborted as he,DEFAULT_MAX_PAGES as ve,IDENTITY_STORE_PAGE_SIZE as Fe,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ar}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as lr,verbsForDriftVerdict as Sr}from"./types/index.js";import{REMEDIATION_PHASES as mr,RemediationPhaseSchema as Tr,RemediationTargetSchema as Rr,RemediationFlipProofSchema as _r,RemediationJournalRecordSchema as Ar,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Cr,APPLICATION_DEPLOY_ORDER as Nr,APPLICATION_DESTROY_ORDER as yr,OPENNEXT_DEPLOY_ORDER as gr,OPENNEXT_DESTROY_ORDER as Ir,PARALLEL_DEPLOY_GROUPS as Lr,PARALLEL_DESTROY_GROUPS as xr,OPENNEXT_PARALLEL_GROUPS as hr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Fr,isOrganisationOperation as Mr,getParallelDeployGroups as Ur,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Wr,OPENNEXT_PATTERNS as Qr,STACK_NOT_FOUND_PATTERN as jr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as it,readStateFile as nt,writeStateFile as st,createEmptyState as ct,deleteStateFile as Et,updateTemplateHash as lt,getStateFilePath as St,regionSuffix as pt}from"./types/config/FjallState.js";import{readDomainState as Tt,writeDomainState as Rt,recordDomainDeployState as _t,deleteDomainState as At,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Ct,CdkProcessManager as Nt,ensureDependencyIntegrity as yt,clearDependencyIntegrityCache as gt,DEPENDENCY_SYNC_TIMEOUT_MS as It,CdkEventMonitor as Lt,startStackMonitoring as xt,DEFAULT_DEPLOY_TIMEOUT_MS as ht,isCdkError as vt,formatInfrastructureError as Ft,getStructuralHint as Mt,getSourceContext as Ut,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Wt,parseBuildPhase as Qt,buildStepContextBuildConfig as jt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as ao,DeploymentError as io,NetworkError as no,FileSystemError as so,ConfigError as co,toServiceError as Eo}from"./types/errors/index.js";import{filterDangerousEnvVars as So,maskSensitiveOutput as po,parseShellArgs as mo,sleep as To}from"@fjall/util";import{artefactOutputKey as _o,DeployModeSchema as Ao,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as Co}from"./util/sleepAbortable.js";import{createSequencedCallbacks as yo}from"./util/sequencedCallbacks.js";import{fileExists as Io}from"@fjall/util/fsHelpers";import{success as xo,failure as ho,isSuccess as vo,isFailure as Fo}from"@fjall/generator";import{deploy as Uo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{buildParamsContext as Vo}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Bo,emitWarningEvent as Ko}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Ho}from"./util/diagnosticScopes.js";import{restart as Jo,probeSecretsDrift as Wo,probeServiceDeploymentStatus as Qo,computeSecretsDrift as jo,deriveStaleParameters as Zo,extractConsumedSsmParameters as qo}from"./orchestration/index.js";import{partitionAccounts as $o,deployDomains as ea}from"./orchestration/index.js";import{buildRegionList as ta,buildAccountRegionPairs as oa,cascadeHomeRegion as aa,cascadeOperationKey as ia}from"./orchestration/index.js";import{projectScalarSummary as sa,projectAccountRows as ca}from"./orchestration/index.js";import{reconcileProviderAccounts as la,mergeReconciledProviderAccounts as Sa}from"./orchestration/index.js";import{decideNextTransition as ma,reconcileTrailMigration as Ta,decommissionMemberTrailStorage as Ra,ORG_TRAIL_BUCKET_OUTPUT_KEY as _a,TRAIL_BUCKET_OUTPUT_KEY as Aa,TRAIL_KEY_ARN_OUTPUT_KEY as da}from"./orchestration/index.js";import{classifyDriftFailure as Da,fetchLastOperationEvents as Pa,DriftProbe as Oa,probePhysicalPresence as fa,clearDriftSuspects as Ca,defaultDriftJournalDir as Na,readDriftSuspects as ya,recordDriftSuspects as ga,detectStackDrift as Ia,runDriftPreFlight as La,formatDriftPreFlightBlock as xa,DRIFT_PREFLIGHT_TRIGGER_STATUSES as ha,DRIFT_PREFLIGHT_BUDGET_MS as va,runRoute53RecordPreflight as Fa}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ua,computeRemediationOpId as ka,defaultRemediationJournalDir as ba,findRemediationJournalByOpId as Ya,listActiveRemediationOps as Va,listActiveRemediationOpsForContext as Ga,readRemediationJournal as Ba,sweepExpiredRemediationJournals as Ka,writeRemediationJournal as Xa,REMEDIATION_JOURNAL_RETENTION_DAYS as Ha,captureRemediationForensics as wa,defaultRemediationForensicsDir as Ja,applyRetainFlip as Wa,composeFlipCapabilities as Qa,computeTemplateDigest as ja,deriveRetainFlipTemplate as Za,findMarkedResourcesByOpId as qa,proveFlipMetadataOnly as za,readRetainFlipState as $a,verifyRetainFlipDiff as ei,FORGET_MARKER_KEY as ri,FORGET_FLIP_SPEC as ti,RECREATE_MARKER_KEY as oi,assessForgetResumability as ai,completeForgetAfterConverge as ii,completeForgetAfterDeploy as ni,formatRecreateInFlightCures as si,partitionPreFlightByRemediation as ci,runForgetSurgery as Ei,synthTemplateDeclaresResource as li,runRecreateSurgery as Si,snapshotPolicyForType as pi,SNAPSHOT_CAPABLE_RESOURCE_TYPES as mi,runRecreatePreFlight as Ti,deriveRemovalTemplate as Ri,findRemovalDeletionFailures as _i,findResourcesPresent as Ai,proveRemovalTargetsOnly as di,advertisableDriftVerbs as ui,buildDriftRepairTicket as Di,runDriftRepairGate as Pi,formatPinOutcomeDetail as Oi,pinProbeCoverage as fi,renderPinReportLines as Ci,runPinRemediation as Ni,captureLegacySurfaces as yi,decodeLegacyAnchor as gi,runIdentitySurfaceGate as Ii,collectIdentityPinCandidates as Li,degradedIdentityPinOutcomes as xi,renderIdentityPinReportLines as hi,runIdentityPinMigration as vi,composePostFailureRepairOffer as Fi,formatDriftRepairOffer as Mi,DriftRepairAvailableError as Ui,checkDeployPathStackAvailability as ki,isDeployPathBlockingStatus as bi,StackUnavailableError as Yi,assertLeaseBeforeStack as Vi,LeaseDeniedError as Gi}from"./orchestration/index.js";import{unlockBucket as Ki,unlockQueue as Xi}from"./orchestration/index.js";import{triageBucketPolicy as wi,isEnforceSslStatement as Ji,toResourcePolicyStatements as Wi,restoreBucketPolicy as Qi,synthesiseEnforceSslDocument as ji,ensureEnforceSsl as Zi,restoreAndReconcileQuarantinedBucket as qi}from"./orchestration/index.js";import{verifyOrgTrailDelivery as $i}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as rn,isRootTaskPolicyArn as tn,ROOT_TASK_POLICY_ARNS as on,MAX_ROOT_SESSION_SECONDS as an}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as sn,flattenAccountsToEnvironments as cn,extractAllAccountNames as En,accountsConfigToOUTree as ln,isStringArray as Sn,isAccountsConfig as pn,isOuOnlyAccountBucket as mn,OU_ONLY_ACCOUNT_BUCKETS as Tn}from"./orchestration/index.js";import{runOpenNextBuild as _n}from"./orchestration/index.js";import{runOrganisationSetup as dn,ORG_SETUP_PHASES as un}from"./orchestration/index.js";import{recordPhysicalName as Pn,parseRecordPhysicalName as On,recordSetKey as fn,deleteRecordSetsByKey as Cn,cascadeTakeoverDigestSeed as Nn,buildCascadeTakeoverTicket as yn,runCascadeTakeoverGate as gn,WorkerDomainDeployProvider as In,createWorkerDomainDeployProvider as Ln,createCascadeDomainProviderFactory as xn}from"./orchestration/index.js";import{assumeCascadeRole as vn}from"./orchestration/contextHelpers.js";import{DOMAIN_DELEGATION_ERROR_TYPES as Mn,DomainDelegationError as Un,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as kn,PUBLIC_DNS_QUERY_TIMEOUT_MS as bn,createPublicResolvers as Yn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Vn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Gn,waitForNsPropagation as Bn,ACM_CAA_ISSUERS as Kn,runCaaPreflight as Xn,deployDelegatedDomain as Hn,delegationRoleUnusableError as wn,deriveZonePhaseState as Jn,extractDelegationRoleArn as Wn,readDelegatedTopologyFromProps as Qn,readDomainStackOutputsByExport as jn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as Zn,templateOwnsDelegationRecord as qn,deleteChildNsFromParent as zn,nsDelegationPhysicalName as $n,runDelegatedDomainDestroy as es}from"./orchestration/index.js";import{classifyZoneRecords as ts,buildSatelliteRecordIndex as os,createSystemDnsNameProbe as as,systemDnsNameProbe as is,normaliseRecordName as ns,isRoute53NameServer as ss,isDelegatedToRoute53 as cs}from"./orchestration/index.js";import{resolveBuildSecrets as ls,resolveSecretRefValue as Ss,resolveBuildSecretSessionProvider as ps,sourcedRefsFromBuildArgs as ms,resolveBuildArgs as Ts,buildBuildSecretSessionPolicy as Rs,buildDeploySessionPolicy as _s,buildDomainSessionPolicy as As,partitionForRegion as ds,validateBuildGroup as us}from"./orchestration/index.js";import{FrameworkRegistry as Ps}from"./orchestration/index.js";import{openNextBuilder as fs,staticSiteBuilder as Cs,dockerBuilder as Ns}from"./orchestration/index.js";import{StepRegistry as gs,getDestroyStepId as Is}from"./steps/index.js";import{buildDeployPlan as xs,computeDeployPlan as hs,computeAssemblyDigest as vs,digestHead as Fs,classifyImpact as Ms,derivePropertyChanges as Us,isDataLoss as ks,isStatefulResourceType as bs,renderPlanSummary as Ys,renderPlanLines as Vs,toWirePlanChanges as Gs,signApprovalToken as Bs,verifyApprovalToken as Ks,DEFAULT_APPROVAL_TTL_MS as Xs,APPROVAL_TOKEN_PATTERN as Hs,runApprovalGate as ws,approvalRefusalReason as Js}from"./orchestration/index.js";import{runDestructionGate as Qs,buildDestructionTicket as js,evaluateDestructionConsents as Zs,computeTicketDigest as qs,legalRemediationVerbs as zs,executableRemediationVerbs as $s,advertisableRemediationVerbs as ec,renderDestructionTicketLines as rc,renderConsentVerdictLines as tc,loadDeployPlan as oc,createMemoisedPlanLoader as ac}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as nc,classifyDeployFailure as sc,classifyFromEcsCompletion as cc,classifyFromFailureAnalysis as Ec,classifyUnclassified as lc}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as pc,getDeploymentFailure as mc}from"./orchestration/failure/deploymentFailureAttachment.js";export{Kn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Nr as APPLICATION_DEPLOY_ORDER,yr as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Hs as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,ao as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,S as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,Zn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Ct as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,Lt as CdkEventMonitor,Nt as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,co as ConfigError,Xs as DEFAULT_APPROVAL_TTL_MS,ht as DEFAULT_DEPLOY_TIMEOUT_MS,ve as DEFAULT_MAX_PAGES,kn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,It as DEPENDENCY_SYNC_TIMEOUT_MS,l as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,i as DEPLOYMENT_EVENT_TYPES,nc as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,F as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,x as DEPLOY_EVENT_ERROR_MESSAGE_MAX,y as DEPLOY_EVENT_ID_MAX,I as DEPLOY_EVENT_MESSAGE_MAX,g as DEPLOY_EVENT_NAME_MAX,v as DEPLOY_EVENT_OUTPUT_MAX,L as DEPLOY_EVENT_STATUS_REASON_MAX,h as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,Mn as DOMAIN_DELEGATION_ERROR_TYPES,va as DRIFT_PREFLIGHT_BUDGET_MS,ha as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,_ as DeployEventSchema,Ao as DeployModeSchema,d as DeployResourceSchema,io as DeploymentError,a as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,Un as DomainDelegationError,Er as DriftFindingSchema,lr as DriftJournalRecordSchema,Oa as DriftProbe,Ui as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Ho as ENGINE_DIAGNOSTIC_SCOPE,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,ti as FORGET_FLIP_SPEC,ri as FORGET_MARKER_KEY,so as FileSystemError,it as FjallStateFileSchema,Ps as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,Fe as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Gi as LeaseDeniedError,an as MAX_ROOT_SESSION_SECONDS,Gn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Vn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,gr as OPENNEXT_DEPLOY_ORDER,Ir as OPENNEXT_DESTROY_ORDER,hr as OPENNEXT_PARALLEL_GROUPS,Qr as OPENNEXT_PATTERNS,Cr as ORGANISATION_TYPES,un as ORG_SETUP_PHASES,_a as ORG_TRAIL_BUCKET_OUTPUT_KEY,Tn as OU_ONLY_ACCOUNT_BUCKETS,Lr as PARALLEL_DEPLOY_GROUPS,xr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Wt as PROGRESS_MESSAGES,bn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,oi as RECREATE_MARKER_KEY,Ha as REMEDIATION_JOURNAL_RETENTION_DAYS,mr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,on as ROOT_TASK_POLICY_ARNS,_r as RemediationFlipProofSchema,Ar as RemediationJournalRecordSchema,Tr as RemediationPhaseSchema,Rr as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,Te as SERVICE_PRINCIPALS,mi as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,jr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,Yi as StackUnavailableError,A as StepProgressSchema,gs as StepRegistry,or as TICKET_VERDICT_SOURCES,Aa as TRAIL_BUCKET_OUTPUT_KEY,da as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,ar as TicketVerdictSourceSchema,to as ValidationError,In as WorkerDomainDeployProvider,ln as accountsConfigToOUTree,ye as activateCostAllocationTags,_e as activateTrustedAccess,ui as advertisableDriftVerbs,ec as advertisableRemediationVerbs,Wa as applyRetainFlip,Js as approvalRefusalReason,Ua as archiveCompletedRemediationJournal,_o as artefactOutputKey,Vi as assertLeaseBeforeStack,ai as assessForgetResumability,vn as assumeCascadeRole,rn as assumeRootForTask,pc as attachDeploymentFailure,oa as buildAccountRegionPairs,Ce as buildAccountToOUMap,Rs as buildBuildSecretSessionPolicy,yn as buildCascadeTakeoverTicket,xs as buildDeployPlan,_s as buildDeploySessionPolicy,js as buildDestructionTicket,As as buildDomainSessionPolicy,Di as buildDriftRepairTicket,Vo as buildParamsContext,ta as buildRegionList,os as buildSatelliteRecordIndex,jt as buildStepContextBuildConfig,ae as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,yi as captureLegacySurfaces,wa as captureRemediationForensics,aa as cascadeHomeRegion,ia as cascadeOperationKey,Nn as cascadeTakeoverDigestSeed,ki as checkDeployPathStackAvailability,ge as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,m as clampDeploymentEventStrings,sc as classifyDeployFailure,Da as classifyDriftFailure,cc as classifyFromEcsCompletion,Ec as classifyFromFailureAnalysis,Ms as classifyImpact,lc as classifyUnclassified,ts as classifyZoneRecords,gt as clearDependencyIntegrityCache,Ca as clearDriftSuspects,Li as collectIdentityPinCandidates,ii as completeForgetAfterConverge,ni as completeForgetAfterDeploy,Qa as composeFlipCapabilities,Fi as composePostFailureRepairOffer,Le as composeSdkAbortSignal,vs as computeAssemblyDigest,hs as computeDeployPlan,ka as computeRemediationOpId,jo as computeSecretsDrift,ja as computeTemplateDigest,qs as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,xn as createCascadeDomainProviderFactory,j as createDeployEmitter,ct as createEmptyState,ac as createMemoisedPlanLoader,Yn as createPublicResolvers,yo as createSequencedCallbacks,as as createSystemDnsNameProbe,Ln as createWorkerDomainDeployProvider,ma as decideNextTransition,gi as decodeLegacyAnchor,Ra as decommissionMemberTrailStorage,Na as defaultDriftJournalDir,Ja as defaultRemediationForensicsDir,ba as defaultRemediationJournalDir,xi as degradedIdentityPinOutcomes,wn as delegationRoleUnusableError,zn as deleteChildNsFromParent,At as deleteDomainState,Cn as deleteRecordSetsByKey,Et as deleteStateFile,Uo as deploy,Hn as deployDelegatedDomain,ea as deployDomains,Us as derivePropertyChanges,Ri as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,Za as deriveRetainFlipTemplate,Zo as deriveStaleParameters,Jn as deriveZonePhaseState,Se as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,Ia as detectStackDrift,Fs as digestHead,Ns as dockerBuilder,Me as drainPages,Jt as emitProgress,Bo as emitStepWarnings,Ko as emitWarningEvent,Ye as enableCentralisedRootAccess,Ae as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Re as enableRamSharing,me as enableServiceAccess,yt as ensureDependencyIntegrity,Zi as ensureEnforceSsl,le as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Zs as evaluateDestructionConsents,$s as executableRemediationVerbs,En as extractAllAccountNames,qo as extractConsumedSsmParameters,Wn as extractDelegationRoleArn,xe as extractErrorName,ho as failure,Pa as fetchLastOperationEvents,Io as fileExists,So as filterDangerousEnvVars,De as findAccount,Ne as findDevelopmentOuId,qa as findMarkedResourcesByOpId,Ya as findRemediationJournalByOpId,_i as findRemovalDeletionFailures,Ai as findResourcesPresent,cn as flattenAccountsToEnvironments,xa as formatDriftPreFlightBlock,Mi as formatDriftRepairOffer,Ft as formatInfrastructureError,Oi as formatPinOutcomeDetail,si as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,mc as getDeploymentFailure,Is as getDestroyStepId,Gr as getOrganisationStackName,Ur as getParallelDeployGroups,kr as getParallelDestroyGroups,Ut as getSourceContext,St as getStateFilePath,Mt as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,he as isAborted,pn as isAccountsConfig,Fr as isApplicationOperation,Br as isApplicationStack,vt as isCdkError,ks as isDataLoss,cs as isDelegatedToRoute53,bi as isDeployPathBlockingStatus,Ji as isEnforceSslStatement,Fo as isFailure,Ue as isOULeaf,Wr as isOpenNextPattern,Mr as isOrganisationOperation,mn as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,tn as isRootTaskPolicyArn,ss as isRoute53NameServer,bs as isStatefulResourceType,Sn as isStringArray,vo as isSuccess,zs as legalRemediationVerbs,ue as listAccounts,Va as listActiveRemediationOps,Ga as listActiveRemediationOpsForContext,oc as loadDeployPlan,po as maskSensitiveOutput,Sa as mergeReconciledProviderAccounts,ns as normaliseRecordName,$n as nsDelegationPhysicalName,fs as openNextBuilder,sn as parseAccountsConfiguration,Qt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,On as parseRecordPhysicalName,mo as parseShellArgs,$o as partitionAccounts,ds as partitionForRegion,ci as partitionPreFlightByRemediation,fi as pinProbeCoverage,fe as placeAccountsInOUs,ie as probeAccountStackExists,fa as probePhysicalPresence,Wo as probeSecretsDrift,Qo as probeServiceDeploymentStatus,ca as projectAccountRows,sa as projectScalarSummary,za as proveFlipMetadataOnly,di as proveRemovalTargetsOnly,Qn as readDelegatedTopologyFromProps,jn as readDomainStackOutputsByExport,Tt as readDomainState,ya as readDriftSuspects,Ba as readRemediationJournal,$a as readRetainFlipState,nt as readStateFile,la as reconcileProviderAccounts,Ta as reconcileTrailMigration,_t as recordDomainDeployState,ga as recordDriftSuspects,Pn as recordPhysicalName,fn as recordSetKey,ce as regionDisabledMessage,pt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,tc as renderConsentVerdictLines,rc as renderDestructionTicketLines,hi as renderIdentityPinReportLines,Ci as renderPinReportLines,Vs as renderPlanLines,Ys as renderPlanSummary,Ts as resolveBuildArgs,ps as resolveBuildSecretSessionProvider,ls as resolveBuildSecrets,Ss as resolveSecretRefValue,Jo as restart,qi as restoreAndReconcileQuarantinedBucket,Qi as restoreBucketPolicy,ws as runApprovalGate,Xn as runCaaPreflight,gn as runCascadeTakeoverGate,es as runDelegatedDomainDestroy,Qs as runDestructionGate,La as runDriftPreFlight,Pi as runDriftRepairGate,Ei as runForgetSurgery,vi as runIdentityPinMigration,Ii as runIdentitySurfaceGate,_n as runOpenNextBuild,dn as runOrganisationSetup,Ni as runPinRemediation,Ti as runRecreatePreFlight,Si as runRecreateSurgery,Fa as runRoute53RecordPreflight,Bs as signApprovalToken,To as sleep,Co as sleepAbortable,Ie as snapshotIdentityCentre,pi as snapshotPolicyForType,ms as sourcedRefsFromBuildArgs,xt as startStackMonitoring,Cs as staticSiteBuilder,rt as stubCallerIdentity,xo as success,Ka as sweepExpiredRemediationJournals,li as synthTemplateDeclaresResource,ji as synthesiseEnforceSslDocument,is as systemDnsNameProbe,qn as templateOwnsDelegationRecord,Jr as toPascalCase,Wi as toResourcePolicyStatements,Eo as toServiceError,Gs as toWirePlanChanges,wi as triageBucketPolicy,T as truncateUtf16Safe,Ki as unlockBucket,Xi as unlockQueue,de as updateBackupGlobalSettings,lt as updateTemplateHash,us as validateBuildGroup,Sr as verbsForDriftVerdict,Ks as verifyApprovalToken,$i as verifyOrgTrailDelivery,ei as verifyRetainFlipDiff,Bn as waitForNsPropagation,et as wrapApplicationError,Rt as writeDomainState,Xa as writeRemediationJournal,st as writeStateFile};

package/dist/src/orchestration/application/deploySessionPolicy.d.ts

@@ -10,6 +10,19 @@ export interface DeploySessionContext {
     accountId: string;
     partition: string;
 }
+/**
+ * CloudFormation stack-mutation actions the caller's deploy session may perform
+ * ONLY on the target app's own stacks (and the CDK bootstrap stack). Read/describe
+ * actions are deliberately absent — synth performs `cloudformation:Describe*` and
+ * change-set describes, which must stay allowed.
+ */
+export declare const CFN_MUTATION_ACTIONS: string[];
+/**
+ * ECR mutation actions the caller's deploy session may perform ONLY on the target
+ * app's own repository (and the CDK asset repos). Layer uploads + PutImage are the
+ * `docker push` path; the delete/policy actions are fenced off foreign repos.
+ */
+export declare const ECR_MUTATION_ACTIONS: string[];
 /**
  * Build a defence-in-depth inline session policy that narrows a 1-hour deploy
  * session's DIRECT CloudFormation/ECR mutation to the target app's stack-name

package/dist/src/orchestration/application/deploySessionPolicy.js

@@ -1 +1 @@
-var s=Object.defineProperty;var i=(r,o)=>s(r,"name",{value:o,configurable:!0});import{success as m,failure as d}from"@fjall/generator";import{toKebab as u,toPascalCase as f}from"@fjall/util";import{buildCacheRepositoryName as y}from"@fjall/util/docker";import{SCHEMA_GATE_ECR_REPO_NAME as $}from"@fjall/util/migration";import{MAX_INLINE_POLICY_CHARS as n}from"./buildSecretSession.js";const S=["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:CreateChangeSet","cloudformation:ExecuteChangeSet","cloudformation:DeleteChangeSet","cloudformation:CancelUpdateStack","cloudformation:ContinueUpdateRollback","cloudformation:RollbackStack","cloudformation:SetStackPolicy","cloudformation:UpdateTerminationProtection"],C=["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchDeleteImage","ecr:DeleteRepository","ecr:SetRepositoryPolicy","ecr:DeleteRepositoryPolicy"];function g(r){const{region:o,accountId:e,partition:t}=r,l=f(r.appName),c=u(r.appName),p=[{Sid:"FjallDeployInheritAdmin",Effect:"Allow",Action:"*",Resource:"*"},{Sid:"FjallDeployDenyForeignStackMutation",Effect:"Deny",Action:S,NotResource:[`arn:${t}:cloudformation:${o}:${e}:stack/${l}*/*`,`arn:${t}:cloudformation:${o}:${e}:stack/CDKToolkit/*`]},{Sid:"FjallDeployDenyForeignEcrMutation",Effect:"Deny",Action:C,NotResource:[`arn:${t}:ecr:${o}:${e}:repository/${c}`,`arn:${t}:ecr:${o}:${e}:repository/${y(c)}`,`arn:${t}:ecr:${o}:${e}:repository/cdk-*`,`arn:${t}:ecr:${o}:${e}:repository/${$}`]}],a=JSON.stringify({Version:"2012-10-17",Statement:p});return a.length>n?d(new Error(`Deploy session policy is ${a.length} chars, exceeding the ${n}-char AWS inline-policy limit.`)):m(a)}i(g,"buildDeploySessionPolicy");export{g as buildDeploySessionPolicy};
+var s=Object.defineProperty;var i=(r,o)=>s(r,"name",{value:o,configurable:!0});import{success as m,failure as d}from"@fjall/generator";import{toKebab as u,toPascalCase as f}from"@fjall/util";import{buildCacheRepositoryName as y}from"@fjall/util/docker";import{SCHEMA_GATE_ECR_REPO_NAME as $}from"@fjall/util/migration";import{MAX_INLINE_POLICY_CHARS as n}from"./buildSecretSession.js";const S=["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:CreateChangeSet","cloudformation:ExecuteChangeSet","cloudformation:DeleteChangeSet","cloudformation:CancelUpdateStack","cloudformation:ContinueUpdateRollback","cloudformation:RollbackStack","cloudformation:SetStackPolicy","cloudformation:UpdateTerminationProtection"],C=["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchDeleteImage","ecr:DeleteRepository","ecr:SetRepositoryPolicy","ecr:DeleteRepositoryPolicy"];function g(r){const{region:o,accountId:e,partition:t}=r,l=f(r.appName),c=u(r.appName),p=[{Sid:"FjallDeployInheritAdmin",Effect:"Allow",Action:"*",Resource:"*"},{Sid:"FjallDeployDenyForeignStackMutation",Effect:"Deny",Action:S,NotResource:[`arn:${t}:cloudformation:${o}:${e}:stack/${l}*/*`,`arn:${t}:cloudformation:${o}:${e}:stack/CDKToolkit/*`]},{Sid:"FjallDeployDenyForeignEcrMutation",Effect:"Deny",Action:C,NotResource:[`arn:${t}:ecr:${o}:${e}:repository/${c}`,`arn:${t}:ecr:${o}:${e}:repository/${y(c)}`,`arn:${t}:ecr:${o}:${e}:repository/cdk-*`,`arn:${t}:ecr:${o}:${e}:repository/${$}`]}],a=JSON.stringify({Version:"2012-10-17",Statement:p});return a.length>n?d(new Error(`Deploy session policy is ${a.length} chars, exceeding the ${n}-char AWS inline-policy limit.`)):m(a)}i(g,"buildDeploySessionPolicy");export{S as CFN_MUTATION_ACTIONS,C as ECR_MUTATION_ACTIONS,g as buildDeploySessionPolicy};

package/dist/src/orchestration/domain/domainSessionPolicy.d.ts

@@ -0,0 +1,62 @@
+import { type Result } from "@fjall/generator";
+/**
+ * The AWS-account/region context a standalone per-zone domain deploy session's
+ * inline policy is scoped to. `zoneName` MUST be the registered domain
+ * record's own `name` spelling (fjall-config.json) — the stack-name
+ * derivation PascalCases the given string verbatim and IAM ARN matching is
+ * case-sensitive, so a caller-normalised or user-typed variant would deny
+ * the zone's own stack (fail-closed, but loud at deploy time instead of
+ * here). Callers necessarily hold the record already: `accountId`/`region`
+ * are its home pin.
+ */
+export interface DomainSessionContext {
+    zoneName: string;
+    region: string;
+    accountId: string;
+    partition: string;
+}
+/**
+ * Build a defence-in-depth inline session policy that narrows a per-zone
+ * domain deploy session's DIRECT CloudFormation mutation to the target zone's
+ * own stacks — the F5 sibling of `buildDeploySessionPolicy`
+ * (`../application/deploySessionPolicy.js`), inheriting its DENY-list
+ * rationale wholesale: the session must keep synth lookups, asset uploads and
+ * `iam:PassRole`, so we lead with `Allow * on *` and Deny only foreign
+ * mutation. It also inherits the same accepted v1 limitation that session
+ * policies do not propagate across `sts:AssumeRole` — the cfn-exec role is
+ * confined by the Phase E permission boundary, not by this policy.
+ *
+ * Scope note: this builder exists for zones homed in the ORG-ROLE account,
+ * where the standalone lane would otherwise run under the unscoped org
+ * session. A FOREIGN-pinned zone needs nothing from here — its session is
+ * minted per-home against that account's M1-narrowed `FjallDeploy` role (the
+ * 2d routing factory), and IAM itself is the narrowing.
+ *
+ * Differences from the application builder, each derived from what a domain
+ * deploy actually does:
+ * - The CFN NotResource names the zone's stacks EXACTLY (no prefix wildcard):
+ *   `getDomainStackName(zone)` in the home region, plus its paired us-east-1
+ *   certificates stack (`getDomainUsEast1CertificatesStackName`) — CloudFront
+ *   viewer certificates only mint in us-east-1, so the pair spans two regions
+ *   by construction. CDKToolkit is exempted in BOTH regions for the same
+ *   reason. Exact names close the app builder's prefix-wildcard class of
+ *   over-grant across DISTINCT stacks. (getDomainStackName is not injective
+ *   — it strips dots before PascalCasing, so `dev.fjall.io` and
+ *   `devfjall.io` share one stack name — but two such zones in one
+ *   account+region share the PHYSICAL stack too, which no ARN-scoped policy
+ *   can separate; that non-injectivity is a pre-existing registration-time
+ *   concern, not a session-policy one.)
+ * - ECR mutation is denied on `Resource: *`, not NotResource-fenced: a domain
+ *   deploy pushes no images, so there is no repository it legitimately
+ *   mutates.
+ * - Route53 record mutation is NOT fenced here: record writes flow through
+ *   CloudFormation's cfn-exec role (out of session-policy reach, above) and
+ *   the takeover gate's release path, which is collision-assessed per zone.
+ *   Fencing `ChangeResourceRecordSets` by hosted-zone id would need a live
+ *   lookup before the session exists — accepted v1 limitation, same class as
+ *   the app builder's.
+ *
+ * Fails closed when the serialised policy would exceed the AWS inline-policy
+ * limit.
+ */
+export declare function buildDomainSessionPolicy(ctx: DomainSessionContext): Result<string>;

package/dist/src/orchestration/domain/domainSessionPolicy.js

@@ -0,0 +1 @@
+var D=Object.defineProperty;var i=(o,t)=>D(o,"name",{value:t,configurable:!0});import{success as S,failure as p}from"@fjall/generator";import{getDomainStackName as N,getDomainUsEast1CertificatesStackName as y}from"@fjall/util";import{MAX_INLINE_POLICY_CHARS as c}from"../application/buildSecretSession.js";import{CFN_MUTATION_ACTIONS as A,ECR_MUTATION_ACTIONS as k}from"../application/deploySessionPolicy.js";function h(o){const{region:t,accountId:r,partition:m}=o,a=N(o.zoneName),l=y(a),e=i((f,u)=>`arn:${m}:cloudformation:${f}:${r}:stack/${u}/*`,"stackArn"),s=[e(t,a),e("us-east-1",l),e(t,"CDKToolkit")];t!=="us-east-1"&&s.push(e("us-east-1","CDKToolkit"));const n=JSON.stringify({Version:"2012-10-17",Statement:[{Sid:"FjallDomainDeployInheritAdmin",Effect:"Allow",Action:"*",Resource:"*"},{Sid:"FjallDomainDeployDenyForeignStackMutation",Effect:"Deny",Action:A,NotResource:s},{Sid:"FjallDomainDeployDenyEcrMutation",Effect:"Deny",Action:k,Resource:"*"}]});return n.length>c?p(new Error(`Domain deploy session policy is ${n.length} chars, exceeding the ${c}-char AWS inline-policy limit.`)):S(n)}i(h,"buildDomainSessionPolicy");export{h as buildDomainSessionPolicy};

package/dist/src/orchestration/index.d.ts

@@ -9,7 +9,7 @@ export { destroyOrganisation } from "./organisation/organisationDestroy.js";
 export { cleanupFailedStack, emptyS3Bucket, preEmptyStackBuckets, formatQuarantineSuspectedMessage, formatRetainedBucketsMessage, isQuarantineDetail, isRetainedBucketsDetail, PRE_EMPTY_TAG_KEYS, isCleanableState, SAFE_CLEANUP_STATES } from "./stackCleanup.js";
 export type { PreEmptyBucketsSummary, EmptyBucketOutcome } from "./stackCleanup.js";
 export type { CascadeDestroyAccountResult } from "./organisation/cascadeDestroyHelpers.js";
-export { partitionAccounts, buildRegionList, buildAccountRegionPairs, cascadeHomeRegion, cascadeOperationKey } from "./organisation/cascadeHelpers.js";
+export { partitionAccounts, buildRegionList, buildAccountRegionPairs, cascadeHomeRegion, cascadeOperationKey, deployDomains } from "./organisation/cascadeHelpers.js";
 export type { AccountRegionPair, DeployDomainsOptions } from "./organisation/cascadeHelpers.js";
 export { projectScalarSummary, projectAccountRows } from "./organisation/cascadeSummary.js";
 export type { CascadeOutcomeResult, CascadeMemberOutcome, CascadePlatformOutcome, CascadeLedger, CascadeAccountRow, CascadePlatformRow, CascadeAccountProjection } from "./organisation/cascadeSummary.js";
@@ -37,6 +37,7 @@ export type { DockerProvider, DockerProgressCallback, DockerServiceConfig, Docke
 export { resolveBuildSecrets, resolveSecretRefValue, resolveBuildSecretSessionProvider, sourcedRefsFromBuildArgs, type ResolvedBuildSecrets } from "./application/buildSecretResolver.js";
 export { buildBuildSecretSessionPolicy, partitionForRegion, type BuildSecretRef, type BuildSecretSessionContext } from "./application/buildSecretSession.js";
 export { buildDeploySessionPolicy, type DeploySessionContext } from "./application/deploySessionPolicy.js";
+export { buildDomainSessionPolicy, type DomainSessionContext } from "./domain/domainSessionPolicy.js";
 export { resolveBuildArgs, type ResolveBuildArgsContext, type ResolveBuildArgsResult, type SourcedBuildArgResolver } from "./application/buildArgResolver.js";
 export { validateBuildGroup, type ValidateBuildGroupInput, type BuildGroupMemberInputs } from "./application/buildGroupValidator.js";
 export type { DomainDeployProvider, DomainConfig, DomainDeployResult, DomainTakeoverSynth, DomainHome, DomainProviderGroup, DomainProviderFactory } from "./domainInterface.js";

package/dist/src/orchestration/index.js

@@ -1 +1 @@
-import{deploy as t}from"./deploy.js";import{destroy as i}from"./destroy.js";import{restart as n,probeSecretsDrift as s,probeServiceDeploymentStatus as c}from"./restart/restartApplication.js";import{computeSecretsDrift as p,deriveStaleParameters as m,extractConsumedSsmParameters as u,ssmParameterNameFromValueFrom as f}from"./restart/secretsDrift.js";import{deployOrganisation as R}from"./organisation/organisationDeploy.js";import{destroyOrganisation as P}from"./organisation/organisationDestroy.js";import{cleanupFailedStack as T,emptyS3Bucket as y,preEmptyStackBuckets as A,formatQuarantineSuspectedMessage as E,formatRetainedBucketsMessage as D,isQuarantineDetail as g,isRetainedBucketsDetail as _,PRE_EMPTY_TAG_KEYS as O,isCleanableState as v,SAFE_CLEANUP_STATES as F}from"./stackCleanup.js";import{partitionAccounts as k,buildRegionList as B,buildAccountRegionPairs as L,cascadeHomeRegion as C,cascadeOperationKey as I}from"./organisation/cascadeHelpers.js";import{projectScalarSummary as h,projectAccountRows as G}from"./organisation/cascadeSummary.js";import{reconcileProviderAccounts as K,mergeReconciledProviderAccounts as M}from"./organisation/reconcileProviderAccounts.js";import{decideNextTransition as V,reconcileTrailMigration as J,ORG_TRAIL_BUCKET_OUTPUT_KEY as H,TRAIL_BUCKET_OUTPUT_KEY as Q,TRAIL_KEY_ARN_OUTPUT_KEY as w}from"./trailMigration/trailMigration.js";import{decommissionMemberTrailStorage as W}from"./trailMigration/memberTrailCleanup.js";import{unlockBucket as z}from"./unlock/unlockBucket.js";import{unlockQueue as Z}from"./unlock/unlockQueue.js";import{triageBucketPolicy as ee,isEnforceSslStatement as re}from"./unlock/bucketPolicyTriage.js";import{toResourcePolicyStatements as oe}from"./unlock/toResourcePolicyStatements.js";import{restoreBucketPolicy as ae,synthesiseEnforceSslDocument as ne,ensureEnforceSsl as se}from"./unlock/restoreBucketPolicy.js";import{restoreAndReconcileQuarantinedBucket as le}from"./unlock/restoreAndReconcileQuarantinedBucket.js";import{parseAccountsConfiguration as me,flattenAccountsToEnvironments as ue,extractAllAccountNames as fe,accountsConfigToOUTree as de,isStringArray as Re,isAccountsConfig as Se,isOuOnlyAccountBucket as Pe,OU_ONLY_ACCOUNT_BUCKETS as xe}from"./organisation/accountsConfig.js";import{resolveBuildSecrets as ye,resolveSecretRefValue as Ae,resolveBuildSecretSessionProvider as Ee,sourcedRefsFromBuildArgs as De}from"./application/buildSecretResolver.js";import{buildBuildSecretSessionPolicy as _e,partitionForRegion as Oe}from"./application/buildSecretSession.js";import{buildDeploySessionPolicy as Fe}from"./application/deploySessionPolicy.js";import{resolveBuildArgs as ke}from"./application/buildArgResolver.js";import{validateBuildGroup as Le}from"./application/buildGroupValidator.js";export*from"./domain/index.js";import{runOpenNextBuild as Ue}from"./application/openNextBuild.js";import{runOrganisationSetup as Ge,ORG_SETUP_PHASES as Ne}from"./organisation/organisationSetup.js";export*from"./builders/index.js";import{buildDeployPlan as Ye,computeDeployPlan as Ve,computeAssemblyDigest as Je,digestHead as He,classifyImpact as Qe,derivePropertyChanges as we,isDataLoss as je,isStatefulResourceType as We,renderPlanSummary as qe,renderPlanLines as ze,toWirePlanChanges as Xe,signApprovalToken as Ze,verifyApprovalToken as $e,DEFAULT_APPROVAL_TTL_MS as er,APPROVAL_TOKEN_PATTERN as rr}from"./application/plan/index.js";import{runApprovalGate as or,approvalRefusalReason as ir}from"./application/approvalGate.js";import{runDestructionGate as nr,buildDestructionTicket as sr,evaluateDestructionConsents as cr,computeTicketDigest as lr,legalRemediationVerbs as pr,executableRemediationVerbs as mr,advertisableRemediationVerbs as ur,renderDestructionTicketLines as fr,renderConsentVerdictLines as dr}from"./application/destructionGate.js";import{loadDeployPlan as Sr,createMemoisedPlanLoader as Pr}from"./application/plan/loadDeployPlan.js";import{classifyDriftFailure as Tr,fetchLastOperationEvents as yr}from"./drift/classifyDriftFailure.js";import{DriftProbe as Er,probePhysicalPresence as Dr}from"./drift/driftProbe.js";import{clearDriftSuspects as _r,defaultDriftJournalDir as Or,readDriftSuspects as vr,recordDriftSuspects as Fr}from"./drift/driftSuspectJournal.js";import{detectStackDrift as kr}from"./drift/detectStackDrift.js";import{runDriftPreFlight as Lr,formatDriftPreFlightBlock as Cr,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Ir,DRIFT_PREFLIGHT_BUDGET_MS as Ur}from"./drift/driftPreFlight.js";import{runRoute53RecordPreflight as Gr}from"./drift/route53RecordPreflight.js";import{archiveCompletedRemediationJournal as Kr,computeRemediationOpId as Mr,defaultRemediationJournalDir as Yr,findRemediationJournalByOpId as Vr,listActiveRemediationOps as Jr,listActiveRemediationOpsForContext as Hr,readRemediationJournal as Qr,sweepExpiredRemediationJournals as wr,writeRemediationJournal as jr,REMEDIATION_JOURNAL_RETENTION_DAYS as Wr}from"./remediation/remediationJournal.js";import{captureRemediationForensics as zr,defaultRemediationForensicsDir as Xr}from"./remediation/forensicsCapture.js";import{applyRetainFlip as $r,composeFlipCapabilities as et,computeTemplateDigest as rt,deriveRetainFlipTemplate as tt,findMarkedResourcesByOpId as ot,proveFlipMetadataOnly as it,readRetainFlipState as at,verifyRetainFlipDiff as nt,FORGET_MARKER_KEY as st,FORGET_FLIP_SPEC as ct,RECREATE_MARKER_KEY as lt}from"./remediation/retainFlip.js";import{assessForgetResumability as mt,completeForgetAfterConverge as ut,completeForgetAfterDeploy as ft,formatRecreateInFlightCures as dt,partitionPreFlightByRemediation as Rt,runForgetSurgery as St,synthTemplateDeclaresResource as Pt}from"./remediation/forgetResource.js";import{runRecreateSurgery as Tt,snapshotPolicyForType as yt,SNAPSHOT_CAPABLE_RESOURCE_TYPES as At}from"./remediation/recreateResource.js";import{runRecreatePreFlight as Dt}from"./remediation/recreatePreFlight.js";import{deriveRemovalTemplate as _t,findRemovalDeletionFailures as Ot,findResourcesPresent as vt,proveRemovalTargetsOnly as Ft}from"./remediation/removalUpdate.js";import{advertisableDriftVerbs as kt,buildDriftRepairTicket as Bt,runDriftRepairGate as Lt}from"./remediation/driftRepairGate.js";import{formatPinOutcomeDetail as It,pinProbeCoverage as Ut,renderPinReportLines as ht,runPinRemediation as Gt}from"./remediation/pinRemediation.js";import{composePostFailureRepairOffer as Kt,formatDriftRepairOffer as Mt,DriftRepairAvailableError as Yt}from"./remediation/postFailureRepairOffer.js";import{captureLegacySurfaces as Jt,decodeLegacyAnchor as Ht,runIdentitySurfaceGate as Qt}from"./remediation/pinIdentity.js";import{collectIdentityPinCandidates as jt,degradedIdentityPinOutcomes as Wt,renderIdentityPinReportLines as qt,runIdentityPinMigration as zt}from"./remediation/migrateIdentity.js";import{checkDeployPathStackAvailability as Zt,isDeployPathBlockingStatus as $t,StackUnavailableError as eo}from"./activeDeploymentGuard.js";import{assertLeaseBeforeStack as to,LeaseDeniedError as oo}from"./application/leaseGate.js";export{rr as APPROVAL_TOKEN_PATTERN,er as DEFAULT_APPROVAL_TTL_MS,Ur as DRIFT_PREFLIGHT_BUDGET_MS,Ir as DRIFT_PREFLIGHT_TRIGGER_STATUSES,Er as DriftProbe,Yt as DriftRepairAvailableError,ct as FORGET_FLIP_SPEC,st as FORGET_MARKER_KEY,oo as LeaseDeniedError,Ne as ORG_SETUP_PHASES,H as ORG_TRAIL_BUCKET_OUTPUT_KEY,xe as OU_ONLY_ACCOUNT_BUCKETS,O as PRE_EMPTY_TAG_KEYS,lt as RECREATE_MARKER_KEY,Wr as REMEDIATION_JOURNAL_RETENTION_DAYS,F as SAFE_CLEANUP_STATES,At as SNAPSHOT_CAPABLE_RESOURCE_TYPES,eo as StackUnavailableError,Q as TRAIL_BUCKET_OUTPUT_KEY,w as TRAIL_KEY_ARN_OUTPUT_KEY,de as accountsConfigToOUTree,kt as advertisableDriftVerbs,ur as advertisableRemediationVerbs,$r as applyRetainFlip,ir as approvalRefusalReason,Kr as archiveCompletedRemediationJournal,to as assertLeaseBeforeStack,mt as assessForgetResumability,L as buildAccountRegionPairs,_e as buildBuildSecretSessionPolicy,Ye as buildDeployPlan,Fe as buildDeploySessionPolicy,sr as buildDestructionTicket,Bt as buildDriftRepairTicket,B as buildRegionList,Jt as captureLegacySurfaces,zr as captureRemediationForensics,C as cascadeHomeRegion,I as cascadeOperationKey,Zt as checkDeployPathStackAvailability,Tr as classifyDriftFailure,Qe as classifyImpact,T as cleanupFailedStack,_r as clearDriftSuspects,jt as collectIdentityPinCandidates,ut as completeForgetAfterConverge,ft as completeForgetAfterDeploy,et as composeFlipCapabilities,Kt as composePostFailureRepairOffer,Je as computeAssemblyDigest,Ve as computeDeployPlan,Mr as computeRemediationOpId,p as computeSecretsDrift,rt as computeTemplateDigest,lr as computeTicketDigest,Pr as createMemoisedPlanLoader,V as decideNextTransition,Ht as decodeLegacyAnchor,W as decommissionMemberTrailStorage,Or as defaultDriftJournalDir,Xr as defaultRemediationForensicsDir,Yr as defaultRemediationJournalDir,Wt as degradedIdentityPinOutcomes,t as deploy,R as deployOrganisation,we as derivePropertyChanges,_t as deriveRemovalTemplate,tt as deriveRetainFlipTemplate,m as deriveStaleParameters,i as destroy,P as destroyOrganisation,kr as detectStackDrift,He as digestHead,y as emptyS3Bucket,se as ensureEnforceSsl,cr as evaluateDestructionConsents,mr as executableRemediationVerbs,fe as extractAllAccountNames,u as extractConsumedSsmParameters,yr as fetchLastOperationEvents,ot as findMarkedResourcesByOpId,Vr as findRemediationJournalByOpId,Ot as findRemovalDeletionFailures,vt as findResourcesPresent,ue as flattenAccountsToEnvironments,Cr as formatDriftPreFlightBlock,Mt as formatDriftRepairOffer,It as formatPinOutcomeDetail,E as formatQuarantineSuspectedMessage,dt as formatRecreateInFlightCures,D as formatRetainedBucketsMessage,Se as isAccountsConfig,v as isCleanableState,je as isDataLoss,$t as isDeployPathBlockingStatus,re as isEnforceSslStatement,Pe as isOuOnlyAccountBucket,g as isQuarantineDetail,_ as isRetainedBucketsDetail,We as isStatefulResourceType,Re as isStringArray,pr as legalRemediationVerbs,Jr as listActiveRemediationOps,Hr as listActiveRemediationOpsForContext,Sr as loadDeployPlan,M as mergeReconciledProviderAccounts,me as parseAccountsConfiguration,k as partitionAccounts,Oe as partitionForRegion,Rt as partitionPreFlightByRemediation,Ut as pinProbeCoverage,A as preEmptyStackBuckets,Dr as probePhysicalPresence,s as probeSecretsDrift,c as probeServiceDeploymentStatus,G as projectAccountRows,h as projectScalarSummary,it as proveFlipMetadataOnly,Ft as proveRemovalTargetsOnly,vr as readDriftSuspects,Qr as readRemediationJournal,at as readRetainFlipState,K as reconcileProviderAccounts,J as reconcileTrailMigration,Fr as recordDriftSuspects,dr as renderConsentVerdictLines,fr as renderDestructionTicketLines,qt as renderIdentityPinReportLines,ht as renderPinReportLines,ze as renderPlanLines,qe as renderPlanSummary,ke as resolveBuildArgs,Ee as resolveBuildSecretSessionProvider,ye as resolveBuildSecrets,Ae as resolveSecretRefValue,n as restart,le as restoreAndReconcileQuarantinedBucket,ae as restoreBucketPolicy,or as runApprovalGate,nr as runDestructionGate,Lr as runDriftPreFlight,Lt as runDriftRepairGate,St as runForgetSurgery,zt as runIdentityPinMigration,Qt as runIdentitySurfaceGate,Ue as runOpenNextBuild,Ge as runOrganisationSetup,Gt as runPinRemediation,Dt as runRecreatePreFlight,Tt as runRecreateSurgery,Gr as runRoute53RecordPreflight,Ze as signApprovalToken,yt as snapshotPolicyForType,De as sourcedRefsFromBuildArgs,f as ssmParameterNameFromValueFrom,wr as sweepExpiredRemediationJournals,Pt as synthTemplateDeclaresResource,ne as synthesiseEnforceSslDocument,oe as toResourcePolicyStatements,Xe as toWirePlanChanges,ee as triageBucketPolicy,z as unlockBucket,Z as unlockQueue,Le as validateBuildGroup,$e as verifyApprovalToken,nt as verifyRetainFlipDiff,jr as writeRemediationJournal};
+import{deploy as t}from"./deploy.js";import{destroy as i}from"./destroy.js";import{restart as n,probeSecretsDrift as s,probeServiceDeploymentStatus as c}from"./restart/restartApplication.js";import{computeSecretsDrift as p,deriveStaleParameters as m,extractConsumedSsmParameters as u,ssmParameterNameFromValueFrom as f}from"./restart/secretsDrift.js";import{deployOrganisation as R}from"./organisation/organisationDeploy.js";import{destroyOrganisation as P}from"./organisation/organisationDestroy.js";import{cleanupFailedStack as T,emptyS3Bucket as y,preEmptyStackBuckets as A,formatQuarantineSuspectedMessage as D,formatRetainedBucketsMessage as E,isQuarantineDetail as g,isRetainedBucketsDetail as _,PRE_EMPTY_TAG_KEYS as O,isCleanableState as v,SAFE_CLEANUP_STATES as F}from"./stackCleanup.js";import{partitionAccounts as k,buildRegionList as B,buildAccountRegionPairs as L,cascadeHomeRegion as C,cascadeOperationKey as I,deployDomains as U}from"./organisation/cascadeHelpers.js";import{projectScalarSummary as G,projectAccountRows as N}from"./organisation/cascadeSummary.js";import{reconcileProviderAccounts as M,mergeReconciledProviderAccounts as Y}from"./organisation/reconcileProviderAccounts.js";import{decideNextTransition as J,reconcileTrailMigration as H,ORG_TRAIL_BUCKET_OUTPUT_KEY as Q,TRAIL_BUCKET_OUTPUT_KEY as w,TRAIL_KEY_ARN_OUTPUT_KEY as j}from"./trailMigration/trailMigration.js";import{decommissionMemberTrailStorage as q}from"./trailMigration/memberTrailCleanup.js";import{unlockBucket as X}from"./unlock/unlockBucket.js";import{unlockQueue as $}from"./unlock/unlockQueue.js";import{triageBucketPolicy as re,isEnforceSslStatement as te}from"./unlock/bucketPolicyTriage.js";import{toResourcePolicyStatements as ie}from"./unlock/toResourcePolicyStatements.js";import{restoreBucketPolicy as ne,synthesiseEnforceSslDocument as se,ensureEnforceSsl as ce}from"./unlock/restoreBucketPolicy.js";import{restoreAndReconcileQuarantinedBucket as pe}from"./unlock/restoreAndReconcileQuarantinedBucket.js";import{parseAccountsConfiguration as ue,flattenAccountsToEnvironments as fe,extractAllAccountNames as de,accountsConfigToOUTree as Re,isStringArray as Se,isAccountsConfig as Pe,isOuOnlyAccountBucket as xe,OU_ONLY_ACCOUNT_BUCKETS as Te}from"./organisation/accountsConfig.js";import{resolveBuildSecrets as Ae,resolveSecretRefValue as De,resolveBuildSecretSessionProvider as Ee,sourcedRefsFromBuildArgs as ge}from"./application/buildSecretResolver.js";import{buildBuildSecretSessionPolicy as Oe,partitionForRegion as ve}from"./application/buildSecretSession.js";import{buildDeploySessionPolicy as be}from"./application/deploySessionPolicy.js";import{buildDomainSessionPolicy as Be}from"./domain/domainSessionPolicy.js";import{resolveBuildArgs as Ce}from"./application/buildArgResolver.js";import{validateBuildGroup as Ue}from"./application/buildGroupValidator.js";export*from"./domain/index.js";import{runOpenNextBuild as Ne}from"./application/openNextBuild.js";import{runOrganisationSetup as Me,ORG_SETUP_PHASES as Ye}from"./organisation/organisationSetup.js";export*from"./builders/index.js";import{buildDeployPlan as He,computeDeployPlan as Qe,computeAssemblyDigest as we,digestHead as je,classifyImpact as We,derivePropertyChanges as qe,isDataLoss as ze,isStatefulResourceType as Xe,renderPlanSummary as Ze,renderPlanLines as $e,toWirePlanChanges as er,signApprovalToken as rr,verifyApprovalToken as tr,DEFAULT_APPROVAL_TTL_MS as or,APPROVAL_TOKEN_PATTERN as ir}from"./application/plan/index.js";import{runApprovalGate as nr,approvalRefusalReason as sr}from"./application/approvalGate.js";import{runDestructionGate as lr,buildDestructionTicket as pr,evaluateDestructionConsents as mr,computeTicketDigest as ur,legalRemediationVerbs as fr,executableRemediationVerbs as dr,advertisableRemediationVerbs as Rr,renderDestructionTicketLines as Sr,renderConsentVerdictLines as Pr}from"./application/destructionGate.js";import{loadDeployPlan as Tr,createMemoisedPlanLoader as yr}from"./application/plan/loadDeployPlan.js";import{classifyDriftFailure as Dr,fetchLastOperationEvents as Er}from"./drift/classifyDriftFailure.js";import{DriftProbe as _r,probePhysicalPresence as Or}from"./drift/driftProbe.js";import{clearDriftSuspects as Fr,defaultDriftJournalDir as br,readDriftSuspects as kr,recordDriftSuspects as Br}from"./drift/driftSuspectJournal.js";import{detectStackDrift as Cr}from"./drift/detectStackDrift.js";import{runDriftPreFlight as Ur,formatDriftPreFlightBlock as hr,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Gr,DRIFT_PREFLIGHT_BUDGET_MS as Nr}from"./drift/driftPreFlight.js";import{runRoute53RecordPreflight as Mr}from"./drift/route53RecordPreflight.js";import{archiveCompletedRemediationJournal as Vr,computeRemediationOpId as Jr,defaultRemediationJournalDir as Hr,findRemediationJournalByOpId as Qr,listActiveRemediationOps as wr,listActiveRemediationOpsForContext as jr,readRemediationJournal as Wr,sweepExpiredRemediationJournals as qr,writeRemediationJournal as zr,REMEDIATION_JOURNAL_RETENTION_DAYS as Xr}from"./remediation/remediationJournal.js";import{captureRemediationForensics as $r,defaultRemediationForensicsDir as et}from"./remediation/forensicsCapture.js";import{applyRetainFlip as tt,composeFlipCapabilities as ot,computeTemplateDigest as it,deriveRetainFlipTemplate as at,findMarkedResourcesByOpId as nt,proveFlipMetadataOnly as st,readRetainFlipState as ct,verifyRetainFlipDiff as lt,FORGET_MARKER_KEY as pt,FORGET_FLIP_SPEC as mt,RECREATE_MARKER_KEY as ut}from"./remediation/retainFlip.js";import{assessForgetResumability as dt,completeForgetAfterConverge as Rt,completeForgetAfterDeploy as St,formatRecreateInFlightCures as Pt,partitionPreFlightByRemediation as xt,runForgetSurgery as Tt,synthTemplateDeclaresResource as yt}from"./remediation/forgetResource.js";import{runRecreateSurgery as Dt,snapshotPolicyForType as Et,SNAPSHOT_CAPABLE_RESOURCE_TYPES as gt}from"./remediation/recreateResource.js";import{runRecreatePreFlight as Ot}from"./remediation/recreatePreFlight.js";import{deriveRemovalTemplate as Ft,findRemovalDeletionFailures as bt,findResourcesPresent as kt,proveRemovalTargetsOnly as Bt}from"./remediation/removalUpdate.js";import{advertisableDriftVerbs as Ct,buildDriftRepairTicket as It,runDriftRepairGate as Ut}from"./remediation/driftRepairGate.js";import{formatPinOutcomeDetail as Gt,pinProbeCoverage as Nt,renderPinReportLines as Kt,runPinRemediation as Mt}from"./remediation/pinRemediation.js";import{composePostFailureRepairOffer as Vt,formatDriftRepairOffer as Jt,DriftRepairAvailableError as Ht}from"./remediation/postFailureRepairOffer.js";import{captureLegacySurfaces as wt,decodeLegacyAnchor as jt,runIdentitySurfaceGate as Wt}from"./remediation/pinIdentity.js";import{collectIdentityPinCandidates as zt,degradedIdentityPinOutcomes as Xt,renderIdentityPinReportLines as Zt,runIdentityPinMigration as $t}from"./remediation/migrateIdentity.js";import{checkDeployPathStackAvailability as ro,isDeployPathBlockingStatus as to,StackUnavailableError as oo}from"./activeDeploymentGuard.js";import{assertLeaseBeforeStack as ao,LeaseDeniedError as no}from"./application/leaseGate.js";export{ir as APPROVAL_TOKEN_PATTERN,or as DEFAULT_APPROVAL_TTL_MS,Nr as DRIFT_PREFLIGHT_BUDGET_MS,Gr as DRIFT_PREFLIGHT_TRIGGER_STATUSES,_r as DriftProbe,Ht as DriftRepairAvailableError,mt as FORGET_FLIP_SPEC,pt as FORGET_MARKER_KEY,no as LeaseDeniedError,Ye as ORG_SETUP_PHASES,Q as ORG_TRAIL_BUCKET_OUTPUT_KEY,Te as OU_ONLY_ACCOUNT_BUCKETS,O as PRE_EMPTY_TAG_KEYS,ut as RECREATE_MARKER_KEY,Xr as REMEDIATION_JOURNAL_RETENTION_DAYS,F as SAFE_CLEANUP_STATES,gt as SNAPSHOT_CAPABLE_RESOURCE_TYPES,oo as StackUnavailableError,w as TRAIL_BUCKET_OUTPUT_KEY,j as TRAIL_KEY_ARN_OUTPUT_KEY,Re as accountsConfigToOUTree,Ct as advertisableDriftVerbs,Rr as advertisableRemediationVerbs,tt as applyRetainFlip,sr as approvalRefusalReason,Vr as archiveCompletedRemediationJournal,ao as assertLeaseBeforeStack,dt as assessForgetResumability,L as buildAccountRegionPairs,Oe as buildBuildSecretSessionPolicy,He as buildDeployPlan,be as buildDeploySessionPolicy,pr as buildDestructionTicket,Be as buildDomainSessionPolicy,It as buildDriftRepairTicket,B as buildRegionList,wt as captureLegacySurfaces,$r as captureRemediationForensics,C as cascadeHomeRegion,I as cascadeOperationKey,ro as checkDeployPathStackAvailability,Dr as classifyDriftFailure,We as classifyImpact,T as cleanupFailedStack,Fr as clearDriftSuspects,zt as collectIdentityPinCandidates,Rt as completeForgetAfterConverge,St as completeForgetAfterDeploy,ot as composeFlipCapabilities,Vt as composePostFailureRepairOffer,we as computeAssemblyDigest,Qe as computeDeployPlan,Jr as computeRemediationOpId,p as computeSecretsDrift,it as computeTemplateDigest,ur as computeTicketDigest,yr as createMemoisedPlanLoader,J as decideNextTransition,jt as decodeLegacyAnchor,q as decommissionMemberTrailStorage,br as defaultDriftJournalDir,et as defaultRemediationForensicsDir,Hr as defaultRemediationJournalDir,Xt as degradedIdentityPinOutcomes,t as deploy,U as deployDomains,R as deployOrganisation,qe as derivePropertyChanges,Ft as deriveRemovalTemplate,at as deriveRetainFlipTemplate,m as deriveStaleParameters,i as destroy,P as destroyOrganisation,Cr as detectStackDrift,je as digestHead,y as emptyS3Bucket,ce as ensureEnforceSsl,mr as evaluateDestructionConsents,dr as executableRemediationVerbs,de as extractAllAccountNames,u as extractConsumedSsmParameters,Er as fetchLastOperationEvents,nt as findMarkedResourcesByOpId,Qr as findRemediationJournalByOpId,bt as findRemovalDeletionFailures,kt as findResourcesPresent,fe as flattenAccountsToEnvironments,hr as formatDriftPreFlightBlock,Jt as formatDriftRepairOffer,Gt as formatPinOutcomeDetail,D as formatQuarantineSuspectedMessage,Pt as formatRecreateInFlightCures,E as formatRetainedBucketsMessage,Pe as isAccountsConfig,v as isCleanableState,ze as isDataLoss,to as isDeployPathBlockingStatus,te as isEnforceSslStatement,xe as isOuOnlyAccountBucket,g as isQuarantineDetail,_ as isRetainedBucketsDetail,Xe as isStatefulResourceType,Se as isStringArray,fr as legalRemediationVerbs,wr as listActiveRemediationOps,jr as listActiveRemediationOpsForContext,Tr as loadDeployPlan,Y as mergeReconciledProviderAccounts,ue as parseAccountsConfiguration,k as partitionAccounts,ve as partitionForRegion,xt as partitionPreFlightByRemediation,Nt as pinProbeCoverage,A as preEmptyStackBuckets,Or as probePhysicalPresence,s as probeSecretsDrift,c as probeServiceDeploymentStatus,N as projectAccountRows,G as projectScalarSummary,st as proveFlipMetadataOnly,Bt as proveRemovalTargetsOnly,kr as readDriftSuspects,Wr as readRemediationJournal,ct as readRetainFlipState,M as reconcileProviderAccounts,H as reconcileTrailMigration,Br as recordDriftSuspects,Pr as renderConsentVerdictLines,Sr as renderDestructionTicketLines,Zt as renderIdentityPinReportLines,Kt as renderPinReportLines,$e as renderPlanLines,Ze as renderPlanSummary,Ce as resolveBuildArgs,Ee as resolveBuildSecretSessionProvider,Ae as resolveBuildSecrets,De as resolveSecretRefValue,n as restart,pe as restoreAndReconcileQuarantinedBucket,ne as restoreBucketPolicy,nr as runApprovalGate,lr as runDestructionGate,Ur as runDriftPreFlight,Ut as runDriftRepairGate,Tt as runForgetSurgery,$t as runIdentityPinMigration,Wt as runIdentitySurfaceGate,Ne as runOpenNextBuild,Me as runOrganisationSetup,Mt as runPinRemediation,Ot as runRecreatePreFlight,Dt as runRecreateSurgery,Mr as runRoute53RecordPreflight,rr as signApprovalToken,Et as snapshotPolicyForType,ge as sourcedRefsFromBuildArgs,f as ssmParameterNameFromValueFrom,qr as sweepExpiredRemediationJournals,yt as synthTemplateDeclaresResource,se as synthesiseEnforceSslDocument,ie as toResourcePolicyStatements,er as toWirePlanChanges,re as triageBucketPolicy,X as unlockBucket,$ as unlockQueue,Ue as validateBuildGroup,tr as verifyApprovalToken,lt as verifyRetainFlipDiff,zr as writeRemediationJournal};

package/dist/src/orchestration/organisation/cascadeHelpers.d.ts

@@ -167,6 +167,21 @@ export interface DeployDomainsOptions {
      * upgrade over the skip, never a new way to fail the phase.
      */
     domainProviderFactory?: DomainProviderFactory;
+    /**
+     * F5 standalone lane: restrict the phase to exactly these zone names
+     * (compared through `normaliseRecordName`, so trailing dots and case
+     * differences still match). The filter applies AFTER the config read and
+     * BEFORE the partition, gate and wave plan — a filtered run keeps every
+     * invariant of the full phase, just over fewer zones. Fail-closed
+     * throughout: an EMPTY filter refuses (a caller wiring defect, not a
+     * request to deploy nothing), a name matching no registered domain
+     * refuses pre-AWS, and a requested zone the pin partition would skip
+     * (foreign home, no routable group) FAILS the phase instead of the
+     * cascade's skip-with-warning — in every case a silent no-op would read
+     * as a successful deploy. Absent: every registered domain, today's
+     * behaviour.
+     */
+    zones?: readonly string[];
 }
 /**
  * Order delegated domains into parent-first topological waves keyed on

package/dist/src/orchestration/organisation/cascadeHelpers.js

@@ -1 +1 @@
-var X=Object.defineProperty;var C=(e,n)=>X(e,"name",{value:n,configurable:!0});import{join as K}from"path";import{success as b,failure as D}from"@fjall/generator";import{logger as N}from"@fjall/util/logger";import{maskSensitiveOutput as P,mapSettledWithConcurrency as q,resolveSynthEnvironment as J}from"@fjall/util";import{ORGANISATION_TYPES as j,getOrganisationStackName as V}from"../../types/operations.js";import{CdkContextBuilder as Q}from"../../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as ee}from"../../types/deployment/index.js";import{CloudFormationService as F}from"../../services/infrastructure/CloudFormationService.js";import{getCascadeStateFilePath as te,regionSuffix as ne}from"../../types/config/FjallState.js";import{BackupClient as oe}from"@aws-sdk/client-backup";import{accountHasDisasterRecovery as re,describeBackupVaultExists as se}from"../../aws/organisations/backup.js";import{assertAssemblyEngineCompat as ie,buildParamsContext as ae,collectStackOutputs as W,assumeCascadeRole as M,emitStepWarnings as ce,emitWarningEvent as U,forwardOutput as L,reconcileOidcProviderIfCarried as _}from"../contextHelpers.js";import{assertLeaseBeforeStack as de}from"../application/leaseGate.js";import{runCascadeTakeoverGate as ue}from"../domain/domainTakeoverGate.js";import{deployDelegatedDomain as fe}from"../domain/delegatedDomainDeploy.js";import{normaliseRecordName as B}from"../domain/zoneClassifier.js";import{runDriftPreFlightGate as ge}from"../drift/preFlightGate.js";import{accountTier as z}from"@fjall/util";import{buildBootstrapTagsIfResolved as me}from"../bootstrapTags.js";import{hasOrganisationTierAccount as le}from"../../aws/organisations/accountGlobals.js";import{DEFAULT_REGION as Y}from"../../aws/utils/regions.js";const pe=4;function He(e){const n=e.find(r=>z(r)==="platform"),i=e.filter(r=>z(r)==="account");return{platformAccount:n,memberAccounts:i}}C(He,"partitionAccounts");function he(e){const n=e?.primaryRegion??Y,i=e?.secondaryRegions??[],r=new Set([n,...i]),f=e?.disasterRecoveryRegion;return f&&r.add(f),[...r]}C(he,"buildRegionList");function Ke(e){return he(e)[0]??Y}C(Ke,"cascadeHomeRegion");function ye(e,n){return`${e} (${n})`}C(ye,"cascadeOperationKey");function Ve(e,n){const i=[];for(const r of n)for(const f of e)i.push({account:f,region:r});return i}C(Ve,"buildAccountRegionPairs");import{buildCascadeRoleArn as Xe}from"../contextHelpers.js";async function We(e,n,i,r){i.onLog?.(`Verifying cascade role access for ${n.length} account(s)\u2026`,"info");const f=await q(n,pe,async c=>M(e.awsProvider,c.id,c.region??e.awsProvider.getRegion(),`fjall-preflight-${c.name}`,r)),t=[];return f.forEach((c,s)=>{const a=n[s];if(a){if(c.status==="rejected"){t.push({accountId:a.id,accountName:a.name,error:c.reason instanceof Error?c.reason.message:String(c.reason)});return}c.value.success||t.push({accountId:a.id,accountName:a.name,error:c.value.error.message})}}),t.length===0&&i.onLog?.(`Cascade role access verified for ${n.length} account(s)`,"info"),t}C(We,"probeCascadeRoles");async function Ue(e,n,i,r,f,t,c){const s=c?.region??r.region??n.awsProvider.getRegion(),a=ye(r.name,s),l=c?.orgConfig??e.orgConfig,v=c?.ipamPoolId;t.onCascadeAccountStart?.(a,r.id,s,f);const y=await M(n.awsProvider,r.id,s,`fjall-cascade-${r.name}`,e.abortSignal);if(!y.success)return t.onCascadeAccountComplete?.(a,!1,P(y.error.message),s),D(new Error(`Failed to assume role for ${r.name}: ${P(y.error.message)}`));const{provider:h,credentials:k}=y.data,E=K(e.workingDirectory,"fjall",f==="platform"?j.PLATFORM:j.ACCOUNT),R=K(E,`cdk.out.${r.id}.${ne(s)}`),p=Q.buildDeploymentContext({deployType:f,target:i.target,path:E,assemblyDir:R,environment:J(r),region:s,accountName:r.name,callerIdentity:ee(r.id),ipamPoolId:v,...ae({orgConfig:l,identity:e.identity,skipOidc:e.options?.skipOidc,region:s,primaryRegion:c?.primaryRegion,trailLifecycle:r.trailLifecycle})},{verbose:e.options?.verbose},l);if(re(r.environment,l?.disasterRecoveryRegion)){const S=await se(h.getClient(oe),e.abortSignal);if(!S.success)return t.onCascadeAccountComplete?.(a,!1,P(S.error.message),s),D(new Error(`Backup vault probe failed for ${r.name}: ${P(S.error.message)}`));p.fjallAdoptBackupVault=S.data}t.onCascadeAccountPhaseChange?.(a,"synth",s);const $=await n.cdkService.runCdkSynth(p,L(t),k);if(!$.success)return t.onCascadeAccountComplete?.(a,!1,P(`Synth failed: ${$.error}`),s),D(new Error(`Synth failed for ${r.name}: ${P($.error)}`));ce(t,$.data);const I=ie(R,t);if(!I.success){const S=P(I.error.message);return t.onCascadeAccountComplete?.(a,!1,S,s),D(new Error(`Engine compatibility check failed for ${r.name}: ${S}`))}const w=V(f==="platform"?j.PLATFORM:j.ACCOUNT),o=te(E,r.id,s),u=new F(h),{changed:d,currentHash:g}=await n.hashService.compareCascadeStack(R,w,o);if(!d&&e.options?.force!==!0&&await u.stackExists(w,void 0,e.abortSignal)){const S=await u.getStackOutputs(w,void 0,e.abortSignal);S.success||N.debug("cascadeHelpers","Failed to read outputs for skipped cascade account (non-critical)",{stackName:w,account:r.name});const H=W(S);return await _(p,h,t,e.abortSignal),t.onLog?.(`${r.name}: no infrastructure changes \u2014 skipping deploy`,"info"),t.onCascadeAccountComplete?.(a,!0,void 0,s,H,!0),b({outputs:H,skipped:!0})}const m=await ge(h,{stackNames:[w],cdkOutPath:R,cfnService:u,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(m.kind==="blocked")return t.onCascadeAccountComplete?.(a,!1,m.message,s),D(new Error(m.message));const A=await de(e.assertLeaseForStack,w,e.abortSignal);if(A!==void 0)return t.onCascadeAccountComplete?.(a,!1,A.message,s),D(A);t.onCascadeAccountPhaseChange?.(a,"bootstrap",s);const x=await n.cdkService.runCdkBootstrap(p,L(t),k,void 0,me({account:r,estate:le(l?.providerAccounts)?"org":"solo",...c?.orgId!==void 0?{orgId:c.orgId}:{}}));if(!x.success)return t.onCascadeAccountComplete?.(a,!1,P(`Bootstrap failed: ${x.error}`),s),D(new Error(`Bootstrap failed for ${r.name}: ${P(x.error)}`));t.onCascadeAccountPhaseChange?.(a,"deploy",s);const O=await n.cdkService.runCdkDeploy(p,w,L(t),S=>t.onCascadeAccountResourceProgress?.(a,S,s),h,k);if(!O.success)return t.onCascadeAccountComplete?.(a,!1,P(O.error),s),D(new Error(P(O.error)));const G=await u.getStackOutputs(w,void 0,e.abortSignal);G.success||N.debug("cascadeHelpers","Failed to read cascade account stack outputs (non-critical)",{stackName:w,account:r.name});const T=W(G);return await _(p,h,t,e.abortSignal),g!==void 0&&((await n.hashService.persistCascadeStack(o,w,g)).success||N.debug("cascadeHelpers","Failed to persist cascade hash state (non-critical)",{stackName:w,account:r.name})),t.onCascadeAccountComplete?.(a,!0,void 0,s,T,!1),b({outputs:T,skipped:!1})}C(Ue,"deployCascadeAccount");async function _e(e,n,i,r){const f=new Map,t=e.awsProvider.getRegion(),c=await M(e.awsProvider,n.id,t,`fjall-ipam-read-${n.name}`,r);if(!c.success)return N.debug("organisationDeploy",`Cannot read Platform outputs: ${c.error.message}`),f;const s=new F(c.data.provider),a=V(j.PLATFORM),l=await s.getStackOutputs(a);if(!l.success)return N.debug("organisationDeploy",`Failed to read Platform stack outputs: ${l.error.message}`),f;const v=/^IpamPoolId(\d{12})(\w+)$/;for(const y of l.data){const h=y.OutputKey?.match(v);if(h&&y.OutputValue){const k=`${h[1]}-${h[2]}`;f.set(k,y.OutputValue)}}return f.size>0&&i.onLog?.(`Read ${f.size} IPAM pool ID(s) from Platform stack`,"info"),f}C(_e,"readPlatformIpamPoolIds");function Z(e,n){const i=e.account!==void 0&&n?.executingAccountId!==void 0&&e.account!==n.executingAccountId,r=e.region!==void 0&&n?.executingRegion!==void 0&&e.region!==n.executingRegion;if(i)return`[${e.name}] skipped: its fjall-config.json entry records account ${e.account} as its home, but this cascade runs in account ${n?.executingAccountId} - deploy it separately with 'fjall domain deploy ${e.name} -t <target in account ${e.account}>' or run the cascade under that account.`;if(r)return`[${e.name}] skipped: its fjall-config.json entry records region ${e.region} as its home, but this cascade runs in region ${n?.executingRegion} - deploy it separately with 'fjall domain deploy ${e.name} --region ${e.region}', or update the entry's "region" key if this move is intentional.`}C(Z,"foreignDomainSkipReason");function Ce(e){const n=new Map;for(const t of e)n.set(B(t.name),t);const i=new Map,r=C((t,c)=>{const s=i.get(t);if(s!==void 0)return s;if(c.includes(t))return[...c.slice(c.indexOf(t)),t];const a=n.get(t);if(a===void 0)return-1;const l=a.parentDomain!==void 0?B(a.parentDomain):void 0,v=l===void 0?-1:r(l,[...c,t]);if(Array.isArray(v))return v;const y=v+1;return i.set(t,y),y},"resolveDepth"),f=[];for(const t of e){const c=r(B(t.name),[]);if(Array.isArray(c)){const s=c.map(a=>n.get(a)?.name??a).join(" -> ");return D(new Error(`Delegated domain ordering: fjall-config.json declares a parentDomain cycle (${s}) - no deploy order satisfies it. Nothing was deployed. Cure: correct the "parentDomain" of one entry in that cycle so parents form a chain, then re-run.`))}(f[c]??=[]).push(t)}return b(f.filter(t=>t.length>0))}C(Ce,"planDelegatedDomainWaves");async function ze(e,n,i){const r=e.getDomains();if(r.length===0)return{domainsDeployed:0,domainsSkipped:0,errors:[],deployedZones:[]};n.onCascadePhaseStart?.("domains");const f=C(o=>{const u=o.account??i?.executingAccountId,d=o.region??i?.executingRegion;if(!(u===void 0||d===void 0))return{accountId:u,region:d}},"resolveHome"),t=C(o=>`${o.accountId}\0${o.region}`,"homeKey"),c=i?.domainProviderFactory,s=new Map;if(c!==void 0)for(const o of r){if(Z(o,i)===void 0)continue;const u=f(o);if(u===void 0)continue;const d=t(u);s.has(d)||s.set(d,u)}const a=new Map;for(const[o,u]of s){const d=await c?.(u);d!==void 0&&(d.success?a.set(o,d.data):U(n,`[domains] account routing for home ${u.accountId}/${u.region} unavailable (${P(d.error.message)}) \u2014 its domains are skipped exactly as they were before routing existed.`))}const l=[],v=new Map,y=new Map;let h=0;for(const o of r){const u=Z(o,i);if(u===void 0){l.push(o);continue}const d=f(o),g=d!==void 0?a.get(t(d)):void 0;if(g!==void 0&&d!==void 0){l.push(o),v.set(o.name,g.provider);const m=t(d),A=y.get(m)??[];A.push(o),y.set(m,A);continue}h++,U(n,u)}const k=l.filter(o=>o.type==="apex"),E=l.filter(o=>o.type==="delegated");let R=0;const p=[],$=[],I=Ce(E);if(!I.success)return p.push(I.error.message),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$};const w=I.data;if(l.length>0){if(i?.takeover===void 0)return p.push("domains phase refused: the cascade executed without a takeover-gate context, so record collisions cannot be assessed \u2014 deploying ungated is not an option. This is a caller wiring defect (executeCascade threads services + consent inputs into DeployDomainsOptions.takeover)."),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$};const o=i.takeover,u=l.filter(m=>!v.has(m.name)),d=[];u.length>0&&d.push({home:{...i.executingAccountId!==void 0?{accountId:i.executingAccountId}:{},...i.executingRegion!==void 0?{region:i.executingRegion}:{}},provider:e,aws:o.aws,cfnService:o.cfnService,...o.route53Client!==void 0?{route53Client:o.route53Client}:{},domains:u});for(const[m,A]of s){const x=a.get(m),O=y.get(m);x===void 0||O===void 0||d.push({home:A,provider:x.provider,aws:x.aws,cfnService:new F(x.aws),domains:O})}const g=await ue(d,n,{...o.consents!==void 0?{consents:o.consents}:{},...o.consentDigest!==void 0?{consentDigest:o.consentDigest}:{},...o.consentGate!==void 0?{consentGate:o.consentGate}:{},...o.abortSignal!==void 0?{abortSignal:o.abortSignal}:{}});if(!g.success)return p.push(g.error.message),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$};if(g.data.kind==="withheld")return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$,takeover:g.data.withheld}}for(const o of k){const d=await(v.get(o.name)??e).deployDomain(o.name,n);d.success?(R++,$.push(o.name)):p.push(`${o.name}: ${d.error.message}`)}for(const o of w){const u=await Promise.allSettled(o.map(d=>{const g=v.get(d.name)??e,m=g.delegatedDeployer?.(d.name);return m!==void 0?fe({deployer:m,callbacks:n,...i?.abortSignal!==void 0?{abortSignal:i.abortSignal}:{},...i?.skipCaaPreflight!==void 0?{skipCaaPreflight:i.skipCaaPreflight}:{}}):g.deployDomain(d.name,n)}));for(let d=0;d<u.length;d++){const g=u[d],m=o[d];if(!(!g||!m))if(g.status==="fulfilled")g.value.success?(R++,$.push(m.name)):p.push(`${m.name}: ${g.value.error.message}`);else{const A=g.reason instanceof Error?g.reason.message:String(g.reason);p.push(`${m.name}: ${A}`)}}}return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:R,domainsSkipped:h,errors:p,deployedZones:$}}C(ze,"deployDomains");export{pe as CASCADE_MAX_CONCURRENCY,Ve as buildAccountRegionPairs,Xe as buildCascadeRoleArn,he as buildRegionList,Ke as cascadeHomeRegion,ye as cascadeOperationKey,Ue as deployCascadeAccount,ze as deployDomains,He as partitionAccounts,Ce as planDelegatedDomainWaves,We as probeCascadeRoles,_e as readPlatformIpamPoolIds};
+var Y=Object.defineProperty;var C=(e,n)=>Y(e,"name",{value:n,configurable:!0});import{join as H}from"path";import{success as L,failure as x}from"@fjall/generator";import{logger as F}from"@fjall/util/logger";import{maskSensitiveOutput as S,mapSettledWithConcurrency as X,resolveSynthEnvironment as J}from"@fjall/util";import{ORGANISATION_TYPES as M,getOrganisationStackName as K}from"../../types/operations.js";import{CdkContextBuilder as Q}from"../../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as ee}from"../../types/deployment/index.js";import{CloudFormationService as B}from"../../services/infrastructure/CloudFormationService.js";import{getCascadeStateFilePath as ne,regionSuffix as te}from"../../types/config/FjallState.js";import{BackupClient as oe}from"@aws-sdk/client-backup";import{accountHasDisasterRecovery as re,describeBackupVaultExists as se}from"../../aws/organisations/backup.js";import{assertAssemblyEngineCompat as ie,buildParamsContext as ae,collectStackOutputs as V,assumeCascadeRole as G,emitStepWarnings as de,emitWarningEvent as W,forwardOutput as T,reconcileOidcProviderIfCarried as Z}from"../contextHelpers.js";import{assertLeaseBeforeStack as ce}from"../application/leaseGate.js";import{runCascadeTakeoverGate as ue}from"../domain/domainTakeoverGate.js";import{deployDelegatedDomain as fe}from"../domain/delegatedDomainDeploy.js";import{normaliseRecordName as j}from"../domain/zoneClassifier.js";import{runDriftPreFlightGate as me}from"../drift/preFlightGate.js";import{accountTier as U}from"@fjall/util";import{buildBootstrapTagsIfResolved as le}from"../bootstrapTags.js";import{hasOrganisationTierAccount as pe}from"../../aws/organisations/accountGlobals.js";import{DEFAULT_REGION as _}from"../../aws/utils/regions.js";const ge=4;function be(e){const n=e.find(r=>U(r)==="platform"),s=e.filter(r=>U(r)==="account");return{platformAccount:n,memberAccounts:s}}C(be,"partitionAccounts");function he(e){const n=e?.primaryRegion??_,s=e?.secondaryRegions??[],r=new Set([n,...s]),l=e?.disasterRecoveryRegion;return l&&r.add(l),[...r]}C(he,"buildRegionList");function He(e){return he(e)[0]??_}C(He,"cascadeHomeRegion");function ye(e,n){return`${e} (${n})`}C(ye,"cascadeOperationKey");function Ke(e,n){const s=[];for(const r of n)for(const l of e)s.push({account:l,region:r});return s}C(Ke,"buildAccountRegionPairs");import{buildCascadeRoleArn as Ye}from"../contextHelpers.js";async function Ve(e,n,s,r){s.onLog?.(`Verifying cascade role access for ${n.length} account(s)\u2026`,"info");const l=await X(n,ge,async d=>G(e.awsProvider,d.id,d.region??e.awsProvider.getRegion(),`fjall-preflight-${d.name}`,r)),o=[];return l.forEach((d,c)=>{const u=n[c];if(u){if(d.status==="rejected"){o.push({accountId:u.id,accountName:u.name,error:d.reason instanceof Error?d.reason.message:String(d.reason)});return}d.value.success||o.push({accountId:u.id,accountName:u.name,error:d.value.error.message})}}),o.length===0&&s.onLog?.(`Cascade role access verified for ${n.length} account(s)`,"info"),o}C(Ve,"probeCascadeRoles");async function We(e,n,s,r,l,o,d){const c=d?.region??r.region??n.awsProvider.getRegion(),u=ye(r.name,c),h=d?.orgConfig??e.orgConfig,v=d?.ipamPoolId;o.onCascadeAccountStart?.(u,r.id,c,l);const g=await G(n.awsProvider,r.id,c,`fjall-cascade-${r.name}`,e.abortSignal);if(!g.success)return o.onCascadeAccountComplete?.(u,!1,S(g.error.message),c),x(new Error(`Failed to assume role for ${r.name}: ${S(g.error.message)}`));const{provider:w,credentials:I}=g.data,E=H(e.workingDirectory,"fjall",l==="platform"?M.PLATFORM:M.ACCOUNT),D=H(E,`cdk.out.${r.id}.${te(c)}`),O=Q.buildDeploymentContext({deployType:l,target:s.target,path:E,assemblyDir:D,environment:J(r),region:c,accountName:r.name,callerIdentity:ee(r.id),ipamPoolId:v,...ae({orgConfig:h,identity:e.identity,skipOidc:e.options?.skipOidc,region:c,primaryRegion:d?.primaryRegion,trailLifecycle:r.trailLifecycle})},{verbose:e.options?.verbose},h);if(re(r.environment,h?.disasterRecoveryRegion)){const y=await se(w.getClient(oe),e.abortSignal);if(!y.success)return o.onCascadeAccountComplete?.(u,!1,S(y.error.message),c),x(new Error(`Backup vault probe failed for ${r.name}: ${S(y.error.message)}`));O.fjallAdoptBackupVault=y.data}o.onCascadeAccountPhaseChange?.(u,"synth",c);const N=await n.cdkService.runCdkSynth(O,T(o),I);if(!N.success)return o.onCascadeAccountComplete?.(u,!1,S(`Synth failed: ${N.error}`),c),x(new Error(`Synth failed for ${r.name}: ${S(N.error)}`));de(o,N.data);const $=ie(D,o);if(!$.success){const y=S($.error.message);return o.onCascadeAccountComplete?.(u,!1,y,c),x(new Error(`Engine compatibility check failed for ${r.name}: ${y}`))}const p=K(l==="platform"?M.PLATFORM:M.ACCOUNT),P=ne(E,r.id,c),k=new B(w),{changed:z,currentHash:t}=await n.hashService.compareCascadeStack(D,p,P);if(!z&&e.options?.force!==!0&&await k.stackExists(p,void 0,e.abortSignal)){const y=await k.getStackOutputs(p,void 0,e.abortSignal);y.success||F.debug("cascadeHelpers","Failed to read outputs for skipped cascade account (non-critical)",{stackName:p,account:r.name});const b=V(y);return await Z(O,w,o,e.abortSignal),o.onLog?.(`${r.name}: no infrastructure changes \u2014 skipping deploy`,"info"),o.onCascadeAccountComplete?.(u,!0,void 0,c,b,!0),L({outputs:b,skipped:!0})}const f=await me(w,{stackNames:[p],cdkOutPath:D,cfnService:k,callbacks:o,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(f.kind==="blocked")return o.onCascadeAccountComplete?.(u,!1,f.message,c),x(new Error(f.message));const i=await ce(e.assertLeaseForStack,p,e.abortSignal);if(i!==void 0)return o.onCascadeAccountComplete?.(u,!1,i.message,c),x(i);o.onCascadeAccountPhaseChange?.(u,"bootstrap",c);const a=await n.cdkService.runCdkBootstrap(O,T(o),I,void 0,le({account:r,estate:pe(h?.providerAccounts)?"org":"solo",...d?.orgId!==void 0?{orgId:d.orgId}:{}}));if(!a.success)return o.onCascadeAccountComplete?.(u,!1,S(`Bootstrap failed: ${a.error}`),c),x(new Error(`Bootstrap failed for ${r.name}: ${S(a.error)}`));o.onCascadeAccountPhaseChange?.(u,"deploy",c);const m=await n.cdkService.runCdkDeploy(O,p,T(o),y=>o.onCascadeAccountResourceProgress?.(u,y,c),w,I);if(!m.success)return o.onCascadeAccountComplete?.(u,!1,S(m.error),c),x(new Error(S(m.error)));const R=await k.getStackOutputs(p,void 0,e.abortSignal);R.success||F.debug("cascadeHelpers","Failed to read cascade account stack outputs (non-critical)",{stackName:p,account:r.name});const A=V(R);return await Z(O,w,o,e.abortSignal),t!==void 0&&((await n.hashService.persistCascadeStack(P,p,t)).success||F.debug("cascadeHelpers","Failed to persist cascade hash state (non-critical)",{stackName:p,account:r.name})),o.onCascadeAccountComplete?.(u,!0,void 0,c,A,!1),L({outputs:A,skipped:!1})}C(We,"deployCascadeAccount");async function Ze(e,n,s,r){const l=new Map,o=e.awsProvider.getRegion(),d=await G(e.awsProvider,n.id,o,`fjall-ipam-read-${n.name}`,r);if(!d.success)return F.debug("organisationDeploy",`Cannot read Platform outputs: ${d.error.message}`),l;const c=new B(d.data.provider),u=K(M.PLATFORM),h=await c.getStackOutputs(u);if(!h.success)return F.debug("organisationDeploy",`Failed to read Platform stack outputs: ${h.error.message}`),l;const v=/^IpamPoolId(\d{12})(\w+)$/;for(const g of h.data){const w=g.OutputKey?.match(v);if(w&&g.OutputValue){const I=`${w[1]}-${w[2]}`;l.set(I,g.OutputValue)}}return l.size>0&&s.onLog?.(`Read ${l.size} IPAM pool ID(s) from Platform stack`,"info"),l}C(Ze,"readPlatformIpamPoolIds");function q(e,n){const s=e.account!==void 0&&n?.executingAccountId!==void 0&&e.account!==n.executingAccountId,r=e.region!==void 0&&n?.executingRegion!==void 0&&e.region!==n.executingRegion;if(s)return`[${e.name}] skipped: its fjall-config.json entry records account ${e.account} as its home, but this cascade runs in account ${n?.executingAccountId} - deploy it separately with 'fjall domain deploy ${e.name} -t <target in account ${e.account}>' or run the cascade under that account.`;if(r)return`[${e.name}] skipped: its fjall-config.json entry records region ${e.region} as its home, but this cascade runs in region ${n?.executingRegion} - deploy it separately with 'fjall domain deploy ${e.name} --region ${e.region}', or update the entry's "region" key if this move is intentional.`}C(q,"foreignDomainSkipReason");function Ce(e){const n=new Map;for(const o of e)n.set(j(o.name),o);const s=new Map,r=C((o,d)=>{const c=s.get(o);if(c!==void 0)return c;if(d.includes(o))return[...d.slice(d.indexOf(o)),o];const u=n.get(o);if(u===void 0)return-1;const h=u.parentDomain!==void 0?j(u.parentDomain):void 0,v=h===void 0?-1:r(h,[...d,o]);if(Array.isArray(v))return v;const g=v+1;return s.set(o,g),g},"resolveDepth"),l=[];for(const o of e){const d=r(j(o.name),[]);if(Array.isArray(d)){const c=d.map(u=>n.get(u)?.name??u).join(" -> ");return x(new Error(`Delegated domain ordering: fjall-config.json declares a parentDomain cycle (${c}) - no deploy order satisfies it. Nothing was deployed. Cure: correct the "parentDomain" of one entry in that cycle so parents form a chain, then re-run.`))}(l[d]??=[]).push(o)}return L(l.filter(o=>o.length>0))}C(Ce,"planDelegatedDomainWaves");async function Ue(e,n,s){const r=e.getDomains();let l=r;if(s?.zones!==void 0){if(s.zones.length===0)return{domainsDeployed:0,domainsSkipped:0,errors:["domains phase refused: the zones filter is present but empty, so there is nothing true to act on (succeeding would read as a deploy that never happened). Cure: name at least one registered zone, or omit the filter to deploy every registered domain; nothing was deployed."],deployedZones:[]};const t=new Set(r.map(a=>j(a.name))),f=s.zones.filter(a=>!t.has(j(a)));if(f.length>0)return{domainsDeployed:0,domainsSkipped:0,errors:[`domains phase refused: ${f.join(", ")} ${f.length===1?"is":"are"} not registered in fjall-config.json domains, so a zones-filtered deploy has nothing true to act on (a silent no-op would read as success). Cure: register the zone ('fjall domain create' / 'fjall domain import') or correct the requested name; nothing was deployed.`],deployedZones:[]};const i=new Set(s.zones.map(a=>j(a)));l=r.filter(a=>i.has(j(a.name)))}if(l.length===0)return{domainsDeployed:0,domainsSkipped:0,errors:[],deployedZones:[]};n.onCascadePhaseStart?.("domains");const o=C(t=>{const f=t.account??s?.executingAccountId,i=t.region??s?.executingRegion;if(!(f===void 0||i===void 0))return{accountId:f,region:i}},"resolveHome"),d=C(t=>`${t.accountId}\0${t.region}`,"homeKey"),c=C(t=>s?.executingAccountId!==void 0&&s?.executingRegion!==void 0?o(t):void 0,"emissionHome"),u=s?.domainProviderFactory,h=new Map;if(u!==void 0)for(const t of l){if(q(t,s)===void 0)continue;const f=o(t);if(f===void 0)continue;const i=d(f);h.has(i)||h.set(i,f)}const v=new Map;for(const[t,f]of h){const i=await u?.(f);i!==void 0&&(i.success?v.set(t,i.data):W(n,`[domains] account routing for home ${f.accountId}/${f.region} unavailable (${S(i.error.message)}) \u2014 its domains are skipped exactly as they were before routing existed.`))}const g=[],w=new Map,I=new Map,E=[];let D=0;for(const t of l){const f=q(t,s);if(f===void 0){g.push(t);continue}const i=o(t),a=i!==void 0?v.get(d(i)):void 0;if(a!==void 0&&i!==void 0){g.push(t),w.set(t.name,a.provider);const m=d(i),R=I.get(m)??[];R.push(t),I.set(m,R);continue}D++,E.push(f),W(n,f)}if(s?.zones!==void 0&&E.length>0)return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:0,domainsSkipped:D,errors:E.map(t=>`zones-filtered deploy refused \u2014 a requested zone cannot be deployed under this identity: ${t}`),deployedZones:[]};const O=g.filter(t=>t.type==="apex"),N=g.filter(t=>t.type==="delegated");let $=0;const p=[],P=[],k=Ce(N);if(!k.success)return p.push(k.error.message),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:$,domainsSkipped:D,errors:p,deployedZones:P};const z=k.data;if(g.length>0){if(s?.takeover===void 0)return p.push("domains phase refused: the cascade executed without a takeover-gate context, so record collisions cannot be assessed \u2014 deploying ungated is not an option. This is a caller wiring defect (executeCascade threads services + consent inputs into DeployDomainsOptions.takeover)."),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:$,domainsSkipped:D,errors:p,deployedZones:P};const t=s.takeover,f=g.filter(m=>!w.has(m.name)),i=[];f.length>0&&i.push({home:{...s.executingAccountId!==void 0?{accountId:s.executingAccountId}:{},...s.executingRegion!==void 0?{region:s.executingRegion}:{}},provider:e,aws:t.aws,cfnService:t.cfnService,...t.route53Client!==void 0?{route53Client:t.route53Client}:{},domains:f});for(const[m,R]of h){const A=v.get(m),y=I.get(m);A===void 0||y===void 0||i.push({home:R,provider:A.provider,aws:A.aws,cfnService:new B(A.aws),domains:y})}const a=await ue(i,n,{...t.consents!==void 0?{consents:t.consents}:{},...t.consentDigest!==void 0?{consentDigest:t.consentDigest}:{},...t.consentGate!==void 0?{consentGate:t.consentGate}:{},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!a.success)return p.push(a.error.message),n.onCascadePhaseComplete?.("domains"),{domainsDeployed:$,domainsSkipped:D,errors:p,deployedZones:P};if(a.data.kind==="withheld")return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:$,domainsSkipped:D,errors:p,deployedZones:P,takeover:a.data.withheld}}for(const t of O){const f=w.get(t.name)??e,i=c(t);n.onDomainDeployStart?.(t.name,i);let a;try{a=await f.deployDomain(t.name,n)}catch(m){a=x(m instanceof Error?m:new Error(String(m)))}a.success?($++,P.push(t.name),n.onDomainDeployComplete?.(t.name,!0,void 0,i)):(p.push(`${t.name}: ${a.error.message}`),n.onDomainDeployComplete?.(t.name,!1,S(a.error.message),i))}for(const t of z){const f=await Promise.allSettled(t.map(async i=>{const a=w.get(i.name)??e;n.onDomainDeployStart?.(i.name,c(i));const m=a.delegatedDeployer?.(i.name);return m!==void 0?fe({deployer:m,callbacks:n,...s?.abortSignal!==void 0?{abortSignal:s.abortSignal}:{},...s?.skipCaaPreflight!==void 0?{skipCaaPreflight:s.skipCaaPreflight}:{}}):a.deployDomain(i.name,n)}));for(let i=0;i<f.length;i++){const a=f[i],m=t[i];if(!a||!m)continue;const R=c(m);if(a.status==="fulfilled")a.value.success?($++,P.push(m.name),n.onDomainDeployComplete?.(m.name,!0,void 0,R)):(p.push(`${m.name}: ${a.value.error.message}`),n.onDomainDeployComplete?.(m.name,!1,S(a.value.error.message),R));else{const A=a.reason instanceof Error?a.reason.message:String(a.reason);p.push(`${m.name}: ${A}`),n.onDomainDeployComplete?.(m.name,!1,S(A),R)}}}return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:$,domainsSkipped:D,errors:p,deployedZones:P}}C(Ue,"deployDomains");export{ge as CASCADE_MAX_CONCURRENCY,Ke as buildAccountRegionPairs,Ye as buildCascadeRoleArn,he as buildRegionList,He as cascadeHomeRegion,ye as cascadeOperationKey,We as deployCascadeAccount,Ue as deployDomains,be as partitionAccounts,Ce as planDelegatedDomainWaves,Ve as probeCascadeRoles,Ze as readPlatformIpamPoolIds};

package/dist/src/types/callbackKeys.d.ts

@@ -1,6 +1,6 @@
 import type { DeployCallbacks } from "./callbacks.js";
 /**
- * Every {@link DeployCallbacks} key (48 callbacks + the `verbose` flag),
+ * Every {@link DeployCallbacks} key (50 callbacks + the `verbose` flag),
  * derived from the type-checked {@link CALLBACK_KEY_PRESENCE} map so the list
  * can never silently diverge from the interface.
  */

package/dist/src/types/callbackKeys.js

@@ -1 +1 @@
-const e={onStepStart:!0,onStepComplete:!0,onProgress:!0,onLog:!0,onOutput:!0,onResourceProgress:!0,onParallelPhaseStart:!0,onParallelPhaseComplete:!0,onParallelStackResourceProgress:!0,onDockerProgress:!0,onBuildPushStart:!0,onBuildPushProgress:!0,onBuildPushComplete:!0,onTaskDefRegistered:!0,onECSUpdate:!0,onECSProgress:!0,onECSComplete:!0,onMigrationsStart:!0,onMigrationsComplete:!0,onCDKBootstrap:!0,onCdkOutput:!0,onCascadeStart:!0,onCascadeAccountsReconciled:!0,onOrgChangesDetected:!0,onCascadeMissingAccounts:!0,onCascadePhaseStart:!0,onCascadePhaseComplete:!0,onCascadeAccountStart:!0,onCascadeAccountPhaseChange:!0,onCascadeAccountResourceProgress:!0,onCascadeAccountComplete:!0,onCascadeComplete:!0,onCascadeLedger:!0,onTrailMigrationPhase:!0,onTrailLifecycleChanged:!0,onStackCleanupProgress:!0,onDetectionComplete:!0,onDetectionPhaseChange:!0,onStackTargets:!0,onSSOUrl:!0,onAuthComplete:!0,onOpenNextBuildStart:!0,onOpenNextProgress:!0,onOpenNextBuildComplete:!0,onOpenNextBuildError:!0,onFailureAnalysis:!0,onDeploymentFailure:!0,onError:!0,verbose:!0},t=Object.keys(e);export{t as ALL_CALLBACK_KEYS};
+const e={onStepStart:!0,onStepComplete:!0,onProgress:!0,onLog:!0,onOutput:!0,onResourceProgress:!0,onParallelPhaseStart:!0,onParallelPhaseComplete:!0,onParallelStackResourceProgress:!0,onDockerProgress:!0,onBuildPushStart:!0,onBuildPushProgress:!0,onBuildPushComplete:!0,onTaskDefRegistered:!0,onECSUpdate:!0,onECSProgress:!0,onECSComplete:!0,onMigrationsStart:!0,onMigrationsComplete:!0,onCDKBootstrap:!0,onCdkOutput:!0,onCascadeStart:!0,onCascadeAccountsReconciled:!0,onOrgChangesDetected:!0,onCascadeMissingAccounts:!0,onCascadePhaseStart:!0,onCascadePhaseComplete:!0,onDomainDeployStart:!0,onDomainDeployComplete:!0,onCascadeAccountStart:!0,onCascadeAccountPhaseChange:!0,onCascadeAccountResourceProgress:!0,onCascadeAccountComplete:!0,onCascadeComplete:!0,onCascadeLedger:!0,onTrailMigrationPhase:!0,onTrailLifecycleChanged:!0,onStackCleanupProgress:!0,onDetectionComplete:!0,onDetectionPhaseChange:!0,onStackTargets:!0,onSSOUrl:!0,onAuthComplete:!0,onOpenNextBuildStart:!0,onOpenNextProgress:!0,onOpenNextBuildComplete:!0,onOpenNextBuildError:!0,onFailureAnalysis:!0,onDeploymentFailure:!0,onError:!0,verbose:!0},t=Object.keys(e);export{t as ALL_CALLBACK_KEYS};

package/dist/src/types/callbacks.d.ts

@@ -4,6 +4,7 @@ import type { DeploymentFailure } from "@fjall/util";
 import type { FailureAnalysis } from "@fjall/util/aws";
 import type { DetectionResult } from "./detection/detection.js";
 import type { CascadeLedger } from "../orchestration/organisation/cascadeSummary.js";
+import type { DomainHome } from "../orchestration/domainInterface.js";
 import type { STEP_COMPLETE_STATUSES, STACK_CLEANUP_PHASES, CASCADE_ACCOUNT_PHASES, LOG_LEVELS } from "./deployEvent.js";
 export type StepCompleteStatus = (typeof STEP_COMPLETE_STATUSES)[number];
 export type StackCleanupPhase = (typeof STACK_CLEANUP_PHASES)[number];
@@ -193,6 +194,28 @@ export interface DeployCallbacks {
     onCascadePhaseStart?: (phase: CascadePhase) => void;
     /** @emittedBy engine — fired when a cascade phase completes. */
     onCascadePhaseComplete?: (phase: CascadePhase) => void;
+    /**
+     * @emittedBy engine — one zone of the domains phase begins deploying
+     * (Phase A apex in sequence, or the moment its parent-first wave
+     * dispatches it). `home` is the zone's fully-resolved `(account, region)`
+     * deploy target, present only when the caller threaded a FULL executing
+     * identity (both keys): eligibility then guarantees pin == identity for
+     * non-routed zones and routed zones deploy into their resolved home by
+     * construction. On the fail-open legacy path (identity absent or
+     * partial) `home` is undefined — a pinned entry deploys through the
+     * ambient provider there, so reporting its pin would be a false audit
+     * record. Fires for the cascade AND the standalone per-zone lane alike;
+     * the phase-level `onCascadePhaseStart("domains")` stays the coarse
+     * envelope around all zones.
+     */
+    onDomainDeployStart?: (zone: string, home?: DomainHome) => void;
+    /**
+     * @emittedBy engine — that zone's deploy settled. Zones the phase never
+     * started (skipped-foreign, takeover-withheld, refused pre-AWS) get NO
+     * complete event — absence of the start/complete pair is the honest
+     * signal that nothing was attempted.
+     */
+    onDomainDeployComplete?: (zone: string, success: boolean, error?: string, home?: DomainHome) => void;
     /** @emittedBy engine */
     onCascadeAccountStart?: (operationKey: string, accountId: string, region: string, deployType?: string) => void;
     /** @emittedBy engine — per-account bootstrap/synth/deploy/destroy phase transitions. */

package/dist/src/types/deployEvent.d.ts

@@ -169,10 +169,10 @@ export declare const PlanChangeSchema: z.ZodObject<{
     resourceType: z.ZodString;
     action: z.ZodEnum<{
         replace: "replace";
+        read: "read";
+        delete: "delete";
         create: "create";
         update: "update";
-        delete: "delete";
-        read: "read";
         "no-op": "no-op";
     }>;
     stack: z.ZodOptional<z.ZodString>;
@@ -820,10 +820,10 @@ export declare const DeployEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             resourceType: z.ZodString;
             action: z.ZodEnum<{
                 replace: "replace";
+                read: "read";
+                delete: "delete";
                 create: "create";
                 update: "update";
-                delete: "delete";
-                read: "read";
                 "no-op": "no-op";
             }>;
             stack: z.ZodOptional<z.ZodString>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "14.3.0",
+  "version": "16.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -96,15 +96,15 @@
     "@aws-sdk/client-ssm": "^3.1098.0",
     "@aws-sdk/client-sso-admin": "^3.1098.0",
     "@aws-sdk/client-sts": "^3.1098.0",
-    "@fjall/generator": "^14.3.0",
-    "@fjall/util": "^14.3.0",
+    "@fjall/generator": "^16.0.0",
+    "@fjall/util": "^16.0.0",
     "@smithy/node-http-handler": "^4.9.13",
     "aws-cdk": "^2.1134.0",
     "tsx": "^4.23.1",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@fjall/components-infrastructure": ">=14.0.0 <15.0.0"
+    "@fjall/components-infrastructure": ">=16.0.0 <17.0.0"
   },
   "peerDependenciesMeta": {
     "@fjall/components-infrastructure": {