@fjall/deploy-core 19.0.0 → 21.0.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "f152a2d7b6a075a5791d9b321acb4761dda16eba6a24856717bf5143f1651236",
+  "hash": "623b78ba79d83f6ebcae4b84de5070792c13fb7d4d7c6cdc07f41e9f44d64d4d",
   "files": {
     "src/__test-utils__/awsMockHelpers.ts": "fea371c1b1869678",
     "src/__test-utils__/index.ts": "e03cf35821157dc4",
@@ -52,9 +52,9 @@
     "src/aws/utils/regions.ts": "3a5191f4d2242a60",
     "src/aws/utils/stackStatus.ts": "55fb23ba5514bc13",
     "src/events/index.ts": "e55c022f0d9013e6",
-    "src/index.ts": "7332e9ed2912c390",
+    "src/index.ts": "2f8c7aa093fea1fc",
     "src/orchestration/activeDeploymentGuard.ts": "e8dde742c00ea728",
-    "src/orchestration/application/applicationDeploy.ts": "6a4090e898f86a28",
+    "src/orchestration/application/applicationDeploy.ts": "8050ffe3915611db",
     "src/orchestration/application/applicationDeployHelpers.ts": "bca833cc04f0b4c5",
     "src/orchestration/application/applicationDestroy.ts": "38b8ecf69c85d884",
     "src/orchestration/application/approvalGate.ts": "81130a8b58279c45",
@@ -70,9 +70,10 @@
     "src/orchestration/application/destroyPreFlight.ts": "cc4978dec60b033e",
     "src/orchestration/application/destructionGate.ts": "5fbaa6ef69eb3ae1",
     "src/orchestration/application/detectionPipeline.ts": "69b7dfcedf22fe01",
+    "src/orchestration/application/directDestroy.ts": "4fac968ba765cd76",
     "src/orchestration/application/dockerBuildHelper.ts": "e7a7259e987d93be",
-    "src/orchestration/application/ecrCacheRepository.ts": "d7a5602ccabde493",
-    "src/orchestration/application/ecsDeploymentTail.ts": "d9ff18631984b2e5",
+    "src/orchestration/application/ecrCacheRepository.ts": "bf396177c8c66e4a",
+    "src/orchestration/application/ecsDeploymentTail.ts": "51974290626f5d47",
     "src/orchestration/application/engineCompat.ts": "d3e1cbf906bc785d",
     "src/orchestration/application/lambdaCodeOnlyRollout.ts": "fc347b90ff55c1fd",
     "src/orchestration/application/leaseGate.ts": "26be2e119b32bef4",
@@ -91,7 +92,7 @@
     "src/orchestration/application/plan/renameDetection.ts": "7242d45be616625f",
     "src/orchestration/application/plan/renderDeployPlan.ts": "d2d77c37aa7b4ed6",
     "src/orchestration/application/plan/types.ts": "191929198672081c",
-    "src/orchestration/application/schemaGateImage.ts": "587a115432c6678e",
+    "src/orchestration/application/schemaGateImage.ts": "0146ae1ce875a9b6",
     "src/orchestration/application/serviceImageTagsRollback.ts": "55e23a493545511c",
     "src/orchestration/application/taskDefinitionRoll.ts": "d9378c509c7ec287",
     "src/orchestration/application/welcomeImageHelper.ts": "1721ea7edc37a96e",
@@ -133,7 +134,7 @@
     "src/orchestration/drift/route53RecordPreflight.ts": "f4db16a6c0e69ac9",
     "src/orchestration/failure/classifyFailure.ts": "bfb80731bc7d6b95",
     "src/orchestration/failure/deploymentFailureAttachment.ts": "358d9e4d88390cfd",
-    "src/orchestration/index.ts": "78a445bece83d7fc",
+    "src/orchestration/index.ts": "ea122e8f176a1a49",
     "src/orchestration/manifestSecretParser.ts": "c5576bd88a3652f8",
     "src/orchestration/organisation/accountsConfig.ts": "a55a3306564e7b2f",
     "src/orchestration/organisation/cascadeDestroyHelpers.ts": "7f1927a00ed24767",
@@ -258,8 +259,8 @@
     "src/types/errors/index.ts": "e3bf5e08988d1182",
     "src/types/events.ts": "5f0e756e98914442",
     "src/types/frameworkBuilder.ts": "41198a0b446f60b6",
-    "src/types/index.ts": "c72f15165e81930c",
-    "src/types/operations.ts": "57a6c9e22a3f37ca",
+    "src/types/index.ts": "67af159ea0d55361",
+    "src/types/operations.ts": "8e59ed4691468920",
     "src/types/params.ts": "f49979d6546586b0",
     "src/types/remediation.ts": "0e1138f0c8fdc6bf",
     "src/types/stepDefinitions.ts": "a5e2aa03b15011b4",
@@ -268,12 +269,12 @@
     "src/util/dockerfileDetection.ts": "c407ab8208fb65ec",
     "src/util/index.ts": "6fcf776825c4518e",
     "src/util/sequencedCallbacks.ts": "e0eb541cff459083",
-    "src/util/sleepAbortable.ts": "f9cac3bf8a79a476",
+    "src/util/sleepAbortable.ts": "ee2facc7b89ab9f5",
     "src/version.ts": "1811a4475823b27e",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "093d8bddf1ead2cf",
+    "package.json": "5c18b2116f2213eb",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "03b3796b0ca16efc9a18b001a6b318007f2a8be0c75ebb0c93420710158e11a7",
-  "outputFileCount": 511
+  "outputHash": "bfe4f6996414bbbd7e15a07e23aaa67569487e9295fb0ef5dac3afdc6acd1715",
+  "outputFileCount": 513
 }

package/dist/.minified

@@ -1 +1 @@
-255 files minified at 2026-08-24T11:07:21.862Z
+256 files minified at 2026-08-26T08:33:04.444Z

package/dist/src/index.d.ts

@@ -33,7 +33,7 @@ export type { RemediationVerbWithSurgery } from "./types/index.js";
 export type { DriftVerdict, DriftSuspect, DriftFinding, DriftJournalRecord } from "./types/index.js";
 export type { StepId, InfrastructureStepName, StepDefinition, StepDeploymentType, Operation, StepContext } from "./types/index.js";
 export type { DeploymentContext, StepOutput, ApplicationDeploymentContext, CallerIdentity, StackOutput, StackOutputsRecord, ValidationResult, DetectionResult, ProgressCallbacks, ApplicationStack, OrganisationType, DeploymentOperation, ApplicationOperation, OrganisationOperation, DeployOrderOptions, ParallelDeployGroupKey, ParallelDestroyGroupKey, OpenNextPattern, AppResourceFlags, ParallelDeploymentResult, ParallelDeployGroup, ParallelOperation, ParallelOperationType, ParallelOperationState, ApplicationErrorType, StackDeploymentData, StackDeploymentOptions, ApplicationDeploymentData, ApplicationDestructionData, FjallStateFile, TemplateHashEntry } from "./types/index.js";
-export { APPLICATION_STACKS, ORGANISATION_TYPES, APPLICATION_DEPLOY_ORDER, APPLICATION_DESTROY_ORDER, OPENNEXT_DEPLOY_ORDER, OPENNEXT_DESTROY_ORDER, PARALLEL_DEPLOY_GROUPS, PARALLEL_DESTROY_GROUPS, OPENNEXT_PARALLEL_GROUPS, PARALLEL_OPERATION_TYPES, isApplicationOperation, isOrganisationOperation, getParallelDeployGroups, getParallelDestroyGroups, getApplicationDeployOrder, getApplicationDestroyOrder, getApplicationStackName, getOrganisationStackName, isApplicationStack, isQuarantineDetail, isRetainedBucketsDetail, getApplicationStepName, getApplicationStepId, toPascalCase, isOpenNextPattern, OPENNEXT_PATTERNS, STACK_NOT_FOUND_PATTERN, STACK_FAILED_STATE_PATTERN, CDK_NO_STACKS_MATCH, INFRASTRUCTURE_FILENAME, ApplicationError, wrapApplicationError, stubCallerIdentity } from "./types/index.js";
+export { APPLICATION_STACKS, ORGANISATION_TYPES, APPLICATION_DEPLOY_ORDER, APPLICATION_DESTROY_ORDER, FULL_APPLICATION_DESTROY_ORDER, OPENNEXT_DEPLOY_ORDER, OPENNEXT_DESTROY_ORDER, PARALLEL_DEPLOY_GROUPS, PARALLEL_DESTROY_GROUPS, OPENNEXT_PARALLEL_GROUPS, PARALLEL_OPERATION_TYPES, isApplicationOperation, isOrganisationOperation, getParallelDeployGroups, getParallelDestroyGroups, getApplicationDeployOrder, getApplicationDestroyOrder, getApplicationStackName, getOrganisationStackName, isApplicationStack, isQuarantineDetail, isRetainedBucketsDetail, getApplicationStepName, getApplicationStepId, toPascalCase, isOpenNextPattern, OPENNEXT_PATTERNS, STACK_NOT_FOUND_PATTERN, STACK_FAILED_STATE_PATTERN, CDK_NO_STACKS_MATCH, INFRASTRUCTURE_FILENAME, ApplicationError, wrapApplicationError, stubCallerIdentity } from "./types/index.js";
 export { deriveResourcesFromManifestStacks } from "./types/detection/patternDetection.js";
 export { FjallStateFileSchema, readStateFile, writeStateFile, createEmptyState, deleteStateFile, updateTemplateHash, getStateFilePath, regionSuffix } from "./types/config/FjallState.js";
 export { readDomainState, writeDomainState, recordDomainDeployState, deleteDomainState, hashDomainDirectory, LEGACY_DOMAIN_STATE_FILENAME, type DomainDeployState } from "./types/config/DomainState.js";
@@ -53,6 +53,7 @@ export { fileExists } from "@fjall/util/fsHelpers";
 export { type Result, success, failure, isSuccess, isFailure } from "@fjall/generator";
 export { deploy } from "./orchestration/index.js";
 export { destroy } from "./orchestration/index.js";
+export { destroyApplicationDirect, type DirectDestroyParams } from "./orchestration/index.js";
 export { buildParamsContext } from "./orchestration/contextHelpers.js";
 export { emitStepWarnings, emitWarningEvent } from "./orchestration/contextHelpers.js";
 export { ENGINE_DIAGNOSTIC_SCOPE } from "./util/diagnosticScopes.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as a,DEPLOYMENT_EVENT_TYPES as i,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as l,CASCADE_PHASES as S,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as m,truncateUtf16Safe as T}from"./types/index.js";import{DeployEventSchema as _,StepProgressSchema as A,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as y,DEPLOY_EVENT_NAME_MAX as g,DEPLOY_EVENT_MESSAGE_MAX as I,DEPLOY_EVENT_STATUS_REASON_MAX as L,DEPLOY_EVENT_ERROR_MESSAGE_MAX as x,DEPLOY_EVENT_TRAIL_DETAIL_MAX as h,DEPLOY_EVENT_OUTPUT_MAX as v,DEPLOY_EVENT_ARN_MAX as F,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ae,probeAccountStackExists as ie}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as le,describeOrganisation as Se,enablePolicyTypes as pe,enableServiceAccess as me,SERVICE_PRINCIPALS as Te,enableRamSharing as Re,activateTrustedAccess as _e,enableIpamDelegatedAdmin as Ae,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as ye,checkIdentityCentreStatus as ge,snapshotIdentityCentre as Ie,composeSdkAbortSignal as Le,extractErrorName as xe,isAborted as he,DEFAULT_MAX_PAGES as ve,IDENTITY_STORE_PAGE_SIZE as Fe,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ar}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as lr,verbsForDriftVerdict as Sr}from"./types/index.js";import{REMEDIATION_PHASES as mr,RemediationPhaseSchema as Tr,RemediationTargetSchema as Rr,RemediationFlipProofSchema as _r,RemediationJournalRecordSchema as Ar,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Cr,APPLICATION_DEPLOY_ORDER as Nr,APPLICATION_DESTROY_ORDER as yr,OPENNEXT_DEPLOY_ORDER as gr,OPENNEXT_DESTROY_ORDER as Ir,PARALLEL_DEPLOY_GROUPS as Lr,PARALLEL_DESTROY_GROUPS as xr,OPENNEXT_PARALLEL_GROUPS as hr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Fr,isOrganisationOperation as Mr,getParallelDeployGroups as Ur,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Wr,OPENNEXT_PATTERNS as Qr,STACK_NOT_FOUND_PATTERN as jr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as it,readStateFile as nt,writeStateFile as st,createEmptyState as ct,deleteStateFile as Et,updateTemplateHash as lt,getStateFilePath as St,regionSuffix as pt}from"./types/config/FjallState.js";import{readDomainState as Tt,writeDomainState as Rt,recordDomainDeployState as _t,deleteDomainState as At,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Ct,CdkProcessManager as Nt,ensureDependencyIntegrity as yt,clearDependencyIntegrityCache as gt,DEPENDENCY_SYNC_TIMEOUT_MS as It,CdkEventMonitor as Lt,startStackMonitoring as xt,DEFAULT_DEPLOY_TIMEOUT_MS as ht,isCdkError as vt,formatInfrastructureError as Ft,getStructuralHint as Mt,getSourceContext as Ut,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Wt,parseBuildPhase as Qt,buildStepContextBuildConfig as jt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as ao,DeploymentError as io,NetworkError as no,FileSystemError as so,ConfigError as co,toServiceError as Eo}from"./types/errors/index.js";import{filterDangerousEnvVars as So,maskSensitiveOutput as po,parseShellArgs as mo,sleep as To}from"@fjall/util";import{artefactOutputKey as _o,DeployModeSchema as Ao,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as Co}from"./util/sleepAbortable.js";import{createSequencedCallbacks as yo}from"./util/sequencedCallbacks.js";import{fileExists as Io}from"@fjall/util/fsHelpers";import{success as xo,failure as ho,isSuccess as vo,isFailure as Fo}from"@fjall/generator";import{deploy as Uo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{buildParamsContext as Vo}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Bo,emitWarningEvent as Ko}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Ho}from"./util/diagnosticScopes.js";import{restart as Jo,probeSecretsDrift as Wo,probeServiceDeploymentStatus as Qo,computeSecretsDrift as jo,deriveStaleParameters as Zo,extractConsumedSsmParameters as qo}from"./orchestration/index.js";import{partitionAccounts as $o,deployDomains as ea}from"./orchestration/index.js";import{buildRegionList as ta,buildAccountRegionPairs as oa,cascadeHomeRegion as aa,cascadeOperationKey as ia}from"./orchestration/index.js";import{projectScalarSummary as sa,projectAccountRows as ca}from"./orchestration/index.js";import{reconcileProviderAccounts as la,mergeReconciledProviderAccounts as Sa}from"./orchestration/index.js";import{decideNextTransition as ma,reconcileTrailMigration as Ta,decommissionMemberTrailStorage as Ra,ORG_TRAIL_BUCKET_OUTPUT_KEY as _a,TRAIL_BUCKET_OUTPUT_KEY as Aa,TRAIL_KEY_ARN_OUTPUT_KEY as da}from"./orchestration/index.js";import{classifyDriftFailure as Da,fetchLastOperationEvents as Pa,DriftProbe as Oa,probePhysicalPresence as fa,clearDriftSuspects as Ca,defaultDriftJournalDir as Na,readDriftSuspects as ya,recordDriftSuspects as ga,detectStackDrift as Ia,runDriftPreFlight as La,formatDriftPreFlightBlock as xa,DRIFT_PREFLIGHT_TRIGGER_STATUSES as ha,DRIFT_PREFLIGHT_BUDGET_MS as va,runRoute53RecordPreflight as Fa}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ua,computeRemediationOpId as ka,defaultRemediationJournalDir as ba,findRemediationJournalByOpId as Ya,listActiveRemediationOps as Va,listActiveRemediationOpsForContext as Ga,readRemediationJournal as Ba,sweepExpiredRemediationJournals as Ka,writeRemediationJournal as Xa,REMEDIATION_JOURNAL_RETENTION_DAYS as Ha,captureRemediationForensics as wa,defaultRemediationForensicsDir as Ja,applyRetainFlip as Wa,composeFlipCapabilities as Qa,computeTemplateDigest as ja,deriveRetainFlipTemplate as Za,findMarkedResourcesByOpId as qa,proveFlipMetadataOnly as za,readRetainFlipState as $a,verifyRetainFlipDiff as ei,FORGET_MARKER_KEY as ri,FORGET_FLIP_SPEC as ti,RECREATE_MARKER_KEY as oi,assessForgetResumability as ai,completeForgetAfterConverge as ii,completeForgetAfterDeploy as ni,formatRecreateInFlightCures as si,partitionPreFlightByRemediation as ci,runForgetSurgery as Ei,synthTemplateDeclaresResource as li,runRecreateSurgery as Si,snapshotPolicyForType as pi,SNAPSHOT_CAPABLE_RESOURCE_TYPES as mi,runRecreatePreFlight as Ti,deriveRemovalTemplate as Ri,findRemovalDeletionFailures as _i,findResourcesPresent as Ai,proveRemovalTargetsOnly as di,advertisableDriftVerbs as ui,buildDriftRepairTicket as Di,runDriftRepairGate as Pi,formatPinOutcomeDetail as Oi,pinProbeCoverage as fi,renderPinReportLines as Ci,runPinRemediation as Ni,captureLegacySurfaces as yi,decodeLegacyAnchor as gi,runIdentitySurfaceGate as Ii,collectIdentityPinCandidates as Li,degradedIdentityPinOutcomes as xi,renderIdentityPinReportLines as hi,runIdentityPinMigration as vi,composePostFailureRepairOffer as Fi,formatDriftRepairOffer as Mi,DriftRepairAvailableError as Ui,checkDeployPathStackAvailability as ki,isDeployPathBlockingStatus as bi,StackUnavailableError as Yi,assertLeaseBeforeStack as Vi,LeaseDeniedError as Gi}from"./orchestration/index.js";import{unlockBucket as Ki,unlockQueue as Xi}from"./orchestration/index.js";import{triageBucketPolicy as wi,isEnforceSslStatement as Ji,toResourcePolicyStatements as Wi,restoreBucketPolicy as Qi,synthesiseEnforceSslDocument as ji,ensureEnforceSsl as Zi,restoreAndReconcileQuarantinedBucket as qi}from"./orchestration/index.js";import{verifyOrgTrailDelivery as $i}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as rn,isRootTaskPolicyArn as tn,ROOT_TASK_POLICY_ARNS as on,MAX_ROOT_SESSION_SECONDS as an}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as sn,flattenAccountsToEnvironments as cn,extractAllAccountNames as En,accountsConfigToOUTree as ln,isStringArray as Sn,isAccountsConfig as pn,isOuOnlyAccountBucket as mn,OU_ONLY_ACCOUNT_BUCKETS as Tn}from"./orchestration/index.js";import{runOpenNextBuild as _n}from"./orchestration/index.js";import{runOrganisationSetup as dn,ORG_SETUP_PHASES as un}from"./orchestration/index.js";import{recordPhysicalName as Pn,parseRecordPhysicalName as On,recordSetKey as fn,deleteRecordSetsByKey as Cn,cascadeTakeoverDigestSeed as Nn,buildCascadeTakeoverTicket as yn,runCascadeTakeoverGate as gn,WorkerDomainDeployProvider as In,createWorkerDomainDeployProvider as Ln,createCascadeDomainProviderFactory as xn}from"./orchestration/index.js";import{assumeCascadeRole as vn}from"./orchestration/contextHelpers.js";import{DOMAIN_DELEGATION_ERROR_TYPES as Mn,DomainDelegationError as Un,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as kn,PUBLIC_DNS_QUERY_TIMEOUT_MS as bn,createPublicResolvers as Yn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Vn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Gn,waitForNsPropagation as Bn,ACM_CAA_ISSUERS as Kn,runCaaPreflight as Xn,deployDelegatedDomain as Hn,delegationRoleUnusableError as wn,deriveZonePhaseState as Jn,extractDelegationRoleArn as Wn,readDelegatedTopologyFromProps as Qn,readDomainStackOutputsByExport as jn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as Zn,templateOwnsDelegationRecord as qn,deleteChildNsFromParent as zn,nsDelegationPhysicalName as $n,runDelegatedDomainDestroy as es}from"./orchestration/index.js";import{classifyZoneRecords as ts,buildSatelliteRecordIndex as os,createSystemDnsNameProbe as as,systemDnsNameProbe as is,normaliseRecordName as ns,isRoute53NameServer as ss,isDelegatedToRoute53 as cs}from"./orchestration/index.js";import{resolveBuildSecrets as ls,resolveSecretRefValue as Ss,resolveBuildSecretSessionProvider as ps,sourcedRefsFromBuildArgs as ms,resolveBuildArgs as Ts,buildBuildSecretSessionPolicy as Rs,buildDeploySessionPolicy as _s,buildDomainSessionPolicy as As,partitionForRegion as ds,validateBuildGroup as us}from"./orchestration/index.js";import{FrameworkRegistry as Ps}from"./orchestration/index.js";import{openNextBuilder as fs,staticSiteBuilder as Cs,dockerBuilder as Ns}from"./orchestration/index.js";import{StepRegistry as gs,getDestroyStepId as Is}from"./steps/index.js";import{buildDeployPlan as xs,computeDeployPlan as hs,computeAssemblyDigest as vs,digestHead as Fs,classifyImpact as Ms,derivePropertyChanges as Us,isDataLoss as ks,isStatefulResourceType as bs,renderPlanSummary as Ys,renderPlanLines as Vs,summarisePlanRisk as Gs,toWirePlanChanges as Bs,signApprovalToken as Ks,verifyApprovalToken as Xs,DEFAULT_APPROVAL_TTL_MS as Hs,APPROVAL_TOKEN_PATTERN as ws,runApprovalGate as Js,approvalRefusalReason as Ws}from"./orchestration/index.js";import{runDestructionGate as js,buildDestructionTicket as Zs,evaluateDestructionConsents as qs,computeTicketDigest as zs,legalRemediationVerbs as $s,executableRemediationVerbs as ec,advertisableRemediationVerbs as rc,renderDestructionTicketLines as tc,renderConsentVerdictLines as oc,loadDeployPlan as ac,createMemoisedPlanLoader as ic}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as sc,classifyDeployFailure as cc,classifyFromEcsCompletion as Ec,classifyFromFailureAnalysis as lc,classifyUnclassified as Sc}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as mc,getDeploymentFailure as Tc}from"./orchestration/failure/deploymentFailureAttachment.js";export{Kn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Nr as APPLICATION_DEPLOY_ORDER,yr as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,ws as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,ao as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,S as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,Zn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Ct as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,Lt as CdkEventMonitor,Nt as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,co as ConfigError,Hs as DEFAULT_APPROVAL_TTL_MS,ht as DEFAULT_DEPLOY_TIMEOUT_MS,ve as DEFAULT_MAX_PAGES,kn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,It as DEPENDENCY_SYNC_TIMEOUT_MS,l as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,i as DEPLOYMENT_EVENT_TYPES,sc as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,F as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,x as DEPLOY_EVENT_ERROR_MESSAGE_MAX,y as DEPLOY_EVENT_ID_MAX,I as DEPLOY_EVENT_MESSAGE_MAX,g as DEPLOY_EVENT_NAME_MAX,v as DEPLOY_EVENT_OUTPUT_MAX,L as DEPLOY_EVENT_STATUS_REASON_MAX,h as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,Mn as DOMAIN_DELEGATION_ERROR_TYPES,va as DRIFT_PREFLIGHT_BUDGET_MS,ha as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,_ as DeployEventSchema,Ao as DeployModeSchema,d as DeployResourceSchema,io as DeploymentError,a as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,Un as DomainDelegationError,Er as DriftFindingSchema,lr as DriftJournalRecordSchema,Oa as DriftProbe,Ui as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Ho as ENGINE_DIAGNOSTIC_SCOPE,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,ti as FORGET_FLIP_SPEC,ri as FORGET_MARKER_KEY,so as FileSystemError,it as FjallStateFileSchema,Ps as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,Fe as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Gi as LeaseDeniedError,an as MAX_ROOT_SESSION_SECONDS,Gn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Vn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,gr as OPENNEXT_DEPLOY_ORDER,Ir as OPENNEXT_DESTROY_ORDER,hr as OPENNEXT_PARALLEL_GROUPS,Qr as OPENNEXT_PATTERNS,Cr as ORGANISATION_TYPES,un as ORG_SETUP_PHASES,_a as ORG_TRAIL_BUCKET_OUTPUT_KEY,Tn as OU_ONLY_ACCOUNT_BUCKETS,Lr as PARALLEL_DEPLOY_GROUPS,xr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Wt as PROGRESS_MESSAGES,bn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,oi as RECREATE_MARKER_KEY,Ha as REMEDIATION_JOURNAL_RETENTION_DAYS,mr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,on as ROOT_TASK_POLICY_ARNS,_r as RemediationFlipProofSchema,Ar as RemediationJournalRecordSchema,Tr as RemediationPhaseSchema,Rr as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,Te as SERVICE_PRINCIPALS,mi as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,jr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,Yi as StackUnavailableError,A as StepProgressSchema,gs as StepRegistry,or as TICKET_VERDICT_SOURCES,Aa as TRAIL_BUCKET_OUTPUT_KEY,da as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,ar as TicketVerdictSourceSchema,to as ValidationError,In as WorkerDomainDeployProvider,ln as accountsConfigToOUTree,ye as activateCostAllocationTags,_e as activateTrustedAccess,ui as advertisableDriftVerbs,rc as advertisableRemediationVerbs,Wa as applyRetainFlip,Ws as approvalRefusalReason,Ua as archiveCompletedRemediationJournal,_o as artefactOutputKey,Vi as assertLeaseBeforeStack,ai as assessForgetResumability,vn as assumeCascadeRole,rn as assumeRootForTask,mc as attachDeploymentFailure,oa as buildAccountRegionPairs,Ce as buildAccountToOUMap,Rs as buildBuildSecretSessionPolicy,yn as buildCascadeTakeoverTicket,xs as buildDeployPlan,_s as buildDeploySessionPolicy,Zs as buildDestructionTicket,As as buildDomainSessionPolicy,Di as buildDriftRepairTicket,Vo as buildParamsContext,ta as buildRegionList,os as buildSatelliteRecordIndex,jt as buildStepContextBuildConfig,ae as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,yi as captureLegacySurfaces,wa as captureRemediationForensics,aa as cascadeHomeRegion,ia as cascadeOperationKey,Nn as cascadeTakeoverDigestSeed,ki as checkDeployPathStackAvailability,ge as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,m as clampDeploymentEventStrings,cc as classifyDeployFailure,Da as classifyDriftFailure,Ec as classifyFromEcsCompletion,lc as classifyFromFailureAnalysis,Ms as classifyImpact,Sc as classifyUnclassified,ts as classifyZoneRecords,gt as clearDependencyIntegrityCache,Ca as clearDriftSuspects,Li as collectIdentityPinCandidates,ii as completeForgetAfterConverge,ni as completeForgetAfterDeploy,Qa as composeFlipCapabilities,Fi as composePostFailureRepairOffer,Le as composeSdkAbortSignal,vs as computeAssemblyDigest,hs as computeDeployPlan,ka as computeRemediationOpId,jo as computeSecretsDrift,ja as computeTemplateDigest,zs as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,xn as createCascadeDomainProviderFactory,j as createDeployEmitter,ct as createEmptyState,ic as createMemoisedPlanLoader,Yn as createPublicResolvers,yo as createSequencedCallbacks,as as createSystemDnsNameProbe,Ln as createWorkerDomainDeployProvider,ma as decideNextTransition,gi as decodeLegacyAnchor,Ra as decommissionMemberTrailStorage,Na as defaultDriftJournalDir,Ja as defaultRemediationForensicsDir,ba as defaultRemediationJournalDir,xi as degradedIdentityPinOutcomes,wn as delegationRoleUnusableError,zn as deleteChildNsFromParent,At as deleteDomainState,Cn as deleteRecordSetsByKey,Et as deleteStateFile,Uo as deploy,Hn as deployDelegatedDomain,ea as deployDomains,Us as derivePropertyChanges,Ri as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,Za as deriveRetainFlipTemplate,Zo as deriveStaleParameters,Jn as deriveZonePhaseState,Se as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,Ia as detectStackDrift,Fs as digestHead,Ns as dockerBuilder,Me as drainPages,Jt as emitProgress,Bo as emitStepWarnings,Ko as emitWarningEvent,Ye as enableCentralisedRootAccess,Ae as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Re as enableRamSharing,me as enableServiceAccess,yt as ensureDependencyIntegrity,Zi as ensureEnforceSsl,le as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,qs as evaluateDestructionConsents,ec as executableRemediationVerbs,En as extractAllAccountNames,qo as extractConsumedSsmParameters,Wn as extractDelegationRoleArn,xe as extractErrorName,ho as failure,Pa as fetchLastOperationEvents,Io as fileExists,So as filterDangerousEnvVars,De as findAccount,Ne as findDevelopmentOuId,qa as findMarkedResourcesByOpId,Ya as findRemediationJournalByOpId,_i as findRemovalDeletionFailures,Ai as findResourcesPresent,cn as flattenAccountsToEnvironments,xa as formatDriftPreFlightBlock,Mi as formatDriftRepairOffer,Ft as formatInfrastructureError,Oi as formatPinOutcomeDetail,si as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,Tc as getDeploymentFailure,Is as getDestroyStepId,Gr as getOrganisationStackName,Ur as getParallelDeployGroups,kr as getParallelDestroyGroups,Ut as getSourceContext,St as getStateFilePath,Mt as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,he as isAborted,pn as isAccountsConfig,Fr as isApplicationOperation,Br as isApplicationStack,vt as isCdkError,ks as isDataLoss,cs as isDelegatedToRoute53,bi as isDeployPathBlockingStatus,Ji as isEnforceSslStatement,Fo as isFailure,Ue as isOULeaf,Wr as isOpenNextPattern,Mr as isOrganisationOperation,mn as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,tn as isRootTaskPolicyArn,ss as isRoute53NameServer,bs as isStatefulResourceType,Sn as isStringArray,vo as isSuccess,$s as legalRemediationVerbs,ue as listAccounts,Va as listActiveRemediationOps,Ga as listActiveRemediationOpsForContext,ac as loadDeployPlan,po as maskSensitiveOutput,Sa as mergeReconciledProviderAccounts,ns as normaliseRecordName,$n as nsDelegationPhysicalName,fs as openNextBuilder,sn as parseAccountsConfiguration,Qt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,On as parseRecordPhysicalName,mo as parseShellArgs,$o as partitionAccounts,ds as partitionForRegion,ci as partitionPreFlightByRemediation,fi as pinProbeCoverage,fe as placeAccountsInOUs,ie as probeAccountStackExists,fa as probePhysicalPresence,Wo as probeSecretsDrift,Qo as probeServiceDeploymentStatus,ca as projectAccountRows,sa as projectScalarSummary,za as proveFlipMetadataOnly,di as proveRemovalTargetsOnly,Qn as readDelegatedTopologyFromProps,jn as readDomainStackOutputsByExport,Tt as readDomainState,ya as readDriftSuspects,Ba as readRemediationJournal,$a as readRetainFlipState,nt as readStateFile,la as reconcileProviderAccounts,Ta as reconcileTrailMigration,_t as recordDomainDeployState,ga as recordDriftSuspects,Pn as recordPhysicalName,fn as recordSetKey,ce as regionDisabledMessage,pt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,oc as renderConsentVerdictLines,tc as renderDestructionTicketLines,hi as renderIdentityPinReportLines,Ci as renderPinReportLines,Vs as renderPlanLines,Ys as renderPlanSummary,Ts as resolveBuildArgs,ps as resolveBuildSecretSessionProvider,ls as resolveBuildSecrets,Ss as resolveSecretRefValue,Jo as restart,qi as restoreAndReconcileQuarantinedBucket,Qi as restoreBucketPolicy,Js as runApprovalGate,Xn as runCaaPreflight,gn as runCascadeTakeoverGate,es as runDelegatedDomainDestroy,js as runDestructionGate,La as runDriftPreFlight,Pi as runDriftRepairGate,Ei as runForgetSurgery,vi as runIdentityPinMigration,Ii as runIdentitySurfaceGate,_n as runOpenNextBuild,dn as runOrganisationSetup,Ni as runPinRemediation,Ti as runRecreatePreFlight,Si as runRecreateSurgery,Fa as runRoute53RecordPreflight,Ks as signApprovalToken,To as sleep,Co as sleepAbortable,Ie as snapshotIdentityCentre,pi as snapshotPolicyForType,ms as sourcedRefsFromBuildArgs,xt as startStackMonitoring,Cs as staticSiteBuilder,rt as stubCallerIdentity,xo as success,Gs as summarisePlanRisk,Ka as sweepExpiredRemediationJournals,li as synthTemplateDeclaresResource,ji as synthesiseEnforceSslDocument,is as systemDnsNameProbe,qn as templateOwnsDelegationRecord,Jr as toPascalCase,Wi as toResourcePolicyStatements,Eo as toServiceError,Bs as toWirePlanChanges,wi as triageBucketPolicy,T as truncateUtf16Safe,Ki as unlockBucket,Xi as unlockQueue,de as updateBackupGlobalSettings,lt as updateTemplateHash,us as validateBuildGroup,Sr as verbsForDriftVerdict,Xs as verifyApprovalToken,$i as verifyOrgTrailDelivery,ei as verifyRetainFlipDiff,Bn as waitForNsPropagation,et as wrapApplicationError,Rt as writeDomainState,Xa as writeRemediationJournal,st as writeStateFile};
+import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as a,DEPLOYMENT_EVENT_TYPES as i,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as c,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as E,DEPLOYMENT_ERROR_MESSAGE_MAX as l,CASCADE_PHASES as S,CASCADE_ACCOUNT_STATUSES as p,clampDeploymentEventStrings as m,truncateUtf16Safe as R}from"./types/index.js";import{DeployEventSchema as _,StepProgressSchema as A,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as y,DEPLOY_EVENT_NAME_MAX as I,DEPLOY_EVENT_MESSAGE_MAX as g,DEPLOY_EVENT_STATUS_REASON_MAX as L,DEPLOY_EVENT_ERROR_MESSAGE_MAX as x,DEPLOY_EVENT_TRAIL_DETAIL_MAX as h,DEPLOY_EVENT_OUTPUT_MAX as F,DEPLOY_EVENT_ARN_MAX as v,DEPLOY_EVENT_URL_MAX as M,STEP_COMPLETE_STATUSES as U,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as W,ALL_PROGRESS_KINDS as Q,createDeployEmitter as j,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ae,probeAccountStackExists as ie}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as ce}from"./aws/index.js";import{ensureOrganisationExists as le,describeOrganisation as Se,enablePolicyTypes as pe,enableServiceAccess as me,SERVICE_PRINCIPALS as Re,enableRamSharing as Te,activateTrustedAccess as _e,enableIpamDelegatedAdmin as Ae,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as ye,checkIdentityCentreStatus as Ie,snapshotIdentityCentre as ge,composeSdkAbortSignal as Le,extractErrorName as xe,isAborted as he,DEFAULT_MAX_PAGES as Fe,IDENTITY_STORE_PAGE_SIZE as ve,drainPages as Me,isOULeaf as Ue,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as We,REMEDIATION_VERB_GLOSS as Qe,IDENTITY_PIN_SLOT_SWAP_GLOSS as je,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ar}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as cr,DriftFindingSchema as Er,DriftJournalRecordSchema as lr,verbsForDriftVerdict as Sr}from"./types/index.js";import{REMEDIATION_PHASES as mr,RemediationPhaseSchema as Rr,RemediationTargetSchema as Tr,RemediationFlipProofSchema as _r,RemediationJournalRecordSchema as Ar,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{APPLICATION_STACKS as fr,ORGANISATION_TYPES as Cr,APPLICATION_DEPLOY_ORDER as Nr,APPLICATION_DESTROY_ORDER as yr,FULL_APPLICATION_DESTROY_ORDER as Ir,OPENNEXT_DEPLOY_ORDER as gr,OPENNEXT_DESTROY_ORDER as Lr,PARALLEL_DEPLOY_GROUPS as xr,PARALLEL_DESTROY_GROUPS as hr,OPENNEXT_PARALLEL_GROUPS as Fr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Mr,isOrganisationOperation as Ur,getParallelDeployGroups as kr,getParallelDestroyGroups as br,getApplicationDeployOrder as Yr,getApplicationDestroyOrder as Vr,getApplicationStackName as Gr,getOrganisationStackName as Br,isApplicationStack as Kr,isQuarantineDetail as Xr,isRetainedBucketsDetail as Hr,getApplicationStepName as wr,getApplicationStepId as Jr,toPascalCase as Wr,isOpenNextPattern as Qr,OPENNEXT_PATTERNS as jr,STACK_NOT_FOUND_PATTERN as Zr,STACK_FAILED_STATE_PATTERN as qr,CDK_NO_STACKS_MATCH as zr,INFRASTRUCTURE_FILENAME as $r,ApplicationError as et,wrapApplicationError as rt,stubCallerIdentity as tt}from"./types/index.js";import{deriveResourcesFromManifestStacks as at}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as nt,readStateFile as st,writeStateFile as ct,createEmptyState as Et,deleteStateFile as lt,updateTemplateHash as St,getStateFilePath as pt,regionSuffix as mt}from"./types/config/FjallState.js";import{readDomainState as Tt,writeDomainState as _t,recordDomainDeployState as At,deleteDomainState as dt,hashDomainDirectory as ut,LEGACY_DOMAIN_STATE_FILENAME as Dt}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Ot}from"./aws/index.js";import{CdkService as Ct,CdkArgumentBuilder as Nt,CdkProcessManager as yt,ensureDependencyIntegrity as It,clearDependencyIntegrityCache as gt,DEPENDENCY_SYNC_TIMEOUT_MS as Lt,CdkEventMonitor as xt,startStackMonitoring as ht,DEFAULT_DEPLOY_TIMEOUT_MS as Ft,isCdkError as vt,formatInfrastructureError as Mt,getStructuralHint as Ut,getSourceContext as kt,hasCdkDifferences as bt,parseDiffOutput as Yt,CloudFormationService as Vt,CloudFormationError as Gt,EcsService as Bt,EcsError as Kt,EcsServiceResolver as Xt,TemplateHashService as Ht,TemplateHashError as wt,CdkContextBuilder as Jt,emitProgress as Wt,PROGRESS_MESSAGES as Qt,parseBuildPhase as jt,buildStepContextBuildConfig as Zt,convertCloudFormationOutputsToRecord as qt,ApplicationStackService as zt}from"./services/index.js";import{CdkError as eo}from"./types/errors/index.js";import{BaseServiceError as to,ValidationError as oo,AuthError as ao,AwsError as io,DeploymentError as no,NetworkError as so,FileSystemError as co,ConfigError as Eo,toServiceError as lo}from"./types/errors/index.js";import{filterDangerousEnvVars as po,maskSensitiveOutput as mo,parseShellArgs as Ro,sleep as To}from"@fjall/util";import{artefactOutputKey as Ao,DeployModeSchema as uo,ServiceArtefactSchema as Do,ServiceArtefactsSchema as Po}from"@fjall/util";import{hasDockerfile as fo}from"./util/dockerfileDetection.js";import{sleepAbortable as No}from"./util/sleepAbortable.js";import{createSequencedCallbacks as Io}from"./util/sequencedCallbacks.js";import{fileExists as Lo}from"@fjall/util/fsHelpers";import{success as ho,failure as Fo,isSuccess as vo,isFailure as Mo}from"@fjall/generator";import{deploy as ko}from"./orchestration/index.js";import{destroy as Yo}from"./orchestration/index.js";import{destroyApplicationDirect as Go}from"./orchestration/index.js";import{buildParamsContext as Ko}from"./orchestration/contextHelpers.js";import{emitStepWarnings as Ho,emitWarningEvent as wo}from"./orchestration/contextHelpers.js";import{ENGINE_DIAGNOSTIC_SCOPE as Wo}from"./util/diagnosticScopes.js";import{restart as jo,probeSecretsDrift as Zo,probeServiceDeploymentStatus as qo,computeSecretsDrift as zo,deriveStaleParameters as $o,extractConsumedSsmParameters as ea}from"./orchestration/index.js";import{partitionAccounts as ta,deployDomains as oa}from"./orchestration/index.js";import{buildRegionList as ia,buildAccountRegionPairs as na,cascadeHomeRegion as sa,cascadeOperationKey as ca}from"./orchestration/index.js";import{projectScalarSummary as la,projectAccountRows as Sa}from"./orchestration/index.js";import{reconcileProviderAccounts as ma,mergeReconciledProviderAccounts as Ra}from"./orchestration/index.js";import{decideNextTransition as _a,reconcileTrailMigration as Aa,decommissionMemberTrailStorage as da,ORG_TRAIL_BUCKET_OUTPUT_KEY as ua,TRAIL_BUCKET_OUTPUT_KEY as Da,TRAIL_KEY_ARN_OUTPUT_KEY as Pa}from"./orchestration/index.js";import{classifyDriftFailure as fa,fetchLastOperationEvents as Ca,DriftProbe as Na,probePhysicalPresence as ya,clearDriftSuspects as Ia,defaultDriftJournalDir as ga,readDriftSuspects as La,recordDriftSuspects as xa,detectStackDrift as ha,runDriftPreFlight as Fa,formatDriftPreFlightBlock as va,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Ma,DRIFT_PREFLIGHT_BUDGET_MS as Ua,runRoute53RecordPreflight as ka}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ya,computeRemediationOpId as Va,defaultRemediationJournalDir as Ga,findRemediationJournalByOpId as Ba,listActiveRemediationOps as Ka,listActiveRemediationOpsForContext as Xa,readRemediationJournal as Ha,sweepExpiredRemediationJournals as wa,writeRemediationJournal as Ja,REMEDIATION_JOURNAL_RETENTION_DAYS as Wa,captureRemediationForensics as Qa,defaultRemediationForensicsDir as ja,applyRetainFlip as Za,composeFlipCapabilities as qa,computeTemplateDigest as za,deriveRetainFlipTemplate as $a,findMarkedResourcesByOpId as ei,proveFlipMetadataOnly as ri,readRetainFlipState as ti,verifyRetainFlipDiff as oi,FORGET_MARKER_KEY as ai,FORGET_FLIP_SPEC as ii,RECREATE_MARKER_KEY as ni,assessForgetResumability as si,completeForgetAfterConverge as ci,completeForgetAfterDeploy as Ei,formatRecreateInFlightCures as li,partitionPreFlightByRemediation as Si,runForgetSurgery as pi,synthTemplateDeclaresResource as mi,runRecreateSurgery as Ri,snapshotPolicyForType as Ti,SNAPSHOT_CAPABLE_RESOURCE_TYPES as _i,runRecreatePreFlight as Ai,deriveRemovalTemplate as di,findRemovalDeletionFailures as ui,findResourcesPresent as Di,proveRemovalTargetsOnly as Pi,advertisableDriftVerbs as Oi,buildDriftRepairTicket as fi,runDriftRepairGate as Ci,formatPinOutcomeDetail as Ni,pinProbeCoverage as yi,renderPinReportLines as Ii,runPinRemediation as gi,captureLegacySurfaces as Li,decodeLegacyAnchor as xi,runIdentitySurfaceGate as hi,collectIdentityPinCandidates as Fi,degradedIdentityPinOutcomes as vi,renderIdentityPinReportLines as Mi,runIdentityPinMigration as Ui,composePostFailureRepairOffer as ki,formatDriftRepairOffer as bi,DriftRepairAvailableError as Yi,checkDeployPathStackAvailability as Vi,isDeployPathBlockingStatus as Gi,StackUnavailableError as Bi,assertLeaseBeforeStack as Ki,LeaseDeniedError as Xi}from"./orchestration/index.js";import{unlockBucket as wi,unlockQueue as Ji}from"./orchestration/index.js";import{triageBucketPolicy as Qi,isEnforceSslStatement as ji,toResourcePolicyStatements as Zi,restoreBucketPolicy as qi,synthesiseEnforceSslDocument as zi,ensureEnforceSsl as $i,restoreAndReconcileQuarantinedBucket as en}from"./orchestration/index.js";import{verifyOrgTrailDelivery as tn}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as an,isRootTaskPolicyArn as nn,ROOT_TASK_POLICY_ARNS as sn,MAX_ROOT_SESSION_SECONDS as cn}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as ln,flattenAccountsToEnvironments as Sn,extractAllAccountNames as pn,accountsConfigToOUTree as mn,isStringArray as Rn,isAccountsConfig as Tn,isOuOnlyAccountBucket as _n,OU_ONLY_ACCOUNT_BUCKETS as An}from"./orchestration/index.js";import{runOpenNextBuild as un}from"./orchestration/index.js";import{runOrganisationSetup as Pn,ORG_SETUP_PHASES as On}from"./orchestration/index.js";import{recordPhysicalName as Cn,parseRecordPhysicalName as Nn,recordSetKey as yn,deleteRecordSetsByKey as In,cascadeTakeoverDigestSeed as gn,buildCascadeTakeoverTicket as Ln,runCascadeTakeoverGate as xn,WorkerDomainDeployProvider as hn,createWorkerDomainDeployProvider as Fn,createCascadeDomainProviderFactory as vn}from"./orchestration/index.js";import{assumeCascadeRole as Un}from"./orchestration/contextHelpers.js";import{DOMAIN_DELEGATION_ERROR_TYPES as bn,DomainDelegationError as Yn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as Vn,PUBLIC_DNS_QUERY_TIMEOUT_MS as Gn,createPublicResolvers as Bn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Kn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Xn,waitForNsPropagation as Hn,ACM_CAA_ISSUERS as wn,runCaaPreflight as Jn,deployDelegatedDomain as Wn,delegationRoleUnusableError as Qn,deriveZonePhaseState as jn,extractDelegationRoleArn as Zn,readDelegatedTopologyFromProps as qn,readDomainStackOutputsByExport as zn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as $n,templateOwnsDelegationRecord as es,deleteChildNsFromParent as rs,nsDelegationPhysicalName as ts,runDelegatedDomainDestroy as os}from"./orchestration/index.js";import{classifyZoneRecords as is,buildSatelliteRecordIndex as ns,createSystemDnsNameProbe as ss,systemDnsNameProbe as cs,normaliseRecordName as Es,isRoute53NameServer as ls,isDelegatedToRoute53 as Ss}from"./orchestration/index.js";import{resolveBuildSecrets as ms,resolveSecretRefValue as Rs,resolveBuildSecretSessionProvider as Ts,sourcedRefsFromBuildArgs as _s,resolveBuildArgs as As,buildBuildSecretSessionPolicy as ds,buildDeploySessionPolicy as us,buildDomainSessionPolicy as Ds,partitionForRegion as Ps,validateBuildGroup as Os}from"./orchestration/index.js";import{FrameworkRegistry as Cs}from"./orchestration/index.js";import{openNextBuilder as ys,staticSiteBuilder as Is,dockerBuilder as gs}from"./orchestration/index.js";import{StepRegistry as xs,getDestroyStepId as hs}from"./steps/index.js";import{buildDeployPlan as vs,computeDeployPlan as Ms,computeAssemblyDigest as Us,digestHead as ks,classifyImpact as bs,derivePropertyChanges as Ys,isDataLoss as Vs,isStatefulResourceType as Gs,renderPlanSummary as Bs,renderPlanLines as Ks,summarisePlanRisk as Xs,toWirePlanChanges as Hs,signApprovalToken as ws,verifyApprovalToken as Js,DEFAULT_APPROVAL_TTL_MS as Ws,APPROVAL_TOKEN_PATTERN as Qs,runApprovalGate as js,approvalRefusalReason as Zs}from"./orchestration/index.js";import{runDestructionGate as zs,buildDestructionTicket as $s,evaluateDestructionConsents as ec,computeTicketDigest as rc,legalRemediationVerbs as tc,executableRemediationVerbs as oc,advertisableRemediationVerbs as ac,renderDestructionTicketLines as ic,renderConsentVerdictLines as nc,loadDeployPlan as sc,createMemoisedPlanLoader as cc}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as lc,classifyDeployFailure as Sc,classifyFromEcsCompletion as pc,classifyFromFailureAnalysis as mc,classifyUnclassified as Rc}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as _c,getDeploymentFailure as Ac}from"./orchestration/failure/deploymentFailureAttachment.js";export{wn as ACM_CAA_ISSUERS,Q as ALL_PROGRESS_KINDS,Nr as APPLICATION_DEPLOY_ORDER,yr as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,W as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Qs as APPROVAL_TOKEN_PATTERN,et as ApplicationError,zt as ApplicationStackService,ao as AuthError,io as AwsError,K as BUILDERS,to as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,p as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,S as CASCADE_PHASES,zr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,$n as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Nt as CdkArgumentBuilder,Jt as CdkContextBuilder,eo as CdkError,xt as CdkEventMonitor,yt as CdkProcessManager,Ct as CdkService,P as ChangeCountsSchema,Gt as CloudFormationError,Ot as CloudFormationEventMonitor,Vt as CloudFormationService,Eo as ConfigError,Ws as DEFAULT_APPROVAL_TTL_MS,Ft as DEFAULT_DEPLOY_TIMEOUT_MS,Fe as DEFAULT_MAX_PAGES,Vn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,Lt as DEPENDENCY_SYNC_TIMEOUT_MS,l as DEPLOYMENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,E as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,i as DEPLOYMENT_EVENT_TYPES,lc as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,v as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,x as DEPLOY_EVENT_ERROR_MESSAGE_MAX,y as DEPLOY_EVENT_ID_MAX,g as DEPLOY_EVENT_MESSAGE_MAX,I as DEPLOY_EVENT_NAME_MAX,F as DEPLOY_EVENT_OUTPUT_MAX,L as DEPLOY_EVENT_STATUS_REASON_MAX,h as DEPLOY_EVENT_TRAIL_DETAIL_MAX,M as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,bn as DOMAIN_DELEGATION_ERROR_TYPES,Ua as DRIFT_PREFLIGHT_BUDGET_MS,Ma as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,_ as DeployEventSchema,uo as DeployModeSchema,d as DeployResourceSchema,no as DeploymentError,a as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,Yn as DomainDelegationError,Er as DriftFindingSchema,lr as DriftJournalRecordSchema,Na as DriftProbe,Yi as DriftRepairAvailableError,cr as DriftSuspectSchema,sr as DriftVerdictSchema,Wo as ENGINE_DIAGNOSTIC_SCOPE,Kt as EcsError,Bt as EcsService,Xt as EcsServiceResolver,ii as FORGET_FLIP_SPEC,ai as FORGET_MARKER_KEY,Ir as FULL_APPLICATION_DESTROY_ORDER,co as FileSystemError,nt as FjallStateFileSchema,Cs as FrameworkRegistry,je as IDENTITY_PIN_SLOT_SWAP_GLOSS,ve as IDENTITY_STORE_PAGE_SIZE,$r as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,Dt as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,Xi as LeaseDeniedError,cn as MAX_ROOT_SESSION_SECONDS,Xn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Kn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,so as NetworkError,gr as OPENNEXT_DEPLOY_ORDER,Lr as OPENNEXT_DESTROY_ORDER,Fr as OPENNEXT_PARALLEL_GROUPS,jr as OPENNEXT_PATTERNS,Cr as ORGANISATION_TYPES,On as ORG_SETUP_PHASES,ua as ORG_TRAIL_BUCKET_OUTPUT_KEY,An as OU_ONLY_ACCOUNT_BUCKETS,xr as PARALLEL_DEPLOY_GROUPS,hr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Qt as PROGRESS_MESSAGES,Gn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,ni as RECREATE_MARKER_KEY,Wa as REMEDIATION_JOURNAL_RETENTION_DAYS,mr as REMEDIATION_PHASES,Qe as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,sn as ROOT_TASK_POLICY_ARNS,_r as RemediationFlipProofSchema,Ar as RemediationJournalRecordSchema,Rr as RemediationPhaseSchema,Tr as RemediationTargetSchema,We as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,Re as SERVICE_PRINCIPALS,_i as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,qr as STACK_FAILED_STATE_PATTERN,Zr as STACK_NOT_FOUND_PATTERN,U as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,Do as ServiceArtefactSchema,Po as ServiceArtefactsSchema,$ as SimpleAwsProvider,Bi as StackUnavailableError,A as StepProgressSchema,xs as StepRegistry,or as TICKET_VERDICT_SOURCES,Da as TRAIL_BUCKET_OUTPUT_KEY,Pa as TRAIL_KEY_ARN_OUTPUT_KEY,wt as TemplateHashError,Ht as TemplateHashService,ar as TicketVerdictSourceSchema,oo as ValidationError,hn as WorkerDomainDeployProvider,mn as accountsConfigToOUTree,ye as activateCostAllocationTags,_e as activateTrustedAccess,Oi as advertisableDriftVerbs,ac as advertisableRemediationVerbs,Za as applyRetainFlip,Zs as approvalRefusalReason,Ya as archiveCompletedRemediationJournal,Ao as artefactOutputKey,Ki as assertLeaseBeforeStack,si as assessForgetResumability,Un as assumeCascadeRole,an as assumeRootForTask,_c as attachDeploymentFailure,na as buildAccountRegionPairs,Ce as buildAccountToOUMap,ds as buildBuildSecretSessionPolicy,Ln as buildCascadeTakeoverTicket,vs as buildDeployPlan,us as buildDeploySessionPolicy,$s as buildDestructionTicket,Ds as buildDomainSessionPolicy,fi as buildDriftRepairTicket,Ko as buildParamsContext,ia as buildRegionList,ns as buildSatelliteRecordIndex,Zt as buildStepContextBuildConfig,ae as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Li as captureLegacySurfaces,Qa as captureRemediationForensics,sa as cascadeHomeRegion,ca as cascadeOperationKey,gn as cascadeTakeoverDigestSeed,Vi as checkDeployPathStackAvailability,Ie as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,m as clampDeploymentEventStrings,Sc as classifyDeployFailure,fa as classifyDriftFailure,pc as classifyFromEcsCompletion,mc as classifyFromFailureAnalysis,bs as classifyImpact,Rc as classifyUnclassified,is as classifyZoneRecords,gt as clearDependencyIntegrityCache,Ia as clearDriftSuspects,Fi as collectIdentityPinCandidates,ci as completeForgetAfterConverge,Ei as completeForgetAfterDeploy,qa as composeFlipCapabilities,ki as composePostFailureRepairOffer,Le as composeSdkAbortSignal,Us as computeAssemblyDigest,Ms as computeDeployPlan,Va as computeRemediationOpId,zo as computeSecretsDrift,za as computeTemplateDigest,rc as computeTicketDigest,qt as convertCloudFormationOutputsToRecord,Pe as createAccount,vn as createCascadeDomainProviderFactory,j as createDeployEmitter,Et as createEmptyState,cc as createMemoisedPlanLoader,Bn as createPublicResolvers,Io as createSequencedCallbacks,ss as createSystemDnsNameProbe,Fn as createWorkerDomainDeployProvider,_a as decideNextTransition,xi as decodeLegacyAnchor,da as decommissionMemberTrailStorage,ga as defaultDriftJournalDir,ja as defaultRemediationForensicsDir,Ga as defaultRemediationJournalDir,vi as degradedIdentityPinOutcomes,Qn as delegationRoleUnusableError,rs as deleteChildNsFromParent,dt as deleteDomainState,In as deleteRecordSetsByKey,lt as deleteStateFile,ko as deploy,Wn as deployDelegatedDomain,oa as deployDomains,Ys as derivePropertyChanges,di as deriveRemovalTemplate,at as deriveResourcesFromManifestStacks,$a as deriveRetainFlipTemplate,$o as deriveStaleParameters,jn as deriveZonePhaseState,Se as describeOrganisation,te as describeTargetReadinessReason,Yo as destroy,Go as destroyApplicationDirect,ha as detectStackDrift,ks as digestHead,gs as dockerBuilder,Me as drainPages,Wt as emitProgress,Ho as emitStepWarnings,wo as emitWarningEvent,Ye as enableCentralisedRootAccess,Ae as enableIpamDelegatedAdmin,pe as enablePolicyTypes,Te as enableRamSharing,me as enableServiceAccess,It as ensureDependencyIntegrity,$i as ensureEnforceSsl,le as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,ec as evaluateDestructionConsents,oc as executableRemediationVerbs,pn as extractAllAccountNames,ea as extractConsumedSsmParameters,Zn as extractDelegationRoleArn,xe as extractErrorName,Fo as failure,Ca as fetchLastOperationEvents,Lo as fileExists,po as filterDangerousEnvVars,De as findAccount,Ne as findDevelopmentOuId,ei as findMarkedResourcesByOpId,Ba as findRemediationJournalByOpId,ui as findRemovalDeletionFailures,Di as findResourcesPresent,Sn as flattenAccountsToEnvironments,va as formatDriftPreFlightBlock,bi as formatDriftRepairOffer,Mt as formatInfrastructureError,Ni as formatPinOutcomeDetail,li as formatRecreateInFlightCures,Yr as getApplicationDeployOrder,Vr as getApplicationDestroyOrder,Gr as getApplicationStackName,Jr as getApplicationStepId,wr as getApplicationStepName,Ac as getDeploymentFailure,hs as getDestroyStepId,Br as getOrganisationStackName,kr as getParallelDeployGroups,br as getParallelDestroyGroups,kt as getSourceContext,pt as getStateFilePath,Ut as getStructuralHint,bt as hasCdkDifferences,fo as hasDockerfile,ut as hashDomainDirectory,he as isAborted,Tn as isAccountsConfig,Mr as isApplicationOperation,Kr as isApplicationStack,vt as isCdkError,Vs as isDataLoss,Ss as isDelegatedToRoute53,Gi as isDeployPathBlockingStatus,ji as isEnforceSslStatement,Mo as isFailure,Ue as isOULeaf,Qr as isOpenNextPattern,Ur as isOrganisationOperation,_n as isOuOnlyAccountBucket,Xr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Hr as isRetainedBucketsDetail,nn as isRootTaskPolicyArn,ls as isRoute53NameServer,Gs as isStatefulResourceType,Rn as isStringArray,vo as isSuccess,tc as legalRemediationVerbs,ue as listAccounts,Ka as listActiveRemediationOps,Xa as listActiveRemediationOpsForContext,sc as loadDeployPlan,mo as maskSensitiveOutput,Ra as mergeReconciledProviderAccounts,Es as normaliseRecordName,ts as nsDelegationPhysicalName,ys as openNextBuilder,ln as parseAccountsConfiguration,jt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,Yt as parseDiffOutput,Nn as parseRecordPhysicalName,Ro as parseShellArgs,ta as partitionAccounts,Ps as partitionForRegion,Si as partitionPreFlightByRemediation,yi as pinProbeCoverage,fe as placeAccountsInOUs,ie as probeAccountStackExists,ya as probePhysicalPresence,Zo as probeSecretsDrift,qo as probeServiceDeploymentStatus,Sa as projectAccountRows,la as projectScalarSummary,ri as proveFlipMetadataOnly,Pi as proveRemovalTargetsOnly,qn as readDelegatedTopologyFromProps,zn as readDomainStackOutputsByExport,Tt as readDomainState,La as readDriftSuspects,Ha as readRemediationJournal,ti as readRetainFlipState,st as readStateFile,ma as reconcileProviderAccounts,Aa as reconcileTrailMigration,At as recordDomainDeployState,xa as recordDriftSuspects,Cn as recordPhysicalName,yn as recordSetKey,ce as regionDisabledMessage,mt as regionSuffix,ke as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,nc as renderConsentVerdictLines,ic as renderDestructionTicketLines,Mi as renderIdentityPinReportLines,Ii as renderPinReportLines,Ks as renderPlanLines,Bs as renderPlanSummary,As as resolveBuildArgs,Ts as resolveBuildSecretSessionProvider,ms as resolveBuildSecrets,Rs as resolveSecretRefValue,jo as restart,en as restoreAndReconcileQuarantinedBucket,qi as restoreBucketPolicy,js as runApprovalGate,Jn as runCaaPreflight,xn as runCascadeTakeoverGate,os as runDelegatedDomainDestroy,zs as runDestructionGate,Fa as runDriftPreFlight,Ci as runDriftRepairGate,pi as runForgetSurgery,Ui as runIdentityPinMigration,hi as runIdentitySurfaceGate,un as runOpenNextBuild,Pn as runOrganisationSetup,gi as runPinRemediation,Ai as runRecreatePreFlight,Ri as runRecreateSurgery,ka as runRoute53RecordPreflight,ws as signApprovalToken,To as sleep,No as sleepAbortable,ge as snapshotIdentityCentre,Ti as snapshotPolicyForType,_s as sourcedRefsFromBuildArgs,ht as startStackMonitoring,Is as staticSiteBuilder,tt as stubCallerIdentity,ho as success,Xs as summarisePlanRisk,wa as sweepExpiredRemediationJournals,mi as synthTemplateDeclaresResource,zi as synthesiseEnforceSslDocument,cs as systemDnsNameProbe,es as templateOwnsDelegationRecord,Wr as toPascalCase,Zi as toResourcePolicyStatements,lo as toServiceError,Hs as toWirePlanChanges,Qi as triageBucketPolicy,R as truncateUtf16Safe,wi as unlockBucket,Ji as unlockQueue,de as updateBackupGlobalSettings,St as updateTemplateHash,Os as validateBuildGroup,Sr as verbsForDriftVerdict,Js as verifyApprovalToken,tn as verifyOrgTrailDelivery,oi as verifyRetainFlipDiff,Hn as waitForNsPropagation,rt as wrapApplicationError,_t as writeDomainState,Ja as writeRemediationJournal,ct as writeStateFile};

package/dist/src/orchestration/application/applicationDeploy.d.ts

@@ -10,7 +10,7 @@ import type { DeployServices } from "../serviceFactory.js";
  * callback or the operation touches no stacks (fully skipped re-run).
  * Shared by the deploy and destroy legs (F-X7) — one emission contract.
  */
-export declare function emitStackTargets(callbacks: DeployParams["callbacks"], services: DeployServices, stackNames: readonly string[]): void;
+export declare function emitStackTargets(callbacks: DeployParams["callbacks"], services: Pick<DeployServices, "awsProvider">, stackNames: readonly string[]): void;
 /**
  * Core application deployment orchestration.
  *

package/dist/src/orchestration/application/directDestroy.d.ts

@@ -0,0 +1,47 @@
+import { type Result } from "@fjall/generator";
+import type { DeployCallbacks } from "../../types/callbacks.js";
+import type { AwsCredentials } from "../../types/credentials.js";
+import type { DestroyResult } from "../../types/params.js";
+export interface DirectDestroyParams {
+    /** Application name as deployed (stack names derive from it). */
+    appName: string;
+    /** AWS credentials for the operation. deploy-core never resolves these itself. */
+    awsCredentials: AwsCredentials;
+    /** Typed callbacks for progress events. CLI and worker implement differently. */
+    callbacks: DeployCallbacks;
+    abortSignal?: AbortSignal;
+    options?: {
+        /** Skip the active-deployment guard (matches DestroyOptions.force). */
+        force?: boolean;
+        /**
+         * Per-stack deletion wait budget. Defaults to 60 minutes — Aurora
+         * clusters resuming from auto-pause before they delete routinely need
+         * far more than the CloudFormationService 10-minute default.
+         */
+        stackTimeoutMs?: number;
+    };
+}
+/**
+ * Destroy an application's stacks directly via the CloudFormation API — no
+ * synth, no materialised workspace, no CDK subprocess.
+ *
+ * CloudFormation deletes a stack using the template it already holds, so the
+ * `cdk destroy` lane's validation synth exists only to satisfy the CDK CLI's
+ * `--app` requirement. This lane removes that requirement entirely: callers
+ * that have no application source in hand (the webapp's dev-substrate destroy
+ * worker) probe the full candidate stack set and delete what exists, in the
+ * same dependency order the CDK lane uses. It also handles stacks the CDK
+ * lane cannot: DeleteStack succeeds on DELETE_FAILED and REVIEW_IN_PROGRESS
+ * stacks.
+ *
+ * Behavioural parity with `destroyApplication` is deliberate, step for step:
+ * active-deployment guard → stack-target emission (the reconciler needs the
+ * target set persisted before the first DeleteStack) → destroy pre-flight
+ * (delete-refusing S3 settings fail closed before anything is emptied) → per
+ * stack: insights log-group capture → pre-empty tagged buckets → DeleteStack
+ * → poll to completion with resource events streamed → orphaned-bucket sweep
+ * and insights reap. Failure reasons prefer the resource-level event reason
+ * over the stack status reason — that is what carries classifiable detail
+ * such as Aurora's "is resuming".
+ */
+export declare function destroyApplicationDirect(params: DirectDestroyParams): Promise<Result<DestroyResult>>;

package/dist/src/orchestration/application/directDestroy.js

@@ -0,0 +1 @@
+var v=Object.defineProperty;var d=(a,r)=>v(a,"name",{value:r,configurable:!0});import{CloudFormationClient as x}from"@aws-sdk/client-cloudformation";import{CloudWatchLogsClient as $}from"@aws-sdk/client-cloudwatch-logs";import{S3Client as b}from"@aws-sdk/client-s3";import{success as L,failure as k}from"@fjall/generator";import{SimpleAwsProvider as B}from"../../aws/SimpleAwsProvider.js";import{CloudFormationEventMonitor as G}from"../../aws/utils/cloudformationEvents.js";import{isAborted as D}from"../../aws/organisations/types.js";import{CloudFormationService as U}from"../../services/infrastructure/CloudFormationService.js";import{FULL_APPLICATION_DESTROY_ORDER as K,getApplicationStackName as W,getApplicationStepId as X,getApplicationStepName as Y}from"../../types/operations.js";import{checkActiveDeployments as j}from"../activeDeploymentGuard.js";import{emitStackTargets as q}from"./applicationDeploy.js";import{runDestroyPreFlight as z}from"./destroyPreFlight.js";import{preEmptyStackBuckets as H,capturedSweepBuckets as J}from"../stackCleanup/preEmpty.js";import{sweepOrphanedDestroyBuckets as Q}from"../stackCleanup/orphanSweep.js";import{captureInsightsLogGroups as V,reapInsightsLogGroups as Z}from"../stackCleanup/insightsLogGroups.js";const tt=3600*1e3;async function St(a){const{appName:r,callbacks:t,abortSignal:e}=a,p=Date.now(),I=a.options?.stackTimeoutMs??tt,c=new B(a.awsCredentials),m=new U(c),l=[],g=[];for(const o of K){if(D(e))return h(r,p);const s=W(r,o),n=await m.getStackStatus(s,void 0,e);if(!n.success)return t.onError?.(n.error),k(n.error);n.data?.status==="DOES_NOT_EXIST"||n.data?.status==="DELETE_COMPLETE"?g.push(s):l.push({stackType:o,stackName:s})}const u=l.length;if(t.onLog?.(`Destroying ${r} directly via CloudFormation (${u} live stack(s), ${g.length} absent)`,"info"),u===0)return L({target:r,deploymentType:"application",stacksDestroyed:[],skippedStacks:g,durationMs:Date.now()-p});const S=l.map(o=>o.stackName);if(a.options?.force!==!0){const o=await j(S,m,e);if(!o.success)return t.onError?.(o.error),k(o.error)}q(t,{awsProvider:c},S);const w=await z(c,{stackNames:S,abortSignal:e});if(!w.success)return t.onError?.(w.error),k(w.error);const F=[],M=c.getClient(x),P=c.getClient(b),R=c.getClient($);for(const{stackType:o,stackName:s}of l){if(D(e))return h(r,p);const n=X(o,"destroy"),C=Y(o,"destroy"),y=l.findIndex(i=>i.stackType===o);t.onStepStart?.(n,C,y,u);const A=await V(M,s,e),_=await H(M,P,s,{onLog:t.onLog,onStackCleanupProgress:t.onStackCleanupProgress},e),N=J(_),E=new G(c);await E.startMonitoring(s,i=>{t.onResourceProgress?.(i)});let f,T;try{const i=await m.deleteStack(s,e);f=i.success?await m.waitForDeleteComplete(s,{timeoutMs:I,onProgress:d(O=>t.onLog?.(O,"info"),"onProgress"),abortSignal:e}):i}finally{T=E.getFirstFailureReason(),E.stopMonitoring()}if(D(e))return h(r,p);if(!f.success){const i=T!==null?new Error(`${f.error.message} (${T})`):f.error;return t.onStepComplete?.(n,C,"error",y,u),t.onError?.(i),k(i)}N.length>0&&await Q(P,N,{onLog:t.onLog,onStackCleanupProgress:t.onStackCleanupProgress},e),A.length>0&&await Z(R,A,{onLog:t.onLog},e),F.push(s),t.onStepComplete?.(n,C,"completed",y,u)}return L({target:r,deploymentType:"application",stacksDestroyed:F,skippedStacks:g,durationMs:Date.now()-p})}d(St,"destroyApplicationDirect");function h(a,r){return L({target:a,deploymentType:"application",cancelled:!0,durationMs:Date.now()-r})}d(h,"cancelledResult");export{St as destroyApplicationDirect};

package/dist/src/orchestration/application/ecrCacheRepository.js

@@ -1 +1 @@
-var u=Object.defineProperty;var n=(t,r)=>u(t,"name",{value:r,configurable:!0});import{ECRClient as m,CreateRepositoryCommand as y,PutLifecyclePolicyCommand as d}from"@aws-sdk/client-ecr";import{success as p,failure as c}from"@fjall/generator";import{getErrorMessage as a,maskSensitiveOutput as l}from"@fjall/util";import{untaggedLifecyclePolicyText as f,CACHE_REPO_UNTAGGED_RETENTION_DAYS as g}from"@fjall/util/docker";import{logger as C}from"@fjall/util/logger";import{composeSdkAbortSignal as s,extractErrorName as E}from"../../aws/organisations/types.js";const T="EcrCacheRepository";async function _(t,r,o){const i=t.getClient(m);try{await i.send(new y({repositoryName:r,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"MUTABLE"}),{abortSignal:s(o)}),C.debug(T,"Created build-cache repository",{cacheRepositoryName:r})}catch(e){if(E(e)!=="RepositoryAlreadyExistsException")return c(new Error(`Could not create build-cache repository '${r}': ${l(a(e))}`))}try{await i.send(new d({repositoryName:r,lifecyclePolicyText:f(g)}),{abortSignal:s(o)})}catch(e){return c(new Error(`Could not set lifecycle policy on build-cache repository '${r}': ${l(a(e))}`))}return p(void 0)}n(_,"ensureBuildCacheRepository");export{_ as ensureBuildCacheRepository};
+var u=Object.defineProperty;var n=(t,r)=>u(t,"name",{value:r,configurable:!0});import{ECRClient as m,CreateRepositoryCommand as y,PutLifecyclePolicyCommand as d}from"@aws-sdk/client-ecr";import{success as g,failure as a}from"@fjall/generator";import{getErrorMessage as c,maskSensitiveOutput as s}from"@fjall/util";import{ecrCreateRepositoryTags as p}from"@fjall/util/aws";import{untaggedLifecyclePolicyText as f,CACHE_REPO_UNTAGGED_RETENTION_DAYS as C}from"@fjall/util/docker";import{logger as E}from"@fjall/util/logger";import{composeSdkAbortSignal as l,extractErrorName as T}from"../../aws/organisations/types.js";const b="EcrCacheRepository";async function L(t,r,o){const i=t.getClient(m);try{await i.send(new y({repositoryName:r,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"MUTABLE",tags:p(r)}),{abortSignal:l(o)}),E.debug(b,"Created build-cache repository",{cacheRepositoryName:r})}catch(e){if(T(e)!=="RepositoryAlreadyExistsException")return a(new Error(`Could not create build-cache repository '${r}': ${s(c(e))}`))}try{await i.send(new d({repositoryName:r,lifecyclePolicyText:f(C)}),{abortSignal:l(o)})}catch(e){return a(new Error(`Could not set lifecycle policy on build-cache repository '${r}': ${s(c(e))}`))}return g(void 0)}n(L,"ensureBuildCacheRepository");export{L as ensureBuildCacheRepository};

package/dist/src/orchestration/application/ecsDeploymentTail.js

@@ -1,3 +1,3 @@
-var B=Object.defineProperty;var d=(o,s)=>B(o,"name",{value:s,configurable:!0});import{logger as u}from"@fjall/util/logger";import{getErrorMessage as I,maskSensitiveOutput as f}from"@fjall/util";import{isAborted as _}from"../../aws/organisations/types.js";import{sleepAbortable as U}from"../../util/sleepAbortable.js";const p="EcsDeploymentTail",z="AWS::ECS::Service",K="AWS::CloudFormation::Stack",G=new Set(["CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS"]),Y=15e3,j=3e4,W=["CloudFormation entered UPDATE_ROLLBACK_FAILED \u2014 the stack is wedged and will refuse further updates until the rollback completes.","To unstick it:","  1. Find the resource(s) that failed to roll back: aws cloudformation describe-stack-events --stack-name <stack> (look for UPDATE_ROLLBACK_FAILED resource events and their status reasons).","  2. Fix the underlying cause if possible (an ECS service that cannot stabilise usually means the previous image cannot boot \u2014 check stopped-task reasons above).","  3. Resume the rollback: aws cloudformation continue-update-rollback --stack-name <stack> [--resources-to-skip <logical-ids>].","  4. Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-update-rollback-failed"].join(`
-`);function Z(o){const{ecsService:s,callbacks:i,abortSignal:c}=o,b=o.pollIntervalMs??Y,S=new Map,h=new AbortController,D=c!==void 0?AbortSignal.any([c,h.signal]):h.signal;let E=!1,N=!1;const C=d(e=>{i.onECSProgress?.(f(e))},"emitProgress"),$=d((e,t)=>t.createdAt!==void 0&&t.createdAt.getTime()>=e.updateStartedAt.getTime()-j,"isFreshDeployment"),O=d(async e=>{const t=await s.describeServices(e.clusterName,[e.serviceArn],D);if(!t.success){u.debug(p,"DescribeServices poll failed (transient, observing)",{serviceArn:e.serviceArn,error:f(t.error.message)});return}const r=t.data[0];if(r===void 0)return;const n=r.deployments?.find(l=>l.status==="PRIMARY");if(n?.id!==void 0&&(e.targetDeploymentId===void 0?$(e,n)&&(e.targetDeploymentId=n.id,e.targetTaskDefinitionArn=n.taskDefinition):n.id!==e.targetDeploymentId&&n.id!==e.replacedByDeploymentId&&(e.replacedByDeploymentId=n.id,C(`${e.serviceName}: ECS replaced the in-flight deployment \u2014 now rolling out ${w(n.taskDefinition)}`)),(n.id===e.targetDeploymentId||n.id===e.replacedByDeploymentId)&&n.rolloutState!==void 0)){const k=`${n.id}:${n.rolloutState}`;if(k!==e.lastNarratedRollout){e.lastNarratedRollout=k;const A=n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""?` (${n.rolloutStateReason})`:"";C(`${e.serviceName}: rollout ${n.rolloutState}${A} \u2014 running ${n.runningCount??0}/${n.desiredCount??0}`),i.onECSUpdate?.(n.rolloutState,e.serviceName)}n.id===e.targetDeploymentId&&(e.lastRolloutState=n.rolloutState,n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""&&(e.lastRolloutReason=n.rolloutStateReason))}if(e.targetDeploymentId===void 0)return;const R=await s.listStoppedTasks(e.clusterName,e.targetDeploymentId,D);if(!R.success){u.debug(p,"ListTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:f(R.error.message)});return}const a=R.data.filter(l=>!e.stoppedTaskArns.has(l));if(a.length===0&&e.pendingForensicArns.size===0)return;for(const l of a)e.stoppedTaskArns.add(l);const y=e.pendingForensicArns.size>0,v=[...e.pendingForensicArns,...a];let m=!1;const T=await s.describeTasks(e.clusterName,v,D);if(T.success)m=y,e.pendingForensicArns.clear(),T.data.length>0&&(e.latestForensic=T.data[T.data.length-1]);else{for(const l of v)e.pendingForensicArns.add(l);u.debug(p,"DescribeTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:f(T.error.message)})}if(a.length===0&&!m)return;const g=e.latestForensic!==void 0?` \u2014 latest: ${F(e.latestForensic)}`:"";C(`${e.serviceName}: ${e.stoppedTaskArns.size} task(s) from the new revision stopped since the update began${g}`)},"pollOnce"),P=d(async e=>{for(;!E&&!_(D);){try{await O(e)}catch(t){u.debug(p,"Tail poll threw (transient, observing)",{serviceArn:e.serviceArn,error:f(I(t))})}await U(b,D)}},"runTailLoop"),L=d((e,t)=>{const r=V(e);if(r===void 0){u.debug(p,"Cannot derive cluster from legacy-format service ARN; skipping tail",{serviceArn:e});return}const n={serviceArn:e,clusterName:r.clusterName,serviceName:r.serviceName,startedAtMs:Date.now(),updateStartedAt:t,stoppedTaskArns:new Set,pendingForensicArns:new Set,loop:Promise.resolve()};n.loop=P(n),S.set(e,n),u.debug(p,"ECS deployment tail started",{serviceArn:e,clusterName:r.clusterName})},"startTail");return{observeResourceEvent(e){if(!E){if(e.resourceType===z&&G.has(e.status)&&e.physicalId!==void 0&&e.physicalId!==""&&!S.has(e.physicalId)){L(e.physicalId,e.timestamp);return}e.resourceType===K&&e.status==="UPDATE_ROLLBACK_FAILED"&&!N&&(N=!0,i.onOutput?.(`${W}
-`))}},async finalise(e){if(E)return;E=!0,h.abort();const t=e?.deploySucceeded===!0;await Promise.all([...S.values()].map(async r=>{await r.loop.catch(n=>{u.debug(p,"Tail loop rejected during finalise",{serviceArn:r.serviceArn,error:f(I(n))})}),await M(r,t).catch(n=>{u.debug(p,"Tail completion emission failed",{serviceArn:r.serviceArn,error:f(I(n))})})}))}};async function M(e,t){if(e.targetDeploymentId===void 0){u.debug(p,"No fresh deployment was ever adopted; skipping ECS completion event",{serviceArn:e.serviceArn});return}let r,n,R,a=e.lastRolloutState,y=e.lastRolloutReason;if(!_(c)){const l=await s.describeServices(e.clusterName,[e.serviceArn],c);if(l.success&&l.data[0]!==void 0){const k=l.data[0];r=k.taskDefinition,n=k.runningCount,R=k.desiredCount;const A=k.deployments?.find(x=>x.status==="PRIMARY");A?.id!==void 0&&(A.id===e.targetDeploymentId?A.rolloutState!==void 0&&(a=A.rolloutState,y=A.rolloutStateReason??y):e.replacedByDeploymentId===void 0&&(e.replacedByDeploymentId=A.id))}else l.success||u.debug(p,"Final DescribeServices snapshot failed",{serviceArn:e.serviceArn,error:f(l.error.message)})}const v=e.replacedByDeploymentId!==void 0;let m;v?m=!1:a==="COMPLETED"?m=!0:a==="FAILED"?m=!1:m=t,r!==void 0&&e.targetTaskDefinitionArn!==void 0&&r!==e.targetTaskDefinitionArn&&C(`${e.serviceName}: service settled on ${w(r)}, not the deployment's target ${w(e.targetTaskDefinitionArn)} \u2014 ECS rolled the service back`);const g=[];m||(y!==void 0?g.push(y):v||g.push(`rollout state ${a??"unknown"} when monitoring ended`),v&&g.push("ECS replaced the in-flight deployment before it completed"),e.stoppedTaskArns.size>0&&g.push(`${e.stoppedTaskArns.size} distinct task(s) from the new revision stopped`),e.latestForensic!==void 0&&g.push(`latest: ${F(e.latestForensic)}`)),i.onECSComplete?.({serviceName:e.serviceName,serviceArn:e.serviceArn,success:m,taskDefinitionArn:r??e.targetTaskDefinitionArn??"unknown",durationMs:Date.now()-e.startedAtMs,...g.length>0&&{reason:f(g.join("; "))},...n!==void 0&&{finalRunningCount:n},...R!==void 0&&{finalDesiredCount:R},...a!==void 0&&{rolloutState:a},...v&&{replaced:!0},...e.stoppedTaskArns.size>0&&{stoppedTaskCount:e.stoppedTaskArns.size},...e.latestForensic?.stopCode!==void 0&&{stopCode:e.latestForensic.stopCode},...e.latestForensic?.stoppedReason!==void 0&&{stoppedReason:f(e.latestForensic.stoppedReason)}})}}d(Z,"createEcsDeploymentTail");function V(o){const s=":service/",i=o.indexOf(s);if(i===-1)return;const b=o.slice(i+s.length).split("/");if(b.length<2)return;const S=b[0],h=b[1];if(!(S===void 0||S===""||h===void 0||h===""))return{clusterName:S,serviceName:h}}d(V,"parseServiceArn");function w(o){if(o===void 0)return"unknown revision";const s=o.split("/"),i=s[s.length-1];return i!==void 0&&i!==""?i:o}d(w,"shortTaskDefinition");function F(o){const s=o.containers.filter(c=>c.exitCode!==void 0).map(c=>`${c.name??"container"} exit ${c.exitCode}`).join(", "),i=o.stoppedReason??o.stopCode??"no stopped reason recorded";return s!==""?`${i} (${s})`:i}d(F,"formatForensic");export{Y as ECS_TAIL_POLL_INTERVAL_MS,W as UPDATE_ROLLBACK_FAILED_RUNBOOK,Z as createEcsDeploymentTail};
+var B=Object.defineProperty;var c=(o,i)=>B(o,"name",{value:i,configurable:!0});import{logger as f}from"@fjall/util/logger";import{getErrorMessage as I,maskSensitiveOutput as p}from"@fjall/util";import{SCHEMA_GATE_CONTAINER_NAME as U,SCHEMA_GATE_EXIT_HINTS as K,schemaGateExitKind as z}from"@fjall/util/migration";import{isAborted as w}from"../../aws/organisations/types.js";import{sleepAbortable as G}from"../../util/sleepAbortable.js";const m="EcsDeploymentTail",Y="AWS::ECS::Service",j="AWS::CloudFormation::Stack",W=new Set(["CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS"]),H=15e3,V=3e4,X=["CloudFormation entered UPDATE_ROLLBACK_FAILED \u2014 the stack is wedged and will refuse further updates until the rollback completes.","To unstick it:","  1. Find the resource(s) that failed to roll back: aws cloudformation describe-stack-events --stack-name <stack> (look for UPDATE_ROLLBACK_FAILED resource events and their status reasons).","  2. Fix the underlying cause if possible (an ECS service that cannot stabilise usually means the previous image cannot boot \u2014 check stopped-task reasons above).","  3. Resume the rollback: aws cloudformation continue-update-rollback --stack-name <stack> [--resources-to-skip <logical-ids>].","  4. Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-update-rollback-failed"].join(`
+`);function oe(o){const{ecsService:i,callbacks:s,abortSignal:a}=o,S=o.pollIntervalMs??H,u=new Map,E=new AbortController,b=a!==void 0?AbortSignal.any([a,E.signal]):E.signal;let C=!1,N=!1;const D=c(e=>{s.onECSProgress?.(p(e))},"emitProgress"),$=c((e,t)=>t.createdAt!==void 0&&t.createdAt.getTime()>=e.updateStartedAt.getTime()-V,"isFreshDeployment"),O=c(async e=>{const t=await i.describeServices(e.clusterName,[e.serviceArn],b);if(!t.success){f.debug(m,"DescribeServices poll failed (transient, observing)",{serviceArn:e.serviceArn,error:p(t.error.message)});return}const r=t.data[0];if(r===void 0)return;const n=r.deployments?.find(l=>l.status==="PRIMARY");if(n?.id!==void 0&&(e.targetDeploymentId===void 0?$(e,n)&&(e.targetDeploymentId=n.id,e.targetTaskDefinitionArn=n.taskDefinition):n.id!==e.targetDeploymentId&&n.id!==e.replacedByDeploymentId&&(e.replacedByDeploymentId=n.id,D(`${e.serviceName}: ECS replaced the in-flight deployment \u2014 now rolling out ${_(n.taskDefinition)}`)),(n.id===e.targetDeploymentId||n.id===e.replacedByDeploymentId)&&n.rolloutState!==void 0)){const v=`${n.id}:${n.rolloutState}`;if(v!==e.lastNarratedRollout){e.lastNarratedRollout=v;const h=n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""?` (${n.rolloutStateReason})`:"";D(`${e.serviceName}: rollout ${n.rolloutState}${h} \u2014 running ${n.runningCount??0}/${n.desiredCount??0}`),s.onECSUpdate?.(n.rolloutState,e.serviceName)}n.id===e.targetDeploymentId&&(e.lastRolloutState=n.rolloutState,n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""&&(e.lastRolloutReason=n.rolloutStateReason))}if(e.targetDeploymentId===void 0)return;const T=await i.listStoppedTasks(e.clusterName,e.targetDeploymentId,b);if(!T.success){f.debug(m,"ListTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:p(T.error.message)});return}const d=T.data.filter(l=>!e.stoppedTaskArns.has(l));if(d.length===0&&e.pendingForensicArns.size===0)return;for(const l of d)e.stoppedTaskArns.add(l);const k=e.pendingForensicArns.size>0,R=[...e.pendingForensicArns,...d];let g=!1;const y=await i.describeTasks(e.clusterName,R,b);if(y.success)g=k,e.pendingForensicArns.clear(),y.data.length>0&&(e.latestForensic=y.data[y.data.length-1]);else{for(const l of R)e.pendingForensicArns.add(l);f.debug(m,"DescribeTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:p(y.error.message)})}if(d.length===0&&!g)return;const A=e.latestForensic!==void 0?` \u2014 latest: ${F(e.latestForensic)}`:"";D(`${e.serviceName}: ${e.stoppedTaskArns.size} task(s) from the new revision stopped since the update began${A}`)},"pollOnce"),P=c(async e=>{for(;!C&&!w(b);){try{await O(e)}catch(t){f.debug(m,"Tail poll threw (transient, observing)",{serviceArn:e.serviceArn,error:p(I(t))})}await G(S,b)}},"runTailLoop"),L=c((e,t)=>{const r=q(e);if(r===void 0){f.debug(m,"Cannot derive cluster from legacy-format service ARN; skipping tail",{serviceArn:e});return}const n={serviceArn:e,clusterName:r.clusterName,serviceName:r.serviceName,startedAtMs:Date.now(),updateStartedAt:t,stoppedTaskArns:new Set,pendingForensicArns:new Set,loop:Promise.resolve()};n.loop=P(n),u.set(e,n),f.debug(m,"ECS deployment tail started",{serviceArn:e,clusterName:r.clusterName})},"startTail");return{observeResourceEvent(e){if(!C){if(e.resourceType===Y&&W.has(e.status)&&e.physicalId!==void 0&&e.physicalId!==""&&!u.has(e.physicalId)){L(e.physicalId,e.timestamp);return}e.resourceType===j&&e.status==="UPDATE_ROLLBACK_FAILED"&&!N&&(N=!0,s.onOutput?.(`${X}
+`))}},async finalise(e){if(C)return;C=!0,E.abort();const t=e?.deploySucceeded===!0;await Promise.all([...u.values()].map(async r=>{await r.loop.catch(n=>{f.debug(m,"Tail loop rejected during finalise",{serviceArn:r.serviceArn,error:p(I(n))})}),await M(r,t).catch(n=>{f.debug(m,"Tail completion emission failed",{serviceArn:r.serviceArn,error:p(I(n))})})}))}};async function M(e,t){if(e.targetDeploymentId===void 0){f.debug(m,"No fresh deployment was ever adopted; skipping ECS completion event",{serviceArn:e.serviceArn});return}let r,n,T,d=e.lastRolloutState,k=e.lastRolloutReason;if(!w(a)){const l=await i.describeServices(e.clusterName,[e.serviceArn],a);if(l.success&&l.data[0]!==void 0){const v=l.data[0];r=v.taskDefinition,n=v.runningCount,T=v.desiredCount;const h=v.deployments?.find(x=>x.status==="PRIMARY");h?.id!==void 0&&(h.id===e.targetDeploymentId?h.rolloutState!==void 0&&(d=h.rolloutState,k=h.rolloutStateReason??k):e.replacedByDeploymentId===void 0&&(e.replacedByDeploymentId=h.id))}else l.success||f.debug(m,"Final DescribeServices snapshot failed",{serviceArn:e.serviceArn,error:p(l.error.message)})}const R=e.replacedByDeploymentId!==void 0;let g;R?g=!1:d==="COMPLETED"?g=!0:d==="FAILED"?g=!1:g=t,r!==void 0&&e.targetTaskDefinitionArn!==void 0&&r!==e.targetTaskDefinitionArn&&D(`${e.serviceName}: service settled on ${_(r)}, not the deployment's target ${_(e.targetTaskDefinitionArn)} \u2014 ECS rolled the service back`);const A=[];g||(k!==void 0?A.push(k):R||A.push(`rollout state ${d??"unknown"} when monitoring ended`),R&&A.push("ECS replaced the in-flight deployment before it completed"),e.stoppedTaskArns.size>0&&A.push(`${e.stoppedTaskArns.size} distinct task(s) from the new revision stopped`),e.latestForensic!==void 0&&A.push(`latest: ${F(e.latestForensic)}`)),s.onECSComplete?.({serviceName:e.serviceName,serviceArn:e.serviceArn,success:g,taskDefinitionArn:r??e.targetTaskDefinitionArn??"unknown",durationMs:Date.now()-e.startedAtMs,...A.length>0&&{reason:p(A.join("; "))},...n!==void 0&&{finalRunningCount:n},...T!==void 0&&{finalDesiredCount:T},...d!==void 0&&{rolloutState:d},...R&&{replaced:!0},...e.stoppedTaskArns.size>0&&{stoppedTaskCount:e.stoppedTaskArns.size},...e.latestForensic?.stopCode!==void 0&&{stopCode:e.latestForensic.stopCode},...e.latestForensic?.stoppedReason!==void 0&&{stoppedReason:p(e.latestForensic.stoppedReason)}})}}c(oe,"createEcsDeploymentTail");function q(o){const i=":service/",s=o.indexOf(i);if(s===-1)return;const S=o.slice(s+i.length).split("/");if(S.length<2)return;const u=S[0],E=S[1];if(!(u===void 0||u===""||E===void 0||E===""))return{clusterName:u,serviceName:E}}c(q,"parseServiceArn");function _(o){if(o===void 0)return"unknown revision";const i=o.split("/"),s=i[i.length-1];return s!==void 0&&s!==""?s:o}c(_,"shortTaskDefinition");function F(o){const i=o.containers.filter(a=>a.exitCode!==void 0).map(a=>{const S=`${a.name??"container"} exit ${a.exitCode}`,u=a.name===U&&a.exitCode!==void 0?z(a.exitCode):void 0;return u===void 0?S:`${S} \u2014 ${K[u]}`}).join(", "),s=o.stoppedReason??o.stopCode??"no stopped reason recorded";return i!==""?`${s} (${i})`:s}c(F,"formatForensic");export{H as ECS_TAIL_POLL_INTERVAL_MS,X as UPDATE_ROLLBACK_FAILED_RUNBOOK,oe as createEcsDeploymentTail};

package/dist/src/orchestration/application/schemaGateImage.js

@@ -1 +1 @@
-var L=Object.defineProperty;var d=(e,t)=>L(e,"name",{value:t,configurable:!0});import{createHash as N}from"node:crypto";import{ECRClient as O,BatchCheckLayerAvailabilityCommand as G,CompleteLayerUploadCommand as D,CreateRepositoryCommand as H,DescribeImagesCommand as j,InitiateLayerUploadCommand as U,PutImageCommand as F,UploadLayerPartCommand as Y}from"@aws-sdk/client-ecr";import{success as S,failure as E}from"@fjall/generator";import{getErrorMessage as w,maskSensitiveOutput as p}from"@fjall/util";import{logger as _}from"@fjall/util/logger";import{parseSchemaGateImageTagsFromManifest as z}from"@fjall/util/manifest";import{SCHEMA_GATE_ECR_REPO_NAME as m,SCHEMA_GATE_PUBLIC_IMAGE_REPO as h}from"@fjall/util/migration";import{composeSdkAbortSignal as l,extractErrorName as $,isAborted as b}from"../../aws/organisations/types.js";const R="SchemaGateImage",k=h.indexOf("/"),g=h.slice(0,k),T=h.slice(k+1),s='The deploy was refused before any stack changed. Fix the cause and re-run, or set schemaGate: { image: "<uri>" } to bring your own gate image, or schemaGate: { materialise: false } to disable the gate container.',J=["application/vnd.oci.image.index.v1+json","application/vnd.oci.image.manifest.v1+json","application/vnd.docker.distribution.manifest.list.v2+json","application/vnd.docker.distribution.manifest.v2+json"].join(", "),V=new Set(["application/vnd.oci.image.index.v1+json","application/vnd.docker.distribution.manifest.list.v2+json"]),W=10*1024*1024,P=12e4;class r extends Error{static{d(this,"SchemaGateImageError")}}function y(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}d(y,"isRecord");async function le(e){const t=z(e.cdkOutPath);if(t.outcome==="manifest-unreadable")return E(new r(`Cannot determine the assembly's schema-gate image tags: ${p(t.reason)}. Re-run the build to regenerate the assembly, or remove the corrupt cdk.out and redeploy.`));const o=t.tags;if(o.length===0)return S(void 0);const a=e.awsProvider.getClient(O),n=e.fetchFn??fetch;try{for(const i of o){if(b(e.abortSignal))throw new r(`Aborted before ensuring schema-gate image '${m}:${i}'`);if(await X(a,i,e.abortSignal)){_.debug(R,"Schema-gate image already present",{tag:i});continue}e.onLog?.(`Schema-gate image ${m}:${i} is not in this account's ECR \u2014 mirroring it from ${h} (one-off per engine version)`,"info"),await Z(a,e.abortSignal),await q(a,n,i,e.abortSignal),e.onLog?.(`Mirrored schema-gate image ${m}:${i}`,"info")}return S(void 0)}catch(i){return i instanceof r?E(i):E(new Error(`Could not ensure the schema-gate image in this account's ECR: ${p(w(i))}. ${s}`))}}d(le,"ensureSchemaGateImage");async function X(e,t,o){try{return await e.send(new j({repositoryName:m,imageIds:[{imageTag:t}]}),{abortSignal:l(o)}),!0}catch(a){const n=$(a);if(n==="ImageNotFoundException"||n==="RepositoryNotFoundException")return!1;throw new r(`Could not check for schema-gate image '${m}:${t}': ${p(w(a))}. ${s}`)}}d(X,"isTagPresent");async function Z(e,t){try{await e.send(new H({repositoryName:m,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"IMMUTABLE"}),{abortSignal:l(t)}),_.debug(R,"Created schema-gate repository",{repositoryName:m})}catch(o){if($(o)!=="RepositoryAlreadyExistsException")throw new r(`Could not create schema-gate repository '${m}': ${p(w(o))}. ${s}`)}}d(Z,"ensureGateRepository");async function q(e,t,o,a){const n=await K(t,a),i=await v(t,n,o,a);if(V.has(i.mediaType))for(const c of ee(i.parsed,o)){if(b(a))throw new r(`Aborted while mirroring schema-gate image '${m}:${o}'`);const f=await v(t,n,c,a);await x(e,t,n,f.parsed,o,a),await M(e,f.raw,f.mediaType,{imageDigest:c},a)}else await x(e,t,n,i.parsed,o,a);await M(e,i.raw,i.mediaType,{imageTag:o},a)}d(q,"mirrorTag");async function K(e,t){const o=`https://${g}/token/?service=${g}&scope=repository:${T}:pull`,a=await e(o,{signal:l(t)});if(!a.ok)throw new r(`Could not obtain an anonymous pull token from ${g}: HTTP ${a.status}. ${s}`);const n=await a.json();if(!y(n)||typeof n.token!="string"||n.token==="")throw new r(`The ${g} token endpoint returned no usable token. ${s}`);return n.token}d(K,"fetchPublicPullToken");async function v(e,t,o,a){const n=await e(`https://${g}/v2/${T}/manifests/${o}`,{headers:{Authorization:`Bearer ${t}`,Accept:J},signal:l(a)});if(!n.ok)throw new r(`Could not fetch manifest '${o}' from ${h}: HTTP ${n.status}. ${s}`);const i=await n.text();o.startsWith("sha256:")&&B(Buffer.from(i),o,`manifest ${o}`);let c;try{c=JSON.parse(i)}catch{throw new r(`Manifest '${o}' from ${h} is not valid JSON. ${s}`)}if(!y(c))throw new r(`Manifest '${o}' from ${h} has an unexpected shape. ${s}`);const f=n.headers.get("content-type"),A=f!==null&&f!==""?f:typeof c.mediaType=="string"?c.mediaType:"";return{raw:i,mediaType:A,parsed:c}}d(v,"fetchPublicManifest");const Q=/^sha256:[0-9a-f]{64}$/;function C(e,t){if(!Q.test(e))throw new r(`A descriptor for '${h}:${t}' carries a malformed digest. ${s}`);return e}d(C,"assertDigestShape");function ee(e,t){if(!Array.isArray(e.manifests))throw new r(`The index manifest for '${h}:${t}' carries no child manifests. ${s}`);const o=[];for(const a of e.manifests){if(!y(a)||typeof a.digest!="string")throw new r(`The index manifest for '${h}:${t}' has a malformed child descriptor. ${s}`);o.push(C(a.digest,t))}return o}d(ee,"collectIndexChildDigests");function te(e,t){const o=[],a=e.config;if(!y(a)||typeof a.digest!="string")throw new r(`An image manifest for '${h}:${t}' has no config digest. ${s}`);if(o.push(C(a.digest,t)),!Array.isArray(e.layers))throw new r(`An image manifest for '${h}:${t}' has no layer list. ${s}`);for(const n of e.layers){if(!y(n)||typeof n.digest!="string")throw new r(`An image manifest for '${h}:${t}' has a malformed layer descriptor. ${s}`);o.push(C(n.digest,t))}return o}d(te,"collectBlobDigests");async function x(e,t,o,a,n,i){const c=te(a,n),f=await e.send(new G({repositoryName:m,layerDigests:c}),{abortSignal:l(i)}),A=new Set((f.layers??[]).filter(u=>u.layerAvailability==="AVAILABLE").map(u=>u.layerDigest));for(const u of c){if(b(i))throw new r(`Aborted while mirroring schema-gate image '${m}:${n}'`);if(A.has(u))continue;const I=await oe(t,o,u,i);B(I,u,`blob ${u}`),await ae(e,u,I,i)}}d(x,"mirrorImageBlobs");async function oe(e,t,o,a){const n=await e(`https://${g}/v2/${T}/blobs/${o}`,{headers:{Authorization:`Bearer ${t}`},signal:l(a,P)});if(!n.ok)throw new r(`Could not download blob ${o} from ${h}: HTTP ${n.status}. ${s}`);return new Uint8Array(await n.arrayBuffer())}d(oe,"fetchPublicBlob");function B(e,t,o){const a=`sha256:${N("sha256").update(e).digest("hex")}`;if(a!==t)throw new r(`Integrity check failed for ${o} from ${h}: downloaded content hashes to ${a}. Refusing to push it. ${s}`)}d(B,"assertDigestMatches");async function ae(e,t,o,a){const i=(await e.send(new U({repositoryName:m}),{abortSignal:l(a)})).uploadId;if(i===void 0)throw new r(`ECR returned no upload id for blob ${t}. ${s}`);let c=0;for(;c<o.length;){if(b(a))throw new r(`Aborted while uploading blob ${t} to '${m}'`);const f=Math.min(c+W,o.length);await e.send(new Y({repositoryName:m,uploadId:i,partFirstByte:c,partLastByte:f-1,layerPartBlob:o.subarray(c,f)}),{abortSignal:l(a,P)}),c=f}try{await e.send(new D({repositoryName:m,uploadId:i,layerDigests:[t]}),{abortSignal:l(a)})}catch(f){if($(f)!=="LayerAlreadyExistsException")throw new r(`Could not complete the upload of blob ${t}: ${p(w(f))}. ${s}`)}}d(ae,"uploadBlob");async function M(e,t,o,a,n){try{await e.send(new F({repositoryName:m,imageManifest:t,...o!==""?{imageManifestMediaType:o}:{},...a}),{abortSignal:l(n)})}catch(i){if($(i)!=="ImageAlreadyExistsException")throw new r(`Could not push a schema-gate manifest to '${m}': ${p(w(i))}. ${s}`)}}d(M,"putImage");export{le as ensureSchemaGateImage};
+var L=Object.defineProperty;var d=(e,t)=>L(e,"name",{value:t,configurable:!0});import{createHash as N}from"node:crypto";import{ECRClient as O,BatchCheckLayerAvailabilityCommand as G,CompleteLayerUploadCommand as D,CreateRepositoryCommand as H,DescribeImagesCommand as j,InitiateLayerUploadCommand as U,PutImageCommand as F,UploadLayerPartCommand as Y}from"@aws-sdk/client-ecr";import{success as S,failure as E}from"@fjall/generator";import{getErrorMessage as w,maskSensitiveOutput as p}from"@fjall/util";import{ecrCreateRepositoryTags as z}from"@fjall/util/aws";import{logger as R}from"@fjall/util/logger";import{parseSchemaGateImageTagsFromManifest as J}from"@fjall/util/manifest";import{SCHEMA_GATE_ECR_REPO_NAME as c,SCHEMA_GATE_PUBLIC_IMAGE_REPO as h}from"@fjall/util/migration";import{composeSdkAbortSignal as l,extractErrorName as $,isAborted as b}from"../../aws/organisations/types.js";const _="SchemaGateImage",k=h.indexOf("/"),g=h.slice(0,k),T=h.slice(k+1),s='The deploy was refused before any stack changed. Fix the cause and re-run, or set schemaGate: { image: "<uri>" } to bring your own gate image, or schemaGate: { materialise: false } to disable the gate container.',V=["application/vnd.oci.image.index.v1+json","application/vnd.oci.image.manifest.v1+json","application/vnd.docker.distribution.manifest.list.v2+json","application/vnd.docker.distribution.manifest.v2+json"].join(", "),W=new Set(["application/vnd.oci.image.index.v1+json","application/vnd.docker.distribution.manifest.list.v2+json"]),X=10*1024*1024,P=12e4;class r extends Error{static{d(this,"SchemaGateImageError")}}function y(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}d(y,"isRecord");async function pe(e){const t=J(e.cdkOutPath);if(t.outcome==="manifest-unreadable")return E(new r(`Cannot determine the assembly's schema-gate image tags: ${p(t.reason)}. Re-run the build to regenerate the assembly, or remove the corrupt cdk.out and redeploy.`));const o=t.tags;if(o.length===0)return S(void 0);const a=e.awsProvider.getClient(O),n=e.fetchFn??fetch;try{for(const i of o){if(b(e.abortSignal))throw new r(`Aborted before ensuring schema-gate image '${c}:${i}'`);if(await Z(a,i,e.abortSignal)){R.debug(_,"Schema-gate image already present",{tag:i});continue}e.onLog?.(`Schema-gate image ${c}:${i} is not in this account's ECR \u2014 mirroring it from ${h} (one-off per engine version)`,"info"),await q(a,e.abortSignal),await K(a,n,i,e.abortSignal),e.onLog?.(`Mirrored schema-gate image ${c}:${i}`,"info")}return S(void 0)}catch(i){return i instanceof r?E(i):E(new Error(`Could not ensure the schema-gate image in this account's ECR: ${p(w(i))}. ${s}`))}}d(pe,"ensureSchemaGateImage");async function Z(e,t,o){try{return await e.send(new j({repositoryName:c,imageIds:[{imageTag:t}]}),{abortSignal:l(o)}),!0}catch(a){const n=$(a);if(n==="ImageNotFoundException"||n==="RepositoryNotFoundException")return!1;throw new r(`Could not check for schema-gate image '${c}:${t}': ${p(w(a))}. ${s}`)}}d(Z,"isTagPresent");async function q(e,t){try{await e.send(new H({repositoryName:c,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"IMMUTABLE",tags:z(c)}),{abortSignal:l(t)}),R.debug(_,"Created schema-gate repository",{repositoryName:c})}catch(o){if($(o)!=="RepositoryAlreadyExistsException")throw new r(`Could not create schema-gate repository '${c}': ${p(w(o))}. ${s}`)}}d(q,"ensureGateRepository");async function K(e,t,o,a){const n=await Q(t,a),i=await v(t,n,o,a);if(W.has(i.mediaType))for(const m of te(i.parsed,o)){if(b(a))throw new r(`Aborted while mirroring schema-gate image '${c}:${o}'`);const f=await v(t,n,m,a);await x(e,t,n,f.parsed,o,a),await M(e,f.raw,f.mediaType,{imageDigest:m},a)}else await x(e,t,n,i.parsed,o,a);await M(e,i.raw,i.mediaType,{imageTag:o},a)}d(K,"mirrorTag");async function Q(e,t){const o=`https://${g}/token/?service=${g}&scope=repository:${T}:pull`,a=await e(o,{signal:l(t)});if(!a.ok)throw new r(`Could not obtain an anonymous pull token from ${g}: HTTP ${a.status}. ${s}`);const n=await a.json();if(!y(n)||typeof n.token!="string"||n.token==="")throw new r(`The ${g} token endpoint returned no usable token. ${s}`);return n.token}d(Q,"fetchPublicPullToken");async function v(e,t,o,a){const n=await e(`https://${g}/v2/${T}/manifests/${o}`,{headers:{Authorization:`Bearer ${t}`,Accept:V},signal:l(a)});if(!n.ok)throw new r(`Could not fetch manifest '${o}' from ${h}: HTTP ${n.status}. ${s}`);const i=await n.text();o.startsWith("sha256:")&&B(Buffer.from(i),o,`manifest ${o}`);let m;try{m=JSON.parse(i)}catch{throw new r(`Manifest '${o}' from ${h} is not valid JSON. ${s}`)}if(!y(m))throw new r(`Manifest '${o}' from ${h} has an unexpected shape. ${s}`);const f=n.headers.get("content-type"),A=f!==null&&f!==""?f:typeof m.mediaType=="string"?m.mediaType:"";return{raw:i,mediaType:A,parsed:m}}d(v,"fetchPublicManifest");const ee=/^sha256:[0-9a-f]{64}$/;function C(e,t){if(!ee.test(e))throw new r(`A descriptor for '${h}:${t}' carries a malformed digest. ${s}`);return e}d(C,"assertDigestShape");function te(e,t){if(!Array.isArray(e.manifests))throw new r(`The index manifest for '${h}:${t}' carries no child manifests. ${s}`);const o=[];for(const a of e.manifests){if(!y(a)||typeof a.digest!="string")throw new r(`The index manifest for '${h}:${t}' has a malformed child descriptor. ${s}`);o.push(C(a.digest,t))}return o}d(te,"collectIndexChildDigests");function oe(e,t){const o=[],a=e.config;if(!y(a)||typeof a.digest!="string")throw new r(`An image manifest for '${h}:${t}' has no config digest. ${s}`);if(o.push(C(a.digest,t)),!Array.isArray(e.layers))throw new r(`An image manifest for '${h}:${t}' has no layer list. ${s}`);for(const n of e.layers){if(!y(n)||typeof n.digest!="string")throw new r(`An image manifest for '${h}:${t}' has a malformed layer descriptor. ${s}`);o.push(C(n.digest,t))}return o}d(oe,"collectBlobDigests");async function x(e,t,o,a,n,i){const m=oe(a,n),f=await e.send(new G({repositoryName:c,layerDigests:m}),{abortSignal:l(i)}),A=new Set((f.layers??[]).filter(u=>u.layerAvailability==="AVAILABLE").map(u=>u.layerDigest));for(const u of m){if(b(i))throw new r(`Aborted while mirroring schema-gate image '${c}:${n}'`);if(A.has(u))continue;const I=await ae(t,o,u,i);B(I,u,`blob ${u}`),await ne(e,u,I,i)}}d(x,"mirrorImageBlobs");async function ae(e,t,o,a){const n=await e(`https://${g}/v2/${T}/blobs/${o}`,{headers:{Authorization:`Bearer ${t}`},signal:l(a,P)});if(!n.ok)throw new r(`Could not download blob ${o} from ${h}: HTTP ${n.status}. ${s}`);return new Uint8Array(await n.arrayBuffer())}d(ae,"fetchPublicBlob");function B(e,t,o){const a=`sha256:${N("sha256").update(e).digest("hex")}`;if(a!==t)throw new r(`Integrity check failed for ${o} from ${h}: downloaded content hashes to ${a}. Refusing to push it. ${s}`)}d(B,"assertDigestMatches");async function ne(e,t,o,a){const i=(await e.send(new U({repositoryName:c}),{abortSignal:l(a)})).uploadId;if(i===void 0)throw new r(`ECR returned no upload id for blob ${t}. ${s}`);let m=0;for(;m<o.length;){if(b(a))throw new r(`Aborted while uploading blob ${t} to '${c}'`);const f=Math.min(m+X,o.length);await e.send(new Y({repositoryName:c,uploadId:i,partFirstByte:m,partLastByte:f-1,layerPartBlob:o.subarray(m,f)}),{abortSignal:l(a,P)}),m=f}try{await e.send(new D({repositoryName:c,uploadId:i,layerDigests:[t]}),{abortSignal:l(a)})}catch(f){if($(f)!=="LayerAlreadyExistsException")throw new r(`Could not complete the upload of blob ${t}: ${p(w(f))}. ${s}`)}}d(ne,"uploadBlob");async function M(e,t,o,a,n){try{await e.send(new F({repositoryName:c,imageManifest:t,...o!==""?{imageManifestMediaType:o}:{},...a}),{abortSignal:l(n)})}catch(i){if($(i)!=="ImageAlreadyExistsException")throw new r(`Could not push a schema-gate manifest to '${c}': ${p(w(i))}. ${s}`)}}d(M,"putImage");export{pe as ensureSchemaGateImage};

package/dist/src/orchestration/index.d.ts

@@ -1,5 +1,6 @@
 export { deploy } from "./deploy.js";
 export { destroy } from "./destroy.js";
+export { destroyApplicationDirect, type DirectDestroyParams } from "./application/directDestroy.js";
 export { restart, probeSecretsDrift, probeServiceDeploymentStatus } from "./restart/restartApplication.js";
 export type { RestartParams, RestartResult, SecretsDriftProbeParams, ServiceDeploymentStatus, ApplicationServiceStatus } from "./restart/restartApplication.js";
 export { computeSecretsDrift, deriveStaleParameters, extractConsumedSsmParameters, ssmParameterNameFromValueFrom } from "./restart/secretsDrift.js";

package/dist/src/orchestration/index.js

@@ -1 +1 @@
-import{deploy as t}from"./deploy.js";import{destroy as i}from"./destroy.js";import{restart as n,probeSecretsDrift as s,probeServiceDeploymentStatus as l}from"./restart/restartApplication.js";import{computeSecretsDrift as p,deriveStaleParameters as m,extractConsumedSsmParameters as u,ssmParameterNameFromValueFrom as f}from"./restart/secretsDrift.js";import{deployOrganisation as R}from"./organisation/organisationDeploy.js";import{destroyOrganisation as S}from"./organisation/organisationDestroy.js";import{cleanupFailedStack as T,emptyS3Bucket as y,preEmptyStackBuckets as A,formatQuarantineSuspectedMessage as D,formatRetainedBucketsMessage as E,isQuarantineDetail as g,isRetainedBucketsDetail as _,PRE_EMPTY_TAG_KEYS as O,isCleanableState as v,SAFE_CLEANUP_STATES as F}from"./stackCleanup.js";import{partitionAccounts as k,buildRegionList as B,buildAccountRegionPairs as L,cascadeHomeRegion as C,cascadeOperationKey as I,deployDomains as U}from"./organisation/cascadeHelpers.js";import{projectScalarSummary as G,projectAccountRows as N}from"./organisation/cascadeSummary.js";import{reconcileProviderAccounts as M,mergeReconciledProviderAccounts as Y}from"./organisation/reconcileProviderAccounts.js";import{decideNextTransition as J,reconcileTrailMigration as H,ORG_TRAIL_BUCKET_OUTPUT_KEY as Q,TRAIL_BUCKET_OUTPUT_KEY as w,TRAIL_KEY_ARN_OUTPUT_KEY as j}from"./trailMigration/trailMigration.js";import{decommissionMemberTrailStorage as q}from"./trailMigration/memberTrailCleanup.js";import{unlockBucket as X}from"./unlock/unlockBucket.js";import{unlockQueue as $}from"./unlock/unlockQueue.js";import{triageBucketPolicy as re,isEnforceSslStatement as te}from"./unlock/bucketPolicyTriage.js";import{toResourcePolicyStatements as ie}from"./unlock/toResourcePolicyStatements.js";import{restoreBucketPolicy as ne,synthesiseEnforceSslDocument as se,ensureEnforceSsl as le}from"./unlock/restoreBucketPolicy.js";import{restoreAndReconcileQuarantinedBucket as pe}from"./unlock/restoreAndReconcileQuarantinedBucket.js";import{parseAccountsConfiguration as ue,flattenAccountsToEnvironments as fe,extractAllAccountNames as de,accountsConfigToOUTree as Re,isStringArray as Pe,isAccountsConfig as Se,isOuOnlyAccountBucket as xe,OU_ONLY_ACCOUNT_BUCKETS as Te}from"./organisation/accountsConfig.js";import{resolveBuildSecrets as Ae,resolveSecretRefValue as De,resolveBuildSecretSessionProvider as Ee,sourcedRefsFromBuildArgs as ge}from"./application/buildSecretResolver.js";import{buildBuildSecretSessionPolicy as Oe,partitionForRegion as ve}from"./application/buildSecretSession.js";import{buildDeploySessionPolicy as be}from"./application/deploySessionPolicy.js";import{buildDomainSessionPolicy as Be}from"./domain/domainSessionPolicy.js";import{resolveBuildArgs as Ce}from"./application/buildArgResolver.js";import{validateBuildGroup as Ue}from"./application/buildGroupValidator.js";export*from"./domain/index.js";import{runOpenNextBuild as Ne}from"./application/openNextBuild.js";import{runOrganisationSetup as Me,ORG_SETUP_PHASES as Ye}from"./organisation/organisationSetup.js";export*from"./builders/index.js";import{buildDeployPlan as He,computeDeployPlan as Qe,computeAssemblyDigest as we,digestHead as je,classifyImpact as We,derivePropertyChanges as qe,isDataLoss as ze,isStatefulResourceType as Xe,renderPlanSummary as Ze,renderPlanLines as $e,summarisePlanRisk as er,toWirePlanChanges as rr,signApprovalToken as tr,verifyApprovalToken as or,DEFAULT_APPROVAL_TTL_MS as ir,APPROVAL_TOKEN_PATTERN as ar}from"./application/plan/index.js";import{runApprovalGate as sr,approvalRefusalReason as lr}from"./application/approvalGate.js";import{runDestructionGate as pr,buildDestructionTicket as mr,evaluateDestructionConsents as ur,computeTicketDigest as fr,legalRemediationVerbs as dr,executableRemediationVerbs as Rr,advertisableRemediationVerbs as Pr,renderDestructionTicketLines as Sr,renderConsentVerdictLines as xr}from"./application/destructionGate.js";import{loadDeployPlan as yr,createMemoisedPlanLoader as Ar}from"./application/plan/loadDeployPlan.js";import{classifyDriftFailure as Er,fetchLastOperationEvents as gr}from"./drift/classifyDriftFailure.js";import{DriftProbe as Or,probePhysicalPresence as vr}from"./drift/driftProbe.js";import{clearDriftSuspects as br,defaultDriftJournalDir as kr,readDriftSuspects as Br,recordDriftSuspects as Lr}from"./drift/driftSuspectJournal.js";import{detectStackDrift as Ir}from"./drift/detectStackDrift.js";import{runDriftPreFlight as hr,formatDriftPreFlightBlock as Gr,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Nr,DRIFT_PREFLIGHT_BUDGET_MS as Kr}from"./drift/driftPreFlight.js";import{runRoute53RecordPreflight as Yr}from"./drift/route53RecordPreflight.js";import{archiveCompletedRemediationJournal as Jr,computeRemediationOpId as Hr,defaultRemediationJournalDir as Qr,findRemediationJournalByOpId as wr,listActiveRemediationOps as jr,listActiveRemediationOpsForContext as Wr,readRemediationJournal as qr,sweepExpiredRemediationJournals as zr,writeRemediationJournal as Xr,REMEDIATION_JOURNAL_RETENTION_DAYS as Zr}from"./remediation/remediationJournal.js";import{captureRemediationForensics as et,defaultRemediationForensicsDir as rt}from"./remediation/forensicsCapture.js";import{applyRetainFlip as ot,composeFlipCapabilities as it,computeTemplateDigest as at,deriveRetainFlipTemplate as nt,findMarkedResourcesByOpId as st,proveFlipMetadataOnly as lt,readRetainFlipState as ct,verifyRetainFlipDiff as pt,FORGET_MARKER_KEY as mt,FORGET_FLIP_SPEC as ut,RECREATE_MARKER_KEY as ft}from"./remediation/retainFlip.js";import{assessForgetResumability as Rt,completeForgetAfterConverge as Pt,completeForgetAfterDeploy as St,formatRecreateInFlightCures as xt,partitionPreFlightByRemediation as Tt,runForgetSurgery as yt,synthTemplateDeclaresResource as At}from"./remediation/forgetResource.js";import{runRecreateSurgery as Et,snapshotPolicyForType as gt,SNAPSHOT_CAPABLE_RESOURCE_TYPES as _t}from"./remediation/recreateResource.js";import{runRecreatePreFlight as vt}from"./remediation/recreatePreFlight.js";import{deriveRemovalTemplate as bt,findRemovalDeletionFailures as kt,findResourcesPresent as Bt,proveRemovalTargetsOnly as Lt}from"./remediation/removalUpdate.js";import{advertisableDriftVerbs as It,buildDriftRepairTicket as Ut,runDriftRepairGate as ht}from"./remediation/driftRepairGate.js";import{formatPinOutcomeDetail as Nt,pinProbeCoverage as Kt,renderPinReportLines as Mt,runPinRemediation as Yt}from"./remediation/pinRemediation.js";import{composePostFailureRepairOffer as Jt,formatDriftRepairOffer as Ht,DriftRepairAvailableError as Qt}from"./remediation/postFailureRepairOffer.js";import{captureLegacySurfaces as jt,decodeLegacyAnchor as Wt,runIdentitySurfaceGate as qt}from"./remediation/pinIdentity.js";import{collectIdentityPinCandidates as Xt,degradedIdentityPinOutcomes as Zt,renderIdentityPinReportLines as $t,runIdentityPinMigration as eo}from"./remediation/migrateIdentity.js";import{checkDeployPathStackAvailability as to,isDeployPathBlockingStatus as oo,StackUnavailableError as io}from"./activeDeploymentGuard.js";import{assertLeaseBeforeStack as no,LeaseDeniedError as so}from"./application/leaseGate.js";export{ar as APPROVAL_TOKEN_PATTERN,ir as DEFAULT_APPROVAL_TTL_MS,Kr as DRIFT_PREFLIGHT_BUDGET_MS,Nr as DRIFT_PREFLIGHT_TRIGGER_STATUSES,Or as DriftProbe,Qt as DriftRepairAvailableError,ut as FORGET_FLIP_SPEC,mt as FORGET_MARKER_KEY,so as LeaseDeniedError,Ye as ORG_SETUP_PHASES,Q as ORG_TRAIL_BUCKET_OUTPUT_KEY,Te as OU_ONLY_ACCOUNT_BUCKETS,O as PRE_EMPTY_TAG_KEYS,ft as RECREATE_MARKER_KEY,Zr as REMEDIATION_JOURNAL_RETENTION_DAYS,F as SAFE_CLEANUP_STATES,_t as SNAPSHOT_CAPABLE_RESOURCE_TYPES,io as StackUnavailableError,w as TRAIL_BUCKET_OUTPUT_KEY,j as TRAIL_KEY_ARN_OUTPUT_KEY,Re as accountsConfigToOUTree,It as advertisableDriftVerbs,Pr as advertisableRemediationVerbs,ot as applyRetainFlip,lr as approvalRefusalReason,Jr as archiveCompletedRemediationJournal,no as assertLeaseBeforeStack,Rt as assessForgetResumability,L as buildAccountRegionPairs,Oe as buildBuildSecretSessionPolicy,He as buildDeployPlan,be as buildDeploySessionPolicy,mr as buildDestructionTicket,Be as buildDomainSessionPolicy,Ut as buildDriftRepairTicket,B as buildRegionList,jt as captureLegacySurfaces,et as captureRemediationForensics,C as cascadeHomeRegion,I as cascadeOperationKey,to as checkDeployPathStackAvailability,Er as classifyDriftFailure,We as classifyImpact,T as cleanupFailedStack,br as clearDriftSuspects,Xt as collectIdentityPinCandidates,Pt as completeForgetAfterConverge,St as completeForgetAfterDeploy,it as composeFlipCapabilities,Jt as composePostFailureRepairOffer,we as computeAssemblyDigest,Qe as computeDeployPlan,Hr as computeRemediationOpId,p as computeSecretsDrift,at as computeTemplateDigest,fr as computeTicketDigest,Ar as createMemoisedPlanLoader,J as decideNextTransition,Wt as decodeLegacyAnchor,q as decommissionMemberTrailStorage,kr as defaultDriftJournalDir,rt as defaultRemediationForensicsDir,Qr as defaultRemediationJournalDir,Zt as degradedIdentityPinOutcomes,t as deploy,U as deployDomains,R as deployOrganisation,qe as derivePropertyChanges,bt as deriveRemovalTemplate,nt as deriveRetainFlipTemplate,m as deriveStaleParameters,i as destroy,S as destroyOrganisation,Ir as detectStackDrift,je as digestHead,y as emptyS3Bucket,le as ensureEnforceSsl,ur as evaluateDestructionConsents,Rr as executableRemediationVerbs,de as extractAllAccountNames,u as extractConsumedSsmParameters,gr as fetchLastOperationEvents,st as findMarkedResourcesByOpId,wr as findRemediationJournalByOpId,kt as findRemovalDeletionFailures,Bt as findResourcesPresent,fe as flattenAccountsToEnvironments,Gr as formatDriftPreFlightBlock,Ht as formatDriftRepairOffer,Nt as formatPinOutcomeDetail,D as formatQuarantineSuspectedMessage,xt as formatRecreateInFlightCures,E as formatRetainedBucketsMessage,Se as isAccountsConfig,v as isCleanableState,ze as isDataLoss,oo as isDeployPathBlockingStatus,te as isEnforceSslStatement,xe as isOuOnlyAccountBucket,g as isQuarantineDetail,_ as isRetainedBucketsDetail,Xe as isStatefulResourceType,Pe as isStringArray,dr as legalRemediationVerbs,jr as listActiveRemediationOps,Wr as listActiveRemediationOpsForContext,yr as loadDeployPlan,Y as mergeReconciledProviderAccounts,ue as parseAccountsConfiguration,k as partitionAccounts,ve as partitionForRegion,Tt as partitionPreFlightByRemediation,Kt as pinProbeCoverage,A as preEmptyStackBuckets,vr as probePhysicalPresence,s as probeSecretsDrift,l as probeServiceDeploymentStatus,N as projectAccountRows,G as projectScalarSummary,lt as proveFlipMetadataOnly,Lt as proveRemovalTargetsOnly,Br as readDriftSuspects,qr as readRemediationJournal,ct as readRetainFlipState,M as reconcileProviderAccounts,H as reconcileTrailMigration,Lr as recordDriftSuspects,xr as renderConsentVerdictLines,Sr as renderDestructionTicketLines,$t as renderIdentityPinReportLines,Mt as renderPinReportLines,$e as renderPlanLines,Ze as renderPlanSummary,Ce as resolveBuildArgs,Ee as resolveBuildSecretSessionProvider,Ae as resolveBuildSecrets,De as resolveSecretRefValue,n as restart,pe as restoreAndReconcileQuarantinedBucket,ne as restoreBucketPolicy,sr as runApprovalGate,pr as runDestructionGate,hr as runDriftPreFlight,ht as runDriftRepairGate,yt as runForgetSurgery,eo as runIdentityPinMigration,qt as runIdentitySurfaceGate,Ne as runOpenNextBuild,Me as runOrganisationSetup,Yt as runPinRemediation,vt as runRecreatePreFlight,Et as runRecreateSurgery,Yr as runRoute53RecordPreflight,tr as signApprovalToken,gt as snapshotPolicyForType,ge as sourcedRefsFromBuildArgs,f as ssmParameterNameFromValueFrom,er as summarisePlanRisk,zr as sweepExpiredRemediationJournals,At as synthTemplateDeclaresResource,se as synthesiseEnforceSslDocument,ie as toResourcePolicyStatements,rr as toWirePlanChanges,re as triageBucketPolicy,X as unlockBucket,$ as unlockQueue,Ue as validateBuildGroup,or as verifyApprovalToken,pt as verifyRetainFlipDiff,Xr as writeRemediationJournal};
+import{deploy as t}from"./deploy.js";import{destroy as i}from"./destroy.js";import{destroyApplicationDirect as n}from"./application/directDestroy.js";import{restart as c,probeSecretsDrift as l,probeServiceDeploymentStatus as p}from"./restart/restartApplication.js";import{computeSecretsDrift as u,deriveStaleParameters as f,extractConsumedSsmParameters as d,ssmParameterNameFromValueFrom as R}from"./restart/secretsDrift.js";import{deployOrganisation as S}from"./organisation/organisationDeploy.js";import{destroyOrganisation as T}from"./organisation/organisationDestroy.js";import{cleanupFailedStack as A,emptyS3Bucket as D,preEmptyStackBuckets as E,formatQuarantineSuspectedMessage as g,formatRetainedBucketsMessage as _,isQuarantineDetail as O,isRetainedBucketsDetail as v,PRE_EMPTY_TAG_KEYS as F,isCleanableState as b,SAFE_CLEANUP_STATES as k}from"./stackCleanup.js";import{partitionAccounts as L,buildRegionList as C,buildAccountRegionPairs as I,cascadeHomeRegion as U,cascadeOperationKey as h,deployDomains as G}from"./organisation/cascadeHelpers.js";import{projectScalarSummary as K,projectAccountRows as M}from"./organisation/cascadeSummary.js";import{reconcileProviderAccounts as V,mergeReconciledProviderAccounts as J}from"./organisation/reconcileProviderAccounts.js";import{decideNextTransition as Q,reconcileTrailMigration as w,ORG_TRAIL_BUCKET_OUTPUT_KEY as j,TRAIL_BUCKET_OUTPUT_KEY as W,TRAIL_KEY_ARN_OUTPUT_KEY as q}from"./trailMigration/trailMigration.js";import{decommissionMemberTrailStorage as X}from"./trailMigration/memberTrailCleanup.js";import{unlockBucket as $}from"./unlock/unlockBucket.js";import{unlockQueue as re}from"./unlock/unlockQueue.js";import{triageBucketPolicy as oe,isEnforceSslStatement as ie}from"./unlock/bucketPolicyTriage.js";import{toResourcePolicyStatements as ne}from"./unlock/toResourcePolicyStatements.js";import{restoreBucketPolicy as ce,synthesiseEnforceSslDocument as le,ensureEnforceSsl as pe}from"./unlock/restoreBucketPolicy.js";import{restoreAndReconcileQuarantinedBucket as ue}from"./unlock/restoreAndReconcileQuarantinedBucket.js";import{parseAccountsConfiguration as de,flattenAccountsToEnvironments as Re,extractAllAccountNames as Pe,accountsConfigToOUTree as Se,isStringArray as xe,isAccountsConfig as Te,isOuOnlyAccountBucket as ye,OU_ONLY_ACCOUNT_BUCKETS as Ae}from"./organisation/accountsConfig.js";import{resolveBuildSecrets as Ee,resolveSecretRefValue as ge,resolveBuildSecretSessionProvider as _e,sourcedRefsFromBuildArgs as Oe}from"./application/buildSecretResolver.js";import{buildBuildSecretSessionPolicy as Fe,partitionForRegion as be}from"./application/buildSecretSession.js";import{buildDeploySessionPolicy as Be}from"./application/deploySessionPolicy.js";import{buildDomainSessionPolicy as Ce}from"./domain/domainSessionPolicy.js";import{resolveBuildArgs as Ue}from"./application/buildArgResolver.js";import{validateBuildGroup as Ge}from"./application/buildGroupValidator.js";export*from"./domain/index.js";import{runOpenNextBuild as Me}from"./application/openNextBuild.js";import{runOrganisationSetup as Ve,ORG_SETUP_PHASES as Je}from"./organisation/organisationSetup.js";export*from"./builders/index.js";import{buildDeployPlan as we,computeDeployPlan as je,computeAssemblyDigest as We,digestHead as qe,classifyImpact as ze,derivePropertyChanges as Xe,isDataLoss as Ze,isStatefulResourceType as $e,renderPlanSummary as er,renderPlanLines as rr,summarisePlanRisk as tr,toWirePlanChanges as or,signApprovalToken as ir,verifyApprovalToken as ar,DEFAULT_APPROVAL_TTL_MS as nr,APPROVAL_TOKEN_PATTERN as sr}from"./application/plan/index.js";import{runApprovalGate as lr,approvalRefusalReason as pr}from"./application/approvalGate.js";import{runDestructionGate as ur,buildDestructionTicket as fr,evaluateDestructionConsents as dr,computeTicketDigest as Rr,legalRemediationVerbs as Pr,executableRemediationVerbs as Sr,advertisableRemediationVerbs as xr,renderDestructionTicketLines as Tr,renderConsentVerdictLines as yr}from"./application/destructionGate.js";import{loadDeployPlan as Dr,createMemoisedPlanLoader as Er}from"./application/plan/loadDeployPlan.js";import{classifyDriftFailure as _r,fetchLastOperationEvents as Or}from"./drift/classifyDriftFailure.js";import{DriftProbe as Fr,probePhysicalPresence as br}from"./drift/driftProbe.js";import{clearDriftSuspects as Br,defaultDriftJournalDir as Lr,readDriftSuspects as Cr,recordDriftSuspects as Ir}from"./drift/driftSuspectJournal.js";import{detectStackDrift as hr}from"./drift/detectStackDrift.js";import{runDriftPreFlight as Nr,formatDriftPreFlightBlock as Kr,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Mr,DRIFT_PREFLIGHT_BUDGET_MS as Yr}from"./drift/driftPreFlight.js";import{runRoute53RecordPreflight as Jr}from"./drift/route53RecordPreflight.js";import{archiveCompletedRemediationJournal as Qr,computeRemediationOpId as wr,defaultRemediationJournalDir as jr,findRemediationJournalByOpId as Wr,listActiveRemediationOps as qr,listActiveRemediationOpsForContext as zr,readRemediationJournal as Xr,sweepExpiredRemediationJournals as Zr,writeRemediationJournal as $r,REMEDIATION_JOURNAL_RETENTION_DAYS as et}from"./remediation/remediationJournal.js";import{captureRemediationForensics as tt,defaultRemediationForensicsDir as ot}from"./remediation/forensicsCapture.js";import{applyRetainFlip as at,composeFlipCapabilities as nt,computeTemplateDigest as st,deriveRetainFlipTemplate as ct,findMarkedResourcesByOpId as lt,proveFlipMetadataOnly as pt,readRetainFlipState as mt,verifyRetainFlipDiff as ut,FORGET_MARKER_KEY as ft,FORGET_FLIP_SPEC as dt,RECREATE_MARKER_KEY as Rt}from"./remediation/retainFlip.js";import{assessForgetResumability as St,completeForgetAfterConverge as xt,completeForgetAfterDeploy as Tt,formatRecreateInFlightCures as yt,partitionPreFlightByRemediation as At,runForgetSurgery as Dt,synthTemplateDeclaresResource as Et}from"./remediation/forgetResource.js";import{runRecreateSurgery as _t,snapshotPolicyForType as Ot,SNAPSHOT_CAPABLE_RESOURCE_TYPES as vt}from"./remediation/recreateResource.js";import{runRecreatePreFlight as bt}from"./remediation/recreatePreFlight.js";import{deriveRemovalTemplate as Bt,findRemovalDeletionFailures as Lt,findResourcesPresent as Ct,proveRemovalTargetsOnly as It}from"./remediation/removalUpdate.js";import{advertisableDriftVerbs as ht,buildDriftRepairTicket as Gt,runDriftRepairGate as Nt}from"./remediation/driftRepairGate.js";import{formatPinOutcomeDetail as Mt,pinProbeCoverage as Yt,renderPinReportLines as Vt,runPinRemediation as Jt}from"./remediation/pinRemediation.js";import{composePostFailureRepairOffer as Qt,formatDriftRepairOffer as wt,DriftRepairAvailableError as jt}from"./remediation/postFailureRepairOffer.js";import{captureLegacySurfaces as qt,decodeLegacyAnchor as zt,runIdentitySurfaceGate as Xt}from"./remediation/pinIdentity.js";import{collectIdentityPinCandidates as $t,degradedIdentityPinOutcomes as eo,renderIdentityPinReportLines as ro,runIdentityPinMigration as to}from"./remediation/migrateIdentity.js";import{checkDeployPathStackAvailability as io,isDeployPathBlockingStatus as ao,StackUnavailableError as no}from"./activeDeploymentGuard.js";import{assertLeaseBeforeStack as co,LeaseDeniedError as lo}from"./application/leaseGate.js";export{sr as APPROVAL_TOKEN_PATTERN,nr as DEFAULT_APPROVAL_TTL_MS,Yr as DRIFT_PREFLIGHT_BUDGET_MS,Mr as DRIFT_PREFLIGHT_TRIGGER_STATUSES,Fr as DriftProbe,jt as DriftRepairAvailableError,dt as FORGET_FLIP_SPEC,ft as FORGET_MARKER_KEY,lo as LeaseDeniedError,Je as ORG_SETUP_PHASES,j as ORG_TRAIL_BUCKET_OUTPUT_KEY,Ae as OU_ONLY_ACCOUNT_BUCKETS,F as PRE_EMPTY_TAG_KEYS,Rt as RECREATE_MARKER_KEY,et as REMEDIATION_JOURNAL_RETENTION_DAYS,k as SAFE_CLEANUP_STATES,vt as SNAPSHOT_CAPABLE_RESOURCE_TYPES,no as StackUnavailableError,W as TRAIL_BUCKET_OUTPUT_KEY,q as TRAIL_KEY_ARN_OUTPUT_KEY,Se as accountsConfigToOUTree,ht as advertisableDriftVerbs,xr as advertisableRemediationVerbs,at as applyRetainFlip,pr as approvalRefusalReason,Qr as archiveCompletedRemediationJournal,co as assertLeaseBeforeStack,St as assessForgetResumability,I as buildAccountRegionPairs,Fe as buildBuildSecretSessionPolicy,we as buildDeployPlan,Be as buildDeploySessionPolicy,fr as buildDestructionTicket,Ce as buildDomainSessionPolicy,Gt as buildDriftRepairTicket,C as buildRegionList,qt as captureLegacySurfaces,tt as captureRemediationForensics,U as cascadeHomeRegion,h as cascadeOperationKey,io as checkDeployPathStackAvailability,_r as classifyDriftFailure,ze as classifyImpact,A as cleanupFailedStack,Br as clearDriftSuspects,$t as collectIdentityPinCandidates,xt as completeForgetAfterConverge,Tt as completeForgetAfterDeploy,nt as composeFlipCapabilities,Qt as composePostFailureRepairOffer,We as computeAssemblyDigest,je as computeDeployPlan,wr as computeRemediationOpId,u as computeSecretsDrift,st as computeTemplateDigest,Rr as computeTicketDigest,Er as createMemoisedPlanLoader,Q as decideNextTransition,zt as decodeLegacyAnchor,X as decommissionMemberTrailStorage,Lr as defaultDriftJournalDir,ot as defaultRemediationForensicsDir,jr as defaultRemediationJournalDir,eo as degradedIdentityPinOutcomes,t as deploy,G as deployDomains,S as deployOrganisation,Xe as derivePropertyChanges,Bt as deriveRemovalTemplate,ct as deriveRetainFlipTemplate,f as deriveStaleParameters,i as destroy,n as destroyApplicationDirect,T as destroyOrganisation,hr as detectStackDrift,qe as digestHead,D as emptyS3Bucket,pe as ensureEnforceSsl,dr as evaluateDestructionConsents,Sr as executableRemediationVerbs,Pe as extractAllAccountNames,d as extractConsumedSsmParameters,Or as fetchLastOperationEvents,lt as findMarkedResourcesByOpId,Wr as findRemediationJournalByOpId,Lt as findRemovalDeletionFailures,Ct as findResourcesPresent,Re as flattenAccountsToEnvironments,Kr as formatDriftPreFlightBlock,wt as formatDriftRepairOffer,Mt as formatPinOutcomeDetail,g as formatQuarantineSuspectedMessage,yt as formatRecreateInFlightCures,_ as formatRetainedBucketsMessage,Te as isAccountsConfig,b as isCleanableState,Ze as isDataLoss,ao as isDeployPathBlockingStatus,ie as isEnforceSslStatement,ye as isOuOnlyAccountBucket,O as isQuarantineDetail,v as isRetainedBucketsDetail,$e as isStatefulResourceType,xe as isStringArray,Pr as legalRemediationVerbs,qr as listActiveRemediationOps,zr as listActiveRemediationOpsForContext,Dr as loadDeployPlan,J as mergeReconciledProviderAccounts,de as parseAccountsConfiguration,L as partitionAccounts,be as partitionForRegion,At as partitionPreFlightByRemediation,Yt as pinProbeCoverage,E as preEmptyStackBuckets,br as probePhysicalPresence,l as probeSecretsDrift,p as probeServiceDeploymentStatus,M as projectAccountRows,K as projectScalarSummary,pt as proveFlipMetadataOnly,It as proveRemovalTargetsOnly,Cr as readDriftSuspects,Xr as readRemediationJournal,mt as readRetainFlipState,V as reconcileProviderAccounts,w as reconcileTrailMigration,Ir as recordDriftSuspects,yr as renderConsentVerdictLines,Tr as renderDestructionTicketLines,ro as renderIdentityPinReportLines,Vt as renderPinReportLines,rr as renderPlanLines,er as renderPlanSummary,Ue as resolveBuildArgs,_e as resolveBuildSecretSessionProvider,Ee as resolveBuildSecrets,ge as resolveSecretRefValue,c as restart,ue as restoreAndReconcileQuarantinedBucket,ce as restoreBucketPolicy,lr as runApprovalGate,ur as runDestructionGate,Nr as runDriftPreFlight,Nt as runDriftRepairGate,Dt as runForgetSurgery,to as runIdentityPinMigration,Xt as runIdentitySurfaceGate,Me as runOpenNextBuild,Ve as runOrganisationSetup,Jt as runPinRemediation,bt as runRecreatePreFlight,_t as runRecreateSurgery,Jr as runRoute53RecordPreflight,ir as signApprovalToken,Ot as snapshotPolicyForType,Oe as sourcedRefsFromBuildArgs,R as ssmParameterNameFromValueFrom,tr as summarisePlanRisk,Zr as sweepExpiredRemediationJournals,Et as synthTemplateDeclaresResource,le as synthesiseEnforceSslDocument,ne as toResourcePolicyStatements,or as toWirePlanChanges,oe as triageBucketPolicy,$ as unlockBucket,re as unlockQueue,Ge as validateBuildGroup,ar as verifyApprovalToken,ut as verifyRetainFlipDiff,$r as writeRemediationJournal};

package/dist/src/types/index.d.ts

@@ -62,7 +62,7 @@ export type { DetectionResult } from "./detection/detection.js";
 export type { ValidationResult } from "./validation.js";
 export type { ProgressCallbacks } from "./ProgressEvent.js";
 export type { ApplicationStack, OrganisationType, DeploymentOperation, ApplicationOperation, OrganisationOperation, DeployOrderOptions, ParallelDeployGroupKey, ParallelDestroyGroupKey } from "./operations.js";
-export { APPLICATION_STACKS, ORGANISATION_TYPES, APPLICATION_DEPLOY_ORDER, APPLICATION_DESTROY_ORDER, OPENNEXT_DEPLOY_ORDER, OPENNEXT_DESTROY_ORDER, PARALLEL_DEPLOY_GROUPS, PARALLEL_DESTROY_GROUPS, OPENNEXT_PARALLEL_GROUPS, isApplicationOperation, isOrganisationOperation, getParallelDeployGroups, getParallelDestroyGroups, getApplicationDeployOrder, getApplicationDestroyOrder, getApplicationStackName, getOrganisationStackName, isApplicationStack, getApplicationStepName, getApplicationStepId, toPascalCase } from "./operations.js";
+export { APPLICATION_STACKS, ORGANISATION_TYPES, APPLICATION_DEPLOY_ORDER, APPLICATION_DESTROY_ORDER, FULL_APPLICATION_DESTROY_ORDER, OPENNEXT_DEPLOY_ORDER, OPENNEXT_DESTROY_ORDER, PARALLEL_DEPLOY_GROUPS, PARALLEL_DESTROY_GROUPS, OPENNEXT_PARALLEL_GROUPS, isApplicationOperation, isOrganisationOperation, getParallelDeployGroups, getParallelDestroyGroups, getApplicationDeployOrder, getApplicationDestroyOrder, getApplicationStackName, getOrganisationStackName, isApplicationStack, getApplicationStepName, getApplicationStepId, toPascalCase } from "./operations.js";
 export type { ParallelDeploymentResult, ParallelDeployGroup, ParallelOperation, ParallelOperationType, ParallelOperationState } from "./deployment/index.js";
 export { PARALLEL_OPERATION_TYPES } from "./deployment/index.js";
 export type { OpenNextPattern, AppResourceFlags } from "./detection/patternTypes.js";

package/dist/src/types/index.js

@@ -1 +1 @@
-import{DeploymentEventSchema as S,DEPLOYMENT_EVENT_TYPES as _,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as T,DEPLOYMENT_EVENT_STATUS_REASON_MAX as A,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as t,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as r,DEPLOYMENT_ERROR_MESSAGE_MAX as o,CASCADE_PHASES as a,CASCADE_ACCOUNT_STATUSES as R,toCascadePhase as O,clampDeploymentEventStrings as P,truncateUtf16Safe as i}from"./deploymentEventSchema.js";import{isQuarantineDetail as D,isRetainedBucketsDetail as c}from"./callbacks.js";import{DeployEventSchema as L,StepProgressSchema as m,DeployResourceSchema as p,PlanChangeSchema as C,PlanPropertyChangeSchema as I,ChangeCountsSchema as l,DEPLOY_EVENT_CONTRACT as s,DEPLOY_EVENT_CONTRACT_MAJOR as M,DEPLOY_EVENT_CONTRACT_MINOR as h,SUPPORTED_CONTRACT_MARKERS as V,DEPLOY_EVENT_ID_MAX as d,DEPLOY_EVENT_NAME_MAX as U,DEPLOY_EVENT_MESSAGE_MAX as Y,DEPLOY_EVENT_STATUS_REASON_MAX as f,DEPLOY_EVENT_ERROR_MESSAGE_MAX as u,DEPLOY_EVENT_TRAIL_DETAIL_MAX as g,DEPLOY_EVENT_OUTPUT_MAX as G,DEPLOY_EVENT_ARN_MAX as x,DEPLOY_EVENT_URL_MAX as X,STEP_COMPLETE_STATUSES as y,LOG_LEVELS as F,STACK_CLEANUP_PHASES as K,CASCADE_ACCOUNT_PHASES as k,DEPLOY_RESULTS as H,DETECTION_PHASES as b,PHASE_STATUSES as v,BUILDERS as J,CASCADE_OUTCOME_RESULTS as B,PLAN_ACTIONS as W,REPLACEMENT_MODES as w,APPROVAL_KINDS as Q,APPROVAL_DECISIONS as j,ALL_PROGRESS_KINDS as q}from"./deployEvent.js";import{createDeployEmitter as Z}from"./deployEmitter.js";import{parseDeployEvent as EE,parseDeployContractVersion as eE}from"./deployEventParse.js";import{TRAIL_MIGRATION_PHASES as _E,TRAIL_MIGRATION_STATUSES as TE}from"./events.js";import{RemediationVerbSchema as tE,REMEDIATION_VERB_GLOSS as rE,IDENTITY_PIN_SLOT_SWAP_GLOSS as oE,DestructionFindingSchema as aE,DestructionTicketResourceSchema as RE,DestructionTicketSchema as OE,DestructionConsentSchema as PE,DestructionOutcomeSchema as iE,DESTRUCTION_FINDINGS as NE,CONSENT_VERDICTS as DE,TICKET_VERDICT_SOURCES as cE,TicketVerdictSourceSchema as nE}from"./destruction.js";import{DRIFT_VERDICTS as mE,DriftVerdictSchema as pE,DriftSuspectSchema as CE,DriftFindingSchema as IE,DriftJournalRecordSchema as lE,verbsForDriftVerdict as sE}from"./drift.js";import{REMEDIATION_PHASES as hE,RemediationPhaseSchema as VE,RemediationTargetSchema as dE,RemediationFlipProofSchema as UE,RemediationJournalRecordSchema as YE,RemediationJournalVerbSchema as fE,RemediationVerbWithSurgerySchema as uE,PinnedSlotRecordSchema as gE,remediationPhaseRank as GE,remediationPlaceholderPhysicalId as xE,isRemediationPlaceholderPhysicalId as XE}from"./remediation.js";import{stubCallerIdentity as FE}from"./deployment/index.js";import{APPLICATION_STACKS as kE,ORGANISATION_TYPES as HE,APPLICATION_DEPLOY_ORDER as bE,APPLICATION_DESTROY_ORDER as vE,OPENNEXT_DEPLOY_ORDER as JE,OPENNEXT_DESTROY_ORDER as BE,PARALLEL_DEPLOY_GROUPS as WE,PARALLEL_DESTROY_GROUPS as wE,OPENNEXT_PARALLEL_GROUPS as QE,isApplicationOperation as jE,isOrganisationOperation as qE,getParallelDeployGroups as zE,getParallelDestroyGroups as ZE,getApplicationDeployOrder as $E,getApplicationDestroyOrder as Ee,getApplicationStackName as ee,getOrganisationStackName as Se,isApplicationStack as _e,getApplicationStepName as Te,getApplicationStepId as Ae,toPascalCase as te}from"./operations.js";import{PARALLEL_OPERATION_TYPES as oe}from"./deployment/index.js";import{isOpenNextPattern as Re,OPENNEXT_PATTERNS as Oe}from"./detection/patternTypes.js";import{STACK_NOT_FOUND_PATTERN as ie,STACK_FAILED_STATE_PATTERN as Ne,CDK_NO_STACKS_MATCH as De,INFRASTRUCTURE_FILENAME as ce}from"./constants.js";import{ApplicationError as Le,wrapApplicationError as me}from"./application/index.js";import{STEP_IDS as Ce,STEP_NAMES as Ie,INFRASTRUCTURE_STEP_NAMES as le,INFRA_STEP_NAME as se}from"./stepDefinitions.js";export{q as ALL_PROGRESS_KINDS,bE as APPLICATION_DEPLOY_ORDER,vE as APPLICATION_DESTROY_ORDER,kE as APPLICATION_STACKS,j as APPROVAL_DECISIONS,Q as APPROVAL_KINDS,Le as ApplicationError,J as BUILDERS,k as CASCADE_ACCOUNT_PHASES,R as CASCADE_ACCOUNT_STATUSES,B as CASCADE_OUTCOME_RESULTS,a as CASCADE_PHASES,De as CDK_NO_STACKS_MATCH,DE as CONSENT_VERDICTS,l as ChangeCountsSchema,o as DEPLOYMENT_ERROR_MESSAGE_MAX,t as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,T as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,A as DEPLOYMENT_EVENT_STATUS_REASON_MAX,r as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,_ as DEPLOYMENT_EVENT_TYPES,x as DEPLOY_EVENT_ARN_MAX,s as DEPLOY_EVENT_CONTRACT,M as DEPLOY_EVENT_CONTRACT_MAJOR,h as DEPLOY_EVENT_CONTRACT_MINOR,u as DEPLOY_EVENT_ERROR_MESSAGE_MAX,d as DEPLOY_EVENT_ID_MAX,Y as DEPLOY_EVENT_MESSAGE_MAX,U as DEPLOY_EVENT_NAME_MAX,G as DEPLOY_EVENT_OUTPUT_MAX,f as DEPLOY_EVENT_STATUS_REASON_MAX,g as DEPLOY_EVENT_TRAIL_DETAIL_MAX,X as DEPLOY_EVENT_URL_MAX,H as DEPLOY_RESULTS,NE as DESTRUCTION_FINDINGS,b as DETECTION_PHASES,mE as DRIFT_VERDICTS,L as DeployEventSchema,p as DeployResourceSchema,S as DeploymentEventSchema,PE as DestructionConsentSchema,aE as DestructionFindingSchema,iE as DestructionOutcomeSchema,RE as DestructionTicketResourceSchema,OE as DestructionTicketSchema,IE as DriftFindingSchema,lE as DriftJournalRecordSchema,CE as DriftSuspectSchema,pE as DriftVerdictSchema,oE as IDENTITY_PIN_SLOT_SWAP_GLOSS,ce as INFRASTRUCTURE_FILENAME,le as INFRASTRUCTURE_STEP_NAMES,se as INFRA_STEP_NAME,F as LOG_LEVELS,JE as OPENNEXT_DEPLOY_ORDER,BE as OPENNEXT_DESTROY_ORDER,QE as OPENNEXT_PARALLEL_GROUPS,Oe as OPENNEXT_PATTERNS,HE as ORGANISATION_TYPES,WE as PARALLEL_DEPLOY_GROUPS,wE as PARALLEL_DESTROY_GROUPS,oe as PARALLEL_OPERATION_TYPES,v as PHASE_STATUSES,W as PLAN_ACTIONS,gE as PinnedSlotRecordSchema,C as PlanChangeSchema,I as PlanPropertyChangeSchema,hE as REMEDIATION_PHASES,rE as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,UE as RemediationFlipProofSchema,YE as RemediationJournalRecordSchema,fE as RemediationJournalVerbSchema,VE as RemediationPhaseSchema,dE as RemediationTargetSchema,tE as RemediationVerbSchema,uE as RemediationVerbWithSurgerySchema,K as STACK_CLEANUP_PHASES,Ne as STACK_FAILED_STATE_PATTERN,ie as STACK_NOT_FOUND_PATTERN,y as STEP_COMPLETE_STATUSES,Ce as STEP_IDS,Ie as STEP_NAMES,V as SUPPORTED_CONTRACT_MARKERS,m as StepProgressSchema,cE as TICKET_VERDICT_SOURCES,_E as TRAIL_MIGRATION_PHASES,TE as TRAIL_MIGRATION_STATUSES,nE as TicketVerdictSourceSchema,P as clampDeploymentEventStrings,Z as createDeployEmitter,$E as getApplicationDeployOrder,Ee as getApplicationDestroyOrder,ee as getApplicationStackName,Ae as getApplicationStepId,Te as getApplicationStepName,Se as getOrganisationStackName,zE as getParallelDeployGroups,ZE as getParallelDestroyGroups,jE as isApplicationOperation,_e as isApplicationStack,Re as isOpenNextPattern,qE as isOrganisationOperation,D as isQuarantineDetail,XE as isRemediationPlaceholderPhysicalId,c as isRetainedBucketsDetail,eE as parseDeployContractVersion,EE as parseDeployEvent,GE as remediationPhaseRank,xE as remediationPlaceholderPhysicalId,FE as stubCallerIdentity,O as toCascadePhase,te as toPascalCase,i as truncateUtf16Safe,sE as verbsForDriftVerdict,me as wrapApplicationError};
+import{DeploymentEventSchema as S,DEPLOYMENT_EVENT_TYPES as _,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as T,DEPLOYMENT_EVENT_STATUS_REASON_MAX as A,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as t,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as r,DEPLOYMENT_ERROR_MESSAGE_MAX as o,CASCADE_PHASES as a,CASCADE_ACCOUNT_STATUSES as R,toCascadePhase as O,clampDeploymentEventStrings as P,truncateUtf16Safe as N}from"./deploymentEventSchema.js";import{isQuarantineDetail as D,isRetainedBucketsDetail as c}from"./callbacks.js";import{DeployEventSchema as n,StepProgressSchema as m,DeployResourceSchema as p,PlanChangeSchema as C,PlanPropertyChangeSchema as I,ChangeCountsSchema as l,DEPLOY_EVENT_CONTRACT as s,DEPLOY_EVENT_CONTRACT_MAJOR as M,DEPLOY_EVENT_CONTRACT_MINOR as h,SUPPORTED_CONTRACT_MARKERS as V,DEPLOY_EVENT_ID_MAX as U,DEPLOY_EVENT_NAME_MAX as Y,DEPLOY_EVENT_MESSAGE_MAX as d,DEPLOY_EVENT_STATUS_REASON_MAX as f,DEPLOY_EVENT_ERROR_MESSAGE_MAX as u,DEPLOY_EVENT_TRAIL_DETAIL_MAX as g,DEPLOY_EVENT_OUTPUT_MAX as G,DEPLOY_EVENT_ARN_MAX as x,DEPLOY_EVENT_URL_MAX as X,STEP_COMPLETE_STATUSES as y,LOG_LEVELS as F,STACK_CLEANUP_PHASES as K,CASCADE_ACCOUNT_PHASES as k,DEPLOY_RESULTS as H,DETECTION_PHASES as b,PHASE_STATUSES as v,BUILDERS as J,CASCADE_OUTCOME_RESULTS as B,PLAN_ACTIONS as W,REPLACEMENT_MODES as w,APPROVAL_KINDS as Q,APPROVAL_DECISIONS as j,ALL_PROGRESS_KINDS as q}from"./deployEvent.js";import{createDeployEmitter as Z}from"./deployEmitter.js";import{parseDeployEvent as EE,parseDeployContractVersion as eE}from"./deployEventParse.js";import{TRAIL_MIGRATION_PHASES as _E,TRAIL_MIGRATION_STATUSES as TE}from"./events.js";import{RemediationVerbSchema as tE,REMEDIATION_VERB_GLOSS as rE,IDENTITY_PIN_SLOT_SWAP_GLOSS as oE,DestructionFindingSchema as aE,DestructionTicketResourceSchema as RE,DestructionTicketSchema as OE,DestructionConsentSchema as PE,DestructionOutcomeSchema as NE,DESTRUCTION_FINDINGS as iE,CONSENT_VERDICTS as DE,TICKET_VERDICT_SOURCES as cE,TicketVerdictSourceSchema as LE}from"./destruction.js";import{DRIFT_VERDICTS as mE,DriftVerdictSchema as pE,DriftSuspectSchema as CE,DriftFindingSchema as IE,DriftJournalRecordSchema as lE,verbsForDriftVerdict as sE}from"./drift.js";import{REMEDIATION_PHASES as hE,RemediationPhaseSchema as VE,RemediationTargetSchema as UE,RemediationFlipProofSchema as YE,RemediationJournalRecordSchema as dE,RemediationJournalVerbSchema as fE,RemediationVerbWithSurgerySchema as uE,PinnedSlotRecordSchema as gE,remediationPhaseRank as GE,remediationPlaceholderPhysicalId as xE,isRemediationPlaceholderPhysicalId as XE}from"./remediation.js";import{stubCallerIdentity as FE}from"./deployment/index.js";import{APPLICATION_STACKS as kE,ORGANISATION_TYPES as HE,APPLICATION_DEPLOY_ORDER as bE,APPLICATION_DESTROY_ORDER as vE,FULL_APPLICATION_DESTROY_ORDER as JE,OPENNEXT_DEPLOY_ORDER as BE,OPENNEXT_DESTROY_ORDER as WE,PARALLEL_DEPLOY_GROUPS as wE,PARALLEL_DESTROY_GROUPS as QE,OPENNEXT_PARALLEL_GROUPS as jE,isApplicationOperation as qE,isOrganisationOperation as zE,getParallelDeployGroups as ZE,getParallelDestroyGroups as $E,getApplicationDeployOrder as Ee,getApplicationDestroyOrder as ee,getApplicationStackName as Se,getOrganisationStackName as _e,isApplicationStack as Te,getApplicationStepName as Ae,getApplicationStepId as te,toPascalCase as re}from"./operations.js";import{PARALLEL_OPERATION_TYPES as ae}from"./deployment/index.js";import{isOpenNextPattern as Oe,OPENNEXT_PATTERNS as Pe}from"./detection/patternTypes.js";import{STACK_NOT_FOUND_PATTERN as ie,STACK_FAILED_STATE_PATTERN as De,CDK_NO_STACKS_MATCH as ce,INFRASTRUCTURE_FILENAME as Le}from"./constants.js";import{ApplicationError as me,wrapApplicationError as pe}from"./application/index.js";import{STEP_IDS as Ie,STEP_NAMES as le,INFRASTRUCTURE_STEP_NAMES as se,INFRA_STEP_NAME as Me}from"./stepDefinitions.js";export{q as ALL_PROGRESS_KINDS,bE as APPLICATION_DEPLOY_ORDER,vE as APPLICATION_DESTROY_ORDER,kE as APPLICATION_STACKS,j as APPROVAL_DECISIONS,Q as APPROVAL_KINDS,me as ApplicationError,J as BUILDERS,k as CASCADE_ACCOUNT_PHASES,R as CASCADE_ACCOUNT_STATUSES,B as CASCADE_OUTCOME_RESULTS,a as CASCADE_PHASES,ce as CDK_NO_STACKS_MATCH,DE as CONSENT_VERDICTS,l as ChangeCountsSchema,o as DEPLOYMENT_ERROR_MESSAGE_MAX,t as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,T as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,A as DEPLOYMENT_EVENT_STATUS_REASON_MAX,r as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,_ as DEPLOYMENT_EVENT_TYPES,x as DEPLOY_EVENT_ARN_MAX,s as DEPLOY_EVENT_CONTRACT,M as DEPLOY_EVENT_CONTRACT_MAJOR,h as DEPLOY_EVENT_CONTRACT_MINOR,u as DEPLOY_EVENT_ERROR_MESSAGE_MAX,U as DEPLOY_EVENT_ID_MAX,d as DEPLOY_EVENT_MESSAGE_MAX,Y as DEPLOY_EVENT_NAME_MAX,G as DEPLOY_EVENT_OUTPUT_MAX,f as DEPLOY_EVENT_STATUS_REASON_MAX,g as DEPLOY_EVENT_TRAIL_DETAIL_MAX,X as DEPLOY_EVENT_URL_MAX,H as DEPLOY_RESULTS,iE as DESTRUCTION_FINDINGS,b as DETECTION_PHASES,mE as DRIFT_VERDICTS,n as DeployEventSchema,p as DeployResourceSchema,S as DeploymentEventSchema,PE as DestructionConsentSchema,aE as DestructionFindingSchema,NE as DestructionOutcomeSchema,RE as DestructionTicketResourceSchema,OE as DestructionTicketSchema,IE as DriftFindingSchema,lE as DriftJournalRecordSchema,CE as DriftSuspectSchema,pE as DriftVerdictSchema,JE as FULL_APPLICATION_DESTROY_ORDER,oE as IDENTITY_PIN_SLOT_SWAP_GLOSS,Le as INFRASTRUCTURE_FILENAME,se as INFRASTRUCTURE_STEP_NAMES,Me as INFRA_STEP_NAME,F as LOG_LEVELS,BE as OPENNEXT_DEPLOY_ORDER,WE as OPENNEXT_DESTROY_ORDER,jE as OPENNEXT_PARALLEL_GROUPS,Pe as OPENNEXT_PATTERNS,HE as ORGANISATION_TYPES,wE as PARALLEL_DEPLOY_GROUPS,QE as PARALLEL_DESTROY_GROUPS,ae as PARALLEL_OPERATION_TYPES,v as PHASE_STATUSES,W as PLAN_ACTIONS,gE as PinnedSlotRecordSchema,C as PlanChangeSchema,I as PlanPropertyChangeSchema,hE as REMEDIATION_PHASES,rE as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,YE as RemediationFlipProofSchema,dE as RemediationJournalRecordSchema,fE as RemediationJournalVerbSchema,VE as RemediationPhaseSchema,UE as RemediationTargetSchema,tE as RemediationVerbSchema,uE as RemediationVerbWithSurgerySchema,K as STACK_CLEANUP_PHASES,De as STACK_FAILED_STATE_PATTERN,ie as STACK_NOT_FOUND_PATTERN,y as STEP_COMPLETE_STATUSES,Ie as STEP_IDS,le as STEP_NAMES,V as SUPPORTED_CONTRACT_MARKERS,m as StepProgressSchema,cE as TICKET_VERDICT_SOURCES,_E as TRAIL_MIGRATION_PHASES,TE as TRAIL_MIGRATION_STATUSES,LE as TicketVerdictSourceSchema,P as clampDeploymentEventStrings,Z as createDeployEmitter,Ee as getApplicationDeployOrder,ee as getApplicationDestroyOrder,Se as getApplicationStackName,te as getApplicationStepId,Ae as getApplicationStepName,_e as getOrganisationStackName,ZE as getParallelDeployGroups,$E as getParallelDestroyGroups,qE as isApplicationOperation,Te as isApplicationStack,Oe as isOpenNextPattern,zE as isOrganisationOperation,D as isQuarantineDetail,XE as isRemediationPlaceholderPhysicalId,c as isRetainedBucketsDetail,eE as parseDeployContractVersion,EE as parseDeployEvent,GE as remediationPhaseRank,xE as remediationPlaceholderPhysicalId,FE as stubCallerIdentity,O as toCascadePhase,re as toPascalCase,N as truncateUtf16Safe,sE as verbsForDriftVerdict,pe as wrapApplicationError};

package/dist/src/types/operations.d.ts

@@ -74,6 +74,16 @@ export declare const OPENNEXT_DEPLOY_ORDER: readonly ApplicationStack[];
  * CDN must be destroyed first as it depends on Compute, then work backwards
  */
 export declare const OPENNEXT_DESTROY_ORDER: readonly ApplicationStack[];
+/**
+ * Superset destroy order over EVERY application stack, for SDK-direct
+ * destroys that probe live stacks instead of synthesising (no pattern or
+ * resource flags in hand). Ordering constraints carried over: Cdn before
+ * Compute (the distribution references it), UsEast1Certificates immediately
+ * after Cdn (the cross-region certificate reference must die first), Network
+ * last (everything depends on it). Stacks absent from the account are
+ * skipped by the probe, so the extra members cost one DescribeStacks each.
+ */
+export declare const FULL_APPLICATION_DESTROY_ORDER: readonly ["Cdn", "UsEast1Certificates", "Compute", "Database", "Messaging", "Storage", "Network"];
 /**
  * Parallel deployment groups for concurrent stack deployment
  * Stacks within each phase can be deployed in parallel.

package/dist/src/types/operations.js

@@ -1 +1 @@
-var _=Object.defineProperty;var a=(e,s)=>_(e,"name",{value:s,configurable:!0});import{isOpenNextPattern as c}from"./detection/patternTypes.js";import{STEP_IDS as o}from"./stepDefinitions.js";import{toPascalCase as p}from"@fjall/util";const t={NETWORK:"Network",DATABASE:"Database",STORAGE:"Storage",COMPUTE:"Compute",US_EAST_1_CERTIFICATES:"UsEast1Certificates",CDN:"Cdn",MESSAGING:"Messaging"},U={ORGANISATION:"organisation",PLATFORM:"platform",ACCOUNT:"account"};function h(e){return e.kind==="application"}a(h,"isApplicationOperation");function L(e){return e.kind==="organisation"}a(L,"isOrganisationOperation");const C=[t.NETWORK,t.DATABASE,t.COMPUTE],P=[t.COMPUTE,t.DATABASE,t.NETWORK],N=[t.NETWORK,t.STORAGE,t.MESSAGING,t.DATABASE,t.COMPUTE,t.CDN],R=[t.CDN,t.COMPUTE,t.DATABASE,t.MESSAGING,t.STORAGE,t.NETWORK],E={PHASE_1:{phase:1,stacks:[t.NETWORK],description:"Network infrastructure"},PHASE_2:{phase:2,stacks:[t.STORAGE,t.MESSAGING,t.DATABASE],description:"Storage and database resources (parallel)"},PHASE_3:{phase:3,stacks:[t.COMPUTE],description:"Compute resources"},PHASE_4:{phase:4,stacks:[t.CDN],description:"CDN distribution"}},M={NEXTJS_PARALLEL:{stacks:[t.STORAGE,t.MESSAGING,t.DATABASE],includeBuild:!0,description:"Build + Storage/Messaging/Database (parallel)"},PAYLOAD_PARALLEL:{stacks:[t.STORAGE,t.MESSAGING],includeBuild:!0,description:"Build + Storage/Messaging (parallel)"}};function x(){return[E.PHASE_1,E.PHASE_2,E.PHASE_3,E.PHASE_4]}a(x,"getParallelDeployGroups");const A={PHASE_1:{phase:1,stacks:[t.CDN],description:"CDN distribution"},PHASE_2:{phase:2,stacks:[t.COMPUTE],description:"Compute resources"},PHASE_3:{phase:3,stacks:[t.DATABASE,t.MESSAGING,t.STORAGE],description:"Database, messaging, and storage (parallel)"},PHASE_4:{phase:4,stacks:[t.NETWORK],description:"Network infrastructure"}};function k(e){const s=[A.PHASE_1,A.PHASE_2,A.PHASE_3,A.PHASE_4];return e?.hasUsEast1Certificates===!0&&s.splice(1,0,{phase:1.5,stacks:[t.US_EAST_1_CERTIFICATES],description:"us-east-1 certificates"}),s}a(k,"getParallelDestroyGroups");const T={Network:1,Storage:2,Messaging:2,Database:2,Compute:3,UsEast1Certificates:4,Cdn:5};function y(e){const{pattern:s,resources:r}=e??{};return c(s)?u(N,r,"deploy"):r?O(r,"asc"):C}a(y,"getApplicationDeployOrder");function m(e){const{pattern:s,resources:r}=e??{};return c(s)?u(R,r,"destroy"):r?O(r,"desc"):P}a(m,"getApplicationDestroyOrder");function u(e,s,r){if(s?.hasUsEast1Certificates!==!0)return e;const n=e.indexOf(t.CDN);if(n===-1)return[...e,t.US_EAST_1_CERTIFICATES];const i=r==="deploy"?n:n+1;return[...e.slice(0,i),t.US_EAST_1_CERTIFICATES,...e.slice(i)]}a(u,"withUsEast1Certificates");function O(e,s){const r=[];return e.hasNetwork&&r.push(t.NETWORK),e.hasStorage&&r.push(t.STORAGE),e.hasMessaging&&r.push(t.MESSAGING),e.hasDatabase&&r.push(t.DATABASE),e.hasCompute&&r.push(t.COMPUTE),e.hasUsEast1Certificates===!0&&r.push(t.US_EAST_1_CERTIFICATES),e.hasCdn&&r.push(t.CDN),r.sort((n,i)=>{const S=T[n]-T[i];return s==="asc"?S:-S})}a(O,"buildOrderFromResources");function B(e,s){return`${p(e)}${s}`}a(B,"getApplicationStackName");function H(e){switch(e){case"organisation":return"Organisation";case"platform":return"Platform";case"account":return"Account";default:{const s=e;throw new Error(`Unsupported organisation type: ${String(s)}`)}}}a(H,"getOrganisationStackName");const D=new Set(Object.values(t));function Y(e){return D.has(e)}a(Y,"isApplicationStack");const d={Network:"network",Database:"database",Storage:"storage",Compute:"compute",UsEast1Certificates:"us-east-1 certificate",Cdn:"cdn",Messaging:"messaging"};function b(e,s){return`${s==="deploy"?"Deploying":"Destroying"} ${d[e]} infrastructure`}a(b,"getApplicationStepName");const l={[t.NETWORK]:{deploy:o.NETWORK,destroy:o.NETWORK_DESTROY},[t.DATABASE]:{deploy:o.DATABASE,destroy:o.DATABASE_DESTROY},[t.STORAGE]:{deploy:o.STORAGE,destroy:o.STORAGE_DESTROY},[t.COMPUTE]:{deploy:o.COMPUTE,destroy:o.COMPUTE_DESTROY},[t.US_EAST_1_CERTIFICATES]:{deploy:o.US_EAST_1_CERTIFICATES,destroy:o.US_EAST_1_CERTIFICATES_DESTROY},[t.CDN]:{deploy:o.CDN,destroy:o.CDN_DESTROY},[t.MESSAGING]:{deploy:o.MESSAGING,destroy:o.MESSAGING_DESTROY}};function K(e,s){return l[e][s]}a(K,"getApplicationStepId");export{C as APPLICATION_DEPLOY_ORDER,P as APPLICATION_DESTROY_ORDER,t as APPLICATION_STACKS,N as OPENNEXT_DEPLOY_ORDER,R as OPENNEXT_DESTROY_ORDER,M as OPENNEXT_PARALLEL_GROUPS,U as ORGANISATION_TYPES,E as PARALLEL_DEPLOY_GROUPS,A as PARALLEL_DESTROY_GROUPS,y as getApplicationDeployOrder,m as getApplicationDestroyOrder,B as getApplicationStackName,K as getApplicationStepId,b as getApplicationStepName,H as getOrganisationStackName,x as getParallelDeployGroups,k as getParallelDestroyGroups,h as isApplicationOperation,Y as isApplicationStack,L as isOrganisationOperation,p as toPascalCase};
+var _=Object.defineProperty;var a=(e,s)=>_(e,"name",{value:s,configurable:!0});import{isOpenNextPattern as T}from"./detection/patternTypes.js";import{STEP_IDS as o}from"./stepDefinitions.js";import{toPascalCase as c}from"@fjall/util";const t={NETWORK:"Network",DATABASE:"Database",STORAGE:"Storage",COMPUTE:"Compute",US_EAST_1_CERTIFICATES:"UsEast1Certificates",CDN:"Cdn",MESSAGING:"Messaging"},L={ORGANISATION:"organisation",PLATFORM:"platform",ACCOUNT:"account"};function h(e){return e.kind==="application"}a(h,"isApplicationOperation");function M(e){return e.kind==="organisation"}a(M,"isOrganisationOperation");const C=[t.NETWORK,t.DATABASE,t.COMPUTE],P=[t.COMPUTE,t.DATABASE,t.NETWORK],R=[t.NETWORK,t.STORAGE,t.MESSAGING,t.DATABASE,t.COMPUTE,t.CDN],N=[t.CDN,t.COMPUTE,t.DATABASE,t.MESSAGING,t.STORAGE,t.NETWORK],x=[t.CDN,t.US_EAST_1_CERTIFICATES,t.COMPUTE,t.DATABASE,t.MESSAGING,t.STORAGE,t.NETWORK],D=!0,i={PHASE_1:{phase:1,stacks:[t.NETWORK],description:"Network infrastructure"},PHASE_2:{phase:2,stacks:[t.STORAGE,t.MESSAGING,t.DATABASE],description:"Storage and database resources (parallel)"},PHASE_3:{phase:3,stacks:[t.COMPUTE],description:"Compute resources"},PHASE_4:{phase:4,stacks:[t.CDN],description:"CDN distribution"}},y={NEXTJS_PARALLEL:{stacks:[t.STORAGE,t.MESSAGING,t.DATABASE],includeBuild:!0,description:"Build + Storage/Messaging/Database (parallel)"},PAYLOAD_PARALLEL:{stacks:[t.STORAGE,t.MESSAGING],includeBuild:!0,description:"Build + Storage/Messaging (parallel)"}};function k(){return[i.PHASE_1,i.PHASE_2,i.PHASE_3,i.PHASE_4]}a(k,"getParallelDeployGroups");const A={PHASE_1:{phase:1,stacks:[t.CDN],description:"CDN distribution"},PHASE_2:{phase:2,stacks:[t.COMPUTE],description:"Compute resources"},PHASE_3:{phase:3,stacks:[t.DATABASE,t.MESSAGING,t.STORAGE],description:"Database, messaging, and storage (parallel)"},PHASE_4:{phase:4,stacks:[t.NETWORK],description:"Network infrastructure"}};function m(e){const s=[A.PHASE_1,A.PHASE_2,A.PHASE_3,A.PHASE_4];return e?.hasUsEast1Certificates===!0&&s.splice(1,0,{phase:1.5,stacks:[t.US_EAST_1_CERTIFICATES],description:"us-east-1 certificates"}),s}a(m,"getParallelDestroyGroups");const p={Network:1,Storage:2,Messaging:2,Database:2,Compute:3,UsEast1Certificates:4,Cdn:5};function B(e){const{pattern:s,resources:r}=e??{};return T(s)?O(R,r,"deploy"):r?u(r,"asc"):C}a(B,"getApplicationDeployOrder");function Y(e){const{pattern:s,resources:r}=e??{};return T(s)?O(N,r,"destroy"):r?u(r,"desc"):P}a(Y,"getApplicationDestroyOrder");function O(e,s,r){if(s?.hasUsEast1Certificates!==!0)return e;const E=e.indexOf(t.CDN);if(E===-1)return[...e,t.US_EAST_1_CERTIFICATES];const n=r==="deploy"?E:E+1;return[...e.slice(0,n),t.US_EAST_1_CERTIFICATES,...e.slice(n)]}a(O,"withUsEast1Certificates");function u(e,s){const r=[];return e.hasNetwork&&r.push(t.NETWORK),e.hasStorage&&r.push(t.STORAGE),e.hasMessaging&&r.push(t.MESSAGING),e.hasDatabase&&r.push(t.DATABASE),e.hasCompute&&r.push(t.COMPUTE),e.hasUsEast1Certificates===!0&&r.push(t.US_EAST_1_CERTIFICATES),e.hasCdn&&r.push(t.CDN),r.sort((E,n)=>{const S=p[E]-p[n];return s==="asc"?S:-S})}a(u,"buildOrderFromResources");function H(e,s){return`${c(e)}${s}`}a(H,"getApplicationStackName");function K(e){switch(e){case"organisation":return"Organisation";case"platform":return"Platform";case"account":return"Account";default:{const s=e;throw new Error(`Unsupported organisation type: ${String(s)}`)}}}a(K,"getOrganisationStackName");const d=new Set(Object.values(t));function b(e){return d.has(e)}a(b,"isApplicationStack");const l={Network:"network",Database:"database",Storage:"storage",Compute:"compute",UsEast1Certificates:"us-east-1 certificate",Cdn:"cdn",Messaging:"messaging"};function F(e,s){return`${s==="deploy"?"Deploying":"Destroying"} ${l[e]} infrastructure`}a(F,"getApplicationStepName");const I={[t.NETWORK]:{deploy:o.NETWORK,destroy:o.NETWORK_DESTROY},[t.DATABASE]:{deploy:o.DATABASE,destroy:o.DATABASE_DESTROY},[t.STORAGE]:{deploy:o.STORAGE,destroy:o.STORAGE_DESTROY},[t.COMPUTE]:{deploy:o.COMPUTE,destroy:o.COMPUTE_DESTROY},[t.US_EAST_1_CERTIFICATES]:{deploy:o.US_EAST_1_CERTIFICATES,destroy:o.US_EAST_1_CERTIFICATES_DESTROY},[t.CDN]:{deploy:o.CDN,destroy:o.CDN_DESTROY},[t.MESSAGING]:{deploy:o.MESSAGING,destroy:o.MESSAGING_DESTROY}};function w(e,s){return I[e][s]}a(w,"getApplicationStepId");export{C as APPLICATION_DEPLOY_ORDER,P as APPLICATION_DESTROY_ORDER,t as APPLICATION_STACKS,x as FULL_APPLICATION_DESTROY_ORDER,R as OPENNEXT_DEPLOY_ORDER,N as OPENNEXT_DESTROY_ORDER,y as OPENNEXT_PARALLEL_GROUPS,L as ORGANISATION_TYPES,i as PARALLEL_DEPLOY_GROUPS,A as PARALLEL_DESTROY_GROUPS,B as getApplicationDeployOrder,Y as getApplicationDestroyOrder,H as getApplicationStackName,w as getApplicationStepId,F as getApplicationStepName,K as getOrganisationStackName,k as getParallelDeployGroups,m as getParallelDestroyGroups,h as isApplicationOperation,b as isApplicationStack,M as isOrganisationOperation,c as toPascalCase};

package/dist/src/util/sleepAbortable.d.ts

@@ -1,8 +1 @@
-/**
- * Promise-based sleep that short-circuits when the supplied abort signal
- * fires. Long-running poll loops MUST use this for inter-poll delays so a
- * shutdown signal (e.g. SIGTERM in the webapp deployment worker) does not
- * stall for the full sleep duration. Resolves (never rejects) on abort;
- * callers check `signal.aborted` after waking.
- */
-export declare function sleepAbortable(ms: number, signal?: AbortSignal): Promise<void>;
+export { sleepAbortable } from "@fjall/util/migration";

package/dist/src/util/sleepAbortable.js

@@ -1 +1 @@
-var u=Object.defineProperty;var r=(t,e)=>u(t,"name",{value:e,configurable:!0});function m(t,e){return e?.aborted===!0?Promise.resolve():new Promise(o=>{const i=setTimeout(()=>{e?.removeEventListener("abort",n),o()},t),n=r(()=>{clearTimeout(i),o()},"onAbort");e?.addEventListener("abort",n,{once:!0})})}r(m,"sleepAbortable");export{m as sleepAbortable};
+import{sleepAbortable as r}from"@fjall/util/migration";export{r as sleepAbortable};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "19.0.0",
+  "version": "21.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -96,15 +96,15 @@
     "@aws-sdk/client-ssm": "^3.1098.0",
     "@aws-sdk/client-sso-admin": "^3.1098.0",
     "@aws-sdk/client-sts": "^3.1098.0",
-    "@fjall/generator": "^19.0.0",
-    "@fjall/util": "^19.0.0",
+    "@fjall/generator": "^21.0.0",
+    "@fjall/util": "^21.0.0",
     "@smithy/node-http-handler": "^4.9.13",
     "aws-cdk": "^2.1134.0",
     "tsx": "^4.23.1",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@fjall/components-infrastructure": ">=19.0.0 <20.0.0"
+    "@fjall/components-infrastructure": ">=21.0.0 <22.0.0"
   },
   "peerDependenciesMeta": {
     "@fjall/components-infrastructure": {