@fjall/deploy-core 2.20.1 → 2.21.0

package/dist/.minified

@@ -1 +1 @@
-153 files minified at 2026-06-23T21:59:07.691Z
+153 files minified at 2026-06-27T21:57:29.114Z

package/dist/src/aws/index.d.ts

@@ -1,6 +1,6 @@
 export type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } from "./AwsProvider.js";
 export { SimpleAwsProvider } from "./SimpleAwsProvider.js";
-export { checkTargetReadiness, describeTargetReadinessReason, buildTargetUnreadyAdvisory } from "./targetReadiness.js";
+export { checkTargetReadiness, describeTargetReadinessReason, buildTargetUnreadyAdvisory, probeAccountStackExists } from "./targetReadiness.js";
 export type { TargetReadinessAccount, TargetReadinessClients, TargetReadinessReason, TargetReadinessVerdict } from "./targetReadiness.js";
 export { buildTargetSetUnreadyAdvisory } from "./targetSetAdvisory.js";
 export type { TargetSetUnreadyAdvisoryParams } from "./targetSetAdvisory.js";

package/dist/src/aws/index.js

@@ -1 +1 @@
-import{SimpleAwsProvider as a}from"./SimpleAwsProvider.js";import{checkTargetReadiness as s,describeTargetReadinessReason as o,buildTargetUnreadyAdvisory as n}from"./targetReadiness.js";import{buildTargetSetUnreadyAdvisory as c}from"./targetSetAdvisory.js";import{ensureOrganisationExists as d,describeOrganisation as A,enablePolicyTypes as u,enableServiceAccess as S,SERVICE_PRINCIPALS as E,enableRamSharing as g,activateTrustedAccess as R,enableIpamDelegatedAdmin as b,updateBackupGlobalSettings as m,listAccounts as p,findAccount as C,createAccount as T,ensureOrganisationalUnitsExist as I,placeAccountsInOUs as x,buildAccountToOUMap as y,activateCostAllocationTags as O,checkIdentityCentreStatus as U,extractErrorName as f,isOULeaf as v,registerSecurityDelegates as P,SECURITY_SERVICE_PRINCIPALS as _,enableCentralisedRootAccess as h,ROOT_ACCESS_FEATURES as k,RootAccessEnablementError as L}from"./organisations/index.js";import{CloudFormationEventMonitor as D}from"./utils/cloudformationEvents.js";export{D as CloudFormationEventMonitor,k as ROOT_ACCESS_FEATURES,L as RootAccessEnablementError,_ as SECURITY_SERVICE_PRINCIPALS,E as SERVICE_PRINCIPALS,a as SimpleAwsProvider,O as activateCostAllocationTags,R as activateTrustedAccess,y as buildAccountToOUMap,c as buildTargetSetUnreadyAdvisory,n as buildTargetUnreadyAdvisory,U as checkIdentityCentreStatus,s as checkTargetReadiness,T as createAccount,A as describeOrganisation,o as describeTargetReadinessReason,h as enableCentralisedRootAccess,b as enableIpamDelegatedAdmin,u as enablePolicyTypes,g as enableRamSharing,S as enableServiceAccess,d as ensureOrganisationExists,I as ensureOrganisationalUnitsExist,f as extractErrorName,C as findAccount,v as isOULeaf,p as listAccounts,x as placeAccountsInOUs,P as registerSecurityDelegates,m as updateBackupGlobalSettings};
+import{SimpleAwsProvider as a}from"./SimpleAwsProvider.js";import{checkTargetReadiness as s,describeTargetReadinessReason as o,buildTargetUnreadyAdvisory as n,probeAccountStackExists as i}from"./targetReadiness.js";import{buildTargetSetUnreadyAdvisory as l}from"./targetSetAdvisory.js";import{ensureOrganisationExists as A,describeOrganisation as u,enablePolicyTypes as S,enableServiceAccess as E,SERVICE_PRINCIPALS as b,enableRamSharing as g,activateTrustedAccess as p,enableIpamDelegatedAdmin as R,updateBackupGlobalSettings as m,listAccounts as C,findAccount as T,createAccount as I,ensureOrganisationalUnitsExist as x,placeAccountsInOUs as y,buildAccountToOUMap as O,activateCostAllocationTags as U,checkIdentityCentreStatus as f,extractErrorName as v,isOULeaf as P,registerSecurityDelegates as _,SECURITY_SERVICE_PRINCIPALS as k,enableCentralisedRootAccess as h,ROOT_ACCESS_FEATURES as L,RootAccessEnablementError as N}from"./organisations/index.js";import{CloudFormationEventMonitor as F}from"./utils/cloudformationEvents.js";export{F as CloudFormationEventMonitor,L as ROOT_ACCESS_FEATURES,N as RootAccessEnablementError,k as SECURITY_SERVICE_PRINCIPALS,b as SERVICE_PRINCIPALS,a as SimpleAwsProvider,U as activateCostAllocationTags,p as activateTrustedAccess,O as buildAccountToOUMap,l as buildTargetSetUnreadyAdvisory,n as buildTargetUnreadyAdvisory,f as checkIdentityCentreStatus,s as checkTargetReadiness,I as createAccount,u as describeOrganisation,o as describeTargetReadinessReason,h as enableCentralisedRootAccess,R as enableIpamDelegatedAdmin,S as enablePolicyTypes,g as enableRamSharing,E as enableServiceAccess,A as ensureOrganisationExists,x as ensureOrganisationalUnitsExist,v as extractErrorName,T as findAccount,P as isOULeaf,C as listAccounts,y as placeAccountsInOUs,i as probeAccountStackExists,_ as registerSecurityDelegates,m as updateBackupGlobalSettings};

package/dist/src/aws/targetReadiness.d.ts

@@ -52,6 +52,15 @@ export declare function buildTargetUnreadyAdvisory(params: {
     reasons: TargetReadinessReason[];
     providerAccounts?: OrgConfig["providerAccounts"];
 }): string;
+/**
+ * Probe whether the `Account` CloudFormation stack exists and is provisioned
+ * in `region`. `success(true)` = a usable stack; `success(false)` = absent or
+ * an unprovisioned shell (failed/rolled-back create, unexecuted change-set,
+ * in-flight/failed delete); `failure` = the describe itself errored. Exported
+ * so connect-time deploy-state probes reuse the same unprovisioned-status
+ * interpretation as the deploy readiness path rather than re-deriving it.
+ */
+export declare function probeAccountStackExists(client: CloudFormationClient, region: string, abortSignal?: AbortSignal): Promise<Result<boolean>>;
 /**
  * Probe whether a deploy target is provisioned before any AWS mutation:
  * the fixed-name Account stack must exist in the target region (both shapes),

package/dist/src/aws/targetReadiness.js

@@ -1 +1 @@
-import{DescribeStacksCommand as N}from"@aws-sdk/client-cloudformation";import{DescribeIpamPoolsCommand as S}from"@aws-sdk/client-ec2";import{success as i,failure as c}from"@fjall/generator";import{accountTier as A,generateTargetName as g,getErrorMessage as E}from"@fjall/util";import{formatIpamPairTagValue as y,IPAM_OPERATIONS_POOL_TAG_KEY as O,STACK_NOT_FOUND_PATTERN as k}from"@fjall/util/aws";import{getOrganisationStackName as _,ORGANISATION_TYPES as R}from"../types/operations.js";import{hasOrganisationTierAccount as T}from"./organisations/accountGlobals.js";import{composeSdkAbortSignal as I,isAborted as P}from"./organisations/types.js";const m=_(R.ACCOUNT),w=new Set(["CREATE_FAILED","ROLLBACK_IN_PROGRESS","ROLLBACK_COMPLETE","ROLLBACK_FAILED","REVIEW_IN_PROGRESS","DELETE_IN_PROGRESS","DELETE_FAILED"]);function $(e){switch(e.kind){case"missing-account-stack":return`the ${e.stackName} stack was not found in ${e.region}`;case"missing-ipam-pool":return`no IPAM pool exists for account ${e.accountId} in ${e.region}`}}function L(e){const t=e.accountName??e.accountId,n=e.reasons.map($).join(" and "),o=e.accountName!==void 0?`run \`fjall target set ${g(e.accountName,e.region)}\` then \`fjall deploy account\`, then retry this deploy`:"run `fjall target list` to find the target name, `fjall target set <target>`, then `fjall deploy account`, then retry this deploy",r=T(e.providerAccounts)?"run `fjall deploy organisation` (the cascade provisions every account and creates the IPAM pool), then retry this deploy":o;return`Target "${t}" is not ready in ${e.region}: ${n}. Nothing has been deployed. Provision the target first: ${r}.`}function b(e){return e instanceof Error&&e.name==="ValidationError"&&e.message.includes(k)}async function C(e,t,n){try{const r=(await e.send(new N({StackName:m}),{abortSignal:I(n)})).Stacks?.[0]?.StackStatus;return i(r!==void 0&&!w.has(r))}catch(o){return b(o)?i(!1):c(new Error(`Failed to probe the ${m} stack in ${t}: ${E(o)}`))}}function v(e,t,n,o){return e.Locale!==n?!1:o.side==="owner"?(e.Tags??[]).some(r=>r.Key===O&&r.Value===o.pairTagValue):e.OwnerId===t?!1:o.platformAccountId===void 0||e.OwnerId===o.platformAccountId}async function x(e,t,n,o,r){try{let a;do{if(P(r))return c(new Error(`Aborted: IPAM pool probe for account ${t} in ${n} cancelled by shutdown signal`));const s=await e.send(new S({...a!==void 0&&{NextToken:a}}),{abortSignal:I(r)});if((s.IpamPools??[]).some(u=>v(u,t,n,o)))return i(!0);a=s.NextToken}while(a!==void 0);return i(!1)}catch(a){return c(new Error(`Failed to probe IPAM pools for account ${t} in ${n}: ${E(a)}`))}}async function B(e,t,n,o,r){const a=[],s=await C(e.cloudFormation,n,r);if(!s.success)return c(s.error);s.data||a.push({kind:"missing-account-stack",stackName:m,region:n});const d=o?.providerAccounts;if(T(d)){const u=(d??[]).find(l=>l.id===t.id),p=(d??[]).find(l=>A(l)==="platform")?.id,h=u!==void 0&&A(u)==="platform"?{side:"owner",pairTagValue:y(t.id,n)}:{side:"consumer",...p!==void 0&&{platformAccountId:p}},f=await x(e.ec2,t.id,n,h,r);if(!f.success)return c(f.error);f.data||a.push({kind:"missing-ipam-pool",accountId:t.id,region:n})}return a.length===0?i({ready:!0}):i({ready:!1,reasons:a,advisory:L({accountId:t.id,...t.name!==void 0&&{accountName:t.name},region:n,reasons:a,...o!==void 0&&{providerAccounts:o.providerAccounts}})})}export{m as ACCOUNT_STACK_NAME,L as buildTargetUnreadyAdvisory,B as checkTargetReadiness,$ as describeTargetReadinessReason};
+import{DescribeStacksCommand as N}from"@aws-sdk/client-cloudformation";import{DescribeIpamPoolsCommand as S}from"@aws-sdk/client-ec2";import{success as i,failure as c}from"@fjall/generator";import{accountTier as A,generateTargetName as g,getErrorMessage as E}from"@fjall/util";import{formatIpamPairTagValue as y,IPAM_OPERATIONS_POOL_TAG_KEY as O,STACK_NOT_FOUND_PATTERN as k}from"@fjall/util/aws";import{getOrganisationStackName as _,ORGANISATION_TYPES as R}from"../types/operations.js";import{hasOrganisationTierAccount as T}from"./organisations/accountGlobals.js";import{composeSdkAbortSignal as I,isAborted as P}from"./organisations/types.js";const m=_(R.ACCOUNT),w=new Set(["CREATE_FAILED","ROLLBACK_IN_PROGRESS","ROLLBACK_COMPLETE","ROLLBACK_FAILED","REVIEW_IN_PROGRESS","DELETE_IN_PROGRESS","DELETE_FAILED"]);function $(e){switch(e.kind){case"missing-account-stack":return`the ${e.stackName} stack was not found in ${e.region}`;case"missing-ipam-pool":return`no IPAM pool exists for account ${e.accountId} in ${e.region}`}}function L(e){const t=e.accountName??e.accountId,n=e.reasons.map($).join(" and "),o=e.accountName!==void 0?`run \`fjall target set ${g(e.accountName,e.region)}\` then \`fjall deploy account\`, then retry this deploy`:"run `fjall target list` to find the target name, `fjall target set <target>`, then `fjall deploy account`, then retry this deploy",r=T(e.providerAccounts)?"run `fjall deploy organisation` (the cascade provisions every account and creates the IPAM pool), then retry this deploy":o;return`Target "${t}" is not ready in ${e.region}: ${n}. Nothing has been deployed. Provision the target first: ${r}.`}function b(e){return e instanceof Error&&e.name==="ValidationError"&&e.message.includes(k)}async function C(e,t,n){try{const r=(await e.send(new N({StackName:m}),{abortSignal:I(n)})).Stacks?.[0]?.StackStatus;return i(r!==void 0&&!w.has(r))}catch(o){return b(o)?i(!1):c(new Error(`Failed to probe the ${m} stack in ${t}: ${E(o)}`))}}function x(e,t,n,o){return e.Locale!==n?!1:o.side==="owner"?(e.Tags??[]).some(r=>r.Key===O&&r.Value===o.pairTagValue):e.OwnerId===t?!1:o.platformAccountId===void 0||e.OwnerId===o.platformAccountId}async function v(e,t,n,o,r){try{let a;do{if(P(r))return c(new Error(`Aborted: IPAM pool probe for account ${t} in ${n} cancelled by shutdown signal`));const s=await e.send(new S({...a!==void 0&&{NextToken:a}}),{abortSignal:I(r)});if((s.IpamPools??[]).some(u=>x(u,t,n,o)))return i(!0);a=s.NextToken}while(a!==void 0);return i(!1)}catch(a){return c(new Error(`Failed to probe IPAM pools for account ${t} in ${n}: ${E(a)}`))}}async function B(e,t,n,o,r){const a=[],s=await C(e.cloudFormation,n,r);if(!s.success)return c(s.error);s.data||a.push({kind:"missing-account-stack",stackName:m,region:n});const d=o?.providerAccounts;if(T(d)){const u=(d??[]).find(l=>l.id===t.id),p=(d??[]).find(l=>A(l)==="platform")?.id,h=u!==void 0&&A(u)==="platform"?{side:"owner",pairTagValue:y(t.id,n)}:{side:"consumer",...p!==void 0&&{platformAccountId:p}},f=await v(e.ec2,t.id,n,h,r);if(!f.success)return c(f.error);f.data||a.push({kind:"missing-ipam-pool",accountId:t.id,region:n})}return a.length===0?i({ready:!0}):i({ready:!1,reasons:a,advisory:L({accountId:t.id,...t.name!==void 0&&{accountName:t.name},region:n,reasons:a,...o!==void 0&&{providerAccounts:o.providerAccounts}})})}export{m as ACCOUNT_STACK_NAME,L as buildTargetUnreadyAdvisory,B as checkTargetReadiness,$ as describeTargetReadinessReason,C as probeAccountStackExists};

package/dist/src/index.d.ts

@@ -16,7 +16,7 @@ export type { DeploymentEvent, DeploymentEventType, DeploymentEventResourceCateg
 export type { AwsCredentials, DeployIdentity, DeployCallbacks, StepCompleteStatus, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession, Entitlements } from "./types/index.js";
 export type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } from "./aws/index.js";
 export { SimpleAwsProvider } from "./aws/index.js";
-export { checkTargetReadiness, describeTargetReadinessReason, buildTargetUnreadyAdvisory, buildTargetSetUnreadyAdvisory } from "./aws/index.js";
+export { checkTargetReadiness, describeTargetReadinessReason, buildTargetUnreadyAdvisory, buildTargetSetUnreadyAdvisory, probeAccountStackExists } from "./aws/index.js";
 export type { TargetReadinessAccount, TargetReadinessClients, TargetReadinessReason, TargetReadinessVerdict, TargetSetUnreadyAdvisoryParams } from "./aws/index.js";
 export { ensureOrganisationExists, describeOrganisation, enablePolicyTypes, enableServiceAccess, SERVICE_PRINCIPALS, enableRamSharing, activateTrustedAccess, enableIpamDelegatedAdmin, updateBackupGlobalSettings, listAccounts, findAccount, createAccount, ensureOrganisationalUnitsExist, placeAccountsInOUs, buildAccountToOUMap, activateCostAllocationTags, checkIdentityCentreStatus, extractErrorName, isOULeaf, registerSecurityDelegates, SECURITY_SERVICE_PRINCIPALS, enableCentralisedRootAccess, ROOT_ACCESS_FEATURES, RootAccessEnablementError } from "./aws/index.js";
 export type { OrgDetails, OUMap, OUTree, AccountPlacementResult, AccountInfo, IdentityCentreStatus, BackupGlobalSettings, CostAllocationTag, CreateAccountResult, RootAccessFeature, RootAccessEnablementSummary } from "./aws/index.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{DeploymentEventSchema as t,DEPLOYMENT_EVENT_TYPES as o,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as i,DEPLOYMENT_EVENT_STATUS_REASON_MAX as a,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as s,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as n,CASCADE_PHASES as c,CASCADE_ACCOUNT_STATUSES as E}from"./types/index.js";import{SimpleAwsProvider as l}from"./aws/index.js";import{checkTargetReadiness as T,describeTargetReadinessReason as p,buildTargetUnreadyAdvisory as u,buildTargetSetUnreadyAdvisory as _}from"./aws/index.js";import{ensureOrganisationExists as R,describeOrganisation as m,enablePolicyTypes as d,enableServiceAccess as P,SERVICE_PRINCIPALS as C,enableRamSharing as N,activateTrustedAccess as f,enableIpamDelegatedAdmin as g,updateBackupGlobalSettings as x,listAccounts as D,findAccount as I,createAccount as L,ensureOrganisationalUnitsExist as U,placeAccountsInOUs as k,buildAccountToOUMap as y,activateCostAllocationTags as v,checkIdentityCentreStatus as M,extractErrorName as F,isOULeaf as Y,registerSecurityDelegates as b,SECURITY_SERVICE_PRINCIPALS as B,enableCentralisedRootAccess as h,ROOT_ACCESS_FEATURES as K,RootAccessEnablementError as G}from"./aws/index.js";import{STEP_IDS as H,STEP_NAMES as X,INFRASTRUCTURE_STEP_NAMES as w,INFRA_STEP_NAME as j}from"./types/index.js";import{ProgressReporter as q,APPLICATION_STACKS as z,ORGANISATION_TYPES as J,APPLICATION_DEPLOY_ORDER as W,APPLICATION_DESTROY_ORDER as Z,OPENNEXT_DEPLOY_ORDER as $,OPENNEXT_DESTROY_ORDER as ee,PARALLEL_DEPLOY_GROUPS as re,PARALLEL_DESTROY_GROUPS as te,OPENNEXT_PARALLEL_GROUPS as oe,PARALLEL_OPERATION_TYPES as ie,isApplicationOperation as ae,isOrganisationOperation as se,getParallelDeployGroups as ne,getParallelDestroyGroups as ce,getApplicationDeployOrder as Ee,getApplicationDestroyOrder as Se,getApplicationStackName as le,getOrganisationStackName as Ae,isApplicationStack as Te,isQuarantineDetail as pe,isRetainedBucketsDetail as ue,getApplicationStepName as _e,getApplicationStepId as Oe,toPascalCase as Re,isOpenNextPattern as me,OPENNEXT_PATTERNS as de,deriveResourcesFromManifestStacks as Pe,STACK_NOT_FOUND_PATTERN as Ce,STACK_FAILED_STATE_PATTERN as Ne,CDK_NO_STACKS_MATCH as fe,INFRASTRUCTURE_FILENAME as ge,ApplicationError as xe,wrapApplicationError as De,FjallStateFileSchema as Ie,readStateFile as Le,writeStateFile as Ue,createEmptyState as ke,deleteStateFile as ye,updateTemplateHash as ve,getStateFilePath as Me,stubCallerIdentity as Fe}from"./types/index.js";import{CloudFormationEventMonitor as be}from"./aws/index.js";import{CdkService as he,CdkArgumentBuilder as Ke,CdkProcessManager as Ge,CdkEventMonitor as Ve,startStackMonitoring as He,DEFAULT_DEPLOY_TIMEOUT_MS as Xe,isCdkError as we,formatInfrastructureError as je,getStructuralHint as Qe,getSourceContext as qe,hasCdkDifferences as ze,parseDiffOutput as Je,CloudFormationService as We,CloudFormationError as Ze,EcsService as $e,EcsError as er,EcsServiceResolver as rr,TemplateHashService as tr,TemplateHashError as or,CdkContextBuilder as ir,emitProgress as ar,PROGRESS_MESSAGES as sr,parseBuildPhase as nr,buildStepContextBuildConfig as cr,convertCloudFormationOutputsToRecord as Er,ApplicationStackService as Sr}from"./services/index.js";import{CdkError as Ar}from"./types/errors/index.js";import{BaseServiceError as pr,ValidationError as ur,AuthError as _r,AwsError as Or,DeploymentError as Rr,NetworkError as mr,FileSystemError as dr,ConfigError as Pr,toServiceError as Cr}from"./types/errors/index.js";import{filterDangerousEnvVars as fr,maskSensitiveOutput as gr,parseShellArgs as xr,sleep as Dr}from"@fjall/util";import{hasDockerfile as Lr}from"./util/dockerfileDetection.js";import{createSequencedCallbacks as kr}from"./util/sequencedCallbacks.js";import{fileExists as vr}from"@fjall/util/fsHelpers";import{success as Fr,failure as Yr,isSuccess as br,isFailure as Br}from"@fjall/generator";import{deploy as Kr}from"./orchestration/index.js";import{destroy as Vr}from"./orchestration/index.js";import{partitionAccounts as Xr}from"./orchestration/index.js";import{buildRegionList as jr,buildAccountRegionPairs as Qr,cascadeHomeRegion as qr,cascadeOperationKey as zr}from"./orchestration/index.js";import{projectScalarSummary as Wr,projectAccountRows as Zr}from"./orchestration/index.js";import{reconcileProviderAccounts as et,mergeReconciledProviderAccounts as rt}from"./orchestration/index.js";import{decideNextTransition as ot,reconcileTrailMigration as it,decommissionMemberTrailStorage as at,ORG_TRAIL_BUCKET_OUTPUT_KEY as st,TRAIL_BUCKET_OUTPUT_KEY as nt,TRAIL_KEY_ARN_OUTPUT_KEY as ct}from"./orchestration/index.js";import{unlockBucket as St,unlockQueue as lt}from"./orchestration/index.js";import{triageBucketPolicy as Tt,isEnforceSslStatement as pt,toResourcePolicyStatements as ut,restoreBucketPolicy as _t,synthesiseEnforceSslDocument as Ot,ensureEnforceSsl as Rt,restoreAndReconcileQuarantinedBucket as mt}from"./orchestration/index.js";import{verifyOrgTrailDelivery as Pt}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as Nt,isRootTaskPolicyArn as ft,ROOT_TASK_POLICY_ARNS as gt,MAX_ROOT_SESSION_SECONDS as xt}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as It,flattenAccountsToEnvironments as Lt,extractAllAccountNames as Ut,accountsConfigToOUTree as kt,isStringArray as yt,isAccountsConfig as vt,isOuOnlyAccountBucket as Mt,OU_ONLY_ACCOUNT_BUCKETS as Ft}from"./orchestration/index.js";import{runOpenNextBuild as bt}from"./orchestration/index.js";import{runOrganisationSetup as ht,ORG_SETUP_PHASES as Kt}from"./orchestration/index.js";import{FrameworkRegistry as Vt}from"./orchestration/index.js";import{openNextBuilder as Xt,dockerBuilder as wt}from"./orchestration/index.js";import{StepRegistry as Qt,getDestroyStepId as qt}from"./steps/index.js";export{W as APPLICATION_DEPLOY_ORDER,Z as APPLICATION_DESTROY_ORDER,z as APPLICATION_STACKS,xe as ApplicationError,Sr as ApplicationStackService,_r as AuthError,Or as AwsError,pr as BaseServiceError,E as CASCADE_ACCOUNT_STATUSES,c as CASCADE_PHASES,fe as CDK_NO_STACKS_MATCH,Ke as CdkArgumentBuilder,ir as CdkContextBuilder,Ar as CdkError,Ve as CdkEventMonitor,Ge as CdkProcessManager,he as CdkService,Ze as CloudFormationError,be as CloudFormationEventMonitor,We as CloudFormationService,Pr as ConfigError,Xe as DEFAULT_DEPLOY_TIMEOUT_MS,s as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,i as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,a as DEPLOYMENT_EVENT_STATUS_REASON_MAX,n as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,o as DEPLOYMENT_EVENT_TYPES,Rr as DeploymentError,t as DeploymentEventSchema,er as EcsError,$e as EcsService,rr as EcsServiceResolver,dr as FileSystemError,Ie as FjallStateFileSchema,Vt as FrameworkRegistry,ge as INFRASTRUCTURE_FILENAME,w as INFRASTRUCTURE_STEP_NAMES,j as INFRA_STEP_NAME,xt as MAX_ROOT_SESSION_SECONDS,mr as NetworkError,$ as OPENNEXT_DEPLOY_ORDER,ee as OPENNEXT_DESTROY_ORDER,oe as OPENNEXT_PARALLEL_GROUPS,de as OPENNEXT_PATTERNS,J as ORGANISATION_TYPES,Kt as ORG_SETUP_PHASES,st as ORG_TRAIL_BUCKET_OUTPUT_KEY,Ft as OU_ONLY_ACCOUNT_BUCKETS,re as PARALLEL_DEPLOY_GROUPS,te as PARALLEL_DESTROY_GROUPS,ie as PARALLEL_OPERATION_TYPES,sr as PROGRESS_MESSAGES,q as ProgressReporter,K as ROOT_ACCESS_FEATURES,gt as ROOT_TASK_POLICY_ARNS,G as RootAccessEnablementError,B as SECURITY_SERVICE_PRINCIPALS,C as SERVICE_PRINCIPALS,Ne as STACK_FAILED_STATE_PATTERN,Ce as STACK_NOT_FOUND_PATTERN,H as STEP_IDS,X as STEP_NAMES,l as SimpleAwsProvider,Qt as StepRegistry,nt as TRAIL_BUCKET_OUTPUT_KEY,ct as TRAIL_KEY_ARN_OUTPUT_KEY,or as TemplateHashError,tr as TemplateHashService,ur as ValidationError,kt as accountsConfigToOUTree,v as activateCostAllocationTags,f as activateTrustedAccess,Nt as assumeRootForTask,Qr as buildAccountRegionPairs,y as buildAccountToOUMap,jr as buildRegionList,cr as buildStepContextBuildConfig,_ as buildTargetSetUnreadyAdvisory,u as buildTargetUnreadyAdvisory,qr as cascadeHomeRegion,zr as cascadeOperationKey,M as checkIdentityCentreStatus,T as checkTargetReadiness,Er as convertCloudFormationOutputsToRecord,L as createAccount,ke as createEmptyState,kr as createSequencedCallbacks,ot as decideNextTransition,at as decommissionMemberTrailStorage,ye as deleteStateFile,Kr as deploy,Pe as deriveResourcesFromManifestStacks,m as describeOrganisation,p as describeTargetReadinessReason,Vr as destroy,wt as dockerBuilder,ar as emitProgress,h as enableCentralisedRootAccess,g as enableIpamDelegatedAdmin,d as enablePolicyTypes,N as enableRamSharing,P as enableServiceAccess,Rt as ensureEnforceSsl,R as ensureOrganisationExists,U as ensureOrganisationalUnitsExist,Ut as extractAllAccountNames,F as extractErrorName,Yr as failure,vr as fileExists,fr as filterDangerousEnvVars,I as findAccount,Lt as flattenAccountsToEnvironments,je as formatInfrastructureError,Ee as getApplicationDeployOrder,Se as getApplicationDestroyOrder,le as getApplicationStackName,Oe as getApplicationStepId,_e as getApplicationStepName,qt as getDestroyStepId,Ae as getOrganisationStackName,ne as getParallelDeployGroups,ce as getParallelDestroyGroups,qe as getSourceContext,Me as getStateFilePath,Qe as getStructuralHint,ze as hasCdkDifferences,Lr as hasDockerfile,vt as isAccountsConfig,ae as isApplicationOperation,Te as isApplicationStack,we as isCdkError,pt as isEnforceSslStatement,Br as isFailure,Y as isOULeaf,me as isOpenNextPattern,se as isOrganisationOperation,Mt as isOuOnlyAccountBucket,pe as isQuarantineDetail,ue as isRetainedBucketsDetail,ft as isRootTaskPolicyArn,yt as isStringArray,br as isSuccess,D as listAccounts,gr as maskSensitiveOutput,rt as mergeReconciledProviderAccounts,Xt as openNextBuilder,It as parseAccountsConfiguration,nr as parseBuildPhase,Je as parseDiffOutput,xr as parseShellArgs,Xr as partitionAccounts,k as placeAccountsInOUs,Zr as projectAccountRows,Wr as projectScalarSummary,Le as readStateFile,et as reconcileProviderAccounts,it as reconcileTrailMigration,b as registerSecurityDelegates,mt as restoreAndReconcileQuarantinedBucket,_t as restoreBucketPolicy,bt as runOpenNextBuild,ht as runOrganisationSetup,Dr as sleep,He as startStackMonitoring,Fe as stubCallerIdentity,Fr as success,Ot as synthesiseEnforceSslDocument,Re as toPascalCase,ut as toResourcePolicyStatements,Cr as toServiceError,Tt as triageBucketPolicy,St as unlockBucket,lt as unlockQueue,x as updateBackupGlobalSettings,ve as updateTemplateHash,Pt as verifyOrgTrailDelivery,De as wrapApplicationError,Ue as writeStateFile};
+import{DeploymentEventSchema as t,DEPLOYMENT_EVENT_TYPES as o,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as i,DEPLOYMENT_EVENT_STATUS_REASON_MAX as a,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as s,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as c,CASCADE_PHASES as n,CASCADE_ACCOUNT_STATUSES as E}from"./types/index.js";import{SimpleAwsProvider as l}from"./aws/index.js";import{checkTargetReadiness as T,describeTargetReadinessReason as p,buildTargetUnreadyAdvisory as u,buildTargetSetUnreadyAdvisory as _,probeAccountStackExists as O}from"./aws/index.js";import{ensureOrganisationExists as m,describeOrganisation as d,enablePolicyTypes as P,enableServiceAccess as C,SERVICE_PRINCIPALS as N,enableRamSharing as f,activateTrustedAccess as g,enableIpamDelegatedAdmin as x,updateBackupGlobalSettings as D,listAccounts as I,findAccount as L,createAccount as U,ensureOrganisationalUnitsExist as k,placeAccountsInOUs as y,buildAccountToOUMap as v,activateCostAllocationTags as M,checkIdentityCentreStatus as F,extractErrorName as Y,isOULeaf as b,registerSecurityDelegates as B,SECURITY_SERVICE_PRINCIPALS as h,enableCentralisedRootAccess as K,ROOT_ACCESS_FEATURES as G,RootAccessEnablementError as V}from"./aws/index.js";import{STEP_IDS as X,STEP_NAMES as w,INFRASTRUCTURE_STEP_NAMES as j,INFRA_STEP_NAME as Q}from"./types/index.js";import{ProgressReporter as z,APPLICATION_STACKS as J,ORGANISATION_TYPES as W,APPLICATION_DEPLOY_ORDER as Z,APPLICATION_DESTROY_ORDER as $,OPENNEXT_DEPLOY_ORDER as ee,OPENNEXT_DESTROY_ORDER as re,PARALLEL_DEPLOY_GROUPS as te,PARALLEL_DESTROY_GROUPS as oe,OPENNEXT_PARALLEL_GROUPS as ie,PARALLEL_OPERATION_TYPES as ae,isApplicationOperation as se,isOrganisationOperation as ce,getParallelDeployGroups as ne,getParallelDestroyGroups as Ee,getApplicationDeployOrder as Se,getApplicationDestroyOrder as le,getApplicationStackName as Ae,getOrganisationStackName as Te,isApplicationStack as pe,isQuarantineDetail as ue,isRetainedBucketsDetail as _e,getApplicationStepName as Oe,getApplicationStepId as Re,toPascalCase as me,isOpenNextPattern as de,OPENNEXT_PATTERNS as Pe,deriveResourcesFromManifestStacks as Ce,STACK_NOT_FOUND_PATTERN as Ne,STACK_FAILED_STATE_PATTERN as fe,CDK_NO_STACKS_MATCH as ge,INFRASTRUCTURE_FILENAME as xe,ApplicationError as De,wrapApplicationError as Ie,FjallStateFileSchema as Le,readStateFile as Ue,writeStateFile as ke,createEmptyState as ye,deleteStateFile as ve,updateTemplateHash as Me,getStateFilePath as Fe,stubCallerIdentity as Ye}from"./types/index.js";import{CloudFormationEventMonitor as Be}from"./aws/index.js";import{CdkService as Ke,CdkArgumentBuilder as Ge,CdkProcessManager as Ve,CdkEventMonitor as He,startStackMonitoring as Xe,DEFAULT_DEPLOY_TIMEOUT_MS as we,isCdkError as je,formatInfrastructureError as Qe,getStructuralHint as qe,getSourceContext as ze,hasCdkDifferences as Je,parseDiffOutput as We,CloudFormationService as Ze,CloudFormationError as $e,EcsService as er,EcsError as rr,EcsServiceResolver as tr,TemplateHashService as or,TemplateHashError as ir,CdkContextBuilder as ar,emitProgress as sr,PROGRESS_MESSAGES as cr,parseBuildPhase as nr,buildStepContextBuildConfig as Er,convertCloudFormationOutputsToRecord as Sr,ApplicationStackService as lr}from"./services/index.js";import{CdkError as Tr}from"./types/errors/index.js";import{BaseServiceError as ur,ValidationError as _r,AuthError as Or,AwsError as Rr,DeploymentError as mr,NetworkError as dr,FileSystemError as Pr,ConfigError as Cr,toServiceError as Nr}from"./types/errors/index.js";import{filterDangerousEnvVars as gr,maskSensitiveOutput as xr,parseShellArgs as Dr,sleep as Ir}from"@fjall/util";import{hasDockerfile as Ur}from"./util/dockerfileDetection.js";import{createSequencedCallbacks as yr}from"./util/sequencedCallbacks.js";import{fileExists as Mr}from"@fjall/util/fsHelpers";import{success as Yr,failure as br,isSuccess as Br,isFailure as hr}from"@fjall/generator";import{deploy as Gr}from"./orchestration/index.js";import{destroy as Hr}from"./orchestration/index.js";import{partitionAccounts as wr}from"./orchestration/index.js";import{buildRegionList as Qr,buildAccountRegionPairs as qr,cascadeHomeRegion as zr,cascadeOperationKey as Jr}from"./orchestration/index.js";import{projectScalarSummary as Zr,projectAccountRows as $r}from"./orchestration/index.js";import{reconcileProviderAccounts as rt,mergeReconciledProviderAccounts as tt}from"./orchestration/index.js";import{decideNextTransition as it,reconcileTrailMigration as at,decommissionMemberTrailStorage as st,ORG_TRAIL_BUCKET_OUTPUT_KEY as ct,TRAIL_BUCKET_OUTPUT_KEY as nt,TRAIL_KEY_ARN_OUTPUT_KEY as Et}from"./orchestration/index.js";import{unlockBucket as lt,unlockQueue as At}from"./orchestration/index.js";import{triageBucketPolicy as pt,isEnforceSslStatement as ut,toResourcePolicyStatements as _t,restoreBucketPolicy as Ot,synthesiseEnforceSslDocument as Rt,ensureEnforceSsl as mt,restoreAndReconcileQuarantinedBucket as dt}from"./orchestration/index.js";import{verifyOrgTrailDelivery as Ct}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as ft,isRootTaskPolicyArn as gt,ROOT_TASK_POLICY_ARNS as xt,MAX_ROOT_SESSION_SECONDS as Dt}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as Lt,flattenAccountsToEnvironments as Ut,extractAllAccountNames as kt,accountsConfigToOUTree as yt,isStringArray as vt,isAccountsConfig as Mt,isOuOnlyAccountBucket as Ft,OU_ONLY_ACCOUNT_BUCKETS as Yt}from"./orchestration/index.js";import{runOpenNextBuild as Bt}from"./orchestration/index.js";import{runOrganisationSetup as Kt,ORG_SETUP_PHASES as Gt}from"./orchestration/index.js";import{FrameworkRegistry as Ht}from"./orchestration/index.js";import{openNextBuilder as wt,dockerBuilder as jt}from"./orchestration/index.js";import{StepRegistry as qt,getDestroyStepId as zt}from"./steps/index.js";export{Z as APPLICATION_DEPLOY_ORDER,$ as APPLICATION_DESTROY_ORDER,J as APPLICATION_STACKS,De as ApplicationError,lr as ApplicationStackService,Or as AuthError,Rr as AwsError,ur as BaseServiceError,E as CASCADE_ACCOUNT_STATUSES,n as CASCADE_PHASES,ge as CDK_NO_STACKS_MATCH,Ge as CdkArgumentBuilder,ar as CdkContextBuilder,Tr as CdkError,He as CdkEventMonitor,Ve as CdkProcessManager,Ke as CdkService,$e as CloudFormationError,Be as CloudFormationEventMonitor,Ze as CloudFormationService,Cr as ConfigError,we as DEFAULT_DEPLOY_TIMEOUT_MS,s as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,i as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,a as DEPLOYMENT_EVENT_STATUS_REASON_MAX,c as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,o as DEPLOYMENT_EVENT_TYPES,mr as DeploymentError,t as DeploymentEventSchema,rr as EcsError,er as EcsService,tr as EcsServiceResolver,Pr as FileSystemError,Le as FjallStateFileSchema,Ht as FrameworkRegistry,xe as INFRASTRUCTURE_FILENAME,j as INFRASTRUCTURE_STEP_NAMES,Q as INFRA_STEP_NAME,Dt as MAX_ROOT_SESSION_SECONDS,dr as NetworkError,ee as OPENNEXT_DEPLOY_ORDER,re as OPENNEXT_DESTROY_ORDER,ie as OPENNEXT_PARALLEL_GROUPS,Pe as OPENNEXT_PATTERNS,W as ORGANISATION_TYPES,Gt as ORG_SETUP_PHASES,ct as ORG_TRAIL_BUCKET_OUTPUT_KEY,Yt as OU_ONLY_ACCOUNT_BUCKETS,te as PARALLEL_DEPLOY_GROUPS,oe as PARALLEL_DESTROY_GROUPS,ae as PARALLEL_OPERATION_TYPES,cr as PROGRESS_MESSAGES,z as ProgressReporter,G as ROOT_ACCESS_FEATURES,xt as ROOT_TASK_POLICY_ARNS,V as RootAccessEnablementError,h as SECURITY_SERVICE_PRINCIPALS,N as SERVICE_PRINCIPALS,fe as STACK_FAILED_STATE_PATTERN,Ne as STACK_NOT_FOUND_PATTERN,X as STEP_IDS,w as STEP_NAMES,l as SimpleAwsProvider,qt as StepRegistry,nt as TRAIL_BUCKET_OUTPUT_KEY,Et as TRAIL_KEY_ARN_OUTPUT_KEY,ir as TemplateHashError,or as TemplateHashService,_r as ValidationError,yt as accountsConfigToOUTree,M as activateCostAllocationTags,g as activateTrustedAccess,ft as assumeRootForTask,qr as buildAccountRegionPairs,v as buildAccountToOUMap,Qr as buildRegionList,Er as buildStepContextBuildConfig,_ as buildTargetSetUnreadyAdvisory,u as buildTargetUnreadyAdvisory,zr as cascadeHomeRegion,Jr as cascadeOperationKey,F as checkIdentityCentreStatus,T as checkTargetReadiness,Sr as convertCloudFormationOutputsToRecord,U as createAccount,ye as createEmptyState,yr as createSequencedCallbacks,it as decideNextTransition,st as decommissionMemberTrailStorage,ve as deleteStateFile,Gr as deploy,Ce as deriveResourcesFromManifestStacks,d as describeOrganisation,p as describeTargetReadinessReason,Hr as destroy,jt as dockerBuilder,sr as emitProgress,K as enableCentralisedRootAccess,x as enableIpamDelegatedAdmin,P as enablePolicyTypes,f as enableRamSharing,C as enableServiceAccess,mt as ensureEnforceSsl,m as ensureOrganisationExists,k as ensureOrganisationalUnitsExist,kt as extractAllAccountNames,Y as extractErrorName,br as failure,Mr as fileExists,gr as filterDangerousEnvVars,L as findAccount,Ut as flattenAccountsToEnvironments,Qe as formatInfrastructureError,Se as getApplicationDeployOrder,le as getApplicationDestroyOrder,Ae as getApplicationStackName,Re as getApplicationStepId,Oe as getApplicationStepName,zt as getDestroyStepId,Te as getOrganisationStackName,ne as getParallelDeployGroups,Ee as getParallelDestroyGroups,ze as getSourceContext,Fe as getStateFilePath,qe as getStructuralHint,Je as hasCdkDifferences,Ur as hasDockerfile,Mt as isAccountsConfig,se as isApplicationOperation,pe as isApplicationStack,je as isCdkError,ut as isEnforceSslStatement,hr as isFailure,b as isOULeaf,de as isOpenNextPattern,ce as isOrganisationOperation,Ft as isOuOnlyAccountBucket,ue as isQuarantineDetail,_e as isRetainedBucketsDetail,gt as isRootTaskPolicyArn,vt as isStringArray,Br as isSuccess,I as listAccounts,xr as maskSensitiveOutput,tt as mergeReconciledProviderAccounts,wt as openNextBuilder,Lt as parseAccountsConfiguration,nr as parseBuildPhase,We as parseDiffOutput,Dr as parseShellArgs,wr as partitionAccounts,y as placeAccountsInOUs,O as probeAccountStackExists,$r as projectAccountRows,Zr as projectScalarSummary,Ue as readStateFile,rt as reconcileProviderAccounts,at as reconcileTrailMigration,B as registerSecurityDelegates,dt as restoreAndReconcileQuarantinedBucket,Ot as restoreBucketPolicy,Bt as runOpenNextBuild,Kt as runOrganisationSetup,Ir as sleep,Xe as startStackMonitoring,Ye as stubCallerIdentity,Yr as success,Rt as synthesiseEnforceSslDocument,me as toPascalCase,_t as toResourcePolicyStatements,Nr as toServiceError,pt as triageBucketPolicy,lt as unlockBucket,At as unlockQueue,D as updateBackupGlobalSettings,Me as updateTemplateHash,Ct as verifyOrgTrailDelivery,Ie as wrapApplicationError,ke as writeStateFile};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "2.20.1",
+  "version": "2.21.0",
   "description": "Shared deployment engine for Fjall — used by CLI and webapp worker",
   "type": "module",
   "main": "dist/src/index.js",
@@ -78,8 +78,8 @@
     "@aws-sdk/client-sqs": "^3.1067.0",
     "@aws-sdk/client-sso-admin": "^3.1038.0",
     "@aws-sdk/client-sts": "^3.1038.0",
-    "@fjall/generator": "^2.20.1",
-    "@fjall/util": "^2.20.1",
+    "@fjall/generator": "^2.21.0",
+    "@fjall/util": "^2.21.0",
     "@smithy/node-http-handler": "^4.6.1",
     "tsx": "^4.21.0",
     "zod": "^4.4.3"
@@ -89,5 +89,5 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.5"
   },
-  "gitHead": "397880361ea533450ea5c888f7e7b9593254f663"
+  "gitHead": "1b8902876c40697183ce8cbc25a0556b11d0ec38"
 }