@fjall/deploy-core 2.22.0 → 2.22.1

package/dist/.minified

@@ -1 +1 @@
-174 files minified at 2026-06-30T11:38:21.686Z
+174 files minified at 2026-06-30T21:20:24.926Z

package/dist/src/aws/AwsProvider.d.ts

@@ -27,9 +27,9 @@ export interface AwsProvider {
      * Assume the SAME identity but with an inline session policy that scopes it
      * down to exactly the SSM / Secrets Manager parameters a build needs to read
      * (least privilege). Returns a provider bound to the scoped session. When a
-     * provider cannot narrow its own session (the worker's pre-assumed OIDC
-     * credentials), this is absent and the caller falls back to the unscoped
-     * provider — see `resolveBuildSecrets`.
+     * provider has no way to re-mint a narrowed session — no SSO/OIDC role to
+     * re-assume (CLI), or no re-mint hook injected (worker) — this is absent and
+     * the caller falls back to the unscoped provider — see `resolveBuildSecrets`.
      */
     assumeScopedBuildSecretSession?(inlinePolicy: string, sessionName: string): Promise<AwsProvider>;
 }

package/dist/src/aws/SimpleAwsProvider.d.ts

@@ -1,4 +1,4 @@
-import type { AwsCredentials } from "../types/credentials.js";
+import type { AwsCredentials, ScopedBuildSecretSessionMinter } from "../types/credentials.js";
 import type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } from "./AwsProvider.js";
 /**
  * Minimal AWS provider for pre-assumed credentials.
@@ -11,7 +11,14 @@ export declare class SimpleAwsProvider implements AwsProvider {
     private readonly region;
     private readonly accountId;
     private readonly clientCache;
-    constructor(awsCredentials: AwsCredentials);
+    /**
+     * Present only when a re-mint hook is injected (the worker). Absent for a bare
+     * provider — including the scoped child this very method returns, so a scoped
+     * session cannot re-scope itself. deploy-core's `resolveBuildSecrets` reads the
+     * field's presence to decide whether to narrow the build-secret read.
+     */
+    assumeScopedBuildSecretSession?: AwsProvider["assumeScopedBuildSecretSession"];
+    constructor(awsCredentials: AwsCredentials, scopedSessionMinter?: ScopedBuildSecretSessionMinter);
     getClient<T>(ClientClass: AwsSdkClientConstructor<T>): T;
     getRegion(): string;
     getAccountId(): string;

package/dist/src/aws/SimpleAwsProvider.js

@@ -1 +1 @@
-import{STSClient as r,AssumeRoleCommand as i}from"@aws-sdk/client-sts";import{NodeHttpHandler as d}from"@smithy/node-http-handler";import{composeSdkAbortSignal as a}from"./organisations/types.js";const o=3e4;class A{credentials;region;accountId;clientCache=new Map;constructor(e){this.credentials={accessKeyId:e.accessKeyId,secretAccessKey:e.secretAccessKey,sessionToken:e.sessionToken},this.region=e.region,this.accountId=e.accountId}getClient(e){const n=e.name,t=this.clientCache.get(n);if(t!==void 0)return t;const c={region:this.region,credentials:this.credentials,requestHandler:new d({requestTimeout:o})},s=new e(c);return this.clientCache.set(n,s),s}getRegion(){return this.region}getAccountId(){return this.accountId}getCredentials(){return this.credentials}exportToEnv(){process.env.AWS_ACCESS_KEY_ID=this.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=this.credentials.secretAccessKey,process.env.AWS_REGION=this.region,this.credentials.sessionToken?process.env.AWS_SESSION_TOKEN=this.credentials.sessionToken:delete process.env.AWS_SESSION_TOKEN}async assumeRole(e,n){const s=(await this.getClient(r).send(new i({RoleArn:e,RoleSessionName:n}),{abortSignal:a(void 0,o)})).Credentials;if(!s?.AccessKeyId||!s?.SecretAccessKey)throw new Error(`AssumeRole for ${e} returned incomplete credentials`);return{accessKeyId:s.AccessKeyId,secretAccessKey:s.SecretAccessKey,sessionToken:s.SessionToken}}}export{A as SimpleAwsProvider};
+import{STSClient as r,AssumeRoleCommand as d}from"@aws-sdk/client-sts";import{NodeHttpHandler as a}from"@smithy/node-http-handler";import{composeSdkAbortSignal as S}from"./organisations/types.js";const o=3e4;class i{credentials;region;accountId;clientCache=new Map;assumeScopedBuildSecretSession;constructor(e,n){this.credentials={accessKeyId:e.accessKeyId,secretAccessKey:e.secretAccessKey,sessionToken:e.sessionToken},this.region=e.region,this.accountId=e.accountId,n!==void 0&&(this.assumeScopedBuildSecretSession=async(t,c)=>{const s=await n(t,c);return new i(s)})}getClient(e){const n=e.name,t=this.clientCache.get(n);if(t!==void 0)return t;const c={region:this.region,credentials:this.credentials,requestHandler:new a({requestTimeout:o})},s=new e(c);return this.clientCache.set(n,s),s}getRegion(){return this.region}getAccountId(){return this.accountId}getCredentials(){return this.credentials}exportToEnv(){process.env.AWS_ACCESS_KEY_ID=this.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=this.credentials.secretAccessKey,process.env.AWS_REGION=this.region,this.credentials.sessionToken?process.env.AWS_SESSION_TOKEN=this.credentials.sessionToken:delete process.env.AWS_SESSION_TOKEN}async assumeRole(e,n){const s=(await this.getClient(r).send(new d({RoleArn:e,RoleSessionName:n}),{abortSignal:S(void 0,o)})).Credentials;if(!s?.AccessKeyId||!s?.SecretAccessKey)throw new Error(`AssumeRole for ${e} returned incomplete credentials`);return{accessKeyId:s.AccessKeyId,secretAccessKey:s.SecretAccessKey,sessionToken:s.SessionToken}}}export{i as SimpleAwsProvider};

package/dist/src/index.d.ts

@@ -15,7 +15,7 @@ export { DeploymentEventSchema, DEPLOYMENT_EVENT_TYPES, DEPLOYMENT_EVENT_RESOURC
 export type { DeploymentEvent, DeploymentEventType, DeploymentEventResourceCategory, DeploymentEventCascadePhase, DeploymentEventCascadeAccountStatus } from "./types/index.js";
 export { DeployEventSchema, StepProgressSchema, DeployResourceSchema, PlanChangeSchema, PlanPropertyChangeSchema, ChangeCountsSchema, DEPLOY_EVENT_CONTRACT, DEPLOY_EVENT_CONTRACT_MAJOR, DEPLOY_EVENT_CONTRACT_MINOR, SUPPORTED_CONTRACT_MARKERS, DEPLOY_EVENT_ID_MAX, DEPLOY_EVENT_NAME_MAX, DEPLOY_EVENT_MESSAGE_MAX, DEPLOY_EVENT_STATUS_REASON_MAX, DEPLOY_EVENT_ERROR_MESSAGE_MAX, DEPLOY_EVENT_TRAIL_DETAIL_MAX, DEPLOY_EVENT_OUTPUT_MAX, DEPLOY_EVENT_ARN_MAX, DEPLOY_EVENT_URL_MAX, STEP_COMPLETE_STATUSES, LOG_LEVELS, STACK_CLEANUP_PHASES, CASCADE_ACCOUNT_PHASES, DEPLOY_RESULTS, DETECTION_PHASES, PHASE_STATUSES, BUILDERS, CASCADE_OUTCOME_RESULTS, PLAN_ACTIONS, REPLACEMENT_MODES, APPROVAL_KINDS, APPROVAL_DECISIONS, ALL_PROGRESS_KINDS, createDeployEmitter, parseDeployEvent, parseDeployContractVersion } from "./types/index.js";
 export type { DeployEvent, ProgressKind, StepProgress, DeployResource, PlanChange, PlanPropertyChange, ChangeCounts, PlanAction, ReplacementMode, ApprovalKind, ApprovalDecision, DeployRunResult, DeployEmitter, CreateDeployEmitterOptions, ParsedDeployEvent, StackCleanupPhase, CascadeAccountPhase, LogLevel } from "./types/index.js";
-export type { AwsCredentials, DeployIdentity, DeployCallbacks, StepCompleteStatus, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, ApprovalGate, ApprovalRequest, GateResolution, OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession, Entitlements } from "./types/index.js";
+export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter, DeployCallbacks, StepCompleteStatus, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, ApprovalGate, ApprovalRequest, GateResolution, OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession, Entitlements } from "./types/index.js";
 export type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } from "./aws/index.js";
 export { SimpleAwsProvider } from "./aws/index.js";
 export { checkTargetReadiness, describeTargetReadinessReason, buildTargetUnreadyAdvisory, buildTargetSetUnreadyAdvisory, probeAccountStackExists } from "./aws/index.js";

package/dist/src/orchestration/serviceFactory.js

@@ -1 +1 @@
-import{SimpleAwsProvider as d}from"../aws/SimpleAwsProvider.js";import{CdkService as f}from"../services/infrastructure/CdkService.js";import{CdkArgumentBuilder as v}from"../services/infrastructure/CdkArgumentBuilder.js";import{CdkProcessManager as p}from"../services/infrastructure/CdkProcessManager.js";import{CloudFormationService as g}from"../services/infrastructure/CloudFormationService.js";import{EcsService as w}from"../services/infrastructure/EcsService.js";import{EcsServiceResolver as u}from"../services/infrastructure/EcsServiceResolver.js";import{EcrImageInspectorService as k}from"../services/infrastructure/EcrImageInspectorService.js";import{ApplicationStackService as b}from"../services/application/ApplicationStackService.js";import{TemplateHashService as y}from"../services/supporting/TemplateHashService.js";import{FrameworkRegistry as A}from"./builders/frameworkRegistry.js";function T(e){const r=new d(e.awsCredentials);r.exportToEnv();const t=new v,i=new p(t,e.abortSignal),n=new f({processManager:i,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{},...e.callbacks.onFailureAnalysis!==void 0?{onFailureAnalysis:e.callbacks.onFailureAnalysis}:{}}),o=new g(r),c=new w(r),s=new u(o),a=new k(r),l=new b(n,o,r),m=new y,S=A.createDefault();return{awsProvider:r,cdkService:n,cfnService:o,ecsService:c,ecsResolver:s,ecrImageInspector:a,stackService:l,hashService:m,frameworkRegistry:S,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{},dispose(){i.dispose()}}}export{T as createDeployServices};
+import{SimpleAwsProvider as d}from"../aws/SimpleAwsProvider.js";import{CdkService as f}from"../services/infrastructure/CdkService.js";import{CdkArgumentBuilder as v}from"../services/infrastructure/CdkArgumentBuilder.js";import{CdkProcessManager as p}from"../services/infrastructure/CdkProcessManager.js";import{CloudFormationService as g}from"../services/infrastructure/CloudFormationService.js";import{EcsService as w}from"../services/infrastructure/EcsService.js";import{EcsServiceResolver as u}from"../services/infrastructure/EcsServiceResolver.js";import{EcrImageInspectorService as k}from"../services/infrastructure/EcrImageInspectorService.js";import{ApplicationStackService as b}from"../services/application/ApplicationStackService.js";import{TemplateHashService as y}from"../services/supporting/TemplateHashService.js";import{FrameworkRegistry as A}from"./builders/frameworkRegistry.js";function T(e){const r=new d(e.awsCredentials,e.mintScopedBuildSecretSession);r.exportToEnv();const t=new v,i=new p(t,e.abortSignal),n=new f({processManager:i,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{},...e.callbacks.onFailureAnalysis!==void 0?{onFailureAnalysis:e.callbacks.onFailureAnalysis}:{}}),o=new g(r),c=new w(r),s=new u(o),a=new k(r),l=new b(n,o,r),S=new y,m=A.createDefault();return{awsProvider:r,cdkService:n,cfnService:o,ecsService:c,ecsResolver:s,ecrImageInspector:a,stackService:l,hashService:S,frameworkRegistry:m,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{},dispose(){i.dispose()}}}export{T as createDeployServices};

package/dist/src/types/credentials.d.ts

@@ -12,6 +12,20 @@ export interface AwsCredentials {
     region: string;
     accountId: string;
 }
+/**
+ * Re-mints a least-privilege child session for reading build-time secrets,
+ * narrowed by an inline session policy. deploy-core builds the policy via
+ * `buildBuildSecretSessionPolicy` and passes a session name; the consumer (the
+ * worker) re-runs its web-identity assume with the inline policy and returns the
+ * scoped credentials.
+ *
+ * A consumer that cannot re-mint (no web-identity token to re-assume with) omits
+ * this — deploy-core then reads build-secrets under the unscoped identity.
+ *
+ * CLI: omits this — `AwsContext.assumeScopedBuildSecretSession` self-scopes.
+ * Worker: supplies this so build-secret reads run under a scoped session.
+ */
+export type ScopedBuildSecretSessionMinter = (inlinePolicy: string, sessionName: string) => Promise<AwsCredentials>;
 /**
  * Pre-fetched organisation identity for org deployments.
  *

package/dist/src/types/index.d.ts

@@ -1,6 +1,6 @@
 export { DeploymentEventSchema, DEPLOYMENT_EVENT_TYPES, DEPLOYMENT_EVENT_RESOURCE_CATEGORIES, DEPLOYMENT_EVENT_STATUS_REASON_MAX, DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX, DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX, CASCADE_PHASES, CASCADE_ACCOUNT_STATUSES, toCascadePhase } from "./deploymentEventSchema.js";
 export type { DeploymentEvent, DeploymentEventType, DeploymentEventResourceCategory, DeploymentEventCascadePhase, DeploymentEventCascadeAccountStatus } from "./deploymentEventSchema.js";
-export type { AwsCredentials, DeployIdentity } from "./credentials.js";
+export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter } from "./credentials.js";
 export type { DeployCallbacks, StepCompleteStatus, StackCleanupPhase, CascadeAccountPhase, LogLevel, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail } from "./callbacks.js";
 export { isQuarantineDetail, isRetainedBucketsDetail } from "./callbacks.js";
 export { DeployEventSchema, StepProgressSchema, DeployResourceSchema, PlanChangeSchema, PlanPropertyChangeSchema, ChangeCountsSchema, DEPLOY_EVENT_CONTRACT, DEPLOY_EVENT_CONTRACT_MAJOR, DEPLOY_EVENT_CONTRACT_MINOR, SUPPORTED_CONTRACT_MARKERS, DEPLOY_EVENT_ID_MAX, DEPLOY_EVENT_NAME_MAX, DEPLOY_EVENT_MESSAGE_MAX, DEPLOY_EVENT_STATUS_REASON_MAX, DEPLOY_EVENT_ERROR_MESSAGE_MAX, DEPLOY_EVENT_TRAIL_DETAIL_MAX, DEPLOY_EVENT_OUTPUT_MAX, DEPLOY_EVENT_ARN_MAX, DEPLOY_EVENT_URL_MAX, STEP_COMPLETE_STATUSES, LOG_LEVELS, STACK_CLEANUP_PHASES, CASCADE_ACCOUNT_PHASES, DEPLOY_RESULTS, DETECTION_PHASES, PHASE_STATUSES, BUILDERS, CASCADE_OUTCOME_RESULTS, PLAN_ACTIONS, REPLACEMENT_MODES, APPROVAL_KINDS, APPROVAL_DECISIONS, ALL_PROGRESS_KINDS } from "./deployEvent.js";

package/dist/src/types/params.d.ts

@@ -1,5 +1,5 @@
 import type { Result } from "@fjall/generator";
-import type { AwsCredentials, DeployIdentity } from "./credentials.js";
+import type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter } from "./credentials.js";
 import type { DeployCallbacks } from "./callbacks.js";
 import type { ApiClientInterface } from "./apiClient.js";
 import type { OrgConfig } from "./config/orgConfig.js";
@@ -15,6 +15,14 @@ export interface DeployParams {
     workingDirectory: string;
     /** AWS credentials for the deployment. deploy-core never resolves these itself. */
     awsCredentials: AwsCredentials;
+    /**
+     * Optional re-mint hook the worker supplies so build-secret reads run under a
+     * least-privilege child session (the inline policy narrows the worker's deploy
+     * role to exactly this app's SSM/SM/KMS). The CLI omits it — its `AwsContext`
+     * self-scopes via `assumeScopedBuildSecretSession`. When omitted, build-secret
+     * reads fall back to the unscoped identity (see `resolveBuildSecrets`).
+     */
+    mintScopedBuildSecretSession?: ScopedBuildSecretSessionMinter;
     /** Typed callbacks for progress events. CLI and worker implement differently. */
     callbacks: DeployCallbacks;
     /** Deployment options */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "2.22.0",
+  "version": "2.22.1",
   "description": "Shared deployment engine for Fjall — used by CLI and webapp worker",
   "type": "module",
   "main": "dist/src/index.js",
@@ -81,8 +81,8 @@
     "@aws-sdk/client-ssm": "^3.1038.0",
     "@aws-sdk/client-sso-admin": "^3.1038.0",
     "@aws-sdk/client-sts": "^3.1038.0",
-    "@fjall/generator": "^2.22.0",
-    "@fjall/util": "^2.22.0",
+    "@fjall/generator": "^2.22.1",
+    "@fjall/util": "^2.22.1",
     "@smithy/node-http-handler": "^4.6.1",
     "aws-cdk": "^2.1128.1",
     "tsx": "^4.21.0",
@@ -93,5 +93,5 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.5"
   },
-  "gitHead": "448c771d258e87f0535ae7698f11438e0f7c57b1"
+  "gitHead": "ec04f1739f19e4b5212899df7f733ee0d1f06ec3"
 }