@fjall/deploy-core 2.25.0 → 2.29.0

package/dist/.minified

@@ -1 +1 @@
-183 files minified at 2026-07-06T11:56:38.163Z
+213 files minified at 2026-07-13T22:22:04.195Z

package/dist/src/aws/index.d.ts

@@ -6,7 +6,7 @@ export { buildTargetSetUnreadyAdvisory } from "./targetSetAdvisory.js";
 export type { TargetSetUnreadyAdvisoryParams } from "./targetSetAdvisory.js";
 export { checkRegionEnabled, regionDisabledMessage } from "./regions/regionOptStatus.js";
 export type { RegionAvailability } from "./regions/regionOptStatus.js";
-export { ensureOrganisationExists, describeOrganisation, enablePolicyTypes, enableServiceAccess, SERVICE_PRINCIPALS, enableRamSharing, activateTrustedAccess, enableIpamDelegatedAdmin, updateBackupGlobalSettings, listAccounts, findAccount, createAccount, ensureOrganisationalUnitsExist, placeAccountsInOUs, buildAccountToOUMap, activateCostAllocationTags, checkIdentityCentreStatus, snapshotIdentityCentre, composeSdkAbortSignal, extractErrorName, isAborted, isOULeaf, DEFAULT_MAX_PAGES, IDENTITY_STORE_PAGE_SIZE, drainPages, registerSecurityDelegates, SECURITY_SERVICE_PRINCIPALS, enableCentralisedRootAccess, ROOT_ACCESS_FEATURES, RootAccessEnablementError } from "./organisations/index.js";
+export { ensureOrganisationExists, describeOrganisation, enablePolicyTypes, enableServiceAccess, SERVICE_PRINCIPALS, enableRamSharing, activateTrustedAccess, enableIpamDelegatedAdmin, updateBackupGlobalSettings, listAccounts, findAccount, createAccount, ensureOrganisationalUnitsExist, placeAccountsInOUs, buildAccountToOUMap, findDevelopmentOuId, activateCostAllocationTags, checkIdentityCentreStatus, snapshotIdentityCentre, composeSdkAbortSignal, extractErrorName, isAborted, isOULeaf, DEFAULT_MAX_PAGES, IDENTITY_STORE_PAGE_SIZE, drainPages, registerSecurityDelegates, SECURITY_SERVICE_PRINCIPALS, enableCentralisedRootAccess, ROOT_ACCESS_FEATURES, RootAccessEnablementError } from "./organisations/index.js";
 export type { OrgDetails, OUMap, OUTree, AccountPlacementResult, AccountInfo, DrainPagesOptions, PagedResult, IdentityCentreStatus, IdentityCentreSnapshot, IdentityCentreSnapshotGroup, IdentityCentreSnapshotOptions, IdentityCentreSnapshotResult, IdentityCentreSnapshotUser, BackupGlobalSettings, CostAllocationTag, CreateAccountResult, RootAccessFeature, RootAccessEnablementSummary } from "./organisations/index.js";
 export { CloudFormationEventMonitor } from "./utils/cloudformationEvents.js";
 export type { AwsClientLike, EventLogWriter, EventFailureAnalyser, EventLogWriterFactory, EventMonitorDeps } from "./utils/cloudformationEvents.js";

package/dist/src/aws/index.js

@@ -1 +1 @@
-import{SimpleAwsProvider as a}from"./SimpleAwsProvider.js";import{checkTargetReadiness as s,describeTargetReadinessReason as o,buildTargetUnreadyAdvisory as n,probeAccountStackExists as i}from"./targetReadiness.js";import{buildTargetSetUnreadyAdvisory as d}from"./targetSetAdvisory.js";import{checkRegionEnabled as A,regionDisabledMessage as E}from"./regions/regionOptStatus.js";import{ensureOrganisationExists as g,describeOrganisation as b,enablePolicyTypes as u,enableServiceAccess as p,SERVICE_PRINCIPALS as R,enableRamSharing as T,activateTrustedAccess as m,enableIpamDelegatedAdmin as I,updateBackupGlobalSettings as C,listAccounts as x,findAccount as _,createAccount as y,ensureOrganisationalUnitsExist as O,placeAccountsInOUs as P,buildAccountToOUMap as U,activateCostAllocationTags as f,checkIdentityCentreStatus as v,snapshotIdentityCentre as k,composeSdkAbortSignal as h,extractErrorName as D,isAborted as L,isOULeaf as M,DEFAULT_MAX_PAGES as N,IDENTITY_STORE_PAGE_SIZE as F,drainPages as G,registerSecurityDelegates as V,SECURITY_SERVICE_PRINCIPALS as Y,enableCentralisedRootAccess as w,ROOT_ACCESS_FEATURES as B,RootAccessEnablementError as X}from"./organisations/index.js";import{CloudFormationEventMonitor as j}from"./utils/cloudformationEvents.js";export{j as CloudFormationEventMonitor,N as DEFAULT_MAX_PAGES,F as IDENTITY_STORE_PAGE_SIZE,B as ROOT_ACCESS_FEATURES,X as RootAccessEnablementError,Y as SECURITY_SERVICE_PRINCIPALS,R as SERVICE_PRINCIPALS,a as SimpleAwsProvider,f as activateCostAllocationTags,m as activateTrustedAccess,U as buildAccountToOUMap,d as buildTargetSetUnreadyAdvisory,n as buildTargetUnreadyAdvisory,v as checkIdentityCentreStatus,A as checkRegionEnabled,s as checkTargetReadiness,h as composeSdkAbortSignal,y as createAccount,b as describeOrganisation,o as describeTargetReadinessReason,G as drainPages,w as enableCentralisedRootAccess,I as enableIpamDelegatedAdmin,u as enablePolicyTypes,T as enableRamSharing,p as enableServiceAccess,g as ensureOrganisationExists,O as ensureOrganisationalUnitsExist,D as extractErrorName,_ as findAccount,L as isAborted,M as isOULeaf,x as listAccounts,P as placeAccountsInOUs,i as probeAccountStackExists,E as regionDisabledMessage,V as registerSecurityDelegates,k as snapshotIdentityCentre,C as updateBackupGlobalSettings};
+import{SimpleAwsProvider as a}from"./SimpleAwsProvider.js";import{checkTargetReadiness as o,describeTargetReadinessReason as s,buildTargetUnreadyAdvisory as n,probeAccountStackExists as i}from"./targetReadiness.js";import{buildTargetSetUnreadyAdvisory as d}from"./targetSetAdvisory.js";import{checkRegionEnabled as A,regionDisabledMessage as E}from"./regions/regionOptStatus.js";import{ensureOrganisationExists as g,describeOrganisation as u,enablePolicyTypes as b,enableServiceAccess as p,SERVICE_PRINCIPALS as m,enableRamSharing as I,activateTrustedAccess as R,enableIpamDelegatedAdmin as T,updateBackupGlobalSettings as C,listAccounts as x,findAccount as O,createAccount as _,ensureOrganisationalUnitsExist as f,placeAccountsInOUs as y,buildAccountToOUMap as P,findDevelopmentOuId as U,activateCostAllocationTags as v,checkIdentityCentreStatus as k,snapshotIdentityCentre as D,composeSdkAbortSignal as h,extractErrorName as L,isAborted as M,isOULeaf as N,DEFAULT_MAX_PAGES as F,IDENTITY_STORE_PAGE_SIZE as G,drainPages as V,registerSecurityDelegates as Y,SECURITY_SERVICE_PRINCIPALS as w,enableCentralisedRootAccess as B,ROOT_ACCESS_FEATURES as X,RootAccessEnablementError as Z}from"./organisations/index.js";import{CloudFormationEventMonitor as q}from"./utils/cloudformationEvents.js";export{q as CloudFormationEventMonitor,F as DEFAULT_MAX_PAGES,G as IDENTITY_STORE_PAGE_SIZE,X as ROOT_ACCESS_FEATURES,Z as RootAccessEnablementError,w as SECURITY_SERVICE_PRINCIPALS,m as SERVICE_PRINCIPALS,a as SimpleAwsProvider,v as activateCostAllocationTags,R as activateTrustedAccess,P as buildAccountToOUMap,d as buildTargetSetUnreadyAdvisory,n as buildTargetUnreadyAdvisory,k as checkIdentityCentreStatus,A as checkRegionEnabled,o as checkTargetReadiness,h as composeSdkAbortSignal,_ as createAccount,u as describeOrganisation,s as describeTargetReadinessReason,V as drainPages,B as enableCentralisedRootAccess,T as enableIpamDelegatedAdmin,b as enablePolicyTypes,I as enableRamSharing,p as enableServiceAccess,g as ensureOrganisationExists,f as ensureOrganisationalUnitsExist,L as extractErrorName,O as findAccount,U as findDevelopmentOuId,M as isAborted,N as isOULeaf,x as listAccounts,y as placeAccountsInOUs,i as probeAccountStackExists,E as regionDisabledMessage,Y as registerSecurityDelegates,D as snapshotIdentityCentre,C as updateBackupGlobalSettings};

package/dist/src/aws/organisations/backup.d.ts

@@ -29,8 +29,13 @@ export declare function accountHasDisasterRecovery(environment: string | null |
  * account/region, to decide adopt-vs-create. A retained, vault-locked DR vault
  * survives stack teardown and collides on the next CREATE.
  *
- * Returns success(true) when present and success(false) ONLY on
- * ResourceNotFoundException. Every other error (AccessDenied, throttling)
+ * Returns success(true) when present. DescribeBackupVault on an ABSENT vault
+ * throws AccessDeniedException ("Insufficient privileges to perform this
+ * action.") rather than ResourceNotFoundException — even for admin
+ * credentials in accounts that have never used AWS Backup — so an
+ * AccessDenied is disambiguated via ListBackupVaults, which answers cleanly:
+ * vault named in the list → exists; absent from a successful listing → does
+ * not. Every other error (throttling, and a listing that is itself denied)
  * propagates as failure — a mis-read "exists" would flip a vault-less region
  * into a broken by-reference deploy.
  */

package/dist/src/aws/organisations/backup.js

@@ -1,2 +1,2 @@
-import{DescribeBackupVaultCommand as l,UpdateGlobalSettingsCommand as m}from"@aws-sdk/client-backup";import{success as i,failure as c}from"@fjall/generator";import{BACKUP_VAULT_NAME as a,getErrorMessage as s,maskSensitiveOutput as d}from"@fjall/util";import{composeSdkAbortSignal as u}from"./types.js";const k={enableCrossAccountBackup:!0,enableDelegatedAdministrator:!0,enableMpa:!1};async function S(e,t,r){try{const n={...k,...t},o={isCrossAccountBackupEnabled:n.enableCrossAccountBackup.toString(),isDelegatedAdministratorEnabled:n.enableDelegatedAdministrator.toString(),isMpaEnabled:n.enableMpa.toString()};return await e.send(new m({GlobalSettings:o}),{abortSignal:u(r)}),i(void 0)}catch(n){return c(new Error(`Failed to update backup global settings: ${s(n)}`))}}function A(e,t){return t===void 0||t===""?!1:e==="production"||e==="compliance"}async function E(e,t){try{return await e.send(new l({BackupVaultName:a}),{abortSignal:u(t)}),i(!0)}catch(r){return r instanceof Error&&r.name==="ResourceNotFoundException"?i(!1):c(new Error(`Failed to describe backup vault "${a}": ${d(s(r))}`))}}async function v(e,t,r){try{const n=await e.send(new l({BackupVaultName:a}),{abortSignal:u(r)}),o=n.LockDate,p=o!==void 0&&o.getTime()<=Date.now();return i({vaultName:n.BackupVaultName??a,region:t,locked:n.Locked??!1,...o!==void 0&&{lockDate:o},lockPermanent:p,recoveryPointCount:n.NumberOfRecoveryPoints??0,...n.EncryptionKeyArn!==void 0&&{encryptionKeyArn:n.EncryptionKeyArn}})}catch(n){return n instanceof Error&&n.name==="ResourceNotFoundException"?i(null):c(new Error(`Failed to describe surviving backup vault "${a}": ${d(s(n))}`))}}function B(e){const t=e.locked?e.lockPermanent?"compliance-locked, PERMANENT \u2014 cannot be removed by anyone, including AWS or the root user":e.lockDate!==void 0?`compliance-locked, immutable from ${e.lockDate.toISOString().slice(0,10)}`:"governance-locked \u2014 removable by privileged IAM":"unlocked";return[`Backup vault "${e.vaultName}" in ${e.region} SURVIVES this destroy.`,`  \u2022 Lock: ${t}`,`  \u2022 Recovery points retained: ${e.recoveryPointCount}`,...e.encryptionKeyArn!==void 0?[`  \u2022 Retained KMS key (also orphaned): ${e.encryptionKeyArn}`]:[],"  The vault and its KMS key are RemovalPolicy.RETAIN \u2014 destroy cannot delete them."].join(`
-`)}export{a as BACKUP_VAULT_NAME,A as accountHasDisasterRecovery,E as describeBackupVaultExists,v as describeSurvivingBackupVault,B as formatSurvivingVaultWarning,S as updateBackupGlobalSettings};
+import{DescribeBackupVaultCommand as p,ListBackupVaultsCommand as m,UpdateGlobalSettingsCommand as k}from"@aws-sdk/client-backup";import{success as i,failure as c}from"@fjall/generator";import{BACKUP_VAULT_NAME as o,getErrorMessage as u,maskSensitiveOutput as d}from"@fjall/util";import{composeSdkAbortSignal as s,isAborted as f}from"./types.js";const b={enableCrossAccountBackup:!0,enableDelegatedAdministrator:!0,enableMpa:!1};async function B(e,r,t){try{const n={...b,...r},a={isCrossAccountBackupEnabled:n.enableCrossAccountBackup.toString(),isDelegatedAdministratorEnabled:n.enableDelegatedAdministrator.toString(),isMpaEnabled:n.enableMpa.toString()};return await e.send(new k({GlobalSettings:a}),{abortSignal:s(t)}),i(void 0)}catch(n){return c(new Error(`Failed to update backup global settings: ${u(n)}`))}}function v(e,r){return r===void 0||r===""?!1:e==="production"||e==="compliance"}async function N(e,r){try{return await e.send(new p({BackupVaultName:o}),{abortSignal:s(r)}),i(!0)}catch(t){return t instanceof Error&&t.name==="ResourceNotFoundException"?i(!1):t instanceof Error&&t.name==="AccessDeniedException"?g(e,r):c(new Error(`Failed to describe backup vault "${o}": ${d(u(t))}`))}}async function g(e,r){try{let t;do{if(f(r))return c(new Error("Backup vault probe aborted"));const n=await e.send(new m({NextToken:t}),{abortSignal:s(r)});if((n.BackupVaultList??[]).some(l=>l.BackupVaultName===o))return i(!0);t=n.NextToken}while(t!==void 0);return i(!1)}catch(t){return c(new Error(`Failed to list backup vaults probing "${o}": ${d(u(t))}`))}}async function w(e,r,t){try{const n=await e.send(new p({BackupVaultName:o}),{abortSignal:s(t)}),a=n.LockDate,l=a!==void 0&&a.getTime()<=Date.now();return i({vaultName:n.BackupVaultName??o,region:r,locked:n.Locked??!1,...a!==void 0&&{lockDate:a},lockPermanent:l,recoveryPointCount:n.NumberOfRecoveryPoints??0,...n.EncryptionKeyArn!==void 0&&{encryptionKeyArn:n.EncryptionKeyArn}})}catch(n){return n instanceof Error&&n.name==="ResourceNotFoundException"?i(null):c(new Error(`Failed to describe surviving backup vault "${o}": ${d(u(n))}`))}}function x(e){const r=e.locked?e.lockPermanent?"compliance-locked, PERMANENT \u2014 cannot be removed by anyone, including AWS or the root user":e.lockDate!==void 0?`compliance-locked, immutable from ${e.lockDate.toISOString().slice(0,10)}`:"governance-locked \u2014 removable by privileged IAM":"unlocked";return[`Backup vault "${e.vaultName}" in ${e.region} SURVIVES this destroy.`,`  \u2022 Lock: ${r}`,`  \u2022 Recovery points retained: ${e.recoveryPointCount}`,...e.encryptionKeyArn!==void 0?[`  \u2022 Retained KMS key (also orphaned): ${e.encryptionKeyArn}`]:[],"  The vault and its KMS key are RemovalPolicy.RETAIN \u2014 destroy cannot delete them."].join(`
+`)}export{o as BACKUP_VAULT_NAME,v as accountHasDisasterRecovery,N as describeBackupVaultExists,w as describeSurvivingBackupVault,x as formatSurvivingVaultWarning,B as updateBackupGlobalSettings};

package/dist/src/aws/organisations/index.d.ts

@@ -6,7 +6,7 @@ export type { BackupGlobalSettings } from "./backup.js";
 export type { CostAllocationTag } from "./costAllocation.js";
 export type { CreateAccountResult } from "./accounts.js";
 export type { RootAccessFeature, RootAccessEnablementSummary } from "./rootAccess.js";
-export { ensureOrganisationExists, describeOrganisation } from "./organisation.js";
+export { ensureOrganisationExists, describeOrganisation, describeOrganisationAsMember, type MemberOrgDetails } from "./organisation.js";
 export { enablePolicyTypes } from "./policies.js";
 export { enableServiceAccess, SERVICE_PRINCIPALS } from "./serviceAccess.js";
 export { enableRamSharing } from "./ram.js";
@@ -14,7 +14,7 @@ export { activateTrustedAccess } from "./trustedAccess.js";
 export { enableIpamDelegatedAdmin } from "./ipam.js";
 export { updateBackupGlobalSettings } from "./backup.js";
 export { listAccounts, findAccount, createAccount } from "./accounts.js";
-export { ensureOrganisationalUnitsExist, placeAccountsInOUs, buildAccountToOUMap } from "./organisationalUnits.js";
+export { ensureOrganisationalUnitsExist, placeAccountsInOUs, buildAccountToOUMap, findDevelopmentOuId } from "./organisationalUnits.js";
 export { activateCostAllocationTags } from "./costAllocation.js";
 export { checkIdentityCentreStatus } from "./identityCentre.js";
 export { snapshotIdentityCentre } from "./identityCentreSnapshot.js";

package/dist/src/aws/organisations/index.js

@@ -1 +1 @@
-import{composeSdkAbortSignal as r,extractErrorName as o,isAborted as a,isOULeaf as s}from"./types.js";import{DEFAULT_MAX_PAGES as c,IDENTITY_STORE_PAGE_SIZE as i,drainPages as p}from"./pagination.js";import{ensureOrganisationExists as A,describeOrganisation as l}from"./organisation.js";import{enablePolicyTypes as E}from"./policies.js";import{enableServiceAccess as S,SERVICE_PRINCIPALS as I}from"./serviceAccess.js";import{enableRamSharing as u}from"./ram.js";import{activateTrustedAccess as g}from"./trustedAccess.js";import{enableIpamDelegatedAdmin as R}from"./ipam.js";import{updateBackupGlobalSettings as _}from"./backup.js";import{listAccounts as P,findAccount as U,createAccount as y}from"./accounts.js";import{ensureOrganisationalUnitsExist as L,placeAccountsInOUs as N,buildAccountToOUMap as h}from"./organisationalUnits.js";import{activateCostAllocationTags as v}from"./costAllocation.js";import{checkIdentityCentreStatus as F}from"./identityCentre.js";import{snapshotIdentityCentre as V}from"./identityCentreSnapshot.js";import{registerSecurityDelegates as B,SECURITY_SERVICE_PRINCIPALS as X}from"./delegatedAdmin.js";import{enableCentralisedRootAccess as j,ROOT_ACCESS_FEATURES as q,RootAccessEnablementError as w}from"./rootAccess.js";export{c as DEFAULT_MAX_PAGES,i as IDENTITY_STORE_PAGE_SIZE,q as ROOT_ACCESS_FEATURES,w as RootAccessEnablementError,X as SECURITY_SERVICE_PRINCIPALS,I as SERVICE_PRINCIPALS,v as activateCostAllocationTags,g as activateTrustedAccess,h as buildAccountToOUMap,F as checkIdentityCentreStatus,r as composeSdkAbortSignal,y as createAccount,l as describeOrganisation,p as drainPages,j as enableCentralisedRootAccess,R as enableIpamDelegatedAdmin,E as enablePolicyTypes,u as enableRamSharing,S as enableServiceAccess,A as ensureOrganisationExists,L as ensureOrganisationalUnitsExist,o as extractErrorName,U as findAccount,a as isAborted,s as isOULeaf,P as listAccounts,N as placeAccountsInOUs,B as registerSecurityDelegates,V as snapshotIdentityCentre,_ as updateBackupGlobalSettings};
+import{composeSdkAbortSignal as r,extractErrorName as o,isAborted as a,isOULeaf as s}from"./types.js";import{DEFAULT_MAX_PAGES as i,IDENTITY_STORE_PAGE_SIZE as c,drainPages as p}from"./pagination.js";import{ensureOrganisationExists as A,describeOrganisation as l,describeOrganisationAsMember as f}from"./organisation.js";import{enablePolicyTypes as E}from"./policies.js";import{enableServiceAccess as d,SERVICE_PRINCIPALS as I}from"./serviceAccess.js";import{enableRamSharing as b}from"./ram.js";import{activateTrustedAccess as C}from"./trustedAccess.js";import{enableIpamDelegatedAdmin as R}from"./ipam.js";import{updateBackupGlobalSettings as _}from"./backup.js";import{listAccounts as U,findAccount as y,createAccount as D}from"./accounts.js";import{ensureOrganisationalUnitsExist as L,placeAccountsInOUs as N,buildAccountToOUMap as h,findDevelopmentOuId as k}from"./organisationalUnits.js";import{activateCostAllocationTags as M}from"./costAllocation.js";import{checkIdentityCentreStatus as V}from"./identityCentre.js";import{snapshotIdentityCentre as B}from"./identityCentreSnapshot.js";import{registerSecurityDelegates as Z,SECURITY_SERVICE_PRINCIPALS as j}from"./delegatedAdmin.js";import{enableCentralisedRootAccess as w,ROOT_ACCESS_FEATURES as z,RootAccessEnablementError as H}from"./rootAccess.js";export{i as DEFAULT_MAX_PAGES,c as IDENTITY_STORE_PAGE_SIZE,z as ROOT_ACCESS_FEATURES,H as RootAccessEnablementError,j as SECURITY_SERVICE_PRINCIPALS,I as SERVICE_PRINCIPALS,M as activateCostAllocationTags,C as activateTrustedAccess,h as buildAccountToOUMap,V as checkIdentityCentreStatus,r as composeSdkAbortSignal,D as createAccount,l as describeOrganisation,f as describeOrganisationAsMember,p as drainPages,w as enableCentralisedRootAccess,R as enableIpamDelegatedAdmin,E as enablePolicyTypes,b as enableRamSharing,d as enableServiceAccess,A as ensureOrganisationExists,L as ensureOrganisationalUnitsExist,o as extractErrorName,y as findAccount,k as findDevelopmentOuId,a as isAborted,s as isOULeaf,U as listAccounts,N as placeAccountsInOUs,Z as registerSecurityDelegates,B as snapshotIdentityCentre,_ as updateBackupGlobalSettings};

package/dist/src/aws/organisations/oidcProvider.d.ts

@@ -20,6 +20,43 @@ export interface OidcProviderTeardownResult {
  * Failure messages stay raw — callers mask at their output boundary.
  */
 export declare function deleteOidcProviderIfUnreferenced(client: IAMClient, abortSignal?: AbortSignal): Promise<Result<OidcProviderTeardownResult>>;
+export interface OidcProviderEnsureResult {
+    status: "present" | "recreated" | "aborted";
+    providerArn?: string;
+}
+/**
+ * Adopt-or-create guard for the account-global `https://fjall.io` OIDC
+ * provider, run after an Account/Platform stack deploy completes.
+ *
+ * Why this exists: pre-2.20.0 Account stacks owned the provider through CDK's
+ * L2 `iam.OpenIdConnectProvider` custom resource. The first redeploy on
+ * ≥2.20.0 replaces it with the adopt-or-create `Custom::FjallOidcProvider`
+ * resource under a NEW logical ID, so CloudFormation creates the new resource
+ * (which adopts the existing provider) and then — in the cleanup phase, after
+ * every in-template resource has run — deletes the old L2 resource, whose
+ * handler issues a real DeleteOpenIDConnectProvider on the same physical
+ * provider. The update completes green while the account's web-identity trust
+ * anchor is destroyed: every subsequent scan AND OIDC-authenticated deploy
+ * fails with InvalidIdentityToken (2026-07-07 fjall-org incident). Because
+ * cleanup runs last, no in-template fix can win; this reconcile runs after
+ * CloudFormation returns, inside the same deploy session, so the account is
+ * healed before the deploy that broke it reports success.
+ *
+ * The created provider mirrors the OidcConnector handler byte-for-byte via
+ * the shared `@fjall/generator` spec constants. EntityAlreadyExists from a
+ * concurrent creator (parallel cascade region, Quick-Create) is success.
+ *
+ * Failure messages stay raw — callers mask at their output boundary.
+ */
+export declare function ensureOidcProviderPresent(client: IAMClient, abortSignal?: AbortSignal): Promise<Result<OidcProviderEnsureResult>>;
+/**
+ * Best-effort wrapper around {@link ensureOidcProviderPresent}: surfaces the
+ * outcome via callbacks/logger and never fails the deploy — the stack deploy
+ * itself succeeded, and a reconcile miss must not convert that into a failure.
+ * A recreation is reported at warn level because it means the deletion class
+ * fired and the operator should know the trust anchor was briefly absent.
+ */
+export declare function reconcileOidcProviderAfterDeploy(client: IAMClient, callbacks: DeployCallbacks, abortSignal?: AbortSignal): Promise<void>;
 /**
  * Best-effort wrapper around {@link deleteOidcProviderIfUnreferenced}: surfaces
  * the outcome via callbacks/logger and swallows failures. A cleanup miss leaves

package/dist/src/aws/organisations/oidcProvider.js

@@ -1 +1 @@
-import{ListOpenIDConnectProvidersCommand as f,ListRolesCommand as u,DeleteOpenIDConnectProviderCommand as m}from"@aws-sdk/client-iam";import{success as d,failure as v}from"@fjall/generator";import{maskSensitiveOutput as I,getErrorMessage as O}from"@fjall/util";import{logger as a}from"@fjall/util/logger";import{composeSdkAbortSignal as s,isAborted as c}from"./types.js";const w="fjall.io",D=`:oidc-provider/${w}`;async function C(i,e){try{if(c(e))return d({deleted:!1,reason:"aborted"});const r=((await i.send(new f({}),{abortSignal:s(e)})).OpenIDConnectProviderList??[]).map(o=>o.Arn).find(o=>typeof o=="string"&&o.endsWith(D));if(r===void 0)return d({deleted:!1,reason:"provider not present"});let t;do{if(c(e))return d({deleted:!1,reason:"aborted"});const o=await i.send(new u({Marker:t}),{abortSignal:s(e)});for(const l of o.Roles??[]){const p=l.AssumeRolePolicyDocument;if(typeof p=="string"&&decodeURIComponent(p).includes(r))return d({deleted:!1,reason:`still referenced by role ${l.RoleName??"(unknown)"}`})}t=o.IsTruncated===!0?o.Marker:void 0}while(t!==void 0);return await i.send(new m({OpenIDConnectProviderArn:r}),{abortSignal:s(e)}),d({deleted:!0,reason:"deleted orphaned provider"})}catch(n){return n instanceof Error&&n.name==="NoSuchEntityException"?d({deleted:!1,reason:"provider not present"}):v(new Error(`Failed to evaluate OIDC provider teardown: ${O(n)}`))}}async function P(i,e,n){const r=await C(i,n);if(!r.success){const t=I(r.error.message);a.debug("oidcTeardown","OIDC provider teardown probe failed",{error:t}),e.onLog?.(`OIDC provider cleanup skipped: ${t}`,"warn");return}if(r.data.deleted){a.info("oidcTeardown","Deleted orphaned account-global OIDC provider"),e.onLog?.("Removed the orphaned Fjall OIDC provider","info");return}a.debug("oidcTeardown","OIDC provider retained",{reason:r.data.reason})}export{P as cleanupOrphanedOidcProvider,C as deleteOidcProviderIfUnreferenced};
+import{ListOpenIDConnectProvidersCommand as l,ListRolesCommand as D,CreateOpenIDConnectProviderCommand as O,DeleteOpenIDConnectProviderCommand as w}from"@aws-sdk/client-iam";import{FJALL_OIDC_AUDIENCE as g,FJALL_OIDC_ISSUER_DOMAIN as f,FJALL_OIDC_PLACEHOLDER_THUMBPRINT as y,success as i,failure as v}from"@fjall/generator";import{maskSensitiveOutput as m,getErrorMessage as I}from"@fjall/util";import{logger as s}from"@fjall/util/logger";import{composeSdkAbortSignal as a,isAborted as c}from"./types.js";const C=`:oidc-provider/${f}`;async function A(d,r){try{if(c(r))return i({deleted:!1,reason:"aborted"});const e=((await d.send(new l({}),{abortSignal:a(r)})).OpenIDConnectProviderList??[]).map(o=>o.Arn).find(o=>typeof o=="string"&&o.endsWith(C));if(e===void 0)return i({deleted:!1,reason:"provider not present"});let t;do{if(c(r))return i({deleted:!1,reason:"aborted"});const o=await d.send(new D({Marker:t}),{abortSignal:a(r)});for(const p of o.Roles??[]){const u=p.AssumeRolePolicyDocument;if(typeof u=="string"&&decodeURIComponent(u).includes(e))return i({deleted:!1,reason:`still referenced by role ${p.RoleName??"(unknown)"}`})}t=o.IsTruncated===!0?o.Marker:void 0}while(t!==void 0);return await d.send(new w({OpenIDConnectProviderArn:e}),{abortSignal:a(r)}),i({deleted:!0,reason:"deleted orphaned provider"})}catch(n){return n instanceof Error&&n.name==="NoSuchEntityException"?i({deleted:!1,reason:"provider not present"}):v(new Error(`Failed to evaluate OIDC provider teardown: ${I(n)}`))}}async function h(d,r){try{if(c(r))return i({status:"aborted"});const e=((await d.send(new l({}),{abortSignal:a(r)})).OpenIDConnectProviderList??[]).map(o=>o.Arn).find(o=>typeof o=="string"&&o.endsWith(C));if(e!==void 0)return i({status:"present",providerArn:e});const t=await d.send(new O({Url:`https://${f}`,ClientIDList:[g],ThumbprintList:[y]}),{abortSignal:a(r)});return i({status:"recreated",...t.OpenIDConnectProviderArn!==void 0&&{providerArn:t.OpenIDConnectProviderArn}})}catch(n){return n instanceof Error&&n.name==="EntityAlreadyExistsException"?i({status:"present"}):v(new Error(`Failed to ensure OIDC provider presence: ${I(n)}`))}}async function F(d,r,n){const e=await h(d,n);if(!e.success){const t=m(e.error.message);s.debug("oidcReconcile","OIDC provider ensure probe failed",{error:t}),r.onLog?.(`Could not verify the Fjall OIDC provider after deploy: ${t}. If scans or deploys later fail with InvalidIdentityToken, re-run this deploy or reconnect the account.`,"warn");return}if(e.data.status==="recreated"){s.info("oidcReconcile","Recreated missing account-global OIDC provider",{providerArn:e.data.providerArn}),r.onLog?.("The Fjall OIDC provider was missing after the stack deploy and has been restored","warn");return}s.debug("oidcReconcile","OIDC provider verified after deploy",{status:e.data.status})}async function _(d,r,n){const e=await A(d,n);if(!e.success){const t=m(e.error.message);s.debug("oidcTeardown","OIDC provider teardown probe failed",{error:t}),r.onLog?.(`OIDC provider cleanup skipped: ${t}`,"warn");return}if(e.data.deleted){s.info("oidcTeardown","Deleted orphaned account-global OIDC provider"),r.onLog?.("Removed the orphaned Fjall OIDC provider","info");return}s.debug("oidcTeardown","OIDC provider retained",{reason:e.data.reason})}export{_ as cleanupOrphanedOidcProvider,A as deleteOidcProviderIfUnreferenced,h as ensureOidcProviderPresent,F as reconcileOidcProviderAfterDeploy};

package/dist/src/aws/organisations/organisation.d.ts

@@ -19,3 +19,24 @@ export declare function ensureOrganisationExists(client: OrganizationsClient, ab
 export declare function describeOrganisation(client: OrganizationsClient, abortSignal?: AbortSignal, opts?: {
     tolerateAccessDenied?: boolean;
 }): Promise<Result<OrgDetails | null>>;
+/**
+ * Org details visible to member-account credentials. rootId is present only
+ * when the caller can ListRoots (management account or delegated
+ * administrator).
+ */
+export interface MemberOrgDetails {
+    orgId: string;
+    managementAccountId: string;
+    rootId?: string;
+}
+/**
+ * Describe the organisation with credentials that may belong to a member
+ * account. DescribeOrganization is callable from any account in an
+ * organisation, but ListRoots only from the management account (or a
+ * delegated administrator) — the root id resolves best-effort and is omitted
+ * when credentials cannot list roots. Read-only: never creates. Returns null
+ * when the account is not in an organisation. A DescribeOrganization denial
+ * still fails: the caller needs orgId (the Account stack exports it), so a
+ * silent fall-through would strip an exported output on redeploy.
+ */
+export declare function describeOrganisationAsMember(client: OrganizationsClient, abortSignal?: AbortSignal): Promise<Result<MemberOrgDetails | null>>;

package/dist/src/aws/organisations/organisation.js

@@ -1 +1 @@
-import{DescribeOrganizationCommand as m,CreateOrganizationCommand as I,ListRootsCommand as w}from"@aws-sdk/client-organizations";import{success as s,failure as a}from"@fjall/generator";import{getErrorMessage as g}from"@fjall/util";import{extractErrorName as c,isAccessDenied as f,composeSdkAbortSignal as u,AWS_ERROR_NAMES as A}from"./types.js";async function h(e,t){try{let n=!1,r=await d(e,t);if(!r)try{r=(await e.send(new I({FeatureSet:"ALL"}),{abortSignal:u(t)})).Organization??null,n=!0}catch(i){if(c(i)==="AlreadyInOrganizationException"){if(r=await d(e,t),!r)return a(new Error("Account is already in an organisation but DescribeOrganization returned nothing"))}else throw i}if(!r?.Id||!r.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));const o=await l(e,t);return o.success?s({orgId:r.Id,rootId:o.data,managementAccountId:r.MasterAccountId,created:n}):o}catch(n){return a(new Error(`Failed to ensure organisation exists: ${g(n)}`))}}async function M(e,t,n){try{const r=await d(e,t,n);if(!r)return s(null);if(!r.Id||!r.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));const o=await l(e,t);return o.success?s({orgId:r.Id,rootId:o.data,managementAccountId:r.MasterAccountId,created:!1}):o}catch(r){return n?.tolerateAccessDenied===!0&&f(c(r))?s(null):a(new Error(`Failed to describe organisation: ${g(r)}`))}}async function l(e,t){const r=(await e.send(new w({}),{abortSignal:u(t)})).Roots??[];return r.length===0||!r[0]?.Id?a(new Error("No organisation root found")):s(r[0].Id)}async function d(e,t,n){try{return(await e.send(new m({}),{abortSignal:u(t)})).Organization??null}catch(r){const o=c(r);if(o===A.ORGS_NOT_IN_USE||n?.tolerateAccessDenied===!0&&f(o))return null;throw r}}export{M as describeOrganisation,h as ensureOrganisationExists};
+import{DescribeOrganizationCommand as l,CreateOrganizationCommand as m,ListRootsCommand as w}from"@aws-sdk/client-organizations";import{success as s,failure as a}from"@fjall/generator";import{getErrorMessage as d}from"@fjall/util";import{extractErrorName as i,isAccessDenied as g,composeSdkAbortSignal as f,AWS_ERROR_NAMES as A}from"./types.js";async function M(n,o){try{let e=!1,r=await c(n,o);if(!r)try{r=(await n.send(new m({FeatureSet:"ALL"}),{abortSignal:f(o)})).Organization??null,e=!0}catch(u){if(i(u)==="AlreadyInOrganizationException"){if(r=await c(n,o),!r)return a(new Error("Account is already in an organisation but DescribeOrganization returned nothing"))}else throw u}if(!r?.Id||!r.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));const t=await I(n,o);return t.success?s({orgId:r.Id,rootId:t.data,managementAccountId:r.MasterAccountId,created:e}):t}catch(e){return a(new Error(`Failed to ensure organisation exists: ${d(e)}`))}}async function h(n,o,e){try{const r=await c(n,o,e);if(!r)return s(null);if(!r.Id||!r.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));const t=await I(n,o);return t.success?s({orgId:r.Id,rootId:t.data,managementAccountId:r.MasterAccountId,created:!1}):t}catch(r){return e?.tolerateAccessDenied===!0&&g(i(r))?s(null):a(new Error(`Failed to describe organisation: ${d(r)}`))}}async function b(n,o){try{const e=await c(n,o);if(!e)return s(null);if(!e.Id||!e.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));let r;try{const t=await I(n,o);t.success&&(r=t.data)}catch(t){if(!g(i(t)))throw t}return s({orgId:e.Id,managementAccountId:e.MasterAccountId,...r!==void 0?{rootId:r}:{}})}catch(e){return a(new Error(`Failed to describe organisation: ${d(e)}`))}}async function I(n,o){const r=(await n.send(new w({}),{abortSignal:f(o)})).Roots??[];return r.length===0||!r[0]?.Id?a(new Error("No organisation root found")):s(r[0].Id)}async function c(n,o,e){try{return(await n.send(new l({}),{abortSignal:f(o)})).Organization??null}catch(r){const t=i(r);if(t===A.ORGS_NOT_IN_USE||e?.tolerateAccessDenied===!0&&g(t))return null;throw r}}export{h as describeOrganisation,b as describeOrganisationAsMember,M as ensureOrganisationExists};

package/dist/src/aws/organisations/organisationalUnits.d.ts

@@ -37,3 +37,18 @@ export declare function buildAccountToOUMap(tree: OUTree, ouMap: OUMap, prefix?:
  * Idempotent — accounts already in the correct OU are counted but not moved.
  */
 export declare function placeAccountsInOUs(client: OrganizationsClient, ouMap: OUMap, accounts: AccountInfo[], accountToOU?: Record<string, string>, abortSignal?: AbortSignal): Promise<Result<AccountPlacementResult>>;
+/**
+ * Find the id of the organisational unit named "development" (case-insensitive),
+ * searching breadth-first from the root up to DEV_OU_SEARCH_MAX_DEPTH levels.
+ * Supports both OU shapes ensureOrganisationalUnitsExist creates: flat
+ * (development at root) and nested (workloads.development).
+ *
+ * Collects EVERY match rather than returning the shallowest one: a flat→nested
+ * migration leaves a stray empty "development" OU at the root alongside the
+ * real nested one, and silently attaching the dev-isolation SCP to the stray
+ * would isolate nothing. Exactly one match → its id; zero → `undefined` (the
+ * org has no development OU — the caller treats that as "nothing to isolate",
+ * not an error); two or more → a loud failure naming the ids so the operator
+ * disambiguates, because a security backstop must never attach to the wrong OU.
+ */
+export declare function findDevelopmentOuId(client: OrganizationsClient, rootId: string, abortSignal?: AbortSignal): Promise<Result<string | undefined>>;

package/dist/src/aws/organisations/organisationalUnits.js

@@ -1 +1 @@
-import{CreateOrganizationalUnitCommand as b,ListOrganizationalUnitsForParentCommand as C,ListParentsCommand as x,MoveAccountCommand as $}from"@aws-sdk/client-organizations";import{success as d,failure as u}from"@fjall/generator";import{extractErrorName as I,isOULeaf as p,composeSdkAbortSignal as m,isAborted as y,AWS_ERROR_NAMES as A}from"./types.js";import{accountTier as F,getErrorMessage as U}from"@fjall/util";async function g(n,a,e){const t=await n.send(new C({ParentId:a}),{abortSignal:m(e)});let r=t.OrganizationalUnits??[],o=t.NextToken;for(;o;){if(y(e))throw new Error("Aborted: OU listing cancelled by shutdown signal");const s=await n.send(new C({ParentId:a,NextToken:o}),{abortSignal:m(e)});r=r.concat(s.OrganizationalUnits??[]),o=s.NextToken}return r}async function T(n,a,e){try{return(await n.send(new x({ChildId:a}),{abortSignal:m(e)})).Parents?.[0]?.Id}catch(t){if(I(t)===A.CHILD_NOT_FOUND)return;throw t}}async function L(n,a,e,t,r){const o=t.find(s=>s.Name===e);if(o?.Id)return d(o.Id);try{const c=(await n.send(new b({Name:e,ParentId:a}),{abortSignal:m(r)})).OrganizationalUnit;return c?.Id?d(c.Id):u(new Error(`OU "${e}" was created but has no ID`))}catch(s){return u(new Error(`Failed to create OU "${e}": ${U(s)}`))}}function P(n){return n.charAt(0).toUpperCase()+n.slice(1)}async function k(n,a,e,t){const r={};if(e.length===0)return d(r);const o=await g(n,a,t);for(const s of e){const c=P(s),i=await L(n,a,c,o,t);if(!i.success)return u(i.error);r[s.toLowerCase()]=i.data,o.push({Id:i.data,Name:c})}return d(r)}async function E(n,a,e,t,r,o,s){const c=await g(n,a,s);for(const[i,f]of Object.entries(e)){const w=P(i),O=await L(n,a,w,c,s);if(!O.success)return u(O.error);const h=O.data,N=r?`${r}.${i.toLowerCase()}`:i.toLowerCase();if(t[N]=h,r){const l=i.toLowerCase();o.has(l)||(t[l]=h)}if(c.push({Id:h,Name:w}),!p(f)){const l=await E(n,h,f,t,N,o,s);if(!l.success)return l}}return d(void 0)}async function v(n,a,e,t){if(y(t))return u(new Error("Aborted: OU reconciliation cancelled by shutdown signal"));try{if(Array.isArray(e))return await k(n,a,e,t);const r={},o=new Set(Object.keys(e).map(c=>c.toLowerCase())),s=await E(n,a,e,r,"",o,t);return s.success?d(r):u(s.error)}catch(r){return u(new Error(`Failed to ensure OUs exist: ${U(r)}`))}}function _(n,a,e=""){const t={};for(const[r,o]of Object.entries(n)){const s=e?`${e}.${r.toLowerCase()}`:r.toLowerCase(),c=a[s];if(p(o)){if(c)for(const i of o)t[i.toLowerCase()]=c}else Object.assign(t,_(o,a,s))}return t}async function M(n,a,e,t,r){try{if(e.length===0)return d({moved:0,alreadyPlaced:0});let o=0,s=0;for(const c of e){if(y(r))return u(new Error("Aborted: account placement cancelled by shutdown signal"));if(F(c)==="organisation")continue;const i=t?t[c.name.toLowerCase()]:a[c.environment.toLowerCase()];if(!i)continue;const f=await T(n,c.id,r);if(f){if(f===i){s++;continue}try{await n.send(new $({AccountId:c.id,SourceParentId:f,DestinationParentId:i}),{abortSignal:m(r)}),o++}catch(w){if(I(w)===A.ACCOUNT_NOT_FOUND)continue;throw w}}}return d({moved:o,alreadyPlaced:s})}catch(o){return u(new Error(`Failed to place accounts in OUs: ${U(o)}`))}}export{_ as buildAccountToOUMap,v as ensureOrganisationalUnitsExist,M as placeAccountsInOUs};
+import{CreateOrganizationalUnitCommand as x,ListOrganizationalUnitsForParentCommand as C,ListParentsCommand as b,MoveAccountCommand as _}from"@aws-sdk/client-organizations";import{success as f,failure as u}from"@fjall/generator";import{extractErrorName as N,isOULeaf as A,composeSdkAbortSignal as m,isAborted as p,AWS_ERROR_NAMES as E}from"./types.js";import{accountTier as v,getErrorMessage as y}from"@fjall/util";async function U(o,s,t){const e=await o.send(new C({ParentId:s}),{abortSignal:m(t)});let n=e.OrganizationalUnits??[],a=e.NextToken;for(;a;){if(p(t))throw new Error("Aborted: OU listing cancelled by shutdown signal");const r=await o.send(new C({ParentId:s,NextToken:a}),{abortSignal:m(t)});n=n.concat(r.OrganizationalUnits??[]),a=r.NextToken}return n}async function F(o,s,t){try{return(await o.send(new b({ChildId:s}),{abortSignal:m(t)})).Parents?.[0]?.Id}catch(e){if(N(e)===E.CHILD_NOT_FOUND)return;throw e}}async function L(o,s,t,e,n){const a=e.find(r=>r.Name===t);if(a?.Id)return f(a.Id);try{const c=(await o.send(new x({Name:t,ParentId:s}),{abortSignal:m(n)})).OrganizationalUnit;return c?.Id?f(c.Id):u(new Error(`OU "${t}" was created but has no ID`))}catch(r){return u(new Error(`Failed to create OU "${t}": ${y(r)}`))}}function P(o){return o.charAt(0).toUpperCase()+o.slice(1)}async function D(o,s,t,e){const n={};if(t.length===0)return f(n);const a=await U(o,s,e);for(const r of t){const c=P(r),i=await L(o,s,c,a,e);if(!i.success)return u(i.error);n[r.toLowerCase()]=i.data,a.push({Id:i.data,Name:c})}return f(n)}async function $(o,s,t,e,n,a,r){const c=await U(o,s,r);for(const[i,d]of Object.entries(t)){const l=P(i),h=await L(o,s,l,c,r);if(!h.success)return u(h.error);const O=h.data,g=n?`${n}.${i.toLowerCase()}`:i.toLowerCase();if(e[g]=O,n){const w=i.toLowerCase();a.has(w)||(e[w]=O)}if(c.push({Id:O,Name:l}),!A(d)){const w=await $(o,O,d,e,g,a,r);if(!w.success)return w}}return f(void 0)}async function H(o,s,t,e){if(p(e))return u(new Error("Aborted: OU reconciliation cancelled by shutdown signal"));try{if(Array.isArray(t))return await D(o,s,t,e);const n={},a=new Set(Object.keys(t).map(c=>c.toLowerCase())),r=await $(o,s,t,n,"",a,e);return r.success?f(n):u(r.error)}catch(n){return u(new Error(`Failed to ensure OUs exist: ${y(n)}`))}}function T(o,s,t=""){const e={};for(const[n,a]of Object.entries(o)){const r=t?`${t}.${n.toLowerCase()}`:n.toLowerCase(),c=s[r];if(A(a)){if(c)for(const i of a)e[i.toLowerCase()]=c}else Object.assign(e,T(a,s,r))}return e}async function S(o,s,t,e,n){try{if(t.length===0)return f({moved:0,alreadyPlaced:0});let a=0,r=0;for(const c of t){if(p(n))return u(new Error("Aborted: account placement cancelled by shutdown signal"));if(v(c)==="organisation")continue;const i=e?e[c.name.toLowerCase()]:s[c.environment.toLowerCase()];if(!i)continue;const d=await F(o,c.id,n);if(d){if(d===i){r++;continue}try{await o.send(new _({AccountId:c.id,SourceParentId:d,DestinationParentId:i}),{abortSignal:m(n)}),a++}catch(l){if(N(l)===E.ACCOUNT_NOT_FOUND)continue;throw l}}}return f({moved:a,alreadyPlaced:r})}catch(a){return u(new Error(`Failed to place accounts in OUs: ${y(a)}`))}}const I="development",k=3;async function K(o,s,t){try{const e=[];let n=[s];for(let a=0;a<k;a++){const r=[];for(const c of n){if(p(t))return u(new Error("Aborted: development-OU lookup cancelled by shutdown signal"));const i=await U(o,c,t);for(const d of i)if(d.Id!==void 0){if(d.Name?.toLowerCase()===I){e.push(d.Id);continue}r.push(d.Id)}}if(r.length===0)break;n=r}return e.length===0?f(void 0):e.length>1?u(new Error(`Found ${e.length} organisational units named "${I}" (${e.join(", ")}); cannot safely target the dev-isolation SCP. A flat\u2192nested migration can leave a stray empty "${I}" OU at the root \u2014 remove the duplicate so exactly one remains.`)):f(e[0])}catch(e){return u(new Error(`Failed to locate development OU: ${y(e)}`))}}export{T as buildAccountToOUMap,H as ensureOrganisationalUnitsExist,K as findDevelopmentOuId,S as placeAccountsInOUs};

package/dist/src/aws/utils/cloudformationEventHelpers.d.ts

@@ -15,6 +15,34 @@ export declare class IpamConcurrencyTracker {
      */
     trackEvent(event: ResourceEvent, eventLogger: EventLogWriter | null): void;
 }
+/**
+ * Clock-skew allowance subtracted from the monitor start time to form the
+ * event cutoff (F-F8). CloudFormation event timestamps come from AWS clocks;
+ * two minutes comfortably covers client/AWS drift (SigV4 itself tolerates
+ * five) without re-admitting a previous operation's history.
+ *
+ * Accepted residual (F-R11, narrowed by F-X9): after a FAILED prime poll, a
+ * previous operation's events inside the skew window (terminal within 120s
+ * of startMonitoring, same stack) are admitted for DISPATCH and terminal
+ * detection. Tightening those to an unskewed `>= monitorStart` bound would
+ * fail CLOSED under a fast client clock (this operation's own terminal event
+ * skipped → event-driven completion silently disabled), and an
+ * AWS-clock-only discriminator (terminal newer than the newest observed
+ * stack-level IN_PROGRESS) hangs any monitor attached to an
+ * already-in-flight operation. That residual is bounded: the completion
+ * verdict is re-read from live DescribeStacks in handleStackCompletion and
+ * the deploy result derives from the CDK subprocess lifecycle.
+ *
+ * The ClientRequestToken is NOT part of the residual (F-X9): the latched
+ * token becomes the webapp reconciler's §5.4 adoption comparand (heartbeat →
+ * Deployment.clientRequestToken → matchesToken/deriveAdoption), where a
+ * previous operation's token would corroborate the WRONG operation's
+ * outcome. Skew-window events are therefore dispatched with the token
+ * withheld (`tokenLatchCutoffMs`, unskewed) — an absent comparand merely
+ * skips adoption assist, and CFN's own ClientRequestToken remains the §5.3
+ * fencing backstop.
+ */
+export declare const EVENT_CUTOFF_SKEW_MS = 120000;
 /** Mutable state passed into pollStackEvents from the monitor class */
 export interface PollContext {
     aws: AwsClientLike;
@@ -25,6 +53,23 @@ export interface PollContext {
     maxHistorySize: number;
     ipamTracker: IpamConcurrencyTracker;
     eventLogger: EventLogWriter | null;
+    /**
+     * Epoch ms below which events belong to a PREVIOUS operation and are
+     * absorbed (marked seen, never processed or dispatched). Guards the case
+     * where the prime poll fails (throttle/network), leaving seenEventIds
+     * empty so the first live poll walks the stack's full prior history (F-F8).
+     */
+    eventCutoffMs: number;
+    /**
+     * Epoch ms of startMonitoring, UNSKEWED (F-X9). Events at/after this bound
+     * carry their ClientRequestToken; events inside the skew window
+     * (eventCutoffMs ≤ t < tokenLatchCutoffMs) are dispatched with the token
+     * withheld — the token feeds the tracker's §5.9 latch and thence the
+     * reconciler's adoption comparand, where a previous operation's token
+     * corroborates the wrong operation. Dispatch and terminal detection keep
+     * the skewed cutoff.
+     */
+    tokenLatchCutoffMs: number;
 }
 /** Poll CloudFormation for new stack events and dispatch them to the callback */
 export declare function pollStackEvents(ctx: PollContext, stackName: string, onResourceUpdate: (event: ResourceEvent) => void): Promise<boolean | "throttled">;

package/dist/src/aws/utils/cloudformationEventHelpers.js

@@ -1 +1 @@
-import{CloudFormationClient as g,DescribeStackEventsCommand as y,DescribeStacksCommand as A}from"@aws-sdk/client-cloudformation";import{logger as m}from"@fjall/util/logger";import{getErrorMessage as S,maskSensitiveOutput as C}from"@fjall/util";import{STACK_NOT_FOUND_PATTERN as f,maskFailureAnalysis as L}from"@fjall/util/aws";import{CF_STACK_RESOURCE_TYPE as I}from"./cloudformationEventTypes.js";import{extractErrorName as P}from"../organisations/types.js";const h=["CREATE_COMPLETE","CREATE_FAILED","DELETE_COMPLETE","DELETE_FAILED","UPDATE_COMPLETE","UPDATE_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","IMPORT_COMPLETE","IMPORT_ROLLBACK_COMPLETE","IMPORT_ROLLBACK_FAILED"],k=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE","IMPORT_COMPLETE"];function O(s){return h.includes(s)}function b(s){return k.includes(s)}const M=new Set(["AWS::EC2::IPAMPool","AWS::EC2::IPAMPoolCidr","AWS::EC2::IPAM"]);function _(s){return M.has(s)}class v{inProgress=new Map;get size(){return this.inProgress.size}clear(){this.inProgress.clear()}trackEvent(e,i){if(e.status.includes("IN_PROGRESS")){this.inProgress.set(e.logicalId,{resourceType:e.resourceType,startTime:e.timestamp});const o=Array.from(this.inProgress.entries()).map(([a,r])=>`${a} (${r.resourceType.split("::").pop()}, started ${r.startTime.toISOString()})`);m.debug("CloudFormation","IPAM resource started",{logicalId:e.logicalId,resourceType:e.resourceType,concurrentIpamCount:this.inProgress.size,concurrentIpamResources:o}),i&&i.writeEvent(e,{phase:"ipam_concurrency",isMainStack:!0,parentStack:`concurrent=${this.inProgress.size}: ${o.join(", ")}`})}else if(e.status.includes("COMPLETE")||e.status.includes("FAILED")){const o=this.inProgress.has(e.logicalId),a=this.inProgress.get(e.logicalId);this.inProgress.delete(e.logicalId);const r=a?e.timestamp.getTime()-a.startTime.getTime():void 0;if(m.debug("CloudFormation",`IPAM resource ${e.status}`,{logicalId:e.logicalId,resourceType:e.resourceType,status:e.status,statusReason:e.statusReason,durationMs:r,wasTracked:o,remainingIpamCount:this.inProgress.size,remainingIpamResources:Array.from(this.inProgress.keys())}),e.status.includes("FAILED")&&i){const l=Array.from(this.inProgress.entries()).map(([c,u])=>({logicalId:c,resourceType:u.resourceType,startTime:u.startTime.toISOString(),inFlightDurationMs:e.timestamp.getTime()-u.startTime.getTime()}));i.writeEvent(e,{phase:"ipam_failure_snapshot",isMainStack:!0,parentStack:JSON.stringify({failedResource:e.logicalId,reason:e.statusReason,durationMs:r,concurrentIpamAtFailure:l})})}}}}async function $(s,e,i){try{const o=s.aws.getClient(g);let a,r=!1,l=!1;do{const c=new y({StackName:e,...a?{NextToken:a}:{}}),u=await o.send(c);if(!u.StackEvents)break;for(const t of u.StackEvents){const d=`${t.EventId}`;if(s.seenEventIds.has(d)){l=!0;continue}if(s.seenEventIds.add(d),t.ResourceType===I&&t.LogicalResourceId!==e){const E=t.ResourceStatus||"",T=t.LogicalResourceId||"";E.includes("IN_PROGRESS")?s.activeNestedStacks.set(T,E):(E.includes("COMPLETE")||E.includes("FAILED"))&&s.activeNestedStacks.delete(T)}if(t.LogicalResourceId===e&&t.ResourceType===I){const E=t.ResourceStatus||"";O(E)&&(r=!0)}t.ResourceStatus&&t.ResourceStatus.includes("FAILED")&&t.ResourceStatusReason&&(s.failureReasons.set(t.LogicalResourceId||"unknown",t.ResourceStatusReason),m.debug("CloudFormation",`Captured failure: ${t.LogicalResourceId} - ${t.ResourceStatusReason}`));const n={logicalId:t.LogicalResourceId||"",physicalId:t.PhysicalResourceId,resourceType:t.ResourceType||"",status:t.ResourceStatus||"",statusReason:t.ResourceStatusReason,timestamp:t.Timestamp||new Date},p=n.logicalId,R=s.eventHistory.get(p)??[];if(R.push(n),s.eventHistory.set(p,R),s.eventHistory.size>s.maxHistorySize){const E=[...s.eventHistory.keys()].slice(0,s.eventHistory.size-s.maxHistorySize);for(const T of E)s.eventHistory.delete(T)}_(n.resourceType)&&s.ipamTracker.trackEvent(n,s.eventLogger),s.eventLogger&&s.eventLogger.writeEvent(n),m.debug("CloudFormation","pollEvents delivering event",{stackName:e,logicalId:n.logicalId,status:n.status,resourceType:n.resourceType}),i(n)}a=l?void 0:u.NextToken}while(a);return r&&s.activeNestedStacks.size>0?!1:r}catch(o){const a=P(o),r=S(o);return a==="ValidationError"&&r.includes(f)?!1:a==="Throttling"||a==="TooManyRequestsException"||a==="ThrottlingException"?"throttled":(r.includes(f)||m.error("CloudFormation","Unexpected polling error",{error:C(r)}),!1)}}async function H(s,e,i,o,a,r){const l=await F(s,e),c=l?.status||"UNKNOWN",u=c.endsWith("_COMPLETE")&&!c.includes("ROLLBACK")&&!c.includes("FAILED");let t=l?.statusReason;!u&&i.size>0&&(t=(Array.from(i.values())[0]??t)||t);let d=null;if(!u&&a){const n=a.analyseFailure(r);d=n===null?null:L(n)}return o&&(o.writeDeploymentEnd(u,c,t),!u&&i.size>0&&o.writeFailureSummary(Array.from(i.entries()).map(([n,p])=>({logicalId:n,reason:p}))),d&&o.writeFailureAnalysis({rootCause:d.rootCause.reason,failedResources:d.affectedResources.map(n=>({logicalId:n.logicalId,resourceType:n.resourceType,reason:n.statusReason||"Unknown reason"})),dependencyChain:d.dependencyChain,remediation:d.remediation})),{success:u,failureMessage:t,analysis:d}}async function F(s,e){try{const i=new A({StackName:e}),r=(await s.getClient(g).send(i)).Stacks?.[0];return r?{status:r.StackStatus||"UNKNOWN",statusReason:r.StackStatusReason}:null}catch(i){return m.debug("CloudFormation","getStackStatus failed",{error:S(i)}),null}}async function B(s,e){const i=[];try{const o=new y({StackName:e}),r=await s.getClient(g).send(o);if(!r.StackEvents)return i;const l=new Map;for(const c of r.StackEvents){const u=c.LogicalResourceId||"";if(u===e&&c.ResourceType===I)continue;const t=l.get(u);(!t||c.Timestamp&&t.timestamp<c.Timestamp)&&l.set(u,{logicalId:u,physicalId:c.PhysicalResourceId,resourceType:c.ResourceType||"",status:c.ResourceStatus||"",statusReason:c.ResourceStatusReason,timestamp:c.Timestamp||new Date})}return Array.from(l.values())}catch(o){const a=P(o),r=S(o);return a==="ValidationError"&&r.includes(f)||r.includes(f)||m.error("CloudFormation","Error getting current resources",{error:C(S(o))}),i}}export{v as IpamConcurrencyTracker,B as fetchCurrentResources,F as fetchStackStatus,H as handleStackCompletion,_ as isIpamResource,b as isSuccessState,O as isTerminalState,$ as pollStackEvents};
+import{CloudFormationClient as R,DescribeStackEventsCommand as y,DescribeStacksCommand as L}from"@aws-sdk/client-cloudformation";import{logger as T}from"@fjall/util/logger";import{getErrorMessage as f,maskSensitiveOutput as P}from"@fjall/util";import{STACK_NOT_FOUND_PATTERN as S,maskFailureAnalysis as k}from"@fjall/util/aws";import{CF_STACK_RESOURCE_TYPE as g}from"./cloudformationEventTypes.js";import{extractErrorName as A}from"../organisations/types.js";const h=["CREATE_COMPLETE","CREATE_FAILED","DELETE_COMPLETE","DELETE_FAILED","UPDATE_COMPLETE","UPDATE_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","IMPORT_COMPLETE","IMPORT_ROLLBACK_COMPLETE","IMPORT_ROLLBACK_FAILED"],_=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE","IMPORT_COMPLETE"];function M(t){return h.includes(t)}function b(t){return _.includes(t)}const O=new Set(["AWS::EC2::IPAMPool","AWS::EC2::IPAMPoolCidr","AWS::EC2::IPAM"]);function F(t){return O.has(t)}class ${inProgress=new Map;get size(){return this.inProgress.size}clear(){this.inProgress.clear()}trackEvent(e,i){if(e.status.includes("IN_PROGRESS")){this.inProgress.set(e.logicalId,{resourceType:e.resourceType,startTime:e.timestamp});const o=Array.from(this.inProgress.entries()).map(([n,r])=>`${n} (${r.resourceType.split("::").pop()}, started ${r.startTime.toISOString()})`);T.debug("CloudFormation","IPAM resource started",{logicalId:e.logicalId,resourceType:e.resourceType,concurrentIpamCount:this.inProgress.size,concurrentIpamResources:o}),i&&i.writeEvent(e,{phase:"ipam_concurrency",isMainStack:!0,parentStack:`concurrent=${this.inProgress.size}: ${o.join(", ")}`})}else if(e.status.includes("COMPLETE")||e.status.includes("FAILED")){const o=this.inProgress.has(e.logicalId),n=this.inProgress.get(e.logicalId);this.inProgress.delete(e.logicalId);const r=n?e.timestamp.getTime()-n.startTime.getTime():void 0;if(T.debug("CloudFormation",`IPAM resource ${e.status}`,{logicalId:e.logicalId,resourceType:e.resourceType,status:e.status,statusReason:e.statusReason,durationMs:r,wasTracked:o,remainingIpamCount:this.inProgress.size,remainingIpamResources:Array.from(this.inProgress.keys())}),e.status.includes("FAILED")&&i){const u=Array.from(this.inProgress.entries()).map(([a,c])=>({logicalId:a,resourceType:c.resourceType,startTime:c.startTime.toISOString(),inFlightDurationMs:e.timestamp.getTime()-c.startTime.getTime()}));i.writeEvent(e,{phase:"ipam_failure_snapshot",isMainStack:!0,parentStack:JSON.stringify({failedResource:e.logicalId,reason:e.statusReason,durationMs:r,concurrentIpamAtFailure:u})})}}}}const H=12e4;async function B(t,e,i){try{const o=t.aws.getClient(R);let n,r=!1,u=!1;do{const a=new y({StackName:e,...n?{NextToken:n}:{}}),c=await o.send(a);if(!c.StackEvents)break;for(const s of c.StackEvents){const m=`${s.EventId}`;if(t.seenEventIds.has(m)){u=!0;continue}if(t.seenEventIds.add(m),s.Timestamp!==void 0&&s.Timestamp.getTime()<t.eventCutoffMs){u=!0;continue}if(s.ResourceType===g&&s.LogicalResourceId!==e){const E=s.ResourceStatus||"",p=s.LogicalResourceId||"";E.includes("IN_PROGRESS")?t.activeNestedStacks.set(p,E):(E.includes("COMPLETE")||E.includes("FAILED"))&&t.activeNestedStacks.delete(p)}if(s.LogicalResourceId===e&&s.ResourceType===g){const E=s.ResourceStatus||"";M(E)&&(r=!0)}s.ResourceStatus&&s.ResourceStatus.includes("FAILED")&&s.ResourceStatusReason&&(t.failureReasons.set(s.LogicalResourceId||"unknown",s.ResourceStatusReason),T.debug("CloudFormation",`Captured failure: ${s.LogicalResourceId} - ${s.ResourceStatusReason}`));const l=s.Timestamp===void 0||s.Timestamp.getTime()>=t.tokenLatchCutoffMs,d={logicalId:s.LogicalResourceId||"",physicalId:s.PhysicalResourceId,resourceType:s.ResourceType||"",status:s.ResourceStatus||"",statusReason:s.ResourceStatusReason,timestamp:s.Timestamp||new Date,clientRequestToken:l?s.ClientRequestToken:void 0},I=d.logicalId,C=t.eventHistory.get(I)??[];if(C.push(d),t.eventHistory.set(I,C),t.eventHistory.size>t.maxHistorySize){const E=[...t.eventHistory.keys()].slice(0,t.eventHistory.size-t.maxHistorySize);for(const p of E)t.eventHistory.delete(p)}F(d.resourceType)&&t.ipamTracker.trackEvent(d,t.eventLogger),t.eventLogger&&t.eventLogger.writeEvent(d),T.debug("CloudFormation","pollEvents delivering event",{stackName:e,logicalId:d.logicalId,status:d.status,resourceType:d.resourceType}),i(d)}n=u?void 0:c.NextToken}while(n);return r&&t.activeNestedStacks.size>0?!1:r}catch(o){const n=A(o),r=f(o);return n==="ValidationError"&&r.includes(S)?!1:n==="Throttling"||n==="TooManyRequestsException"||n==="ThrottlingException"?"throttled":(r.includes(S)||T.error("CloudFormation","Unexpected polling error",{error:P(r)}),!1)}}async function W(t,e,i,o,n,r){const u=await D(t,e),a=u?.status||"UNKNOWN",c=a.endsWith("_COMPLETE")&&!a.includes("ROLLBACK")&&!a.includes("FAILED");let s=u?.statusReason;!c&&i.size>0&&(s=(Array.from(i.values())[0]??s)||s);let m=null;if(!c&&n){const l=n.analyseFailure(r,e);m=l===null?null:k(l)}return o&&(o.writeDeploymentEnd(c,a,s),!c&&i.size>0&&o.writeFailureSummary(Array.from(i.entries()).map(([l,d])=>({logicalId:l,reason:d}))),m&&o.writeFailureAnalysis({rootCause:m.rootCause.reason,failedResources:m.affectedResources.map(l=>({logicalId:l.logicalId,resourceType:l.resourceType,reason:l.statusReason||"Unknown reason"})),dependencyChain:m.dependencyChain,remediation:m.remediation})),{success:c,failureMessage:s,analysis:m}}async function D(t,e){try{const i=new L({StackName:e}),r=(await t.getClient(R).send(i)).Stacks?.[0];return r?{status:r.StackStatus||"UNKNOWN",statusReason:r.StackStatusReason}:null}catch(i){return T.debug("CloudFormation","getStackStatus failed",{error:f(i)}),null}}async function q(t,e){const i=[];try{const o=new y({StackName:e}),r=await t.getClient(R).send(o);if(!r.StackEvents)return i;const u=new Map;for(const a of r.StackEvents){const c=a.LogicalResourceId||"";if(c===e&&a.ResourceType===g)continue;const s=u.get(c);(!s||a.Timestamp&&s.timestamp<a.Timestamp)&&u.set(c,{logicalId:c,physicalId:a.PhysicalResourceId,resourceType:a.ResourceType||"",status:a.ResourceStatus||"",statusReason:a.ResourceStatusReason,timestamp:a.Timestamp||new Date,clientRequestToken:a.ClientRequestToken})}return Array.from(u.values())}catch(o){const n=A(o),r=f(o);return n==="ValidationError"&&r.includes(S)||r.includes(S)||T.error("CloudFormation","Error getting current resources",{error:P(f(o))}),i}}export{H as EVENT_CUTOFF_SKEW_MS,$ as IpamConcurrencyTracker,q as fetchCurrentResources,D as fetchStackStatus,W as handleStackCompletion,F as isIpamResource,b as isSuccessState,M as isTerminalState,B as pollStackEvents};

package/dist/src/aws/utils/cloudformationEventTypes.d.ts

@@ -32,7 +32,7 @@ export interface EventLogWriter {
 }
 /** Interface for failure analysis — decouples from concrete CloudFormationFailureAnalyser */
 export interface EventFailureAnalyser {
-    analyseFailure(eventHistory: Map<string, ResourceEvent[]>): FailureAnalysis | null;
+    analyseFailure(eventHistory: Map<string, ResourceEvent[]>, stackName?: string): FailureAnalysis | null;
 }
 /** Factory to create an EventLogWriter for a specific deployment */
 export type EventLogWriterFactory = (deploymentId: string, stackName: string, region: string, deploymentName?: string) => EventLogWriter;

package/dist/src/aws/utils/cloudformationEvents.d.ts

@@ -15,10 +15,11 @@ export declare class CloudFormationEventMonitor {
     private eventLogWriterFactory;
     private onFailureAnalysis;
     private lastAnalysis;
-    private deploymentStartTime;
     private maxHistorySize;
     private maxSeenEventIds;
     private ipamTracker;
+    private eventCutoffMs;
+    private tokenLatchCutoffMs;
     constructor(aws: AwsClientLike, deps?: EventMonitorDeps);
     enableLogging(deploymentId: string, stackName: string, region: string, deploymentName?: string): void;
     startMonitoring(stackName: string, onResourceUpdate: (event: ResourceEvent) => void, onStackComplete?: (success: boolean, message?: string) => void): Promise<void>;

package/dist/src/aws/utils/cloudformationEvents.js

@@ -1 +1 @@
-import{logger as u}from"@fjall/util/logger";import{getErrorMessage as m,sleep as p}from"@fjall/util";import{STACK_NOT_FOUND_PATTERN as d}from"@fjall/util/aws";import{isResourceEvent as x,STACK_NOT_FOUND_PATTERN as b,CDK_NO_STACKS_MATCH as K}from"@fjall/util/aws";import{CF_STACK_RESOURCE_TYPE as S}from"./cloudformationEventTypes.js";import{isTerminalState as v,isSuccessState as w,IpamConcurrencyTracker as C,pollStackEvents as E,handleStackCompletion as M,fetchStackStatus as F,fetchCurrentResources as T}from"./cloudformationEventHelpers.js";class D{aws;seenEventIds=new Set;isMonitoring=!1;pollInterval=null;activeNestedStacks=new Map;failureReasons=new Map;eventHistory=new Map;eventLogger=null;failureAnalyser;eventLogWriterFactory;onFailureAnalysis;lastAnalysis=null;deploymentStartTime=null;maxHistorySize=1e3;maxSeenEventIds=1e4;ipamTracker=new C;constructor(t,e){this.aws=t,this.failureAnalyser=e?.failureAnalyser??null,this.eventLogWriterFactory=e?.eventLogWriterFactory,this.onFailureAnalysis=e?.onFailureAnalysis}enableLogging(t,e,a,s){this.eventLogWriterFactory&&(this.eventLogger=this.eventLogWriterFactory(t,e,a,s))}async startMonitoring(t,e,a){if(this.isMonitoring){u.debug("CloudFormation","startMonitoring SKIPPED - already monitoring",{stackName:t});return}u.debug("CloudFormation","startMonitoring STARTED",{stackName:t}),this.isMonitoring=!0,this.seenEventIds.clear(),this.eventHistory.clear(),this.deploymentStartTime=new Date;try{await this.pollEvents(t,()=>{})}catch(r){const h=m(r);h.includes(d)||u.debug("CloudFormation","Initial poll failed",{error:h})}let s=5e3;const o=1e4;let n=0,g=0;const l=async()=>{if(this.isMonitoring)try{const r=await this.pollEvents(t,e);n++,r==="throttled"?(g++,s=Math.min(3e4,5e3*Math.pow(2,g-1))):(g=0,n>20&&s<o?s=Math.min(o,s+1e3):n<=20&&(s=5e3)),r===!0?await this.handleStackComplete(t,a):this.pollInterval=setTimeout(l,s)}catch(r){u.debug("CloudFormation","Polling iteration error (continuing)",{error:m(r)}),this.pollInterval=setTimeout(l,s)}};this.pollInterval=setTimeout(l,s)}stopMonitoring(){u.debug("CloudFormation","stopMonitoring called",{wasMonitoring:this.isMonitoring,seenEventCount:this.seenEventIds.size}),this.isMonitoring=!1,this.pollInterval&&(clearTimeout(this.pollInterval),this.pollInterval=null),this.cleanup()}cleanup(){if(this.activeNestedStacks.clear(),this.failureReasons.clear(),this.eventHistory.clear(),this.ipamTracker.clear(),this.seenEventIds.size>this.maxSeenEventIds){const t=Array.from(this.seenEventIds),e=Math.floor(this.maxSeenEventIds/2);this.seenEventIds=new Set(t.slice(-e))}this.eventLogger&&(this.eventLogger=null)}async handleStackComplete(t,e){const a=new Map(this.failureReasons),s=new Map(this.eventHistory),o=this.eventLogger;this.stopMonitoring();const n=await M(this.aws,t,a,o,this.failureAnalyser,s);this.lastAnalysis=n.analysis,n.analysis&&this.onFailureAnalysis&&this.onFailureAnalysis(n.analysis),e&&e(n.success,n.failureMessage)}getResourceHistory(t){return this.eventHistory.get(t)||[]}getEventHistory(){return new Map(this.eventHistory)}getFailureAnalysis(){return this.lastAnalysis}getFirstFailureReason(){return this.failureReasons.size>0?Array.from(this.failureReasons.values())[0]??null:null}getEventLogger(){return this.eventLogger}getEventLogPath(){return this.eventLogger?.getLogPath()||null}getLogSummary(){return this.eventLogger?.getLogSummary()||null}async waitForStackComplete(t,e={}){const{timeout:a=1800*1e3,pollInterval:s=2e3,onResourceUpdate:o,onStackComplete:n}=e,g=Date.now();let l,r=!1,h=!1,c;u.debug("CloudFormation","waitForStackComplete called",{stackName:t,timeout:a,pollInterval:s,hasOnResourceUpdate:!!o}),await this.startMonitoring(t,i=>{o&&o(i),i.resourceType===S&&i.logicalId===t&&(l=i.status,v(i.status)&&(r=!0,h=w(i.status),h||(c=this.getFirstFailureReason()||i.statusReason||"Stack operation failed")))},(i,f)=>{n&&n(i,f)});try{let i=!1,f=!1;for(;!r&&this.isMonitoring&&Date.now()-g<a;)await p(s),!i&&Date.now()-g>3e4&&!f&&(f=!0,await this.getStackStatus(t)||u.debug("CloudFormation","Stack not found after 30s, continuing to wait (CDK may be uploading assets)",{stackName:t})),l&&(i=!0);if(this.stopMonitoring(),!r){if(c)return{success:!1,status:"FAILED",failureReason:c,logPath:this.getLogSummary()||void 0};const y=await this.getStackStatus(t);return{success:!1,status:y?.status||"UNKNOWN",failureReason:`Deployment timed out after ${a/1e3} seconds. Stack status: ${y?.status||"UNKNOWN"}`,logPath:this.getLogSummary()||void 0}}return{success:h,status:l,failureReason:c,logPath:this.getLogSummary()||void 0}}catch(i){return this.stopMonitoring(),{success:!1,failureReason:`Monitoring error: ${m(i)}`,logPath:this.getLogSummary()||void 0}}}pollContext(){return{aws:this.aws,seenEventIds:this.seenEventIds,activeNestedStacks:this.activeNestedStacks,failureReasons:this.failureReasons,eventHistory:this.eventHistory,maxHistorySize:this.maxHistorySize,ipamTracker:this.ipamTracker,eventLogger:this.eventLogger}}async pollEvents(t,e){return E(this.pollContext(),t,e)}async getStackStatus(t){return F(this.aws,t)}async getCurrentResources(t){return T(this.aws,t)}}export{K as CDK_NO_STACKS_MATCH,D as CloudFormationEventMonitor,b as STACK_NOT_FOUND_PATTERN,x as isResourceEvent};
+import{logger as c}from"@fjall/util/logger";import{getErrorMessage as v,sleep as m}from"@fjall/util";import{STACK_NOT_FOUND_PATTERN as S}from"@fjall/util/aws";import{isResourceEvent as K,STACK_NOT_FOUND_PATTERN as O,CDK_NO_STACKS_MATCH as b}from"@fjall/util/aws";import{CF_STACK_RESOURCE_TYPE as p}from"./cloudformationEventTypes.js";import{isTerminalState as d,isSuccessState as M,IpamConcurrencyTracker as C,pollStackEvents as w,handleStackCompletion as E,fetchStackStatus as F,fetchCurrentResources as L,EVENT_CUTOFF_SKEW_MS as T}from"./cloudformationEventHelpers.js";class D{aws;seenEventIds=new Set;isMonitoring=!1;pollInterval=null;activeNestedStacks=new Map;failureReasons=new Map;eventHistory=new Map;eventLogger=null;failureAnalyser;eventLogWriterFactory;onFailureAnalysis;lastAnalysis=null;maxHistorySize=1e3;maxSeenEventIds=1e4;ipamTracker=new C;eventCutoffMs=0;tokenLatchCutoffMs=0;constructor(t,e){this.aws=t,this.failureAnalyser=e?.failureAnalyser??null,this.eventLogWriterFactory=e?.eventLogWriterFactory,this.onFailureAnalysis=e?.onFailureAnalysis}enableLogging(t,e,r,a){this.eventLogWriterFactory&&(this.eventLogger=this.eventLogWriterFactory(t,e,r,a))}async startMonitoring(t,e,r){if(this.isMonitoring){c.debug("CloudFormation","startMonitoring SKIPPED - already monitoring",{stackName:t});return}c.debug("CloudFormation","startMonitoring STARTED",{stackName:t}),this.isMonitoring=!0,this.seenEventIds.clear(),this.eventHistory.clear();const a=Date.now();this.eventCutoffMs=a-T,this.tokenLatchCutoffMs=a;try{await this.pollEvents(t,()=>{})}catch(o){const h=v(o);h.includes(S)||c.debug("CloudFormation","Initial poll failed",{error:h})}let s=5e3;const n=1e4;let g=0,l=0;const u=async()=>{if(this.isMonitoring)try{const o=await this.pollEvents(t,e);g++,o==="throttled"?(l++,s=Math.min(3e4,5e3*Math.pow(2,l-1))):(l=0,g>20&&s<n?s=Math.min(n,s+1e3):g<=20&&(s=5e3)),o===!0?await this.handleStackComplete(t,r):this.pollInterval=setTimeout(u,s)}catch(o){c.debug("CloudFormation","Polling iteration error (continuing)",{error:v(o)}),this.pollInterval=setTimeout(u,s)}};this.pollInterval=setTimeout(u,s)}stopMonitoring(){c.debug("CloudFormation","stopMonitoring called",{wasMonitoring:this.isMonitoring,seenEventCount:this.seenEventIds.size}),this.isMonitoring=!1,this.pollInterval&&(clearTimeout(this.pollInterval),this.pollInterval=null),this.cleanup()}cleanup(){if(this.activeNestedStacks.clear(),this.failureReasons.clear(),this.eventHistory.clear(),this.ipamTracker.clear(),this.seenEventIds.size>this.maxSeenEventIds){const t=Array.from(this.seenEventIds),e=Math.floor(this.maxSeenEventIds/2);this.seenEventIds=new Set(t.slice(-e))}this.eventLogger&&(this.eventLogger=null)}async handleStackComplete(t,e){const r=new Map(this.failureReasons),a=new Map(this.eventHistory),s=this.eventLogger;this.stopMonitoring();const n=await E(this.aws,t,r,s,this.failureAnalyser,a);this.lastAnalysis=n.analysis,n.analysis&&this.onFailureAnalysis&&this.onFailureAnalysis(n.analysis),e&&e(n.success,n.failureMessage)}getResourceHistory(t){return this.eventHistory.get(t)||[]}getEventHistory(){return new Map(this.eventHistory)}getFailureAnalysis(){return this.lastAnalysis}getFirstFailureReason(){return this.failureReasons.size>0?Array.from(this.failureReasons.values())[0]??null:null}getEventLogger(){return this.eventLogger}getEventLogPath(){return this.eventLogger?.getLogPath()||null}getLogSummary(){return this.eventLogger?.getLogSummary()||null}async waitForStackComplete(t,e={}){const{timeout:r=1800*1e3,pollInterval:a=2e3,onResourceUpdate:s,onStackComplete:n}=e,g=Date.now();let l,u=!1,o=!1,h;c.debug("CloudFormation","waitForStackComplete called",{stackName:t,timeout:r,pollInterval:a,hasOnResourceUpdate:!!s}),await this.startMonitoring(t,i=>{s&&s(i),i.resourceType===p&&i.logicalId===t&&(l=i.status,d(i.status)&&(u=!0,o=M(i.status),o||(h=this.getFirstFailureReason()||i.statusReason||"Stack operation failed")))},(i,f)=>{n&&n(i,f)});try{let i=!1,f=!1;for(;!u&&this.isMonitoring&&Date.now()-g<r;)await m(a),!i&&Date.now()-g>3e4&&!f&&(f=!0,await this.getStackStatus(t)||c.debug("CloudFormation","Stack not found after 30s, continuing to wait (CDK may be uploading assets)",{stackName:t})),l&&(i=!0);if(this.stopMonitoring(),!u){if(h)return{success:!1,status:"FAILED",failureReason:h,logPath:this.getLogSummary()||void 0};const y=await this.getStackStatus(t);return{success:!1,status:y?.status||"UNKNOWN",failureReason:`Deployment timed out after ${r/1e3} seconds. Stack status: ${y?.status||"UNKNOWN"}`,logPath:this.getLogSummary()||void 0}}return{success:o,status:l,failureReason:h,logPath:this.getLogSummary()||void 0}}catch(i){return this.stopMonitoring(),{success:!1,failureReason:`Monitoring error: ${v(i)}`,logPath:this.getLogSummary()||void 0}}}pollContext(){return{aws:this.aws,seenEventIds:this.seenEventIds,activeNestedStacks:this.activeNestedStacks,failureReasons:this.failureReasons,eventHistory:this.eventHistory,maxHistorySize:this.maxHistorySize,ipamTracker:this.ipamTracker,eventLogger:this.eventLogger,eventCutoffMs:this.eventCutoffMs,tokenLatchCutoffMs:this.tokenLatchCutoffMs}}async pollEvents(t,e){return w(this.pollContext(),t,e)}async getStackStatus(t){return F(this.aws,t)}async getCurrentResources(t){return L(this.aws,t)}}export{b as CDK_NO_STACKS_MATCH,D as CloudFormationEventMonitor,O as STACK_NOT_FOUND_PATTERN,K as isResourceEvent};

package/dist/src/aws/utils/stackStatus.js

@@ -1 +1 @@
-const e={CREATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with creation"},CREATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully created"},CREATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack creation failed - fix issues before redeploying"},DELETE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with deletion"},DELETE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully deleted"},DELETE_FAILED:{safeToRedeploy:"Maybe",description:"Stack deletion failed - investigate before redeploying"},ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back due to failure"},ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack rolled back due to failure - fix issues before redeploying"},ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Rollback failed - manual intervention needed"},UPDATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update is in progress"},UPDATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update completed successfully"},UPDATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack update failed - fix issues before redeploying"},UPDATE_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back an update"},UPDATE_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update rolled back successfully"},UPDATE_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Update rollback failed - manual fix needed"},IMPORT_IN_PROGRESS:{safeToRedeploy:"No",description:"Resource import in progress"},IMPORT_COMPLETE:{safeToRedeploy:"Yes",description:"Resource import completed successfully"},IMPORT_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Import rollback in progress"},IMPORT_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Import rollback completed"},IMPORT_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Import rollback failed - manual fix needed"},REVIEW_IN_PROGRESS:{safeToRedeploy:"Yes",description:"Stack is in review mode"},UNKNOWN:{safeToRedeploy:"Maybe",description:"Unknown stack status"}};export{e as stackStatusMap};
+const e={CREATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with creation"},CREATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully created"},CREATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack creation failed - fix issues before redeploying"},DELETE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with deletion"},DELETE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully deleted"},DELETE_FAILED:{safeToRedeploy:"Maybe",description:"Stack deletion failed - investigate before redeploying"},ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back due to failure"},ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack rolled back due to failure - fix issues before redeploying"},ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Rollback failed - manual intervention needed"},UPDATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update is in progress"},UPDATE_COMPLETE_CLEANUP_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update is finalising - old resources being cleaned up"},UPDATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update completed successfully"},UPDATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack update failed - fix issues before redeploying"},UPDATE_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back an update"},UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS:{safeToRedeploy:"No",description:"Update rollback is finalising - old resources being cleaned up"},UPDATE_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update rolled back successfully"},UPDATE_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Update rollback failed - manual fix needed"},IMPORT_IN_PROGRESS:{safeToRedeploy:"No",description:"Resource import in progress"},IMPORT_COMPLETE:{safeToRedeploy:"Yes",description:"Resource import completed successfully"},IMPORT_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Import rollback in progress"},IMPORT_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Import rollback completed"},IMPORT_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Import rollback failed - manual fix needed"},REVIEW_IN_PROGRESS:{safeToRedeploy:"Yes",description:"Stack is in review mode"},UNKNOWN:{safeToRedeploy:"Maybe",description:"Unknown stack status"}};export{e as stackStatusMap};

package/dist/src/index.d.ts

@@ -15,16 +15,21 @@ export { DeploymentEventSchema, DEPLOYMENT_EVENT_TYPES, DEPLOYMENT_EVENT_RESOURC
 export type { DeploymentEvent, DeploymentEventType, DeploymentEventResourceCategory, DeploymentEventCascadePhase, DeploymentEventCascadeAccountStatus } from "./types/index.js";
 export { DeployEventSchema, StepProgressSchema, DeployResourceSchema, PlanChangeSchema, PlanPropertyChangeSchema, ChangeCountsSchema, DEPLOY_EVENT_CONTRACT, DEPLOY_EVENT_CONTRACT_MAJOR, DEPLOY_EVENT_CONTRACT_MINOR, SUPPORTED_CONTRACT_MARKERS, DEPLOY_EVENT_ID_MAX, DEPLOY_EVENT_NAME_MAX, DEPLOY_EVENT_MESSAGE_MAX, DEPLOY_EVENT_STATUS_REASON_MAX, DEPLOY_EVENT_ERROR_MESSAGE_MAX, DEPLOY_EVENT_TRAIL_DETAIL_MAX, DEPLOY_EVENT_OUTPUT_MAX, DEPLOY_EVENT_ARN_MAX, DEPLOY_EVENT_URL_MAX, STEP_COMPLETE_STATUSES, LOG_LEVELS, STACK_CLEANUP_PHASES, CASCADE_ACCOUNT_PHASES, DEPLOY_RESULTS, DETECTION_PHASES, PHASE_STATUSES, BUILDERS, CASCADE_OUTCOME_RESULTS, PLAN_ACTIONS, REPLACEMENT_MODES, APPROVAL_KINDS, APPROVAL_DECISIONS, ALL_PROGRESS_KINDS, createDeployEmitter, parseDeployEvent, parseDeployContractVersion } from "./types/index.js";
 export type { DeployEvent, ProgressKind, StepProgress, DeployResource, PlanChange, PlanPropertyChange, ChangeCounts, PlanAction, ReplacementMode, ApprovalKind, ApprovalDecision, DeployRunResult, DeployEmitter, CreateDeployEmitterOptions, ParsedDeployEvent, StackCleanupPhase, CascadeAccountPhase, LogLevel } from "./types/index.js";
-export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter, DeployCallbacks, StepCompleteStatus, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, ApprovalGate, ApprovalGatePlanDetail, ApprovalRequest, GateResolution, OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession, Entitlements } from "./types/index.js";
+export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter, DeployCallbacks, StepCompleteStatus, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, StackTarget, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DatabaseEndpointRestartRequest, InfrastructureSource, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, StackLeaseVerdict, ApprovalGate, ApprovalGatePlanDetail, ApprovalRequest, GateResolution, RemediationVerb, DestructionFinding, DestructionTicketResource, DestructionTicket, DestructionConsent, ConsentVerdict, ConsentVerdictRow, DestructionConsentReport, DestructionConsentRequest, DestructionConsentResolution, DestructionConsentGate, DestructionOutcome, TicketVerdictSource, RemediationPhase, RemediationTarget, RemediationFlipProof, RemediationJournalRecord, OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession, Entitlements } from "./types/index.js";
 export type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } from "./aws/index.js";
 export { SimpleAwsProvider } from "./aws/index.js";
 export { checkTargetReadiness, describeTargetReadinessReason, buildTargetUnreadyAdvisory, buildTargetSetUnreadyAdvisory, probeAccountStackExists } from "./aws/index.js";
 export type { TargetReadinessAccount, TargetReadinessClients, TargetReadinessReason, TargetReadinessVerdict, TargetSetUnreadyAdvisoryParams } from "./aws/index.js";
 export { checkRegionEnabled, regionDisabledMessage } from "./aws/index.js";
 export type { RegionAvailability } from "./aws/index.js";
-export { ensureOrganisationExists, describeOrganisation, enablePolicyTypes, enableServiceAccess, SERVICE_PRINCIPALS, enableRamSharing, activateTrustedAccess, enableIpamDelegatedAdmin, updateBackupGlobalSettings, listAccounts, findAccount, createAccount, ensureOrganisationalUnitsExist, placeAccountsInOUs, buildAccountToOUMap, activateCostAllocationTags, checkIdentityCentreStatus, snapshotIdentityCentre, composeSdkAbortSignal, extractErrorName, isAborted, DEFAULT_MAX_PAGES, IDENTITY_STORE_PAGE_SIZE, drainPages, isOULeaf, registerSecurityDelegates, SECURITY_SERVICE_PRINCIPALS, enableCentralisedRootAccess, ROOT_ACCESS_FEATURES, RootAccessEnablementError } from "./aws/index.js";
+export { ensureOrganisationExists, describeOrganisation, enablePolicyTypes, enableServiceAccess, SERVICE_PRINCIPALS, enableRamSharing, activateTrustedAccess, enableIpamDelegatedAdmin, updateBackupGlobalSettings, listAccounts, findAccount, createAccount, ensureOrganisationalUnitsExist, placeAccountsInOUs, buildAccountToOUMap, findDevelopmentOuId, activateCostAllocationTags, checkIdentityCentreStatus, snapshotIdentityCentre, composeSdkAbortSignal, extractErrorName, isAborted, DEFAULT_MAX_PAGES, IDENTITY_STORE_PAGE_SIZE, drainPages, isOULeaf, registerSecurityDelegates, SECURITY_SERVICE_PRINCIPALS, enableCentralisedRootAccess, ROOT_ACCESS_FEATURES, RootAccessEnablementError } from "./aws/index.js";
 export type { OrgDetails, OUMap, OUTree, AccountPlacementResult, AccountInfo, DrainPagesOptions, PagedResult, IdentityCentreStatus, IdentityCentreSnapshot, IdentityCentreSnapshotGroup, IdentityCentreSnapshotOptions, IdentityCentreSnapshotResult, IdentityCentreSnapshotUser, BackupGlobalSettings, CostAllocationTag, CreateAccountResult, RootAccessFeature, RootAccessEnablementSummary } from "./aws/index.js";
 export { STEP_IDS, STEP_NAMES, INFRASTRUCTURE_STEP_NAMES, INFRA_STEP_NAME } from "./types/index.js";
+export { RemediationVerbSchema, REMEDIATION_VERB_GLOSS, DestructionFindingSchema, DestructionTicketResourceSchema, DestructionTicketSchema, DestructionConsentSchema, DestructionOutcomeSchema, DESTRUCTION_FINDINGS, CONSENT_VERDICTS, TICKET_VERDICT_SOURCES, TicketVerdictSourceSchema } from "./types/index.js";
+export { DRIFT_VERDICTS, DriftVerdictSchema, DriftSuspectSchema, DriftFindingSchema, DriftJournalRecordSchema, verbsForDriftVerdict } from "./types/index.js";
+export { REMEDIATION_PHASES, RemediationPhaseSchema, RemediationTargetSchema, RemediationFlipProofSchema, RemediationJournalRecordSchema, RemediationVerbWithSurgerySchema, remediationPhaseRank, remediationPlaceholderPhysicalId, isRemediationPlaceholderPhysicalId } from "./types/index.js";
+export type { RemediationVerbWithSurgery } from "./types/index.js";
+export type { DriftVerdict, DriftSuspect, DriftFinding, DriftJournalRecord } from "./types/index.js";
 export type { StepId, InfrastructureStepName, StepDefinition, StepDeploymentType, Operation, StepContext } from "./types/index.js";
 export type { DeploymentContext, StepOutput, ApplicationDeploymentContext, CallerIdentity, StackOutput, StackOutputsRecord, ValidationResult, DetectionResult, ProgressCallbacks, ApplicationStack, OrganisationType, DeploymentOperation, ApplicationOperation, OrganisationOperation, DeployOrderOptions, ParallelDeployGroupKey, ParallelDestroyGroupKey, OpenNextPattern, AppResourceFlags, ParallelDeploymentResult, ParallelDeployGroup, ParallelOperation, ParallelOperationType, ParallelOperationState, ApplicationErrorType, StackDeploymentData, StackDeploymentOptions, ApplicationDeploymentData, ApplicationDestructionData, FjallStateFile, TemplateHashEntry } from "./types/index.js";
 export { ProgressReporter, APPLICATION_STACKS, ORGANISATION_TYPES, APPLICATION_DEPLOY_ORDER, APPLICATION_DESTROY_ORDER, OPENNEXT_DEPLOY_ORDER, OPENNEXT_DESTROY_ORDER, PARALLEL_DEPLOY_GROUPS, PARALLEL_DESTROY_GROUPS, OPENNEXT_PARALLEL_GROUPS, PARALLEL_OPERATION_TYPES, isApplicationOperation, isOrganisationOperation, getParallelDeployGroups, getParallelDestroyGroups, getApplicationDeployOrder, getApplicationDestroyOrder, getApplicationStackName, getOrganisationStackName, isApplicationStack, isQuarantineDetail, isRetainedBucketsDetail, getApplicationStepName, getApplicationStepId, toPascalCase, isOpenNextPattern, OPENNEXT_PATTERNS, deriveResourcesFromManifestStacks, STACK_NOT_FOUND_PATTERN, STACK_FAILED_STATE_PATTERN, CDK_NO_STACKS_MATCH, INFRASTRUCTURE_FILENAME, ApplicationError, wrapApplicationError, FjallStateFileSchema, readStateFile, writeStateFile, createEmptyState, deleteStateFile, updateTemplateHash, getStateFilePath, stubCallerIdentity } from "./types/index.js";
@@ -55,6 +60,10 @@ export { reconcileProviderAccounts, mergeReconciledProviderAccounts } from "./or
 export type { ReconcileResult } from "./orchestration/index.js";
 export { decideNextTransition, reconcileTrailMigration, decommissionMemberTrailStorage, ORG_TRAIL_BUCKET_OUTPUT_KEY, TRAIL_BUCKET_OUTPUT_KEY, TRAIL_KEY_ARN_OUTPUT_KEY } from "./orchestration/index.js";
 export type { MemberTrailFacts, TrailMigrationTransition, TrailMigrationOutcome, DecommissionClients, DecommissionInput, DecommissionOutcome } from "./orchestration/index.js";
+export { classifyDriftFailure, fetchLastOperationEvents, DriftProbe, clearDriftSuspects, defaultDriftJournalDir, readDriftSuspects, recordDriftSuspects, detectStackDrift, runDriftPreFlight, formatDriftPreFlightBlock, DRIFT_PREFLIGHT_TRIGGER_STATUSES, DRIFT_PREFLIGHT_BUDGET_MS } from "./orchestration/index.js";
+export type { DriftProbeOptions, DriftProbeRunner, ProbeDriftSuspectsParams, DriftJournalOptions, RecordDriftSuspectsParams, DetectStackDriftDeps, DetectStackDriftParams, StackDriftReport, RunDriftPreFlightParams, DriftPreFlightBlockExtras, DriftPreFlightOutcome } from "./orchestration/index.js";
+export { archiveCompletedRemediationJournal, computeRemediationOpId, defaultRemediationJournalDir, findRemediationJournalByOpId, listActiveRemediationOps, listActiveRemediationOpsForContext, readRemediationJournal, sweepExpiredRemediationJournals, writeRemediationJournal, REMEDIATION_JOURNAL_RETENTION_DAYS, captureRemediationForensics, defaultRemediationForensicsDir, applyRetainFlip, composeFlipCapabilities, computeTemplateDigest, deriveRetainFlipTemplate, findMarkedResourcesByOpId, proveFlipMetadataOnly, readRetainFlipState, verifyRetainFlipDiff, FORGET_MARKER_KEY, FORGET_FLIP_SPEC, RECREATE_MARKER_KEY, assessForgetResumability, completeForgetAfterConverge, completeForgetAfterDeploy, formatRecreateInFlightCures, partitionPreFlightByRemediation, runForgetSurgery, synthTemplateDeclaresResource, runRecreateSurgery, snapshotPolicyForType, SNAPSHOT_CAPABLE_RESOURCE_TYPES, runRecreatePreFlight, deriveRemovalTemplate, findRemovalDeletionFailures, proveRemovalTargetsOnly, advertisableDriftVerbs, buildDriftRepairTicket, runDriftRepairGate, formatPinOutcomeDetail, pinProbeCoverage, renderPinReportLines, runPinRemediation, composePostFailureRepairOffer, formatDriftRepairOffer, DriftRepairAvailableError, checkDeployPathStackAvailability, isDeployPathBlockingStatus, StackUnavailableError, assertLeaseBeforeStack, LeaseDeniedError } from "./orchestration/index.js";
+export type { RemediationJournalContext, RemediationJournalOptions, CaptureRemediationForensicsParams, ForensicsCaptureOptions, RemediationForensicsBundle, ApplyRetainFlipOutcome, ApplyRetainFlipParams, DeriveRetainFlipParams, FlipDeletionPolicy, FlipProofResult, FlipSpec, RetainFlipDerivation, RetainFlipState, RecreateOrchestrationOptions, RecreateSurgeryParams, RecreateSurgeryReport, RecreatePreFlightStack, RunRecreatePreFlightParams, ProveRemovalTargetsOnlyParams, RemovalDeletionFailure, RemovalDerivation, RemovalProofResult, StrippedExport, CompleteForgetAfterDeployParams, CompleteForgetOutcome, CompleteForgetParams, ForeignMarkerOperation, ForgetOrchestrationOptions, ForgetResumeAssessment, ForgetResumeSource, ForgetSurgeryParams, ForgetSurgeryReport, PreFlightRemediationDeps, PreFlightRemediationPartition, DriftRepairGateOutcome, RunDriftRepairGateParams, ComposePostFailureRepairOfferParams, PinnedProperty, PinProbeCoverage, PinRemediationReport, PinReportOnlyReason, PinResourceOutcome, PinTarget, RunPinRemediationParams } from "./orchestration/index.js";
 export { unlockBucket, unlockQueue } from "./orchestration/index.js";
 export type { UnlockBucketInput, UnlockBucketReport, UnlockQueueInput, UnlockQueueReport } from "./orchestration/index.js";
 export { triageBucketPolicy, isEnforceSslStatement, toResourcePolicyStatements, restoreBucketPolicy, synthesiseEnforceSslDocument, ensureEnforceSsl, restoreAndReconcileQuarantinedBucket } from "./orchestration/index.js";
@@ -76,3 +85,5 @@ export { openNextBuilder, dockerBuilder } from "./orchestration/index.js";
 export { StepRegistry, getDestroyStepId } from "./steps/index.js";
 export { buildDeployPlan, computeDeployPlan, computeAssemblyDigest, digestHead, classifyImpact, derivePropertyChanges, isDataLoss, isStatefulResourceType, renderPlanSummary, renderPlanLines, toWirePlanChanges, signApprovalToken, verifyApprovalToken, DEFAULT_APPROVAL_TTL_MS, APPROVAL_TOKEN_PATTERN, runApprovalGate } from "./orchestration/index.js";
 export type { DeployPlan, DeployPlanResourceChange, StackTemplatePair, CfnTemplateReader, ComputeDeployPlanParams, ComputeDeployPlanStack, ImpactClassification, SignApprovalTokenOptions, SignedApprovalToken, VerifyApprovalTokenOptions, VerifyApprovalTokenResult, RunApprovalGateParams, ApprovalGateOutcome } from "./orchestration/index.js";
+export { runDestructionGate, buildDestructionTicket, evaluateDestructionConsents, computeTicketDigest, legalRemediationVerbs, executableRemediationVerbs, advertisableRemediationVerbs, renderDestructionTicketLines, renderConsentVerdictLines, loadDeployPlan, createMemoisedPlanLoader } from "./orchestration/index.js";
+export type { RunDestructionGateParams, DestructionGateOutcome, EvaluateDestructionConsentsParams, LoadDeployPlanParams, DeployPlanLoader } from "./orchestration/index.js";