@fjall/deploy-core 2.27.0 → 2.29.0

package/dist/.minified

@@ -1 +1 @@
-185 files minified at 2026-07-07T01:04:28.789Z
+213 files minified at 2026-07-13T22:22:04.195Z

package/dist/src/aws/organisations/backup.d.ts

@@ -29,8 +29,13 @@ export declare function accountHasDisasterRecovery(environment: string | null |
  * account/region, to decide adopt-vs-create. A retained, vault-locked DR vault
  * survives stack teardown and collides on the next CREATE.
  *
- * Returns success(true) when present and success(false) ONLY on
- * ResourceNotFoundException. Every other error (AccessDenied, throttling)
+ * Returns success(true) when present. DescribeBackupVault on an ABSENT vault
+ * throws AccessDeniedException ("Insufficient privileges to perform this
+ * action.") rather than ResourceNotFoundException — even for admin
+ * credentials in accounts that have never used AWS Backup — so an
+ * AccessDenied is disambiguated via ListBackupVaults, which answers cleanly:
+ * vault named in the list → exists; absent from a successful listing → does
+ * not. Every other error (throttling, and a listing that is itself denied)
  * propagates as failure — a mis-read "exists" would flip a vault-less region
  * into a broken by-reference deploy.
  */

package/dist/src/aws/organisations/backup.js

@@ -1,2 +1,2 @@
-import{DescribeBackupVaultCommand as l,UpdateGlobalSettingsCommand as m}from"@aws-sdk/client-backup";import{success as i,failure as c}from"@fjall/generator";import{BACKUP_VAULT_NAME as a,getErrorMessage as s,maskSensitiveOutput as d}from"@fjall/util";import{composeSdkAbortSignal as u}from"./types.js";const k={enableCrossAccountBackup:!0,enableDelegatedAdministrator:!0,enableMpa:!1};async function S(e,t,r){try{const n={...k,...t},o={isCrossAccountBackupEnabled:n.enableCrossAccountBackup.toString(),isDelegatedAdministratorEnabled:n.enableDelegatedAdministrator.toString(),isMpaEnabled:n.enableMpa.toString()};return await e.send(new m({GlobalSettings:o}),{abortSignal:u(r)}),i(void 0)}catch(n){return c(new Error(`Failed to update backup global settings: ${s(n)}`))}}function A(e,t){return t===void 0||t===""?!1:e==="production"||e==="compliance"}async function E(e,t){try{return await e.send(new l({BackupVaultName:a}),{abortSignal:u(t)}),i(!0)}catch(r){return r instanceof Error&&r.name==="ResourceNotFoundException"?i(!1):c(new Error(`Failed to describe backup vault "${a}": ${d(s(r))}`))}}async function v(e,t,r){try{const n=await e.send(new l({BackupVaultName:a}),{abortSignal:u(r)}),o=n.LockDate,p=o!==void 0&&o.getTime()<=Date.now();return i({vaultName:n.BackupVaultName??a,region:t,locked:n.Locked??!1,...o!==void 0&&{lockDate:o},lockPermanent:p,recoveryPointCount:n.NumberOfRecoveryPoints??0,...n.EncryptionKeyArn!==void 0&&{encryptionKeyArn:n.EncryptionKeyArn}})}catch(n){return n instanceof Error&&n.name==="ResourceNotFoundException"?i(null):c(new Error(`Failed to describe surviving backup vault "${a}": ${d(s(n))}`))}}function B(e){const t=e.locked?e.lockPermanent?"compliance-locked, PERMANENT \u2014 cannot be removed by anyone, including AWS or the root user":e.lockDate!==void 0?`compliance-locked, immutable from ${e.lockDate.toISOString().slice(0,10)}`:"governance-locked \u2014 removable by privileged IAM":"unlocked";return[`Backup vault "${e.vaultName}" in ${e.region} SURVIVES this destroy.`,`  \u2022 Lock: ${t}`,`  \u2022 Recovery points retained: ${e.recoveryPointCount}`,...e.encryptionKeyArn!==void 0?[`  \u2022 Retained KMS key (also orphaned): ${e.encryptionKeyArn}`]:[],"  The vault and its KMS key are RemovalPolicy.RETAIN \u2014 destroy cannot delete them."].join(`
-`)}export{a as BACKUP_VAULT_NAME,A as accountHasDisasterRecovery,E as describeBackupVaultExists,v as describeSurvivingBackupVault,B as formatSurvivingVaultWarning,S as updateBackupGlobalSettings};
+import{DescribeBackupVaultCommand as p,ListBackupVaultsCommand as m,UpdateGlobalSettingsCommand as k}from"@aws-sdk/client-backup";import{success as i,failure as c}from"@fjall/generator";import{BACKUP_VAULT_NAME as o,getErrorMessage as u,maskSensitiveOutput as d}from"@fjall/util";import{composeSdkAbortSignal as s,isAborted as f}from"./types.js";const b={enableCrossAccountBackup:!0,enableDelegatedAdministrator:!0,enableMpa:!1};async function B(e,r,t){try{const n={...b,...r},a={isCrossAccountBackupEnabled:n.enableCrossAccountBackup.toString(),isDelegatedAdministratorEnabled:n.enableDelegatedAdministrator.toString(),isMpaEnabled:n.enableMpa.toString()};return await e.send(new k({GlobalSettings:a}),{abortSignal:s(t)}),i(void 0)}catch(n){return c(new Error(`Failed to update backup global settings: ${u(n)}`))}}function v(e,r){return r===void 0||r===""?!1:e==="production"||e==="compliance"}async function N(e,r){try{return await e.send(new p({BackupVaultName:o}),{abortSignal:s(r)}),i(!0)}catch(t){return t instanceof Error&&t.name==="ResourceNotFoundException"?i(!1):t instanceof Error&&t.name==="AccessDeniedException"?g(e,r):c(new Error(`Failed to describe backup vault "${o}": ${d(u(t))}`))}}async function g(e,r){try{let t;do{if(f(r))return c(new Error("Backup vault probe aborted"));const n=await e.send(new m({NextToken:t}),{abortSignal:s(r)});if((n.BackupVaultList??[]).some(l=>l.BackupVaultName===o))return i(!0);t=n.NextToken}while(t!==void 0);return i(!1)}catch(t){return c(new Error(`Failed to list backup vaults probing "${o}": ${d(u(t))}`))}}async function w(e,r,t){try{const n=await e.send(new p({BackupVaultName:o}),{abortSignal:s(t)}),a=n.LockDate,l=a!==void 0&&a.getTime()<=Date.now();return i({vaultName:n.BackupVaultName??o,region:r,locked:n.Locked??!1,...a!==void 0&&{lockDate:a},lockPermanent:l,recoveryPointCount:n.NumberOfRecoveryPoints??0,...n.EncryptionKeyArn!==void 0&&{encryptionKeyArn:n.EncryptionKeyArn}})}catch(n){return n instanceof Error&&n.name==="ResourceNotFoundException"?i(null):c(new Error(`Failed to describe surviving backup vault "${o}": ${d(u(n))}`))}}function x(e){const r=e.locked?e.lockPermanent?"compliance-locked, PERMANENT \u2014 cannot be removed by anyone, including AWS or the root user":e.lockDate!==void 0?`compliance-locked, immutable from ${e.lockDate.toISOString().slice(0,10)}`:"governance-locked \u2014 removable by privileged IAM":"unlocked";return[`Backup vault "${e.vaultName}" in ${e.region} SURVIVES this destroy.`,`  \u2022 Lock: ${r}`,`  \u2022 Recovery points retained: ${e.recoveryPointCount}`,...e.encryptionKeyArn!==void 0?[`  \u2022 Retained KMS key (also orphaned): ${e.encryptionKeyArn}`]:[],"  The vault and its KMS key are RemovalPolicy.RETAIN \u2014 destroy cannot delete them."].join(`
+`)}export{o as BACKUP_VAULT_NAME,v as accountHasDisasterRecovery,N as describeBackupVaultExists,w as describeSurvivingBackupVault,x as formatSurvivingVaultWarning,B as updateBackupGlobalSettings};

package/dist/src/aws/organisations/index.d.ts

@@ -6,7 +6,7 @@ export type { BackupGlobalSettings } from "./backup.js";
 export type { CostAllocationTag } from "./costAllocation.js";
 export type { CreateAccountResult } from "./accounts.js";
 export type { RootAccessFeature, RootAccessEnablementSummary } from "./rootAccess.js";
-export { ensureOrganisationExists, describeOrganisation } from "./organisation.js";
+export { ensureOrganisationExists, describeOrganisation, describeOrganisationAsMember, type MemberOrgDetails } from "./organisation.js";
 export { enablePolicyTypes } from "./policies.js";
 export { enableServiceAccess, SERVICE_PRINCIPALS } from "./serviceAccess.js";
 export { enableRamSharing } from "./ram.js";

package/dist/src/aws/organisations/index.js

@@ -1 +1 @@
-import{composeSdkAbortSignal as o,extractErrorName as r,isAborted as a,isOULeaf as n}from"./types.js";import{DEFAULT_MAX_PAGES as c,IDENTITY_STORE_PAGE_SIZE as i,drainPages as p}from"./pagination.js";import{ensureOrganisationExists as A,describeOrganisation as l}from"./organisation.js";import{enablePolicyTypes as x}from"./policies.js";import{enableServiceAccess as S,SERVICE_PRINCIPALS as d}from"./serviceAccess.js";import{enableRamSharing as u}from"./ram.js";import{activateTrustedAccess as g}from"./trustedAccess.js";import{enableIpamDelegatedAdmin as R}from"./ipam.js";import{updateBackupGlobalSettings as O}from"./backup.js";import{listAccounts as P,findAccount as U,createAccount as y}from"./accounts.js";import{ensureOrganisationalUnitsExist as v,placeAccountsInOUs as L,buildAccountToOUMap as N,findDevelopmentOuId as h}from"./organisationalUnits.js";import{activateCostAllocationTags as G}from"./costAllocation.js";import{checkIdentityCentreStatus as M}from"./identityCentre.js";import{snapshotIdentityCentre as Y}from"./identityCentreSnapshot.js";import{registerSecurityDelegates as X,SECURITY_SERVICE_PRINCIPALS as Z}from"./delegatedAdmin.js";import{enableCentralisedRootAccess as q,ROOT_ACCESS_FEATURES as w,RootAccessEnablementError as z}from"./rootAccess.js";export{c as DEFAULT_MAX_PAGES,i as IDENTITY_STORE_PAGE_SIZE,w as ROOT_ACCESS_FEATURES,z as RootAccessEnablementError,Z as SECURITY_SERVICE_PRINCIPALS,d as SERVICE_PRINCIPALS,G as activateCostAllocationTags,g as activateTrustedAccess,N as buildAccountToOUMap,M as checkIdentityCentreStatus,o as composeSdkAbortSignal,y as createAccount,l as describeOrganisation,p as drainPages,q as enableCentralisedRootAccess,R as enableIpamDelegatedAdmin,x as enablePolicyTypes,u as enableRamSharing,S as enableServiceAccess,A as ensureOrganisationExists,v as ensureOrganisationalUnitsExist,r as extractErrorName,U as findAccount,h as findDevelopmentOuId,a as isAborted,n as isOULeaf,P as listAccounts,L as placeAccountsInOUs,X as registerSecurityDelegates,Y as snapshotIdentityCentre,O as updateBackupGlobalSettings};
+import{composeSdkAbortSignal as r,extractErrorName as o,isAborted as a,isOULeaf as s}from"./types.js";import{DEFAULT_MAX_PAGES as i,IDENTITY_STORE_PAGE_SIZE as c,drainPages as p}from"./pagination.js";import{ensureOrganisationExists as A,describeOrganisation as l,describeOrganisationAsMember as f}from"./organisation.js";import{enablePolicyTypes as E}from"./policies.js";import{enableServiceAccess as d,SERVICE_PRINCIPALS as I}from"./serviceAccess.js";import{enableRamSharing as b}from"./ram.js";import{activateTrustedAccess as C}from"./trustedAccess.js";import{enableIpamDelegatedAdmin as R}from"./ipam.js";import{updateBackupGlobalSettings as _}from"./backup.js";import{listAccounts as U,findAccount as y,createAccount as D}from"./accounts.js";import{ensureOrganisationalUnitsExist as L,placeAccountsInOUs as N,buildAccountToOUMap as h,findDevelopmentOuId as k}from"./organisationalUnits.js";import{activateCostAllocationTags as M}from"./costAllocation.js";import{checkIdentityCentreStatus as V}from"./identityCentre.js";import{snapshotIdentityCentre as B}from"./identityCentreSnapshot.js";import{registerSecurityDelegates as Z,SECURITY_SERVICE_PRINCIPALS as j}from"./delegatedAdmin.js";import{enableCentralisedRootAccess as w,ROOT_ACCESS_FEATURES as z,RootAccessEnablementError as H}from"./rootAccess.js";export{i as DEFAULT_MAX_PAGES,c as IDENTITY_STORE_PAGE_SIZE,z as ROOT_ACCESS_FEATURES,H as RootAccessEnablementError,j as SECURITY_SERVICE_PRINCIPALS,I as SERVICE_PRINCIPALS,M as activateCostAllocationTags,C as activateTrustedAccess,h as buildAccountToOUMap,V as checkIdentityCentreStatus,r as composeSdkAbortSignal,D as createAccount,l as describeOrganisation,f as describeOrganisationAsMember,p as drainPages,w as enableCentralisedRootAccess,R as enableIpamDelegatedAdmin,E as enablePolicyTypes,b as enableRamSharing,d as enableServiceAccess,A as ensureOrganisationExists,L as ensureOrganisationalUnitsExist,o as extractErrorName,y as findAccount,k as findDevelopmentOuId,a as isAborted,s as isOULeaf,U as listAccounts,N as placeAccountsInOUs,Z as registerSecurityDelegates,B as snapshotIdentityCentre,_ as updateBackupGlobalSettings};

package/dist/src/aws/organisations/oidcProvider.d.ts

@@ -20,6 +20,43 @@ export interface OidcProviderTeardownResult {
  * Failure messages stay raw — callers mask at their output boundary.
  */
 export declare function deleteOidcProviderIfUnreferenced(client: IAMClient, abortSignal?: AbortSignal): Promise<Result<OidcProviderTeardownResult>>;
+export interface OidcProviderEnsureResult {
+    status: "present" | "recreated" | "aborted";
+    providerArn?: string;
+}
+/**
+ * Adopt-or-create guard for the account-global `https://fjall.io` OIDC
+ * provider, run after an Account/Platform stack deploy completes.
+ *
+ * Why this exists: pre-2.20.0 Account stacks owned the provider through CDK's
+ * L2 `iam.OpenIdConnectProvider` custom resource. The first redeploy on
+ * ≥2.20.0 replaces it with the adopt-or-create `Custom::FjallOidcProvider`
+ * resource under a NEW logical ID, so CloudFormation creates the new resource
+ * (which adopts the existing provider) and then — in the cleanup phase, after
+ * every in-template resource has run — deletes the old L2 resource, whose
+ * handler issues a real DeleteOpenIDConnectProvider on the same physical
+ * provider. The update completes green while the account's web-identity trust
+ * anchor is destroyed: every subsequent scan AND OIDC-authenticated deploy
+ * fails with InvalidIdentityToken (2026-07-07 fjall-org incident). Because
+ * cleanup runs last, no in-template fix can win; this reconcile runs after
+ * CloudFormation returns, inside the same deploy session, so the account is
+ * healed before the deploy that broke it reports success.
+ *
+ * The created provider mirrors the OidcConnector handler byte-for-byte via
+ * the shared `@fjall/generator` spec constants. EntityAlreadyExists from a
+ * concurrent creator (parallel cascade region, Quick-Create) is success.
+ *
+ * Failure messages stay raw — callers mask at their output boundary.
+ */
+export declare function ensureOidcProviderPresent(client: IAMClient, abortSignal?: AbortSignal): Promise<Result<OidcProviderEnsureResult>>;
+/**
+ * Best-effort wrapper around {@link ensureOidcProviderPresent}: surfaces the
+ * outcome via callbacks/logger and never fails the deploy — the stack deploy
+ * itself succeeded, and a reconcile miss must not convert that into a failure.
+ * A recreation is reported at warn level because it means the deletion class
+ * fired and the operator should know the trust anchor was briefly absent.
+ */
+export declare function reconcileOidcProviderAfterDeploy(client: IAMClient, callbacks: DeployCallbacks, abortSignal?: AbortSignal): Promise<void>;
 /**
  * Best-effort wrapper around {@link deleteOidcProviderIfUnreferenced}: surfaces
  * the outcome via callbacks/logger and swallows failures. A cleanup miss leaves

package/dist/src/aws/organisations/oidcProvider.js

@@ -1 +1 @@
-import{ListOpenIDConnectProvidersCommand as f,ListRolesCommand as u,DeleteOpenIDConnectProviderCommand as m}from"@aws-sdk/client-iam";import{success as d,failure as v}from"@fjall/generator";import{maskSensitiveOutput as I,getErrorMessage as O}from"@fjall/util";import{logger as a}from"@fjall/util/logger";import{composeSdkAbortSignal as s,isAborted as c}from"./types.js";const w="fjall.io",D=`:oidc-provider/${w}`;async function C(i,e){try{if(c(e))return d({deleted:!1,reason:"aborted"});const r=((await i.send(new f({}),{abortSignal:s(e)})).OpenIDConnectProviderList??[]).map(o=>o.Arn).find(o=>typeof o=="string"&&o.endsWith(D));if(r===void 0)return d({deleted:!1,reason:"provider not present"});let t;do{if(c(e))return d({deleted:!1,reason:"aborted"});const o=await i.send(new u({Marker:t}),{abortSignal:s(e)});for(const l of o.Roles??[]){const p=l.AssumeRolePolicyDocument;if(typeof p=="string"&&decodeURIComponent(p).includes(r))return d({deleted:!1,reason:`still referenced by role ${l.RoleName??"(unknown)"}`})}t=o.IsTruncated===!0?o.Marker:void 0}while(t!==void 0);return await i.send(new m({OpenIDConnectProviderArn:r}),{abortSignal:s(e)}),d({deleted:!0,reason:"deleted orphaned provider"})}catch(n){return n instanceof Error&&n.name==="NoSuchEntityException"?d({deleted:!1,reason:"provider not present"}):v(new Error(`Failed to evaluate OIDC provider teardown: ${O(n)}`))}}async function P(i,e,n){const r=await C(i,n);if(!r.success){const t=I(r.error.message);a.debug("oidcTeardown","OIDC provider teardown probe failed",{error:t}),e.onLog?.(`OIDC provider cleanup skipped: ${t}`,"warn");return}if(r.data.deleted){a.info("oidcTeardown","Deleted orphaned account-global OIDC provider"),e.onLog?.("Removed the orphaned Fjall OIDC provider","info");return}a.debug("oidcTeardown","OIDC provider retained",{reason:r.data.reason})}export{P as cleanupOrphanedOidcProvider,C as deleteOidcProviderIfUnreferenced};
+import{ListOpenIDConnectProvidersCommand as l,ListRolesCommand as D,CreateOpenIDConnectProviderCommand as O,DeleteOpenIDConnectProviderCommand as w}from"@aws-sdk/client-iam";import{FJALL_OIDC_AUDIENCE as g,FJALL_OIDC_ISSUER_DOMAIN as f,FJALL_OIDC_PLACEHOLDER_THUMBPRINT as y,success as i,failure as v}from"@fjall/generator";import{maskSensitiveOutput as m,getErrorMessage as I}from"@fjall/util";import{logger as s}from"@fjall/util/logger";import{composeSdkAbortSignal as a,isAborted as c}from"./types.js";const C=`:oidc-provider/${f}`;async function A(d,r){try{if(c(r))return i({deleted:!1,reason:"aborted"});const e=((await d.send(new l({}),{abortSignal:a(r)})).OpenIDConnectProviderList??[]).map(o=>o.Arn).find(o=>typeof o=="string"&&o.endsWith(C));if(e===void 0)return i({deleted:!1,reason:"provider not present"});let t;do{if(c(r))return i({deleted:!1,reason:"aborted"});const o=await d.send(new D({Marker:t}),{abortSignal:a(r)});for(const p of o.Roles??[]){const u=p.AssumeRolePolicyDocument;if(typeof u=="string"&&decodeURIComponent(u).includes(e))return i({deleted:!1,reason:`still referenced by role ${p.RoleName??"(unknown)"}`})}t=o.IsTruncated===!0?o.Marker:void 0}while(t!==void 0);return await d.send(new w({OpenIDConnectProviderArn:e}),{abortSignal:a(r)}),i({deleted:!0,reason:"deleted orphaned provider"})}catch(n){return n instanceof Error&&n.name==="NoSuchEntityException"?i({deleted:!1,reason:"provider not present"}):v(new Error(`Failed to evaluate OIDC provider teardown: ${I(n)}`))}}async function h(d,r){try{if(c(r))return i({status:"aborted"});const e=((await d.send(new l({}),{abortSignal:a(r)})).OpenIDConnectProviderList??[]).map(o=>o.Arn).find(o=>typeof o=="string"&&o.endsWith(C));if(e!==void 0)return i({status:"present",providerArn:e});const t=await d.send(new O({Url:`https://${f}`,ClientIDList:[g],ThumbprintList:[y]}),{abortSignal:a(r)});return i({status:"recreated",...t.OpenIDConnectProviderArn!==void 0&&{providerArn:t.OpenIDConnectProviderArn}})}catch(n){return n instanceof Error&&n.name==="EntityAlreadyExistsException"?i({status:"present"}):v(new Error(`Failed to ensure OIDC provider presence: ${I(n)}`))}}async function F(d,r,n){const e=await h(d,n);if(!e.success){const t=m(e.error.message);s.debug("oidcReconcile","OIDC provider ensure probe failed",{error:t}),r.onLog?.(`Could not verify the Fjall OIDC provider after deploy: ${t}. If scans or deploys later fail with InvalidIdentityToken, re-run this deploy or reconnect the account.`,"warn");return}if(e.data.status==="recreated"){s.info("oidcReconcile","Recreated missing account-global OIDC provider",{providerArn:e.data.providerArn}),r.onLog?.("The Fjall OIDC provider was missing after the stack deploy and has been restored","warn");return}s.debug("oidcReconcile","OIDC provider verified after deploy",{status:e.data.status})}async function _(d,r,n){const e=await A(d,n);if(!e.success){const t=m(e.error.message);s.debug("oidcTeardown","OIDC provider teardown probe failed",{error:t}),r.onLog?.(`OIDC provider cleanup skipped: ${t}`,"warn");return}if(e.data.deleted){s.info("oidcTeardown","Deleted orphaned account-global OIDC provider"),r.onLog?.("Removed the orphaned Fjall OIDC provider","info");return}s.debug("oidcTeardown","OIDC provider retained",{reason:e.data.reason})}export{_ as cleanupOrphanedOidcProvider,A as deleteOidcProviderIfUnreferenced,h as ensureOidcProviderPresent,F as reconcileOidcProviderAfterDeploy};

package/dist/src/aws/organisations/organisation.d.ts

@@ -19,3 +19,24 @@ export declare function ensureOrganisationExists(client: OrganizationsClient, ab
 export declare function describeOrganisation(client: OrganizationsClient, abortSignal?: AbortSignal, opts?: {
     tolerateAccessDenied?: boolean;
 }): Promise<Result<OrgDetails | null>>;
+/**
+ * Org details visible to member-account credentials. rootId is present only
+ * when the caller can ListRoots (management account or delegated
+ * administrator).
+ */
+export interface MemberOrgDetails {
+    orgId: string;
+    managementAccountId: string;
+    rootId?: string;
+}
+/**
+ * Describe the organisation with credentials that may belong to a member
+ * account. DescribeOrganization is callable from any account in an
+ * organisation, but ListRoots only from the management account (or a
+ * delegated administrator) — the root id resolves best-effort and is omitted
+ * when credentials cannot list roots. Read-only: never creates. Returns null
+ * when the account is not in an organisation. A DescribeOrganization denial
+ * still fails: the caller needs orgId (the Account stack exports it), so a
+ * silent fall-through would strip an exported output on redeploy.
+ */
+export declare function describeOrganisationAsMember(client: OrganizationsClient, abortSignal?: AbortSignal): Promise<Result<MemberOrgDetails | null>>;

package/dist/src/aws/organisations/organisation.js

@@ -1 +1 @@
-import{DescribeOrganizationCommand as m,CreateOrganizationCommand as I,ListRootsCommand as w}from"@aws-sdk/client-organizations";import{success as s,failure as a}from"@fjall/generator";import{getErrorMessage as g}from"@fjall/util";import{extractErrorName as c,isAccessDenied as f,composeSdkAbortSignal as u,AWS_ERROR_NAMES as A}from"./types.js";async function h(e,t){try{let n=!1,r=await d(e,t);if(!r)try{r=(await e.send(new I({FeatureSet:"ALL"}),{abortSignal:u(t)})).Organization??null,n=!0}catch(i){if(c(i)==="AlreadyInOrganizationException"){if(r=await d(e,t),!r)return a(new Error("Account is already in an organisation but DescribeOrganization returned nothing"))}else throw i}if(!r?.Id||!r.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));const o=await l(e,t);return o.success?s({orgId:r.Id,rootId:o.data,managementAccountId:r.MasterAccountId,created:n}):o}catch(n){return a(new Error(`Failed to ensure organisation exists: ${g(n)}`))}}async function M(e,t,n){try{const r=await d(e,t,n);if(!r)return s(null);if(!r.Id||!r.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));const o=await l(e,t);return o.success?s({orgId:r.Id,rootId:o.data,managementAccountId:r.MasterAccountId,created:!1}):o}catch(r){return n?.tolerateAccessDenied===!0&&f(c(r))?s(null):a(new Error(`Failed to describe organisation: ${g(r)}`))}}async function l(e,t){const r=(await e.send(new w({}),{abortSignal:u(t)})).Roots??[];return r.length===0||!r[0]?.Id?a(new Error("No organisation root found")):s(r[0].Id)}async function d(e,t,n){try{return(await e.send(new m({}),{abortSignal:u(t)})).Organization??null}catch(r){const o=c(r);if(o===A.ORGS_NOT_IN_USE||n?.tolerateAccessDenied===!0&&f(o))return null;throw r}}export{M as describeOrganisation,h as ensureOrganisationExists};
+import{DescribeOrganizationCommand as l,CreateOrganizationCommand as m,ListRootsCommand as w}from"@aws-sdk/client-organizations";import{success as s,failure as a}from"@fjall/generator";import{getErrorMessage as d}from"@fjall/util";import{extractErrorName as i,isAccessDenied as g,composeSdkAbortSignal as f,AWS_ERROR_NAMES as A}from"./types.js";async function M(n,o){try{let e=!1,r=await c(n,o);if(!r)try{r=(await n.send(new m({FeatureSet:"ALL"}),{abortSignal:f(o)})).Organization??null,e=!0}catch(u){if(i(u)==="AlreadyInOrganizationException"){if(r=await c(n,o),!r)return a(new Error("Account is already in an organisation but DescribeOrganization returned nothing"))}else throw u}if(!r?.Id||!r.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));const t=await I(n,o);return t.success?s({orgId:r.Id,rootId:t.data,managementAccountId:r.MasterAccountId,created:e}):t}catch(e){return a(new Error(`Failed to ensure organisation exists: ${d(e)}`))}}async function h(n,o,e){try{const r=await c(n,o,e);if(!r)return s(null);if(!r.Id||!r.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));const t=await I(n,o);return t.success?s({orgId:r.Id,rootId:t.data,managementAccountId:r.MasterAccountId,created:!1}):t}catch(r){return e?.tolerateAccessDenied===!0&&g(i(r))?s(null):a(new Error(`Failed to describe organisation: ${d(r)}`))}}async function b(n,o){try{const e=await c(n,o);if(!e)return s(null);if(!e.Id||!e.MasterAccountId)return a(new Error("Organisation is missing required fields (Id or MasterAccountId)"));let r;try{const t=await I(n,o);t.success&&(r=t.data)}catch(t){if(!g(i(t)))throw t}return s({orgId:e.Id,managementAccountId:e.MasterAccountId,...r!==void 0?{rootId:r}:{}})}catch(e){return a(new Error(`Failed to describe organisation: ${d(e)}`))}}async function I(n,o){const r=(await n.send(new w({}),{abortSignal:f(o)})).Roots??[];return r.length===0||!r[0]?.Id?a(new Error("No organisation root found")):s(r[0].Id)}async function c(n,o,e){try{return(await n.send(new l({}),{abortSignal:f(o)})).Organization??null}catch(r){const t=i(r);if(t===A.ORGS_NOT_IN_USE||e?.tolerateAccessDenied===!0&&g(t))return null;throw r}}export{h as describeOrganisation,b as describeOrganisationAsMember,M as ensureOrganisationExists};

package/dist/src/aws/utils/cloudformationEventHelpers.d.ts

@@ -15,6 +15,34 @@ export declare class IpamConcurrencyTracker {
      */
     trackEvent(event: ResourceEvent, eventLogger: EventLogWriter | null): void;
 }
+/**
+ * Clock-skew allowance subtracted from the monitor start time to form the
+ * event cutoff (F-F8). CloudFormation event timestamps come from AWS clocks;
+ * two minutes comfortably covers client/AWS drift (SigV4 itself tolerates
+ * five) without re-admitting a previous operation's history.
+ *
+ * Accepted residual (F-R11, narrowed by F-X9): after a FAILED prime poll, a
+ * previous operation's events inside the skew window (terminal within 120s
+ * of startMonitoring, same stack) are admitted for DISPATCH and terminal
+ * detection. Tightening those to an unskewed `>= monitorStart` bound would
+ * fail CLOSED under a fast client clock (this operation's own terminal event
+ * skipped → event-driven completion silently disabled), and an
+ * AWS-clock-only discriminator (terminal newer than the newest observed
+ * stack-level IN_PROGRESS) hangs any monitor attached to an
+ * already-in-flight operation. That residual is bounded: the completion
+ * verdict is re-read from live DescribeStacks in handleStackCompletion and
+ * the deploy result derives from the CDK subprocess lifecycle.
+ *
+ * The ClientRequestToken is NOT part of the residual (F-X9): the latched
+ * token becomes the webapp reconciler's §5.4 adoption comparand (heartbeat →
+ * Deployment.clientRequestToken → matchesToken/deriveAdoption), where a
+ * previous operation's token would corroborate the WRONG operation's
+ * outcome. Skew-window events are therefore dispatched with the token
+ * withheld (`tokenLatchCutoffMs`, unskewed) — an absent comparand merely
+ * skips adoption assist, and CFN's own ClientRequestToken remains the §5.3
+ * fencing backstop.
+ */
+export declare const EVENT_CUTOFF_SKEW_MS = 120000;
 /** Mutable state passed into pollStackEvents from the monitor class */
 export interface PollContext {
     aws: AwsClientLike;
@@ -25,6 +53,23 @@ export interface PollContext {
     maxHistorySize: number;
     ipamTracker: IpamConcurrencyTracker;
     eventLogger: EventLogWriter | null;
+    /**
+     * Epoch ms below which events belong to a PREVIOUS operation and are
+     * absorbed (marked seen, never processed or dispatched). Guards the case
+     * where the prime poll fails (throttle/network), leaving seenEventIds
+     * empty so the first live poll walks the stack's full prior history (F-F8).
+     */
+    eventCutoffMs: number;
+    /**
+     * Epoch ms of startMonitoring, UNSKEWED (F-X9). Events at/after this bound
+     * carry their ClientRequestToken; events inside the skew window
+     * (eventCutoffMs ≤ t < tokenLatchCutoffMs) are dispatched with the token
+     * withheld — the token feeds the tracker's §5.9 latch and thence the
+     * reconciler's adoption comparand, where a previous operation's token
+     * corroborates the wrong operation. Dispatch and terminal detection keep
+     * the skewed cutoff.
+     */
+    tokenLatchCutoffMs: number;
 }
 /** Poll CloudFormation for new stack events and dispatch them to the callback */
 export declare function pollStackEvents(ctx: PollContext, stackName: string, onResourceUpdate: (event: ResourceEvent) => void): Promise<boolean | "throttled">;

package/dist/src/aws/utils/cloudformationEventHelpers.js

@@ -1 +1 @@
-import{CloudFormationClient as g,DescribeStackEventsCommand as y,DescribeStacksCommand as A}from"@aws-sdk/client-cloudformation";import{logger as m}from"@fjall/util/logger";import{getErrorMessage as S,maskSensitiveOutput as C}from"@fjall/util";import{STACK_NOT_FOUND_PATTERN as f,maskFailureAnalysis as L}from"@fjall/util/aws";import{CF_STACK_RESOURCE_TYPE as I}from"./cloudformationEventTypes.js";import{extractErrorName as P}from"../organisations/types.js";const h=["CREATE_COMPLETE","CREATE_FAILED","DELETE_COMPLETE","DELETE_FAILED","UPDATE_COMPLETE","UPDATE_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","IMPORT_COMPLETE","IMPORT_ROLLBACK_COMPLETE","IMPORT_ROLLBACK_FAILED"],k=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE","IMPORT_COMPLETE"];function O(s){return h.includes(s)}function b(s){return k.includes(s)}const M=new Set(["AWS::EC2::IPAMPool","AWS::EC2::IPAMPoolCidr","AWS::EC2::IPAM"]);function _(s){return M.has(s)}class v{inProgress=new Map;get size(){return this.inProgress.size}clear(){this.inProgress.clear()}trackEvent(e,i){if(e.status.includes("IN_PROGRESS")){this.inProgress.set(e.logicalId,{resourceType:e.resourceType,startTime:e.timestamp});const o=Array.from(this.inProgress.entries()).map(([a,r])=>`${a} (${r.resourceType.split("::").pop()}, started ${r.startTime.toISOString()})`);m.debug("CloudFormation","IPAM resource started",{logicalId:e.logicalId,resourceType:e.resourceType,concurrentIpamCount:this.inProgress.size,concurrentIpamResources:o}),i&&i.writeEvent(e,{phase:"ipam_concurrency",isMainStack:!0,parentStack:`concurrent=${this.inProgress.size}: ${o.join(", ")}`})}else if(e.status.includes("COMPLETE")||e.status.includes("FAILED")){const o=this.inProgress.has(e.logicalId),a=this.inProgress.get(e.logicalId);this.inProgress.delete(e.logicalId);const r=a?e.timestamp.getTime()-a.startTime.getTime():void 0;if(m.debug("CloudFormation",`IPAM resource ${e.status}`,{logicalId:e.logicalId,resourceType:e.resourceType,status:e.status,statusReason:e.statusReason,durationMs:r,wasTracked:o,remainingIpamCount:this.inProgress.size,remainingIpamResources:Array.from(this.inProgress.keys())}),e.status.includes("FAILED")&&i){const l=Array.from(this.inProgress.entries()).map(([c,u])=>({logicalId:c,resourceType:u.resourceType,startTime:u.startTime.toISOString(),inFlightDurationMs:e.timestamp.getTime()-u.startTime.getTime()}));i.writeEvent(e,{phase:"ipam_failure_snapshot",isMainStack:!0,parentStack:JSON.stringify({failedResource:e.logicalId,reason:e.statusReason,durationMs:r,concurrentIpamAtFailure:l})})}}}}async function $(s,e,i){try{const o=s.aws.getClient(g);let a,r=!1,l=!1;do{const c=new y({StackName:e,...a?{NextToken:a}:{}}),u=await o.send(c);if(!u.StackEvents)break;for(const t of u.StackEvents){const d=`${t.EventId}`;if(s.seenEventIds.has(d)){l=!0;continue}if(s.seenEventIds.add(d),t.ResourceType===I&&t.LogicalResourceId!==e){const E=t.ResourceStatus||"",T=t.LogicalResourceId||"";E.includes("IN_PROGRESS")?s.activeNestedStacks.set(T,E):(E.includes("COMPLETE")||E.includes("FAILED"))&&s.activeNestedStacks.delete(T)}if(t.LogicalResourceId===e&&t.ResourceType===I){const E=t.ResourceStatus||"";O(E)&&(r=!0)}t.ResourceStatus&&t.ResourceStatus.includes("FAILED")&&t.ResourceStatusReason&&(s.failureReasons.set(t.LogicalResourceId||"unknown",t.ResourceStatusReason),m.debug("CloudFormation",`Captured failure: ${t.LogicalResourceId} - ${t.ResourceStatusReason}`));const n={logicalId:t.LogicalResourceId||"",physicalId:t.PhysicalResourceId,resourceType:t.ResourceType||"",status:t.ResourceStatus||"",statusReason:t.ResourceStatusReason,timestamp:t.Timestamp||new Date},p=n.logicalId,R=s.eventHistory.get(p)??[];if(R.push(n),s.eventHistory.set(p,R),s.eventHistory.size>s.maxHistorySize){const E=[...s.eventHistory.keys()].slice(0,s.eventHistory.size-s.maxHistorySize);for(const T of E)s.eventHistory.delete(T)}_(n.resourceType)&&s.ipamTracker.trackEvent(n,s.eventLogger),s.eventLogger&&s.eventLogger.writeEvent(n),m.debug("CloudFormation","pollEvents delivering event",{stackName:e,logicalId:n.logicalId,status:n.status,resourceType:n.resourceType}),i(n)}a=l?void 0:u.NextToken}while(a);return r&&s.activeNestedStacks.size>0?!1:r}catch(o){const a=P(o),r=S(o);return a==="ValidationError"&&r.includes(f)?!1:a==="Throttling"||a==="TooManyRequestsException"||a==="ThrottlingException"?"throttled":(r.includes(f)||m.error("CloudFormation","Unexpected polling error",{error:C(r)}),!1)}}async function H(s,e,i,o,a,r){const l=await F(s,e),c=l?.status||"UNKNOWN",u=c.endsWith("_COMPLETE")&&!c.includes("ROLLBACK")&&!c.includes("FAILED");let t=l?.statusReason;!u&&i.size>0&&(t=(Array.from(i.values())[0]??t)||t);let d=null;if(!u&&a){const n=a.analyseFailure(r);d=n===null?null:L(n)}return o&&(o.writeDeploymentEnd(u,c,t),!u&&i.size>0&&o.writeFailureSummary(Array.from(i.entries()).map(([n,p])=>({logicalId:n,reason:p}))),d&&o.writeFailureAnalysis({rootCause:d.rootCause.reason,failedResources:d.affectedResources.map(n=>({logicalId:n.logicalId,resourceType:n.resourceType,reason:n.statusReason||"Unknown reason"})),dependencyChain:d.dependencyChain,remediation:d.remediation})),{success:u,failureMessage:t,analysis:d}}async function F(s,e){try{const i=new A({StackName:e}),r=(await s.getClient(g).send(i)).Stacks?.[0];return r?{status:r.StackStatus||"UNKNOWN",statusReason:r.StackStatusReason}:null}catch(i){return m.debug("CloudFormation","getStackStatus failed",{error:S(i)}),null}}async function B(s,e){const i=[];try{const o=new y({StackName:e}),r=await s.getClient(g).send(o);if(!r.StackEvents)return i;const l=new Map;for(const c of r.StackEvents){const u=c.LogicalResourceId||"";if(u===e&&c.ResourceType===I)continue;const t=l.get(u);(!t||c.Timestamp&&t.timestamp<c.Timestamp)&&l.set(u,{logicalId:u,physicalId:c.PhysicalResourceId,resourceType:c.ResourceType||"",status:c.ResourceStatus||"",statusReason:c.ResourceStatusReason,timestamp:c.Timestamp||new Date})}return Array.from(l.values())}catch(o){const a=P(o),r=S(o);return a==="ValidationError"&&r.includes(f)||r.includes(f)||m.error("CloudFormation","Error getting current resources",{error:C(S(o))}),i}}export{v as IpamConcurrencyTracker,B as fetchCurrentResources,F as fetchStackStatus,H as handleStackCompletion,_ as isIpamResource,b as isSuccessState,O as isTerminalState,$ as pollStackEvents};
+import{CloudFormationClient as R,DescribeStackEventsCommand as y,DescribeStacksCommand as L}from"@aws-sdk/client-cloudformation";import{logger as T}from"@fjall/util/logger";import{getErrorMessage as f,maskSensitiveOutput as P}from"@fjall/util";import{STACK_NOT_FOUND_PATTERN as S,maskFailureAnalysis as k}from"@fjall/util/aws";import{CF_STACK_RESOURCE_TYPE as g}from"./cloudformationEventTypes.js";import{extractErrorName as A}from"../organisations/types.js";const h=["CREATE_COMPLETE","CREATE_FAILED","DELETE_COMPLETE","DELETE_FAILED","UPDATE_COMPLETE","UPDATE_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","IMPORT_COMPLETE","IMPORT_ROLLBACK_COMPLETE","IMPORT_ROLLBACK_FAILED"],_=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE","IMPORT_COMPLETE"];function M(t){return h.includes(t)}function b(t){return _.includes(t)}const O=new Set(["AWS::EC2::IPAMPool","AWS::EC2::IPAMPoolCidr","AWS::EC2::IPAM"]);function F(t){return O.has(t)}class ${inProgress=new Map;get size(){return this.inProgress.size}clear(){this.inProgress.clear()}trackEvent(e,i){if(e.status.includes("IN_PROGRESS")){this.inProgress.set(e.logicalId,{resourceType:e.resourceType,startTime:e.timestamp});const o=Array.from(this.inProgress.entries()).map(([n,r])=>`${n} (${r.resourceType.split("::").pop()}, started ${r.startTime.toISOString()})`);T.debug("CloudFormation","IPAM resource started",{logicalId:e.logicalId,resourceType:e.resourceType,concurrentIpamCount:this.inProgress.size,concurrentIpamResources:o}),i&&i.writeEvent(e,{phase:"ipam_concurrency",isMainStack:!0,parentStack:`concurrent=${this.inProgress.size}: ${o.join(", ")}`})}else if(e.status.includes("COMPLETE")||e.status.includes("FAILED")){const o=this.inProgress.has(e.logicalId),n=this.inProgress.get(e.logicalId);this.inProgress.delete(e.logicalId);const r=n?e.timestamp.getTime()-n.startTime.getTime():void 0;if(T.debug("CloudFormation",`IPAM resource ${e.status}`,{logicalId:e.logicalId,resourceType:e.resourceType,status:e.status,statusReason:e.statusReason,durationMs:r,wasTracked:o,remainingIpamCount:this.inProgress.size,remainingIpamResources:Array.from(this.inProgress.keys())}),e.status.includes("FAILED")&&i){const u=Array.from(this.inProgress.entries()).map(([a,c])=>({logicalId:a,resourceType:c.resourceType,startTime:c.startTime.toISOString(),inFlightDurationMs:e.timestamp.getTime()-c.startTime.getTime()}));i.writeEvent(e,{phase:"ipam_failure_snapshot",isMainStack:!0,parentStack:JSON.stringify({failedResource:e.logicalId,reason:e.statusReason,durationMs:r,concurrentIpamAtFailure:u})})}}}}const H=12e4;async function B(t,e,i){try{const o=t.aws.getClient(R);let n,r=!1,u=!1;do{const a=new y({StackName:e,...n?{NextToken:n}:{}}),c=await o.send(a);if(!c.StackEvents)break;for(const s of c.StackEvents){const m=`${s.EventId}`;if(t.seenEventIds.has(m)){u=!0;continue}if(t.seenEventIds.add(m),s.Timestamp!==void 0&&s.Timestamp.getTime()<t.eventCutoffMs){u=!0;continue}if(s.ResourceType===g&&s.LogicalResourceId!==e){const E=s.ResourceStatus||"",p=s.LogicalResourceId||"";E.includes("IN_PROGRESS")?t.activeNestedStacks.set(p,E):(E.includes("COMPLETE")||E.includes("FAILED"))&&t.activeNestedStacks.delete(p)}if(s.LogicalResourceId===e&&s.ResourceType===g){const E=s.ResourceStatus||"";M(E)&&(r=!0)}s.ResourceStatus&&s.ResourceStatus.includes("FAILED")&&s.ResourceStatusReason&&(t.failureReasons.set(s.LogicalResourceId||"unknown",s.ResourceStatusReason),T.debug("CloudFormation",`Captured failure: ${s.LogicalResourceId} - ${s.ResourceStatusReason}`));const l=s.Timestamp===void 0||s.Timestamp.getTime()>=t.tokenLatchCutoffMs,d={logicalId:s.LogicalResourceId||"",physicalId:s.PhysicalResourceId,resourceType:s.ResourceType||"",status:s.ResourceStatus||"",statusReason:s.ResourceStatusReason,timestamp:s.Timestamp||new Date,clientRequestToken:l?s.ClientRequestToken:void 0},I=d.logicalId,C=t.eventHistory.get(I)??[];if(C.push(d),t.eventHistory.set(I,C),t.eventHistory.size>t.maxHistorySize){const E=[...t.eventHistory.keys()].slice(0,t.eventHistory.size-t.maxHistorySize);for(const p of E)t.eventHistory.delete(p)}F(d.resourceType)&&t.ipamTracker.trackEvent(d,t.eventLogger),t.eventLogger&&t.eventLogger.writeEvent(d),T.debug("CloudFormation","pollEvents delivering event",{stackName:e,logicalId:d.logicalId,status:d.status,resourceType:d.resourceType}),i(d)}n=u?void 0:c.NextToken}while(n);return r&&t.activeNestedStacks.size>0?!1:r}catch(o){const n=A(o),r=f(o);return n==="ValidationError"&&r.includes(S)?!1:n==="Throttling"||n==="TooManyRequestsException"||n==="ThrottlingException"?"throttled":(r.includes(S)||T.error("CloudFormation","Unexpected polling error",{error:P(r)}),!1)}}async function W(t,e,i,o,n,r){const u=await D(t,e),a=u?.status||"UNKNOWN",c=a.endsWith("_COMPLETE")&&!a.includes("ROLLBACK")&&!a.includes("FAILED");let s=u?.statusReason;!c&&i.size>0&&(s=(Array.from(i.values())[0]??s)||s);let m=null;if(!c&&n){const l=n.analyseFailure(r,e);m=l===null?null:k(l)}return o&&(o.writeDeploymentEnd(c,a,s),!c&&i.size>0&&o.writeFailureSummary(Array.from(i.entries()).map(([l,d])=>({logicalId:l,reason:d}))),m&&o.writeFailureAnalysis({rootCause:m.rootCause.reason,failedResources:m.affectedResources.map(l=>({logicalId:l.logicalId,resourceType:l.resourceType,reason:l.statusReason||"Unknown reason"})),dependencyChain:m.dependencyChain,remediation:m.remediation})),{success:c,failureMessage:s,analysis:m}}async function D(t,e){try{const i=new L({StackName:e}),r=(await t.getClient(R).send(i)).Stacks?.[0];return r?{status:r.StackStatus||"UNKNOWN",statusReason:r.StackStatusReason}:null}catch(i){return T.debug("CloudFormation","getStackStatus failed",{error:f(i)}),null}}async function q(t,e){const i=[];try{const o=new y({StackName:e}),r=await t.getClient(R).send(o);if(!r.StackEvents)return i;const u=new Map;for(const a of r.StackEvents){const c=a.LogicalResourceId||"";if(c===e&&a.ResourceType===g)continue;const s=u.get(c);(!s||a.Timestamp&&s.timestamp<a.Timestamp)&&u.set(c,{logicalId:c,physicalId:a.PhysicalResourceId,resourceType:a.ResourceType||"",status:a.ResourceStatus||"",statusReason:a.ResourceStatusReason,timestamp:a.Timestamp||new Date,clientRequestToken:a.ClientRequestToken})}return Array.from(u.values())}catch(o){const n=A(o),r=f(o);return n==="ValidationError"&&r.includes(S)||r.includes(S)||T.error("CloudFormation","Error getting current resources",{error:P(f(o))}),i}}export{H as EVENT_CUTOFF_SKEW_MS,$ as IpamConcurrencyTracker,q as fetchCurrentResources,D as fetchStackStatus,W as handleStackCompletion,F as isIpamResource,b as isSuccessState,M as isTerminalState,B as pollStackEvents};

package/dist/src/aws/utils/cloudformationEventTypes.d.ts

@@ -32,7 +32,7 @@ export interface EventLogWriter {
 }
 /** Interface for failure analysis — decouples from concrete CloudFormationFailureAnalyser */
 export interface EventFailureAnalyser {
-    analyseFailure(eventHistory: Map<string, ResourceEvent[]>): FailureAnalysis | null;
+    analyseFailure(eventHistory: Map<string, ResourceEvent[]>, stackName?: string): FailureAnalysis | null;
 }
 /** Factory to create an EventLogWriter for a specific deployment */
 export type EventLogWriterFactory = (deploymentId: string, stackName: string, region: string, deploymentName?: string) => EventLogWriter;

package/dist/src/aws/utils/cloudformationEvents.d.ts

@@ -15,10 +15,11 @@ export declare class CloudFormationEventMonitor {
     private eventLogWriterFactory;
     private onFailureAnalysis;
     private lastAnalysis;
-    private deploymentStartTime;
     private maxHistorySize;
     private maxSeenEventIds;
     private ipamTracker;
+    private eventCutoffMs;
+    private tokenLatchCutoffMs;
     constructor(aws: AwsClientLike, deps?: EventMonitorDeps);
     enableLogging(deploymentId: string, stackName: string, region: string, deploymentName?: string): void;
     startMonitoring(stackName: string, onResourceUpdate: (event: ResourceEvent) => void, onStackComplete?: (success: boolean, message?: string) => void): Promise<void>;

package/dist/src/aws/utils/cloudformationEvents.js

@@ -1 +1 @@
-import{logger as u}from"@fjall/util/logger";import{getErrorMessage as m,sleep as p}from"@fjall/util";import{STACK_NOT_FOUND_PATTERN as d}from"@fjall/util/aws";import{isResourceEvent as x,STACK_NOT_FOUND_PATTERN as b,CDK_NO_STACKS_MATCH as K}from"@fjall/util/aws";import{CF_STACK_RESOURCE_TYPE as S}from"./cloudformationEventTypes.js";import{isTerminalState as v,isSuccessState as w,IpamConcurrencyTracker as C,pollStackEvents as E,handleStackCompletion as M,fetchStackStatus as F,fetchCurrentResources as T}from"./cloudformationEventHelpers.js";class D{aws;seenEventIds=new Set;isMonitoring=!1;pollInterval=null;activeNestedStacks=new Map;failureReasons=new Map;eventHistory=new Map;eventLogger=null;failureAnalyser;eventLogWriterFactory;onFailureAnalysis;lastAnalysis=null;deploymentStartTime=null;maxHistorySize=1e3;maxSeenEventIds=1e4;ipamTracker=new C;constructor(t,e){this.aws=t,this.failureAnalyser=e?.failureAnalyser??null,this.eventLogWriterFactory=e?.eventLogWriterFactory,this.onFailureAnalysis=e?.onFailureAnalysis}enableLogging(t,e,a,s){this.eventLogWriterFactory&&(this.eventLogger=this.eventLogWriterFactory(t,e,a,s))}async startMonitoring(t,e,a){if(this.isMonitoring){u.debug("CloudFormation","startMonitoring SKIPPED - already monitoring",{stackName:t});return}u.debug("CloudFormation","startMonitoring STARTED",{stackName:t}),this.isMonitoring=!0,this.seenEventIds.clear(),this.eventHistory.clear(),this.deploymentStartTime=new Date;try{await this.pollEvents(t,()=>{})}catch(r){const h=m(r);h.includes(d)||u.debug("CloudFormation","Initial poll failed",{error:h})}let s=5e3;const o=1e4;let n=0,g=0;const l=async()=>{if(this.isMonitoring)try{const r=await this.pollEvents(t,e);n++,r==="throttled"?(g++,s=Math.min(3e4,5e3*Math.pow(2,g-1))):(g=0,n>20&&s<o?s=Math.min(o,s+1e3):n<=20&&(s=5e3)),r===!0?await this.handleStackComplete(t,a):this.pollInterval=setTimeout(l,s)}catch(r){u.debug("CloudFormation","Polling iteration error (continuing)",{error:m(r)}),this.pollInterval=setTimeout(l,s)}};this.pollInterval=setTimeout(l,s)}stopMonitoring(){u.debug("CloudFormation","stopMonitoring called",{wasMonitoring:this.isMonitoring,seenEventCount:this.seenEventIds.size}),this.isMonitoring=!1,this.pollInterval&&(clearTimeout(this.pollInterval),this.pollInterval=null),this.cleanup()}cleanup(){if(this.activeNestedStacks.clear(),this.failureReasons.clear(),this.eventHistory.clear(),this.ipamTracker.clear(),this.seenEventIds.size>this.maxSeenEventIds){const t=Array.from(this.seenEventIds),e=Math.floor(this.maxSeenEventIds/2);this.seenEventIds=new Set(t.slice(-e))}this.eventLogger&&(this.eventLogger=null)}async handleStackComplete(t,e){const a=new Map(this.failureReasons),s=new Map(this.eventHistory),o=this.eventLogger;this.stopMonitoring();const n=await M(this.aws,t,a,o,this.failureAnalyser,s);this.lastAnalysis=n.analysis,n.analysis&&this.onFailureAnalysis&&this.onFailureAnalysis(n.analysis),e&&e(n.success,n.failureMessage)}getResourceHistory(t){return this.eventHistory.get(t)||[]}getEventHistory(){return new Map(this.eventHistory)}getFailureAnalysis(){return this.lastAnalysis}getFirstFailureReason(){return this.failureReasons.size>0?Array.from(this.failureReasons.values())[0]??null:null}getEventLogger(){return this.eventLogger}getEventLogPath(){return this.eventLogger?.getLogPath()||null}getLogSummary(){return this.eventLogger?.getLogSummary()||null}async waitForStackComplete(t,e={}){const{timeout:a=1800*1e3,pollInterval:s=2e3,onResourceUpdate:o,onStackComplete:n}=e,g=Date.now();let l,r=!1,h=!1,c;u.debug("CloudFormation","waitForStackComplete called",{stackName:t,timeout:a,pollInterval:s,hasOnResourceUpdate:!!o}),await this.startMonitoring(t,i=>{o&&o(i),i.resourceType===S&&i.logicalId===t&&(l=i.status,v(i.status)&&(r=!0,h=w(i.status),h||(c=this.getFirstFailureReason()||i.statusReason||"Stack operation failed")))},(i,f)=>{n&&n(i,f)});try{let i=!1,f=!1;for(;!r&&this.isMonitoring&&Date.now()-g<a;)await p(s),!i&&Date.now()-g>3e4&&!f&&(f=!0,await this.getStackStatus(t)||u.debug("CloudFormation","Stack not found after 30s, continuing to wait (CDK may be uploading assets)",{stackName:t})),l&&(i=!0);if(this.stopMonitoring(),!r){if(c)return{success:!1,status:"FAILED",failureReason:c,logPath:this.getLogSummary()||void 0};const y=await this.getStackStatus(t);return{success:!1,status:y?.status||"UNKNOWN",failureReason:`Deployment timed out after ${a/1e3} seconds. Stack status: ${y?.status||"UNKNOWN"}`,logPath:this.getLogSummary()||void 0}}return{success:h,status:l,failureReason:c,logPath:this.getLogSummary()||void 0}}catch(i){return this.stopMonitoring(),{success:!1,failureReason:`Monitoring error: ${m(i)}`,logPath:this.getLogSummary()||void 0}}}pollContext(){return{aws:this.aws,seenEventIds:this.seenEventIds,activeNestedStacks:this.activeNestedStacks,failureReasons:this.failureReasons,eventHistory:this.eventHistory,maxHistorySize:this.maxHistorySize,ipamTracker:this.ipamTracker,eventLogger:this.eventLogger}}async pollEvents(t,e){return E(this.pollContext(),t,e)}async getStackStatus(t){return F(this.aws,t)}async getCurrentResources(t){return T(this.aws,t)}}export{K as CDK_NO_STACKS_MATCH,D as CloudFormationEventMonitor,b as STACK_NOT_FOUND_PATTERN,x as isResourceEvent};
+import{logger as c}from"@fjall/util/logger";import{getErrorMessage as v,sleep as m}from"@fjall/util";import{STACK_NOT_FOUND_PATTERN as S}from"@fjall/util/aws";import{isResourceEvent as K,STACK_NOT_FOUND_PATTERN as O,CDK_NO_STACKS_MATCH as b}from"@fjall/util/aws";import{CF_STACK_RESOURCE_TYPE as p}from"./cloudformationEventTypes.js";import{isTerminalState as d,isSuccessState as M,IpamConcurrencyTracker as C,pollStackEvents as w,handleStackCompletion as E,fetchStackStatus as F,fetchCurrentResources as L,EVENT_CUTOFF_SKEW_MS as T}from"./cloudformationEventHelpers.js";class D{aws;seenEventIds=new Set;isMonitoring=!1;pollInterval=null;activeNestedStacks=new Map;failureReasons=new Map;eventHistory=new Map;eventLogger=null;failureAnalyser;eventLogWriterFactory;onFailureAnalysis;lastAnalysis=null;maxHistorySize=1e3;maxSeenEventIds=1e4;ipamTracker=new C;eventCutoffMs=0;tokenLatchCutoffMs=0;constructor(t,e){this.aws=t,this.failureAnalyser=e?.failureAnalyser??null,this.eventLogWriterFactory=e?.eventLogWriterFactory,this.onFailureAnalysis=e?.onFailureAnalysis}enableLogging(t,e,r,a){this.eventLogWriterFactory&&(this.eventLogger=this.eventLogWriterFactory(t,e,r,a))}async startMonitoring(t,e,r){if(this.isMonitoring){c.debug("CloudFormation","startMonitoring SKIPPED - already monitoring",{stackName:t});return}c.debug("CloudFormation","startMonitoring STARTED",{stackName:t}),this.isMonitoring=!0,this.seenEventIds.clear(),this.eventHistory.clear();const a=Date.now();this.eventCutoffMs=a-T,this.tokenLatchCutoffMs=a;try{await this.pollEvents(t,()=>{})}catch(o){const h=v(o);h.includes(S)||c.debug("CloudFormation","Initial poll failed",{error:h})}let s=5e3;const n=1e4;let g=0,l=0;const u=async()=>{if(this.isMonitoring)try{const o=await this.pollEvents(t,e);g++,o==="throttled"?(l++,s=Math.min(3e4,5e3*Math.pow(2,l-1))):(l=0,g>20&&s<n?s=Math.min(n,s+1e3):g<=20&&(s=5e3)),o===!0?await this.handleStackComplete(t,r):this.pollInterval=setTimeout(u,s)}catch(o){c.debug("CloudFormation","Polling iteration error (continuing)",{error:v(o)}),this.pollInterval=setTimeout(u,s)}};this.pollInterval=setTimeout(u,s)}stopMonitoring(){c.debug("CloudFormation","stopMonitoring called",{wasMonitoring:this.isMonitoring,seenEventCount:this.seenEventIds.size}),this.isMonitoring=!1,this.pollInterval&&(clearTimeout(this.pollInterval),this.pollInterval=null),this.cleanup()}cleanup(){if(this.activeNestedStacks.clear(),this.failureReasons.clear(),this.eventHistory.clear(),this.ipamTracker.clear(),this.seenEventIds.size>this.maxSeenEventIds){const t=Array.from(this.seenEventIds),e=Math.floor(this.maxSeenEventIds/2);this.seenEventIds=new Set(t.slice(-e))}this.eventLogger&&(this.eventLogger=null)}async handleStackComplete(t,e){const r=new Map(this.failureReasons),a=new Map(this.eventHistory),s=this.eventLogger;this.stopMonitoring();const n=await E(this.aws,t,r,s,this.failureAnalyser,a);this.lastAnalysis=n.analysis,n.analysis&&this.onFailureAnalysis&&this.onFailureAnalysis(n.analysis),e&&e(n.success,n.failureMessage)}getResourceHistory(t){return this.eventHistory.get(t)||[]}getEventHistory(){return new Map(this.eventHistory)}getFailureAnalysis(){return this.lastAnalysis}getFirstFailureReason(){return this.failureReasons.size>0?Array.from(this.failureReasons.values())[0]??null:null}getEventLogger(){return this.eventLogger}getEventLogPath(){return this.eventLogger?.getLogPath()||null}getLogSummary(){return this.eventLogger?.getLogSummary()||null}async waitForStackComplete(t,e={}){const{timeout:r=1800*1e3,pollInterval:a=2e3,onResourceUpdate:s,onStackComplete:n}=e,g=Date.now();let l,u=!1,o=!1,h;c.debug("CloudFormation","waitForStackComplete called",{stackName:t,timeout:r,pollInterval:a,hasOnResourceUpdate:!!s}),await this.startMonitoring(t,i=>{s&&s(i),i.resourceType===p&&i.logicalId===t&&(l=i.status,d(i.status)&&(u=!0,o=M(i.status),o||(h=this.getFirstFailureReason()||i.statusReason||"Stack operation failed")))},(i,f)=>{n&&n(i,f)});try{let i=!1,f=!1;for(;!u&&this.isMonitoring&&Date.now()-g<r;)await m(a),!i&&Date.now()-g>3e4&&!f&&(f=!0,await this.getStackStatus(t)||c.debug("CloudFormation","Stack not found after 30s, continuing to wait (CDK may be uploading assets)",{stackName:t})),l&&(i=!0);if(this.stopMonitoring(),!u){if(h)return{success:!1,status:"FAILED",failureReason:h,logPath:this.getLogSummary()||void 0};const y=await this.getStackStatus(t);return{success:!1,status:y?.status||"UNKNOWN",failureReason:`Deployment timed out after ${r/1e3} seconds. Stack status: ${y?.status||"UNKNOWN"}`,logPath:this.getLogSummary()||void 0}}return{success:o,status:l,failureReason:h,logPath:this.getLogSummary()||void 0}}catch(i){return this.stopMonitoring(),{success:!1,failureReason:`Monitoring error: ${v(i)}`,logPath:this.getLogSummary()||void 0}}}pollContext(){return{aws:this.aws,seenEventIds:this.seenEventIds,activeNestedStacks:this.activeNestedStacks,failureReasons:this.failureReasons,eventHistory:this.eventHistory,maxHistorySize:this.maxHistorySize,ipamTracker:this.ipamTracker,eventLogger:this.eventLogger,eventCutoffMs:this.eventCutoffMs,tokenLatchCutoffMs:this.tokenLatchCutoffMs}}async pollEvents(t,e){return w(this.pollContext(),t,e)}async getStackStatus(t){return F(this.aws,t)}async getCurrentResources(t){return L(this.aws,t)}}export{b as CDK_NO_STACKS_MATCH,D as CloudFormationEventMonitor,O as STACK_NOT_FOUND_PATTERN,K as isResourceEvent};

package/dist/src/aws/utils/stackStatus.js

@@ -1 +1 @@
-const e={CREATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with creation"},CREATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully created"},CREATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack creation failed - fix issues before redeploying"},DELETE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with deletion"},DELETE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully deleted"},DELETE_FAILED:{safeToRedeploy:"Maybe",description:"Stack deletion failed - investigate before redeploying"},ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back due to failure"},ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack rolled back due to failure - fix issues before redeploying"},ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Rollback failed - manual intervention needed"},UPDATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update is in progress"},UPDATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update completed successfully"},UPDATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack update failed - fix issues before redeploying"},UPDATE_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back an update"},UPDATE_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update rolled back successfully"},UPDATE_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Update rollback failed - manual fix needed"},IMPORT_IN_PROGRESS:{safeToRedeploy:"No",description:"Resource import in progress"},IMPORT_COMPLETE:{safeToRedeploy:"Yes",description:"Resource import completed successfully"},IMPORT_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Import rollback in progress"},IMPORT_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Import rollback completed"},IMPORT_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Import rollback failed - manual fix needed"},REVIEW_IN_PROGRESS:{safeToRedeploy:"Yes",description:"Stack is in review mode"},UNKNOWN:{safeToRedeploy:"Maybe",description:"Unknown stack status"}};export{e as stackStatusMap};
+const e={CREATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with creation"},CREATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully created"},CREATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack creation failed - fix issues before redeploying"},DELETE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is busy with deletion"},DELETE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack was successfully deleted"},DELETE_FAILED:{safeToRedeploy:"Maybe",description:"Stack deletion failed - investigate before redeploying"},ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back due to failure"},ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack rolled back due to failure - fix issues before redeploying"},ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Rollback failed - manual intervention needed"},UPDATE_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update is in progress"},UPDATE_COMPLETE_CLEANUP_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack update is finalising - old resources being cleaned up"},UPDATE_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update completed successfully"},UPDATE_FAILED:{safeToRedeploy:"Maybe",description:"Stack update failed - fix issues before redeploying"},UPDATE_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Stack is rolling back an update"},UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS:{safeToRedeploy:"No",description:"Update rollback is finalising - old resources being cleaned up"},UPDATE_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Stack update rolled back successfully"},UPDATE_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Update rollback failed - manual fix needed"},IMPORT_IN_PROGRESS:{safeToRedeploy:"No",description:"Resource import in progress"},IMPORT_COMPLETE:{safeToRedeploy:"Yes",description:"Resource import completed successfully"},IMPORT_ROLLBACK_IN_PROGRESS:{safeToRedeploy:"No",description:"Import rollback in progress"},IMPORT_ROLLBACK_COMPLETE:{safeToRedeploy:"Yes",description:"Import rollback completed"},IMPORT_ROLLBACK_FAILED:{safeToRedeploy:"No",description:"Import rollback failed - manual fix needed"},REVIEW_IN_PROGRESS:{safeToRedeploy:"Yes",description:"Stack is in review mode"},UNKNOWN:{safeToRedeploy:"Maybe",description:"Unknown stack status"}};export{e as stackStatusMap};

package/dist/src/index.d.ts

@@ -15,7 +15,7 @@ export { DeploymentEventSchema, DEPLOYMENT_EVENT_TYPES, DEPLOYMENT_EVENT_RESOURC
 export type { DeploymentEvent, DeploymentEventType, DeploymentEventResourceCategory, DeploymentEventCascadePhase, DeploymentEventCascadeAccountStatus } from "./types/index.js";
 export { DeployEventSchema, StepProgressSchema, DeployResourceSchema, PlanChangeSchema, PlanPropertyChangeSchema, ChangeCountsSchema, DEPLOY_EVENT_CONTRACT, DEPLOY_EVENT_CONTRACT_MAJOR, DEPLOY_EVENT_CONTRACT_MINOR, SUPPORTED_CONTRACT_MARKERS, DEPLOY_EVENT_ID_MAX, DEPLOY_EVENT_NAME_MAX, DEPLOY_EVENT_MESSAGE_MAX, DEPLOY_EVENT_STATUS_REASON_MAX, DEPLOY_EVENT_ERROR_MESSAGE_MAX, DEPLOY_EVENT_TRAIL_DETAIL_MAX, DEPLOY_EVENT_OUTPUT_MAX, DEPLOY_EVENT_ARN_MAX, DEPLOY_EVENT_URL_MAX, STEP_COMPLETE_STATUSES, LOG_LEVELS, STACK_CLEANUP_PHASES, CASCADE_ACCOUNT_PHASES, DEPLOY_RESULTS, DETECTION_PHASES, PHASE_STATUSES, BUILDERS, CASCADE_OUTCOME_RESULTS, PLAN_ACTIONS, REPLACEMENT_MODES, APPROVAL_KINDS, APPROVAL_DECISIONS, ALL_PROGRESS_KINDS, createDeployEmitter, parseDeployEvent, parseDeployContractVersion } from "./types/index.js";
 export type { DeployEvent, ProgressKind, StepProgress, DeployResource, PlanChange, PlanPropertyChange, ChangeCounts, PlanAction, ReplacementMode, ApprovalKind, ApprovalDecision, DeployRunResult, DeployEmitter, CreateDeployEmitterOptions, ParsedDeployEvent, StackCleanupPhase, CascadeAccountPhase, LogLevel } from "./types/index.js";
-export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter, DeployCallbacks, StepCompleteStatus, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DatabaseEndpointRestartRequest, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, ApprovalGate, ApprovalGatePlanDetail, ApprovalRequest, GateResolution, OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession, Entitlements } from "./types/index.js";
+export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter, DeployCallbacks, StepCompleteStatus, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, StackTarget, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DatabaseEndpointRestartRequest, InfrastructureSource, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, StackLeaseVerdict, ApprovalGate, ApprovalGatePlanDetail, ApprovalRequest, GateResolution, RemediationVerb, DestructionFinding, DestructionTicketResource, DestructionTicket, DestructionConsent, ConsentVerdict, ConsentVerdictRow, DestructionConsentReport, DestructionConsentRequest, DestructionConsentResolution, DestructionConsentGate, DestructionOutcome, TicketVerdictSource, RemediationPhase, RemediationTarget, RemediationFlipProof, RemediationJournalRecord, OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession, Entitlements } from "./types/index.js";
 export type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } from "./aws/index.js";
 export { SimpleAwsProvider } from "./aws/index.js";
 export { checkTargetReadiness, describeTargetReadinessReason, buildTargetUnreadyAdvisory, buildTargetSetUnreadyAdvisory, probeAccountStackExists } from "./aws/index.js";
@@ -25,6 +25,11 @@ export type { RegionAvailability } from "./aws/index.js";
 export { ensureOrganisationExists, describeOrganisation, enablePolicyTypes, enableServiceAccess, SERVICE_PRINCIPALS, enableRamSharing, activateTrustedAccess, enableIpamDelegatedAdmin, updateBackupGlobalSettings, listAccounts, findAccount, createAccount, ensureOrganisationalUnitsExist, placeAccountsInOUs, buildAccountToOUMap, findDevelopmentOuId, activateCostAllocationTags, checkIdentityCentreStatus, snapshotIdentityCentre, composeSdkAbortSignal, extractErrorName, isAborted, DEFAULT_MAX_PAGES, IDENTITY_STORE_PAGE_SIZE, drainPages, isOULeaf, registerSecurityDelegates, SECURITY_SERVICE_PRINCIPALS, enableCentralisedRootAccess, ROOT_ACCESS_FEATURES, RootAccessEnablementError } from "./aws/index.js";
 export type { OrgDetails, OUMap, OUTree, AccountPlacementResult, AccountInfo, DrainPagesOptions, PagedResult, IdentityCentreStatus, IdentityCentreSnapshot, IdentityCentreSnapshotGroup, IdentityCentreSnapshotOptions, IdentityCentreSnapshotResult, IdentityCentreSnapshotUser, BackupGlobalSettings, CostAllocationTag, CreateAccountResult, RootAccessFeature, RootAccessEnablementSummary } from "./aws/index.js";
 export { STEP_IDS, STEP_NAMES, INFRASTRUCTURE_STEP_NAMES, INFRA_STEP_NAME } from "./types/index.js";
+export { RemediationVerbSchema, REMEDIATION_VERB_GLOSS, DestructionFindingSchema, DestructionTicketResourceSchema, DestructionTicketSchema, DestructionConsentSchema, DestructionOutcomeSchema, DESTRUCTION_FINDINGS, CONSENT_VERDICTS, TICKET_VERDICT_SOURCES, TicketVerdictSourceSchema } from "./types/index.js";
+export { DRIFT_VERDICTS, DriftVerdictSchema, DriftSuspectSchema, DriftFindingSchema, DriftJournalRecordSchema, verbsForDriftVerdict } from "./types/index.js";
+export { REMEDIATION_PHASES, RemediationPhaseSchema, RemediationTargetSchema, RemediationFlipProofSchema, RemediationJournalRecordSchema, RemediationVerbWithSurgerySchema, remediationPhaseRank, remediationPlaceholderPhysicalId, isRemediationPlaceholderPhysicalId } from "./types/index.js";
+export type { RemediationVerbWithSurgery } from "./types/index.js";
+export type { DriftVerdict, DriftSuspect, DriftFinding, DriftJournalRecord } from "./types/index.js";
 export type { StepId, InfrastructureStepName, StepDefinition, StepDeploymentType, Operation, StepContext } from "./types/index.js";
 export type { DeploymentContext, StepOutput, ApplicationDeploymentContext, CallerIdentity, StackOutput, StackOutputsRecord, ValidationResult, DetectionResult, ProgressCallbacks, ApplicationStack, OrganisationType, DeploymentOperation, ApplicationOperation, OrganisationOperation, DeployOrderOptions, ParallelDeployGroupKey, ParallelDestroyGroupKey, OpenNextPattern, AppResourceFlags, ParallelDeploymentResult, ParallelDeployGroup, ParallelOperation, ParallelOperationType, ParallelOperationState, ApplicationErrorType, StackDeploymentData, StackDeploymentOptions, ApplicationDeploymentData, ApplicationDestructionData, FjallStateFile, TemplateHashEntry } from "./types/index.js";
 export { ProgressReporter, APPLICATION_STACKS, ORGANISATION_TYPES, APPLICATION_DEPLOY_ORDER, APPLICATION_DESTROY_ORDER, OPENNEXT_DEPLOY_ORDER, OPENNEXT_DESTROY_ORDER, PARALLEL_DEPLOY_GROUPS, PARALLEL_DESTROY_GROUPS, OPENNEXT_PARALLEL_GROUPS, PARALLEL_OPERATION_TYPES, isApplicationOperation, isOrganisationOperation, getParallelDeployGroups, getParallelDestroyGroups, getApplicationDeployOrder, getApplicationDestroyOrder, getApplicationStackName, getOrganisationStackName, isApplicationStack, isQuarantineDetail, isRetainedBucketsDetail, getApplicationStepName, getApplicationStepId, toPascalCase, isOpenNextPattern, OPENNEXT_PATTERNS, deriveResourcesFromManifestStacks, STACK_NOT_FOUND_PATTERN, STACK_FAILED_STATE_PATTERN, CDK_NO_STACKS_MATCH, INFRASTRUCTURE_FILENAME, ApplicationError, wrapApplicationError, FjallStateFileSchema, readStateFile, writeStateFile, createEmptyState, deleteStateFile, updateTemplateHash, getStateFilePath, stubCallerIdentity } from "./types/index.js";
@@ -55,6 +60,10 @@ export { reconcileProviderAccounts, mergeReconciledProviderAccounts } from "./or
 export type { ReconcileResult } from "./orchestration/index.js";
 export { decideNextTransition, reconcileTrailMigration, decommissionMemberTrailStorage, ORG_TRAIL_BUCKET_OUTPUT_KEY, TRAIL_BUCKET_OUTPUT_KEY, TRAIL_KEY_ARN_OUTPUT_KEY } from "./orchestration/index.js";
 export type { MemberTrailFacts, TrailMigrationTransition, TrailMigrationOutcome, DecommissionClients, DecommissionInput, DecommissionOutcome } from "./orchestration/index.js";
+export { classifyDriftFailure, fetchLastOperationEvents, DriftProbe, clearDriftSuspects, defaultDriftJournalDir, readDriftSuspects, recordDriftSuspects, detectStackDrift, runDriftPreFlight, formatDriftPreFlightBlock, DRIFT_PREFLIGHT_TRIGGER_STATUSES, DRIFT_PREFLIGHT_BUDGET_MS } from "./orchestration/index.js";
+export type { DriftProbeOptions, DriftProbeRunner, ProbeDriftSuspectsParams, DriftJournalOptions, RecordDriftSuspectsParams, DetectStackDriftDeps, DetectStackDriftParams, StackDriftReport, RunDriftPreFlightParams, DriftPreFlightBlockExtras, DriftPreFlightOutcome } from "./orchestration/index.js";
+export { archiveCompletedRemediationJournal, computeRemediationOpId, defaultRemediationJournalDir, findRemediationJournalByOpId, listActiveRemediationOps, listActiveRemediationOpsForContext, readRemediationJournal, sweepExpiredRemediationJournals, writeRemediationJournal, REMEDIATION_JOURNAL_RETENTION_DAYS, captureRemediationForensics, defaultRemediationForensicsDir, applyRetainFlip, composeFlipCapabilities, computeTemplateDigest, deriveRetainFlipTemplate, findMarkedResourcesByOpId, proveFlipMetadataOnly, readRetainFlipState, verifyRetainFlipDiff, FORGET_MARKER_KEY, FORGET_FLIP_SPEC, RECREATE_MARKER_KEY, assessForgetResumability, completeForgetAfterConverge, completeForgetAfterDeploy, formatRecreateInFlightCures, partitionPreFlightByRemediation, runForgetSurgery, synthTemplateDeclaresResource, runRecreateSurgery, snapshotPolicyForType, SNAPSHOT_CAPABLE_RESOURCE_TYPES, runRecreatePreFlight, deriveRemovalTemplate, findRemovalDeletionFailures, proveRemovalTargetsOnly, advertisableDriftVerbs, buildDriftRepairTicket, runDriftRepairGate, formatPinOutcomeDetail, pinProbeCoverage, renderPinReportLines, runPinRemediation, composePostFailureRepairOffer, formatDriftRepairOffer, DriftRepairAvailableError, checkDeployPathStackAvailability, isDeployPathBlockingStatus, StackUnavailableError, assertLeaseBeforeStack, LeaseDeniedError } from "./orchestration/index.js";
+export type { RemediationJournalContext, RemediationJournalOptions, CaptureRemediationForensicsParams, ForensicsCaptureOptions, RemediationForensicsBundle, ApplyRetainFlipOutcome, ApplyRetainFlipParams, DeriveRetainFlipParams, FlipDeletionPolicy, FlipProofResult, FlipSpec, RetainFlipDerivation, RetainFlipState, RecreateOrchestrationOptions, RecreateSurgeryParams, RecreateSurgeryReport, RecreatePreFlightStack, RunRecreatePreFlightParams, ProveRemovalTargetsOnlyParams, RemovalDeletionFailure, RemovalDerivation, RemovalProofResult, StrippedExport, CompleteForgetAfterDeployParams, CompleteForgetOutcome, CompleteForgetParams, ForeignMarkerOperation, ForgetOrchestrationOptions, ForgetResumeAssessment, ForgetResumeSource, ForgetSurgeryParams, ForgetSurgeryReport, PreFlightRemediationDeps, PreFlightRemediationPartition, DriftRepairGateOutcome, RunDriftRepairGateParams, ComposePostFailureRepairOfferParams, PinnedProperty, PinProbeCoverage, PinRemediationReport, PinReportOnlyReason, PinResourceOutcome, PinTarget, RunPinRemediationParams } from "./orchestration/index.js";
 export { unlockBucket, unlockQueue } from "./orchestration/index.js";
 export type { UnlockBucketInput, UnlockBucketReport, UnlockQueueInput, UnlockQueueReport } from "./orchestration/index.js";
 export { triageBucketPolicy, isEnforceSslStatement, toResourcePolicyStatements, restoreBucketPolicy, synthesiseEnforceSslDocument, ensureEnforceSsl, restoreAndReconcileQuarantinedBucket } from "./orchestration/index.js";
@@ -76,3 +85,5 @@ export { openNextBuilder, dockerBuilder } from "./orchestration/index.js";
 export { StepRegistry, getDestroyStepId } from "./steps/index.js";
 export { buildDeployPlan, computeDeployPlan, computeAssemblyDigest, digestHead, classifyImpact, derivePropertyChanges, isDataLoss, isStatefulResourceType, renderPlanSummary, renderPlanLines, toWirePlanChanges, signApprovalToken, verifyApprovalToken, DEFAULT_APPROVAL_TTL_MS, APPROVAL_TOKEN_PATTERN, runApprovalGate } from "./orchestration/index.js";
 export type { DeployPlan, DeployPlanResourceChange, StackTemplatePair, CfnTemplateReader, ComputeDeployPlanParams, ComputeDeployPlanStack, ImpactClassification, SignApprovalTokenOptions, SignedApprovalToken, VerifyApprovalTokenOptions, VerifyApprovalTokenResult, RunApprovalGateParams, ApprovalGateOutcome } from "./orchestration/index.js";
+export { runDestructionGate, buildDestructionTicket, evaluateDestructionConsents, computeTicketDigest, legalRemediationVerbs, executableRemediationVerbs, advertisableRemediationVerbs, renderDestructionTicketLines, renderConsentVerdictLines, loadDeployPlan, createMemoisedPlanLoader } from "./orchestration/index.js";
+export type { RunDestructionGateParams, DestructionGateOutcome, EvaluateDestructionConsentsParams, LoadDeployPlanParams, DeployPlanLoader } from "./orchestration/index.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{DeploymentEventSchema as t,DEPLOYMENT_EVENT_TYPES as o,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as a,DEPLOYMENT_EVENT_STATUS_REASON_MAX as E,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as i,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as s,CASCADE_PHASES as S,CASCADE_ACCOUNT_STATUSES as n}from"./types/index.js";import{DeployEventSchema as A,StepProgressSchema as l,DeployResourceSchema as T,PlanChangeSchema as _,PlanPropertyChangeSchema as p,ChangeCountsSchema as O,DEPLOY_EVENT_CONTRACT as P,DEPLOY_EVENT_CONTRACT_MAJOR as u,DEPLOY_EVENT_CONTRACT_MINOR as R,SUPPORTED_CONTRACT_MARKERS as m,DEPLOY_EVENT_ID_MAX as d,DEPLOY_EVENT_NAME_MAX as C,DEPLOY_EVENT_MESSAGE_MAX as N,DEPLOY_EVENT_STATUS_REASON_MAX as D,DEPLOY_EVENT_ERROR_MESSAGE_MAX as L,DEPLOY_EVENT_TRAIL_DETAIL_MAX as f,DEPLOY_EVENT_OUTPUT_MAX as g,DEPLOY_EVENT_ARN_MAX as I,DEPLOY_EVENT_URL_MAX as x,STEP_COMPLETE_STATUSES as y,LOG_LEVELS as U,STACK_CLEANUP_PHASES as M,CASCADE_ACCOUNT_PHASES as v,DEPLOY_RESULTS as k,DETECTION_PHASES as Y,PHASE_STATUSES as h,BUILDERS as b,CASCADE_OUTCOME_RESULTS as V,PLAN_ACTIONS as F,REPLACEMENT_MODES as B,APPROVAL_KINDS as G,APPROVAL_DECISIONS as K,ALL_PROGRESS_KINDS as X,createDeployEmitter as H,parseDeployEvent as w,parseDeployContractVersion as j}from"./types/index.js";import{SimpleAwsProvider as q}from"./aws/index.js";import{checkTargetReadiness as W,describeTargetReadinessReason as Z,buildTargetUnreadyAdvisory as z,buildTargetSetUnreadyAdvisory as $,probeAccountStackExists as ee}from"./aws/index.js";import{checkRegionEnabled as te,regionDisabledMessage as oe}from"./aws/index.js";import{ensureOrganisationExists as Ee,describeOrganisation as ie,enablePolicyTypes as se,enableServiceAccess as Se,SERVICE_PRINCIPALS as ne,enableRamSharing as ce,activateTrustedAccess as Ae,enableIpamDelegatedAdmin as le,updateBackupGlobalSettings as Te,listAccounts as _e,findAccount as pe,createAccount as Oe,ensureOrganisationalUnitsExist as Pe,placeAccountsInOUs as ue,buildAccountToOUMap as Re,findDevelopmentOuId as me,activateCostAllocationTags as de,checkIdentityCentreStatus as Ce,snapshotIdentityCentre as Ne,composeSdkAbortSignal as De,extractErrorName as Le,isAborted as fe,DEFAULT_MAX_PAGES as ge,IDENTITY_STORE_PAGE_SIZE as Ie,drainPages as xe,isOULeaf as ye,registerSecurityDelegates as Ue,SECURITY_SERVICE_PRINCIPALS as Me,enableCentralisedRootAccess as ve,ROOT_ACCESS_FEATURES as ke,RootAccessEnablementError as Ye}from"./aws/index.js";import{STEP_IDS as be,STEP_NAMES as Ve,INFRASTRUCTURE_STEP_NAMES as Fe,INFRA_STEP_NAME as Be}from"./types/index.js";import{ProgressReporter as Ke,APPLICATION_STACKS as Xe,ORGANISATION_TYPES as He,APPLICATION_DEPLOY_ORDER as we,APPLICATION_DESTROY_ORDER as je,OPENNEXT_DEPLOY_ORDER as Qe,OPENNEXT_DESTROY_ORDER as qe,PARALLEL_DEPLOY_GROUPS as Je,PARALLEL_DESTROY_GROUPS as We,OPENNEXT_PARALLEL_GROUPS as Ze,PARALLEL_OPERATION_TYPES as ze,isApplicationOperation as $e,isOrganisationOperation as er,getParallelDeployGroups as rr,getParallelDestroyGroups as tr,getApplicationDeployOrder as or,getApplicationDestroyOrder as ar,getApplicationStackName as Er,getOrganisationStackName as ir,isApplicationStack as sr,isQuarantineDetail as Sr,isRetainedBucketsDetail as nr,getApplicationStepName as cr,getApplicationStepId as Ar,toPascalCase as lr,isOpenNextPattern as Tr,OPENNEXT_PATTERNS as _r,deriveResourcesFromManifestStacks as pr,STACK_NOT_FOUND_PATTERN as Or,STACK_FAILED_STATE_PATTERN as Pr,CDK_NO_STACKS_MATCH as ur,INFRASTRUCTURE_FILENAME as Rr,ApplicationError as mr,wrapApplicationError as dr,FjallStateFileSchema as Cr,readStateFile as Nr,writeStateFile as Dr,createEmptyState as Lr,deleteStateFile as fr,updateTemplateHash as gr,getStateFilePath as Ir,stubCallerIdentity as xr}from"./types/index.js";import{CloudFormationEventMonitor as Ur}from"./aws/index.js";import{CdkService as vr,CdkArgumentBuilder as kr,CdkProcessManager as Yr,CdkEventMonitor as hr,startStackMonitoring as br,DEFAULT_DEPLOY_TIMEOUT_MS as Vr,isCdkError as Fr,formatInfrastructureError as Br,getStructuralHint as Gr,getSourceContext as Kr,hasCdkDifferences as Xr,parseDiffOutput as Hr,CloudFormationService as wr,CloudFormationError as jr,EcsService as Qr,EcsError as qr,EcsServiceResolver as Jr,TemplateHashService as Wr,TemplateHashError as Zr,CdkContextBuilder as zr,emitProgress as $r,PROGRESS_MESSAGES as et,parseBuildPhase as rt,buildStepContextBuildConfig as tt,convertCloudFormationOutputsToRecord as ot,ApplicationStackService as at}from"./services/index.js";import{CdkError as it}from"./types/errors/index.js";import{BaseServiceError as St,ValidationError as nt,AuthError as ct,AwsError as At,DeploymentError as lt,NetworkError as Tt,FileSystemError as _t,ConfigError as pt,toServiceError as Ot}from"./types/errors/index.js";import{filterDangerousEnvVars as ut,maskSensitiveOutput as Rt,parseShellArgs as mt,sleep as dt}from"@fjall/util";import{artefactOutputKey as Nt,DeployModeSchema as Dt,ServiceArtefactSchema as Lt,ServiceArtefactsSchema as ft}from"@fjall/util";import{hasDockerfile as It}from"./util/dockerfileDetection.js";import{sleepAbortable as yt}from"./util/sleepAbortable.js";import{createSequencedCallbacks as Mt}from"./util/sequencedCallbacks.js";import{fileExists as kt}from"@fjall/util/fsHelpers";import{success as ht,failure as bt,isSuccess as Vt,isFailure as Ft}from"@fjall/generator";import{deploy as Gt}from"./orchestration/index.js";import{destroy as Xt}from"./orchestration/index.js";import{restart as wt,probeSecretsDrift as jt,computeSecretsDrift as Qt,deriveStaleParameters as qt,extractConsumedSsmParameters as Jt}from"./orchestration/index.js";import{partitionAccounts as Zt}from"./orchestration/index.js";import{buildRegionList as $t,buildAccountRegionPairs as eo,cascadeHomeRegion as ro,cascadeOperationKey as to}from"./orchestration/index.js";import{projectScalarSummary as ao,projectAccountRows as Eo}from"./orchestration/index.js";import{reconcileProviderAccounts as so,mergeReconciledProviderAccounts as So}from"./orchestration/index.js";import{decideNextTransition as co,reconcileTrailMigration as Ao,decommissionMemberTrailStorage as lo,ORG_TRAIL_BUCKET_OUTPUT_KEY as To,TRAIL_BUCKET_OUTPUT_KEY as _o,TRAIL_KEY_ARN_OUTPUT_KEY as po}from"./orchestration/index.js";import{unlockBucket as Po,unlockQueue as uo}from"./orchestration/index.js";import{triageBucketPolicy as mo,isEnforceSslStatement as Co,toResourcePolicyStatements as No,restoreBucketPolicy as Do,synthesiseEnforceSslDocument as Lo,ensureEnforceSsl as fo,restoreAndReconcileQuarantinedBucket as go}from"./orchestration/index.js";import{verifyOrgTrailDelivery as xo}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as Uo,isRootTaskPolicyArn as Mo,ROOT_TASK_POLICY_ARNS as vo,MAX_ROOT_SESSION_SECONDS as ko}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as ho,flattenAccountsToEnvironments as bo,extractAllAccountNames as Vo,accountsConfigToOUTree as Fo,isStringArray as Bo,isAccountsConfig as Go,isOuOnlyAccountBucket as Ko,OU_ONLY_ACCOUNT_BUCKETS as Xo}from"./orchestration/index.js";import{runOpenNextBuild as wo}from"./orchestration/index.js";import{runOrganisationSetup as Qo,ORG_SETUP_PHASES as qo}from"./orchestration/index.js";import{resolveBuildSecrets as Wo,resolveSecretRefValue as Zo,resolveBuildSecretSessionProvider as zo,sourcedRefsFromBuildArgs as $o,resolveBuildArgs as ea,buildBuildSecretSessionPolicy as ra,buildDeploySessionPolicy as ta,partitionForRegion as oa,validateBuildGroup as aa}from"./orchestration/index.js";import{FrameworkRegistry as ia}from"./orchestration/index.js";import{openNextBuilder as Sa,dockerBuilder as na}from"./orchestration/index.js";import{StepRegistry as Aa,getDestroyStepId as la}from"./steps/index.js";import{buildDeployPlan as _a,computeDeployPlan as pa,computeAssemblyDigest as Oa,digestHead as Pa,classifyImpact as ua,derivePropertyChanges as Ra,isDataLoss as ma,isStatefulResourceType as da,renderPlanSummary as Ca,renderPlanLines as Na,toWirePlanChanges as Da,signApprovalToken as La,verifyApprovalToken as fa,DEFAULT_APPROVAL_TTL_MS as ga,APPROVAL_TOKEN_PATTERN as Ia,runApprovalGate as xa}from"./orchestration/index.js";export{X as ALL_PROGRESS_KINDS,we as APPLICATION_DEPLOY_ORDER,je as APPLICATION_DESTROY_ORDER,Xe as APPLICATION_STACKS,K as APPROVAL_DECISIONS,G as APPROVAL_KINDS,Ia as APPROVAL_TOKEN_PATTERN,mr as ApplicationError,at as ApplicationStackService,ct as AuthError,At as AwsError,b as BUILDERS,St as BaseServiceError,v as CASCADE_ACCOUNT_PHASES,n as CASCADE_ACCOUNT_STATUSES,V as CASCADE_OUTCOME_RESULTS,S as CASCADE_PHASES,ur as CDK_NO_STACKS_MATCH,kr as CdkArgumentBuilder,zr as CdkContextBuilder,it as CdkError,hr as CdkEventMonitor,Yr as CdkProcessManager,vr as CdkService,O as ChangeCountsSchema,jr as CloudFormationError,Ur as CloudFormationEventMonitor,wr as CloudFormationService,pt as ConfigError,ga as DEFAULT_APPROVAL_TTL_MS,Vr as DEFAULT_DEPLOY_TIMEOUT_MS,ge as DEFAULT_MAX_PAGES,i as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,a as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,E as DEPLOYMENT_EVENT_STATUS_REASON_MAX,s as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,o as DEPLOYMENT_EVENT_TYPES,I as DEPLOY_EVENT_ARN_MAX,P as DEPLOY_EVENT_CONTRACT,u as DEPLOY_EVENT_CONTRACT_MAJOR,R as DEPLOY_EVENT_CONTRACT_MINOR,L as DEPLOY_EVENT_ERROR_MESSAGE_MAX,d as DEPLOY_EVENT_ID_MAX,N as DEPLOY_EVENT_MESSAGE_MAX,C as DEPLOY_EVENT_NAME_MAX,g as DEPLOY_EVENT_OUTPUT_MAX,D as DEPLOY_EVENT_STATUS_REASON_MAX,f as DEPLOY_EVENT_TRAIL_DETAIL_MAX,x as DEPLOY_EVENT_URL_MAX,k as DEPLOY_RESULTS,Y as DETECTION_PHASES,A as DeployEventSchema,Dt as DeployModeSchema,T as DeployResourceSchema,lt as DeploymentError,t as DeploymentEventSchema,qr as EcsError,Qr as EcsService,Jr as EcsServiceResolver,_t as FileSystemError,Cr as FjallStateFileSchema,ia as FrameworkRegistry,Ie as IDENTITY_STORE_PAGE_SIZE,Rr as INFRASTRUCTURE_FILENAME,Fe as INFRASTRUCTURE_STEP_NAMES,Be as INFRA_STEP_NAME,U as LOG_LEVELS,ko as MAX_ROOT_SESSION_SECONDS,Tt as NetworkError,Qe as OPENNEXT_DEPLOY_ORDER,qe as OPENNEXT_DESTROY_ORDER,Ze as OPENNEXT_PARALLEL_GROUPS,_r as OPENNEXT_PATTERNS,He as ORGANISATION_TYPES,qo as ORG_SETUP_PHASES,To as ORG_TRAIL_BUCKET_OUTPUT_KEY,Xo as OU_ONLY_ACCOUNT_BUCKETS,Je as PARALLEL_DEPLOY_GROUPS,We as PARALLEL_DESTROY_GROUPS,ze as PARALLEL_OPERATION_TYPES,h as PHASE_STATUSES,F as PLAN_ACTIONS,et as PROGRESS_MESSAGES,_ as PlanChangeSchema,p as PlanPropertyChangeSchema,Ke as ProgressReporter,B as REPLACEMENT_MODES,ke as ROOT_ACCESS_FEATURES,vo as ROOT_TASK_POLICY_ARNS,Ye as RootAccessEnablementError,Me as SECURITY_SERVICE_PRINCIPALS,ne as SERVICE_PRINCIPALS,M as STACK_CLEANUP_PHASES,Pr as STACK_FAILED_STATE_PATTERN,Or as STACK_NOT_FOUND_PATTERN,y as STEP_COMPLETE_STATUSES,be as STEP_IDS,Ve as STEP_NAMES,m as SUPPORTED_CONTRACT_MARKERS,Lt as ServiceArtefactSchema,ft as ServiceArtefactsSchema,q as SimpleAwsProvider,l as StepProgressSchema,Aa as StepRegistry,_o as TRAIL_BUCKET_OUTPUT_KEY,po as TRAIL_KEY_ARN_OUTPUT_KEY,Zr as TemplateHashError,Wr as TemplateHashService,nt as ValidationError,Fo as accountsConfigToOUTree,de as activateCostAllocationTags,Ae as activateTrustedAccess,Nt as artefactOutputKey,Uo as assumeRootForTask,eo as buildAccountRegionPairs,Re as buildAccountToOUMap,ra as buildBuildSecretSessionPolicy,_a as buildDeployPlan,ta as buildDeploySessionPolicy,$t as buildRegionList,tt as buildStepContextBuildConfig,$ as buildTargetSetUnreadyAdvisory,z as buildTargetUnreadyAdvisory,ro as cascadeHomeRegion,to as cascadeOperationKey,Ce as checkIdentityCentreStatus,te as checkRegionEnabled,W as checkTargetReadiness,ua as classifyImpact,De as composeSdkAbortSignal,Oa as computeAssemblyDigest,pa as computeDeployPlan,Qt as computeSecretsDrift,ot as convertCloudFormationOutputsToRecord,Oe as createAccount,H as createDeployEmitter,Lr as createEmptyState,Mt as createSequencedCallbacks,co as decideNextTransition,lo as decommissionMemberTrailStorage,fr as deleteStateFile,Gt as deploy,Ra as derivePropertyChanges,pr as deriveResourcesFromManifestStacks,qt as deriveStaleParameters,ie as describeOrganisation,Z as describeTargetReadinessReason,Xt as destroy,Pa as digestHead,na as dockerBuilder,xe as drainPages,$r as emitProgress,ve as enableCentralisedRootAccess,le as enableIpamDelegatedAdmin,se as enablePolicyTypes,ce as enableRamSharing,Se as enableServiceAccess,fo as ensureEnforceSsl,Ee as ensureOrganisationExists,Pe as ensureOrganisationalUnitsExist,Vo as extractAllAccountNames,Jt as extractConsumedSsmParameters,Le as extractErrorName,bt as failure,kt as fileExists,ut as filterDangerousEnvVars,pe as findAccount,me as findDevelopmentOuId,bo as flattenAccountsToEnvironments,Br as formatInfrastructureError,or as getApplicationDeployOrder,ar as getApplicationDestroyOrder,Er as getApplicationStackName,Ar as getApplicationStepId,cr as getApplicationStepName,la as getDestroyStepId,ir as getOrganisationStackName,rr as getParallelDeployGroups,tr as getParallelDestroyGroups,Kr as getSourceContext,Ir as getStateFilePath,Gr as getStructuralHint,Xr as hasCdkDifferences,It as hasDockerfile,fe as isAborted,Go as isAccountsConfig,$e as isApplicationOperation,sr as isApplicationStack,Fr as isCdkError,ma as isDataLoss,Co as isEnforceSslStatement,Ft as isFailure,ye as isOULeaf,Tr as isOpenNextPattern,er as isOrganisationOperation,Ko as isOuOnlyAccountBucket,Sr as isQuarantineDetail,nr as isRetainedBucketsDetail,Mo as isRootTaskPolicyArn,da as isStatefulResourceType,Bo as isStringArray,Vt as isSuccess,_e as listAccounts,Rt as maskSensitiveOutput,So as mergeReconciledProviderAccounts,Sa as openNextBuilder,ho as parseAccountsConfiguration,rt as parseBuildPhase,j as parseDeployContractVersion,w as parseDeployEvent,Hr as parseDiffOutput,mt as parseShellArgs,Zt as partitionAccounts,oa as partitionForRegion,ue as placeAccountsInOUs,ee as probeAccountStackExists,jt as probeSecretsDrift,Eo as projectAccountRows,ao as projectScalarSummary,Nr as readStateFile,so as reconcileProviderAccounts,Ao as reconcileTrailMigration,oe as regionDisabledMessage,Ue as registerSecurityDelegates,Na as renderPlanLines,Ca as renderPlanSummary,ea as resolveBuildArgs,zo as resolveBuildSecretSessionProvider,Wo as resolveBuildSecrets,Zo as resolveSecretRefValue,wt as restart,go as restoreAndReconcileQuarantinedBucket,Do as restoreBucketPolicy,xa as runApprovalGate,wo as runOpenNextBuild,Qo as runOrganisationSetup,La as signApprovalToken,dt as sleep,yt as sleepAbortable,Ne as snapshotIdentityCentre,$o as sourcedRefsFromBuildArgs,br as startStackMonitoring,xr as stubCallerIdentity,ht as success,Lo as synthesiseEnforceSslDocument,lr as toPascalCase,No as toResourcePolicyStatements,Ot as toServiceError,Da as toWirePlanChanges,mo as triageBucketPolicy,Po as unlockBucket,uo as unlockQueue,Te as updateBackupGlobalSettings,gr as updateTemplateHash,aa as validateBuildGroup,fa as verifyApprovalToken,xo as verifyOrgTrailDelivery,dr as wrapApplicationError,Dr as writeStateFile};
+import{DeploymentEventSchema as t,DEPLOYMENT_EVENT_TYPES as o,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as i,DEPLOYMENT_EVENT_STATUS_REASON_MAX as a,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as s,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as n,CASCADE_PHASES as c,CASCADE_ACCOUNT_STATUSES as E}from"./types/index.js";import{DeployEventSchema as l,StepProgressSchema as T,DeployResourceSchema as p,PlanChangeSchema as A,PlanPropertyChangeSchema as R,ChangeCountsSchema as _,DEPLOY_EVENT_CONTRACT as m,DEPLOY_EVENT_CONTRACT_MAJOR as u,DEPLOY_EVENT_CONTRACT_MINOR as d,SUPPORTED_CONTRACT_MARKERS as P,DEPLOY_EVENT_ID_MAX as O,DEPLOY_EVENT_NAME_MAX as D,DEPLOY_EVENT_MESSAGE_MAX as f,DEPLOY_EVENT_STATUS_REASON_MAX as C,DEPLOY_EVENT_ERROR_MESSAGE_MAX as N,DEPLOY_EVENT_TRAIL_DETAIL_MAX as g,DEPLOY_EVENT_OUTPUT_MAX as L,DEPLOY_EVENT_ARN_MAX as I,DEPLOY_EVENT_URL_MAX as y,STEP_COMPLETE_STATUSES as h,LOG_LEVELS as v,STACK_CLEANUP_PHASES as x,CASCADE_ACCOUNT_PHASES as F,DEPLOY_RESULTS as M,DETECTION_PHASES as U,PHASE_STATUSES as k,BUILDERS as b,CASCADE_OUTCOME_RESULTS as V,PLAN_ACTIONS as Y,REPLACEMENT_MODES as B,APPROVAL_KINDS as G,APPROVAL_DECISIONS as K,ALL_PROGRESS_KINDS as X,createDeployEmitter as H,parseDeployEvent as J,parseDeployContractVersion as w}from"./types/index.js";import{SimpleAwsProvider as Q}from"./aws/index.js";import{checkTargetReadiness as q,describeTargetReadinessReason as Z,buildTargetUnreadyAdvisory as z,buildTargetSetUnreadyAdvisory as $,probeAccountStackExists as ee}from"./aws/index.js";import{checkRegionEnabled as te,regionDisabledMessage as oe}from"./aws/index.js";import{ensureOrganisationExists as ae,describeOrganisation as se,enablePolicyTypes as ne,enableServiceAccess as ce,SERVICE_PRINCIPALS as Ee,enableRamSharing as Se,activateTrustedAccess as le,enableIpamDelegatedAdmin as Te,updateBackupGlobalSettings as pe,listAccounts as Ae,findAccount as Re,createAccount as _e,ensureOrganisationalUnitsExist as me,placeAccountsInOUs as ue,buildAccountToOUMap as de,findDevelopmentOuId as Pe,activateCostAllocationTags as Oe,checkIdentityCentreStatus as De,snapshotIdentityCentre as fe,composeSdkAbortSignal as Ce,extractErrorName as Ne,isAborted as ge,DEFAULT_MAX_PAGES as Le,IDENTITY_STORE_PAGE_SIZE as Ie,drainPages as ye,isOULeaf as he,registerSecurityDelegates as ve,SECURITY_SERVICE_PRINCIPALS as xe,enableCentralisedRootAccess as Fe,ROOT_ACCESS_FEATURES as Me,RootAccessEnablementError as Ue}from"./aws/index.js";import{STEP_IDS as be,STEP_NAMES as Ve,INFRASTRUCTURE_STEP_NAMES as Ye,INFRA_STEP_NAME as Be}from"./types/index.js";import{RemediationVerbSchema as Ke,REMEDIATION_VERB_GLOSS as Xe,DestructionFindingSchema as He,DestructionTicketResourceSchema as Je,DestructionTicketSchema as we,DestructionConsentSchema as je,DestructionOutcomeSchema as Qe,DESTRUCTION_FINDINGS as We,CONSENT_VERDICTS as qe,TICKET_VERDICT_SOURCES as Ze,TicketVerdictSourceSchema as ze}from"./types/index.js";import{DRIFT_VERDICTS as er,DriftVerdictSchema as rr,DriftSuspectSchema as tr,DriftFindingSchema as or,DriftJournalRecordSchema as ir,verbsForDriftVerdict as ar}from"./types/index.js";import{REMEDIATION_PHASES as nr,RemediationPhaseSchema as cr,RemediationTargetSchema as Er,RemediationFlipProofSchema as Sr,RemediationJournalRecordSchema as lr,RemediationVerbWithSurgerySchema as Tr,remediationPhaseRank as pr,remediationPlaceholderPhysicalId as Ar,isRemediationPlaceholderPhysicalId as Rr}from"./types/index.js";import{ProgressReporter as mr,APPLICATION_STACKS as ur,ORGANISATION_TYPES as dr,APPLICATION_DEPLOY_ORDER as Pr,APPLICATION_DESTROY_ORDER as Or,OPENNEXT_DEPLOY_ORDER as Dr,OPENNEXT_DESTROY_ORDER as fr,PARALLEL_DEPLOY_GROUPS as Cr,PARALLEL_DESTROY_GROUPS as Nr,OPENNEXT_PARALLEL_GROUPS as gr,PARALLEL_OPERATION_TYPES as Lr,isApplicationOperation as Ir,isOrganisationOperation as yr,getParallelDeployGroups as hr,getParallelDestroyGroups as vr,getApplicationDeployOrder as xr,getApplicationDestroyOrder as Fr,getApplicationStackName as Mr,getOrganisationStackName as Ur,isApplicationStack as kr,isQuarantineDetail as br,isRetainedBucketsDetail as Vr,getApplicationStepName as Yr,getApplicationStepId as Br,toPascalCase as Gr,isOpenNextPattern as Kr,OPENNEXT_PATTERNS as Xr,deriveResourcesFromManifestStacks as Hr,STACK_NOT_FOUND_PATTERN as Jr,STACK_FAILED_STATE_PATTERN as wr,CDK_NO_STACKS_MATCH as jr,INFRASTRUCTURE_FILENAME as Qr,ApplicationError as Wr,wrapApplicationError as qr,FjallStateFileSchema as Zr,readStateFile as zr,writeStateFile as $r,createEmptyState as et,deleteStateFile as rt,updateTemplateHash as tt,getStateFilePath as ot,stubCallerIdentity as it}from"./types/index.js";import{CloudFormationEventMonitor as st}from"./aws/index.js";import{CdkService as ct,CdkArgumentBuilder as Et,CdkProcessManager as St,CdkEventMonitor as lt,startStackMonitoring as Tt,DEFAULT_DEPLOY_TIMEOUT_MS as pt,isCdkError as At,formatInfrastructureError as Rt,getStructuralHint as _t,getSourceContext as mt,hasCdkDifferences as ut,parseDiffOutput as dt,CloudFormationService as Pt,CloudFormationError as Ot,EcsService as Dt,EcsError as ft,EcsServiceResolver as Ct,TemplateHashService as Nt,TemplateHashError as gt,CdkContextBuilder as Lt,emitProgress as It,PROGRESS_MESSAGES as yt,parseBuildPhase as ht,buildStepContextBuildConfig as vt,convertCloudFormationOutputsToRecord as xt,ApplicationStackService as Ft}from"./services/index.js";import{CdkError as Ut}from"./types/errors/index.js";import{BaseServiceError as bt,ValidationError as Vt,AuthError as Yt,AwsError as Bt,DeploymentError as Gt,NetworkError as Kt,FileSystemError as Xt,ConfigError as Ht,toServiceError as Jt}from"./types/errors/index.js";import{filterDangerousEnvVars as jt,maskSensitiveOutput as Qt,parseShellArgs as Wt,sleep as qt}from"@fjall/util";import{artefactOutputKey as zt,DeployModeSchema as $t,ServiceArtefactSchema as eo,ServiceArtefactsSchema as ro}from"@fjall/util";import{hasDockerfile as oo}from"./util/dockerfileDetection.js";import{sleepAbortable as ao}from"./util/sleepAbortable.js";import{createSequencedCallbacks as no}from"./util/sequencedCallbacks.js";import{fileExists as Eo}from"@fjall/util/fsHelpers";import{success as lo,failure as To,isSuccess as po,isFailure as Ao}from"@fjall/generator";import{deploy as _o}from"./orchestration/index.js";import{destroy as uo}from"./orchestration/index.js";import{restart as Oo,probeSecretsDrift as Do,computeSecretsDrift as fo,deriveStaleParameters as Co,extractConsumedSsmParameters as No}from"./orchestration/index.js";import{partitionAccounts as Lo}from"./orchestration/index.js";import{buildRegionList as yo,buildAccountRegionPairs as ho,cascadeHomeRegion as vo,cascadeOperationKey as xo}from"./orchestration/index.js";import{projectScalarSummary as Mo,projectAccountRows as Uo}from"./orchestration/index.js";import{reconcileProviderAccounts as bo,mergeReconciledProviderAccounts as Vo}from"./orchestration/index.js";import{decideNextTransition as Bo,reconcileTrailMigration as Go,decommissionMemberTrailStorage as Ko,ORG_TRAIL_BUCKET_OUTPUT_KEY as Xo,TRAIL_BUCKET_OUTPUT_KEY as Ho,TRAIL_KEY_ARN_OUTPUT_KEY as Jo}from"./orchestration/index.js";import{classifyDriftFailure as jo,fetchLastOperationEvents as Qo,DriftProbe as Wo,clearDriftSuspects as qo,defaultDriftJournalDir as Zo,readDriftSuspects as zo,recordDriftSuspects as $o,detectStackDrift as ei,runDriftPreFlight as ri,formatDriftPreFlightBlock as ti,DRIFT_PREFLIGHT_TRIGGER_STATUSES as oi,DRIFT_PREFLIGHT_BUDGET_MS as ii}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as si,computeRemediationOpId as ni,defaultRemediationJournalDir as ci,findRemediationJournalByOpId as Ei,listActiveRemediationOps as Si,listActiveRemediationOpsForContext as li,readRemediationJournal as Ti,sweepExpiredRemediationJournals as pi,writeRemediationJournal as Ai,REMEDIATION_JOURNAL_RETENTION_DAYS as Ri,captureRemediationForensics as _i,defaultRemediationForensicsDir as mi,applyRetainFlip as ui,composeFlipCapabilities as di,computeTemplateDigest as Pi,deriveRetainFlipTemplate as Oi,findMarkedResourcesByOpId as Di,proveFlipMetadataOnly as fi,readRetainFlipState as Ci,verifyRetainFlipDiff as Ni,FORGET_MARKER_KEY as gi,FORGET_FLIP_SPEC as Li,RECREATE_MARKER_KEY as Ii,assessForgetResumability as yi,completeForgetAfterConverge as hi,completeForgetAfterDeploy as vi,formatRecreateInFlightCures as xi,partitionPreFlightByRemediation as Fi,runForgetSurgery as Mi,synthTemplateDeclaresResource as Ui,runRecreateSurgery as ki,snapshotPolicyForType as bi,SNAPSHOT_CAPABLE_RESOURCE_TYPES as Vi,runRecreatePreFlight as Yi,deriveRemovalTemplate as Bi,findRemovalDeletionFailures as Gi,proveRemovalTargetsOnly as Ki,advertisableDriftVerbs as Xi,buildDriftRepairTicket as Hi,runDriftRepairGate as Ji,formatPinOutcomeDetail as wi,pinProbeCoverage as ji,renderPinReportLines as Qi,runPinRemediation as Wi,composePostFailureRepairOffer as qi,formatDriftRepairOffer as Zi,DriftRepairAvailableError as zi,checkDeployPathStackAvailability as $i,isDeployPathBlockingStatus as ea,StackUnavailableError as ra,assertLeaseBeforeStack as ta,LeaseDeniedError as oa}from"./orchestration/index.js";import{unlockBucket as aa,unlockQueue as sa}from"./orchestration/index.js";import{triageBucketPolicy as ca,isEnforceSslStatement as Ea,toResourcePolicyStatements as Sa,restoreBucketPolicy as la,synthesiseEnforceSslDocument as Ta,ensureEnforceSsl as pa,restoreAndReconcileQuarantinedBucket as Aa}from"./orchestration/index.js";import{verifyOrgTrailDelivery as _a}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as ua,isRootTaskPolicyArn as da,ROOT_TASK_POLICY_ARNS as Pa,MAX_ROOT_SESSION_SECONDS as Oa}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as fa,flattenAccountsToEnvironments as Ca,extractAllAccountNames as Na,accountsConfigToOUTree as ga,isStringArray as La,isAccountsConfig as Ia,isOuOnlyAccountBucket as ya,OU_ONLY_ACCOUNT_BUCKETS as ha}from"./orchestration/index.js";import{runOpenNextBuild as xa}from"./orchestration/index.js";import{runOrganisationSetup as Ma,ORG_SETUP_PHASES as Ua}from"./orchestration/index.js";import{resolveBuildSecrets as ba,resolveSecretRefValue as Va,resolveBuildSecretSessionProvider as Ya,sourcedRefsFromBuildArgs as Ba,resolveBuildArgs as Ga,buildBuildSecretSessionPolicy as Ka,buildDeploySessionPolicy as Xa,partitionForRegion as Ha,validateBuildGroup as Ja}from"./orchestration/index.js";import{FrameworkRegistry as ja}from"./orchestration/index.js";import{openNextBuilder as Wa,dockerBuilder as qa}from"./orchestration/index.js";import{StepRegistry as za,getDestroyStepId as $a}from"./steps/index.js";import{buildDeployPlan as rs,computeDeployPlan as ts,computeAssemblyDigest as os,digestHead as is,classifyImpact as as,derivePropertyChanges as ss,isDataLoss as ns,isStatefulResourceType as cs,renderPlanSummary as Es,renderPlanLines as Ss,toWirePlanChanges as ls,signApprovalToken as Ts,verifyApprovalToken as ps,DEFAULT_APPROVAL_TTL_MS as As,APPROVAL_TOKEN_PATTERN as Rs,runApprovalGate as _s}from"./orchestration/index.js";import{runDestructionGate as us,buildDestructionTicket as ds,evaluateDestructionConsents as Ps,computeTicketDigest as Os,legalRemediationVerbs as Ds,executableRemediationVerbs as fs,advertisableRemediationVerbs as Cs,renderDestructionTicketLines as Ns,renderConsentVerdictLines as gs,loadDeployPlan as Ls,createMemoisedPlanLoader as Is}from"./orchestration/index.js";export{X as ALL_PROGRESS_KINDS,Pr as APPLICATION_DEPLOY_ORDER,Or as APPLICATION_DESTROY_ORDER,ur as APPLICATION_STACKS,K as APPROVAL_DECISIONS,G as APPROVAL_KINDS,Rs as APPROVAL_TOKEN_PATTERN,Wr as ApplicationError,Ft as ApplicationStackService,Yt as AuthError,Bt as AwsError,b as BUILDERS,bt as BaseServiceError,F as CASCADE_ACCOUNT_PHASES,E as CASCADE_ACCOUNT_STATUSES,V as CASCADE_OUTCOME_RESULTS,c as CASCADE_PHASES,jr as CDK_NO_STACKS_MATCH,qe as CONSENT_VERDICTS,Et as CdkArgumentBuilder,Lt as CdkContextBuilder,Ut as CdkError,lt as CdkEventMonitor,St as CdkProcessManager,ct as CdkService,_ as ChangeCountsSchema,Ot as CloudFormationError,st as CloudFormationEventMonitor,Pt as CloudFormationService,Ht as ConfigError,As as DEFAULT_APPROVAL_TTL_MS,pt as DEFAULT_DEPLOY_TIMEOUT_MS,Le as DEFAULT_MAX_PAGES,s as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,i as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,a as DEPLOYMENT_EVENT_STATUS_REASON_MAX,n as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,o as DEPLOYMENT_EVENT_TYPES,I as DEPLOY_EVENT_ARN_MAX,m as DEPLOY_EVENT_CONTRACT,u as DEPLOY_EVENT_CONTRACT_MAJOR,d as DEPLOY_EVENT_CONTRACT_MINOR,N as DEPLOY_EVENT_ERROR_MESSAGE_MAX,O as DEPLOY_EVENT_ID_MAX,f as DEPLOY_EVENT_MESSAGE_MAX,D as DEPLOY_EVENT_NAME_MAX,L as DEPLOY_EVENT_OUTPUT_MAX,C as DEPLOY_EVENT_STATUS_REASON_MAX,g as DEPLOY_EVENT_TRAIL_DETAIL_MAX,y as DEPLOY_EVENT_URL_MAX,M as DEPLOY_RESULTS,We as DESTRUCTION_FINDINGS,U as DETECTION_PHASES,ii as DRIFT_PREFLIGHT_BUDGET_MS,oi as DRIFT_PREFLIGHT_TRIGGER_STATUSES,er as DRIFT_VERDICTS,l as DeployEventSchema,$t as DeployModeSchema,p as DeployResourceSchema,Gt as DeploymentError,t as DeploymentEventSchema,je as DestructionConsentSchema,He as DestructionFindingSchema,Qe as DestructionOutcomeSchema,Je as DestructionTicketResourceSchema,we as DestructionTicketSchema,or as DriftFindingSchema,ir as DriftJournalRecordSchema,Wo as DriftProbe,zi as DriftRepairAvailableError,tr as DriftSuspectSchema,rr as DriftVerdictSchema,ft as EcsError,Dt as EcsService,Ct as EcsServiceResolver,Li as FORGET_FLIP_SPEC,gi as FORGET_MARKER_KEY,Xt as FileSystemError,Zr as FjallStateFileSchema,ja as FrameworkRegistry,Ie as IDENTITY_STORE_PAGE_SIZE,Qr as INFRASTRUCTURE_FILENAME,Ye as INFRASTRUCTURE_STEP_NAMES,Be as INFRA_STEP_NAME,v as LOG_LEVELS,oa as LeaseDeniedError,Oa as MAX_ROOT_SESSION_SECONDS,Kt as NetworkError,Dr as OPENNEXT_DEPLOY_ORDER,fr as OPENNEXT_DESTROY_ORDER,gr as OPENNEXT_PARALLEL_GROUPS,Xr as OPENNEXT_PATTERNS,dr as ORGANISATION_TYPES,Ua as ORG_SETUP_PHASES,Xo as ORG_TRAIL_BUCKET_OUTPUT_KEY,ha as OU_ONLY_ACCOUNT_BUCKETS,Cr as PARALLEL_DEPLOY_GROUPS,Nr as PARALLEL_DESTROY_GROUPS,Lr as PARALLEL_OPERATION_TYPES,k as PHASE_STATUSES,Y as PLAN_ACTIONS,yt as PROGRESS_MESSAGES,A as PlanChangeSchema,R as PlanPropertyChangeSchema,mr as ProgressReporter,Ii as RECREATE_MARKER_KEY,Ri as REMEDIATION_JOURNAL_RETENTION_DAYS,nr as REMEDIATION_PHASES,Xe as REMEDIATION_VERB_GLOSS,B as REPLACEMENT_MODES,Me as ROOT_ACCESS_FEATURES,Pa as ROOT_TASK_POLICY_ARNS,Sr as RemediationFlipProofSchema,lr as RemediationJournalRecordSchema,cr as RemediationPhaseSchema,Er as RemediationTargetSchema,Ke as RemediationVerbSchema,Tr as RemediationVerbWithSurgerySchema,Ue as RootAccessEnablementError,xe as SECURITY_SERVICE_PRINCIPALS,Ee as SERVICE_PRINCIPALS,Vi as SNAPSHOT_CAPABLE_RESOURCE_TYPES,x as STACK_CLEANUP_PHASES,wr as STACK_FAILED_STATE_PATTERN,Jr as STACK_NOT_FOUND_PATTERN,h as STEP_COMPLETE_STATUSES,be as STEP_IDS,Ve as STEP_NAMES,P as SUPPORTED_CONTRACT_MARKERS,eo as ServiceArtefactSchema,ro as ServiceArtefactsSchema,Q as SimpleAwsProvider,ra as StackUnavailableError,T as StepProgressSchema,za as StepRegistry,Ze as TICKET_VERDICT_SOURCES,Ho as TRAIL_BUCKET_OUTPUT_KEY,Jo as TRAIL_KEY_ARN_OUTPUT_KEY,gt as TemplateHashError,Nt as TemplateHashService,ze as TicketVerdictSourceSchema,Vt as ValidationError,ga as accountsConfigToOUTree,Oe as activateCostAllocationTags,le as activateTrustedAccess,Xi as advertisableDriftVerbs,Cs as advertisableRemediationVerbs,ui as applyRetainFlip,si as archiveCompletedRemediationJournal,zt as artefactOutputKey,ta as assertLeaseBeforeStack,yi as assessForgetResumability,ua as assumeRootForTask,ho as buildAccountRegionPairs,de as buildAccountToOUMap,Ka as buildBuildSecretSessionPolicy,rs as buildDeployPlan,Xa as buildDeploySessionPolicy,ds as buildDestructionTicket,Hi as buildDriftRepairTicket,yo as buildRegionList,vt as buildStepContextBuildConfig,$ as buildTargetSetUnreadyAdvisory,z as buildTargetUnreadyAdvisory,_i as captureRemediationForensics,vo as cascadeHomeRegion,xo as cascadeOperationKey,$i as checkDeployPathStackAvailability,De as checkIdentityCentreStatus,te as checkRegionEnabled,q as checkTargetReadiness,jo as classifyDriftFailure,as as classifyImpact,qo as clearDriftSuspects,hi as completeForgetAfterConverge,vi as completeForgetAfterDeploy,di as composeFlipCapabilities,qi as composePostFailureRepairOffer,Ce as composeSdkAbortSignal,os as computeAssemblyDigest,ts as computeDeployPlan,ni as computeRemediationOpId,fo as computeSecretsDrift,Pi as computeTemplateDigest,Os as computeTicketDigest,xt as convertCloudFormationOutputsToRecord,_e as createAccount,H as createDeployEmitter,et as createEmptyState,Is as createMemoisedPlanLoader,no as createSequencedCallbacks,Bo as decideNextTransition,Ko as decommissionMemberTrailStorage,Zo as defaultDriftJournalDir,mi as defaultRemediationForensicsDir,ci as defaultRemediationJournalDir,rt as deleteStateFile,_o as deploy,ss as derivePropertyChanges,Bi as deriveRemovalTemplate,Hr as deriveResourcesFromManifestStacks,Oi as deriveRetainFlipTemplate,Co as deriveStaleParameters,se as describeOrganisation,Z as describeTargetReadinessReason,uo as destroy,ei as detectStackDrift,is as digestHead,qa as dockerBuilder,ye as drainPages,It as emitProgress,Fe as enableCentralisedRootAccess,Te as enableIpamDelegatedAdmin,ne as enablePolicyTypes,Se as enableRamSharing,ce as enableServiceAccess,pa as ensureEnforceSsl,ae as ensureOrganisationExists,me as ensureOrganisationalUnitsExist,Ps as evaluateDestructionConsents,fs as executableRemediationVerbs,Na as extractAllAccountNames,No as extractConsumedSsmParameters,Ne as extractErrorName,To as failure,Qo as fetchLastOperationEvents,Eo as fileExists,jt as filterDangerousEnvVars,Re as findAccount,Pe as findDevelopmentOuId,Di as findMarkedResourcesByOpId,Ei as findRemediationJournalByOpId,Gi as findRemovalDeletionFailures,Ca as flattenAccountsToEnvironments,ti as formatDriftPreFlightBlock,Zi as formatDriftRepairOffer,Rt as formatInfrastructureError,wi as formatPinOutcomeDetail,xi as formatRecreateInFlightCures,xr as getApplicationDeployOrder,Fr as getApplicationDestroyOrder,Mr as getApplicationStackName,Br as getApplicationStepId,Yr as getApplicationStepName,$a as getDestroyStepId,Ur as getOrganisationStackName,hr as getParallelDeployGroups,vr as getParallelDestroyGroups,mt as getSourceContext,ot as getStateFilePath,_t as getStructuralHint,ut as hasCdkDifferences,oo as hasDockerfile,ge as isAborted,Ia as isAccountsConfig,Ir as isApplicationOperation,kr as isApplicationStack,At as isCdkError,ns as isDataLoss,ea as isDeployPathBlockingStatus,Ea as isEnforceSslStatement,Ao as isFailure,he as isOULeaf,Kr as isOpenNextPattern,yr as isOrganisationOperation,ya as isOuOnlyAccountBucket,br as isQuarantineDetail,Rr as isRemediationPlaceholderPhysicalId,Vr as isRetainedBucketsDetail,da as isRootTaskPolicyArn,cs as isStatefulResourceType,La as isStringArray,po as isSuccess,Ds as legalRemediationVerbs,Ae as listAccounts,Si as listActiveRemediationOps,li as listActiveRemediationOpsForContext,Ls as loadDeployPlan,Qt as maskSensitiveOutput,Vo as mergeReconciledProviderAccounts,Wa as openNextBuilder,fa as parseAccountsConfiguration,ht as parseBuildPhase,w as parseDeployContractVersion,J as parseDeployEvent,dt as parseDiffOutput,Wt as parseShellArgs,Lo as partitionAccounts,Ha as partitionForRegion,Fi as partitionPreFlightByRemediation,ji as pinProbeCoverage,ue as placeAccountsInOUs,ee as probeAccountStackExists,Do as probeSecretsDrift,Uo as projectAccountRows,Mo as projectScalarSummary,fi as proveFlipMetadataOnly,Ki as proveRemovalTargetsOnly,zo as readDriftSuspects,Ti as readRemediationJournal,Ci as readRetainFlipState,zr as readStateFile,bo as reconcileProviderAccounts,Go as reconcileTrailMigration,$o as recordDriftSuspects,oe as regionDisabledMessage,ve as registerSecurityDelegates,pr as remediationPhaseRank,Ar as remediationPlaceholderPhysicalId,gs as renderConsentVerdictLines,Ns as renderDestructionTicketLines,Qi as renderPinReportLines,Ss as renderPlanLines,Es as renderPlanSummary,Ga as resolveBuildArgs,Ya as resolveBuildSecretSessionProvider,ba as resolveBuildSecrets,Va as resolveSecretRefValue,Oo as restart,Aa as restoreAndReconcileQuarantinedBucket,la as restoreBucketPolicy,_s as runApprovalGate,us as runDestructionGate,ri as runDriftPreFlight,Ji as runDriftRepairGate,Mi as runForgetSurgery,xa as runOpenNextBuild,Ma as runOrganisationSetup,Wi as runPinRemediation,Yi as runRecreatePreFlight,ki as runRecreateSurgery,Ts as signApprovalToken,qt as sleep,ao as sleepAbortable,fe as snapshotIdentityCentre,bi as snapshotPolicyForType,Ba as sourcedRefsFromBuildArgs,Tt as startStackMonitoring,it as stubCallerIdentity,lo as success,pi as sweepExpiredRemediationJournals,Ui as synthTemplateDeclaresResource,Ta as synthesiseEnforceSslDocument,Gr as toPascalCase,Sa as toResourcePolicyStatements,Jt as toServiceError,ls as toWirePlanChanges,ca as triageBucketPolicy,aa as unlockBucket,sa as unlockQueue,pe as updateBackupGlobalSettings,tt as updateTemplateHash,Ja as validateBuildGroup,ar as verbsForDriftVerdict,ps as verifyApprovalToken,_a as verifyOrgTrailDelivery,Ni as verifyRetainFlipDiff,qr as wrapApplicationError,Ai as writeRemediationJournal,$r as writeStateFile};

package/dist/src/orchestration/activeDeploymentGuard.d.ts

@@ -1,5 +1,22 @@
 import { type Result } from "@fjall/generator";
+import { BaseServiceError } from "../types/errors/ServiceError.js";
 import type { CloudFormationService } from "../services/infrastructure/CloudFormationService.js";
+/**
+ * A deploy-path pre-flight found one or more target stacks mid-operation or
+ * otherwise unavailable. Carries the offending stacks so surfaces can render
+ * them; the message is surface-neutral (no CLI flags, no CLI commands) and
+ * pre-built from static literals + stack names/statuses — nothing to mask.
+ */
+export declare class StackUnavailableError extends BaseServiceError {
+    readonly stacks: ReadonlyArray<{
+        name: string;
+        status: string;
+    }>;
+    constructor(message: string, stacks: ReadonlyArray<{
+        name: string;
+        status: string;
+    }>);
+}
 /**
  * Pre-flight check: query CloudFormation for each stack and reject
  * if any are currently in an IN_PROGRESS or otherwise unsafe state.
@@ -8,3 +25,27 @@ import type { CloudFormationService } from "../services/infrastructure/CloudForm
  * is blocking — specifically `safeToRedeploy === "No"`.
  */
 export declare function checkActiveDeployments(stackNames: string[], cfnService: CloudFormationService): Promise<Result<void>>;
+/**
+ * Deploy-path blocking classification (P0.5). Deliberately stricter than the
+ * destroy guard's `safeToRedeploy === "No"` check:
+ *
+ * - every `*_IN_PROGRESS` status blocks EXCEPT `REVIEW_IN_PROGRESS` (a
+ *   change-set awaiting execution holds no stack lock)
+ * - `DELETE_FAILED` blocks (the map says "Maybe" for destroy's benefit, but a
+ *   deploy into a half-deleted stack only wedges it further)
+ * - any status this build cannot classify blocks by DEFAULT — a new
+ *   CloudFormation status is more likely a new in-progress state than a new
+ *   terminal one, so fail closed rather than race it
+ *
+ * Known terminal states (complete, failed, rolled back) pass: CloudFormation
+ * accepts an update there, and deployability is the deploy's own problem.
+ */
+export declare function isDeployPathBlockingStatus(status: string): boolean;
+/**
+ * Deploy-path pre-flight (P0.5): reject the deploy BEFORE any image
+ * build/push when a target stack is mid-operation or in an unclassifiable
+ * state. Unlike `checkActiveDeployments` (the destroy guard) there is NO
+ * `--force` bypass — deploying over an in-flight operation cannot be a
+ * deliberate recovery action the way a forced destroy can.
+ */
+export declare function checkDeployPathStackAvailability(stackNames: string[], cfnService: CloudFormationService, abortSignal?: AbortSignal): Promise<Result<void>>;

package/dist/src/orchestration/activeDeploymentGuard.js

@@ -1,5 +1,9 @@
-import{success as r,failure as a}from"@fjall/generator";import{stackStatusMap as i}from"../aws/utils/stackStatus.js";async function d(o,u){if(o.length===0)return r(void 0);const c=await Promise.all(o.map(async e=>{const t=await u.getStackStatus(e);return{name:e,result:t}})),n=[];for(const{name:e,result:t}of c){if(!t.success)return a(t.error);const s=t.data;if(s===null||s.status==="DOES_NOT_EXIST")continue;i[s.status]?.safeToRedeploy==="No"&&n.push({name:e,status:s.status})}if(n.length>0){const e=n.map(t=>`  ${t.name}: ${t.status}`).join(`
-`);return a(new Error(`Cannot proceed while stacks are busy:
-${e}
+import{success as u,failure as c}from"@fjall/generator";import{stackStatusMap as l}from"../aws/utils/stackStatus.js";import{BaseServiceError as f}from"../types/errors/ServiceError.js";class p extends f{stacks;constructor(r,o){super("STACK_UNAVAILABLE",r),this.stacks=o}}async function E(t,r){if(t.length===0)return u(void 0);const o=await Promise.all(t.map(async n=>{const e=await r.getStackStatus(n);return{name:n,result:e}})),a=[];for(const{name:n,result:e}of o){if(!e.success)return c(e.error);const s=e.data;if(s===null||s.status==="DOES_NOT_EXIST")continue;l[s.status]?.safeToRedeploy==="No"&&a.push({name:n,status:s.status})}if(a.length>0){const n=a.map(e=>`  ${e.name}: ${e.status}`).join(`
+`);return c(new Error(`Cannot proceed while stacks are busy:
+${n}
 
-Wait for the in-progress operation to complete, or use --force to override.`))}return r(void 0)}export{d as checkActiveDeployments};
+Wait for the in-progress operation to complete, or use --force to override.`))}return u(void 0)}function d(t){return t==="REVIEW_IN_PROGRESS"?!1:t.endsWith("_IN_PROGRESS")||t==="DELETE_FAILED"?!0:l[t]===void 0||t==="UNKNOWN"}function S(t){const r=t.map(a=>`  ${a.name}: ${a.status}`).join(`
+`);return`Cannot start this deployment \u2014 ${t.length===1?"a CloudFormation stack is not available":"CloudFormation stacks are not available"}:
+${r}
+
+Another operation may be in progress or need attention. Wait for it to finish, then retry. Check progress in the Fjall dashboard.`}async function y(t,r,o){if(t.length===0)return u(void 0);const a=await Promise.all(t.map(async e=>{const s=await r.getStackStatus(e,void 0,o);return{name:e,result:s}})),n=[];for(const{name:e,result:s}of a){if(!s.success)return c(s.error);const i=s.data;i===null||i.status==="DOES_NOT_EXIST"||d(i.status)&&n.push({name:e,status:i.status})}return n.length>0?c(new p(S(n),n)):u(void 0)}export{p as StackUnavailableError,E as checkActiveDeployments,y as checkDeployPathStackAvailability,d as isDeployPathBlockingStatus};

package/dist/src/orchestration/application/applicationDeploy.d.ts

@@ -2,6 +2,15 @@ import { type Result } from "@fjall/generator";
 import type { DeployParams, DeployResult } from "../../types/params.js";
 import type { ApplicationOperation } from "../../types/operations.js";
 import type { DeployServices } from "../serviceFactory.js";
+/**
+ * Surface the stacks this operation will mutate (§5.9 reconciler coordinates),
+ * post-plan and before the first mutating CFN op. A reconciler persists these
+ * so a crashed run's in-flight stacks can be located by name/account/region
+ * without waiting for failure output. No-ops when no consumer wired the
+ * callback or the operation touches no stacks (fully skipped re-run).
+ * Shared by the deploy and destroy legs (F-X7) — one emission contract.
+ */
+export declare function emitStackTargets(callbacks: DeployParams["callbacks"], services: DeployServices, stackNames: readonly string[]): void;
 /**
  * Core application deployment orchestration.
  *