@fjall/deploy-core 2.34.0 → 3.1.0

package/dist/src/index.js

@@ -1 +1 @@
-import{DeploymentEventSchema as t,DEPLOYMENT_EVENT_TYPES as o,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as i,DEPLOYMENT_EVENT_STATUS_REASON_MAX as a,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as s,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as n,CASCADE_PHASES as c,CASCADE_ACCOUNT_STATUSES as E}from"./types/index.js";import{DeployEventSchema as l,StepProgressSchema as p,DeployResourceSchema as T,PlanChangeSchema as A,PlanPropertyChangeSchema as R,ChangeCountsSchema as _,DEPLOY_EVENT_CONTRACT as m,DEPLOY_EVENT_CONTRACT_MAJOR as u,DEPLOY_EVENT_CONTRACT_MINOR as d,SUPPORTED_CONTRACT_MARKERS as P,DEPLOY_EVENT_ID_MAX as O,DEPLOY_EVENT_NAME_MAX as D,DEPLOY_EVENT_MESSAGE_MAX as f,DEPLOY_EVENT_STATUS_REASON_MAX as C,DEPLOY_EVENT_ERROR_MESSAGE_MAX as N,DEPLOY_EVENT_TRAIL_DETAIL_MAX as g,DEPLOY_EVENT_OUTPUT_MAX as L,DEPLOY_EVENT_ARN_MAX as I,DEPLOY_EVENT_URL_MAX as y,STEP_COMPLETE_STATUSES as h,LOG_LEVELS as v,STACK_CLEANUP_PHASES as x,CASCADE_ACCOUNT_PHASES as F,DEPLOY_RESULTS as M,DETECTION_PHASES as U,PHASE_STATUSES as k,BUILDERS as b,CASCADE_OUTCOME_RESULTS as V,PLAN_ACTIONS as Y,REPLACEMENT_MODES as B,APPROVAL_KINDS as G,APPROVAL_DECISIONS as K,ALL_PROGRESS_KINDS as X,createDeployEmitter as H,parseDeployEvent as J,parseDeployContractVersion as w}from"./types/index.js";import{SimpleAwsProvider as Q}from"./aws/index.js";import{checkTargetReadiness as q,describeTargetReadinessReason as Z,buildTargetUnreadyAdvisory as z,buildTargetSetUnreadyAdvisory as $,probeAccountStackExists as ee}from"./aws/index.js";import{checkRegionEnabled as te,regionDisabledMessage as oe}from"./aws/index.js";import{ensureOrganisationExists as ae,describeOrganisation as se,enablePolicyTypes as ne,enableServiceAccess as ce,SERVICE_PRINCIPALS as Ee,enableRamSharing as Se,activateTrustedAccess as le,enableIpamDelegatedAdmin as pe,updateBackupGlobalSettings as Te,listAccounts as Ae,findAccount as Re,createAccount as _e,ensureOrganisationalUnitsExist as me,placeAccountsInOUs as ue,buildAccountToOUMap as de,findDevelopmentOuId as Pe,activateCostAllocationTags as Oe,checkIdentityCentreStatus as De,snapshotIdentityCentre as fe,composeSdkAbortSignal as Ce,extractErrorName as Ne,isAborted as ge,DEFAULT_MAX_PAGES as Le,IDENTITY_STORE_PAGE_SIZE as Ie,drainPages as ye,isOULeaf as he,registerSecurityDelegates as ve,SECURITY_SERVICE_PRINCIPALS as xe,enableCentralisedRootAccess as Fe,ROOT_ACCESS_FEATURES as Me,RootAccessEnablementError as Ue}from"./aws/index.js";import{STEP_IDS as be,STEP_NAMES as Ve,INFRASTRUCTURE_STEP_NAMES as Ye,INFRA_STEP_NAME as Be}from"./types/index.js";import{RemediationVerbSchema as Ke,REMEDIATION_VERB_GLOSS as Xe,DestructionFindingSchema as He,DestructionTicketResourceSchema as Je,DestructionTicketSchema as we,DestructionConsentSchema as je,DestructionOutcomeSchema as Qe,DESTRUCTION_FINDINGS as We,CONSENT_VERDICTS as qe,TICKET_VERDICT_SOURCES as Ze,TicketVerdictSourceSchema as ze}from"./types/index.js";import{DRIFT_VERDICTS as er,DriftVerdictSchema as rr,DriftSuspectSchema as tr,DriftFindingSchema as or,DriftJournalRecordSchema as ir,verbsForDriftVerdict as ar}from"./types/index.js";import{REMEDIATION_PHASES as nr,RemediationPhaseSchema as cr,RemediationTargetSchema as Er,RemediationFlipProofSchema as Sr,RemediationJournalRecordSchema as lr,RemediationVerbWithSurgerySchema as pr,remediationPhaseRank as Tr,remediationPlaceholderPhysicalId as Ar,isRemediationPlaceholderPhysicalId as Rr}from"./types/index.js";import{ProgressReporter as mr,APPLICATION_STACKS as ur,ORGANISATION_TYPES as dr,APPLICATION_DEPLOY_ORDER as Pr,APPLICATION_DESTROY_ORDER as Or,OPENNEXT_DEPLOY_ORDER as Dr,OPENNEXT_DESTROY_ORDER as fr,PARALLEL_DEPLOY_GROUPS as Cr,PARALLEL_DESTROY_GROUPS as Nr,OPENNEXT_PARALLEL_GROUPS as gr,PARALLEL_OPERATION_TYPES as Lr,isApplicationOperation as Ir,isOrganisationOperation as yr,getParallelDeployGroups as hr,getParallelDestroyGroups as vr,getApplicationDeployOrder as xr,getApplicationDestroyOrder as Fr,getApplicationStackName as Mr,getOrganisationStackName as Ur,isApplicationStack as kr,isQuarantineDetail as br,isRetainedBucketsDetail as Vr,getApplicationStepName as Yr,getApplicationStepId as Br,toPascalCase as Gr,isOpenNextPattern as Kr,OPENNEXT_PATTERNS as Xr,STACK_NOT_FOUND_PATTERN as Hr,STACK_FAILED_STATE_PATTERN as Jr,CDK_NO_STACKS_MATCH as wr,INFRASTRUCTURE_FILENAME as jr,ApplicationError as Qr,wrapApplicationError as Wr,stubCallerIdentity as qr}from"./types/index.js";import{deriveResourcesFromManifestStacks as zr}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as et,readStateFile as rt,writeStateFile as tt,createEmptyState as ot,deleteStateFile as it,updateTemplateHash as at,getStateFilePath as st,regionSuffix as nt}from"./types/config/FjallState.js";import{CloudFormationEventMonitor as Et}from"./aws/index.js";import{CdkService as lt,CdkArgumentBuilder as pt,CdkProcessManager as Tt,CdkEventMonitor as At,startStackMonitoring as Rt,DEFAULT_DEPLOY_TIMEOUT_MS as _t,isCdkError as mt,formatInfrastructureError as ut,getStructuralHint as dt,getSourceContext as Pt,hasCdkDifferences as Ot,parseDiffOutput as Dt,CloudFormationService as ft,CloudFormationError as Ct,EcsService as Nt,EcsError as gt,EcsServiceResolver as Lt,TemplateHashService as It,TemplateHashError as yt,CdkContextBuilder as ht,emitProgress as vt,PROGRESS_MESSAGES as xt,parseBuildPhase as Ft,buildStepContextBuildConfig as Mt,convertCloudFormationOutputsToRecord as Ut,ApplicationStackService as kt}from"./services/index.js";import{CdkError as Vt}from"./types/errors/index.js";import{BaseServiceError as Bt,ValidationError as Gt,AuthError as Kt,AwsError as Xt,DeploymentError as Ht,NetworkError as Jt,FileSystemError as wt,ConfigError as jt,toServiceError as Qt}from"./types/errors/index.js";import{filterDangerousEnvVars as qt,maskSensitiveOutput as Zt,parseShellArgs as zt,sleep as $t}from"@fjall/util";import{artefactOutputKey as ro,DeployModeSchema as to,ServiceArtefactSchema as oo,ServiceArtefactsSchema as io}from"@fjall/util";import{hasDockerfile as so}from"./util/dockerfileDetection.js";import{sleepAbortable as co}from"./util/sleepAbortable.js";import{createSequencedCallbacks as So}from"./util/sequencedCallbacks.js";import{fileExists as po}from"@fjall/util/fsHelpers";import{success as Ao,failure as Ro,isSuccess as _o,isFailure as mo}from"@fjall/generator";import{deploy as Po}from"./orchestration/index.js";import{destroy as Do}from"./orchestration/index.js";import{restart as Co,probeSecretsDrift as No,computeSecretsDrift as go,deriveStaleParameters as Lo,extractConsumedSsmParameters as Io}from"./orchestration/index.js";import{partitionAccounts as ho}from"./orchestration/index.js";import{buildRegionList as xo,buildAccountRegionPairs as Fo,cascadeHomeRegion as Mo,cascadeOperationKey as Uo}from"./orchestration/index.js";import{projectScalarSummary as bo,projectAccountRows as Vo}from"./orchestration/index.js";import{reconcileProviderAccounts as Bo,mergeReconciledProviderAccounts as Go}from"./orchestration/index.js";import{decideNextTransition as Xo,reconcileTrailMigration as Ho,decommissionMemberTrailStorage as Jo,ORG_TRAIL_BUCKET_OUTPUT_KEY as wo,TRAIL_BUCKET_OUTPUT_KEY as jo,TRAIL_KEY_ARN_OUTPUT_KEY as Qo}from"./orchestration/index.js";import{classifyDriftFailure as qo,fetchLastOperationEvents as Zo,DriftProbe as zo,clearDriftSuspects as $o,defaultDriftJournalDir as ei,readDriftSuspects as ri,recordDriftSuspects as ti,detectStackDrift as oi,runDriftPreFlight as ii,formatDriftPreFlightBlock as ai,DRIFT_PREFLIGHT_TRIGGER_STATUSES as si,DRIFT_PREFLIGHT_BUDGET_MS as ni}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ei,computeRemediationOpId as Si,defaultRemediationJournalDir as li,findRemediationJournalByOpId as pi,listActiveRemediationOps as Ti,listActiveRemediationOpsForContext as Ai,readRemediationJournal as Ri,sweepExpiredRemediationJournals as _i,writeRemediationJournal as mi,REMEDIATION_JOURNAL_RETENTION_DAYS as ui,captureRemediationForensics as di,defaultRemediationForensicsDir as Pi,applyRetainFlip as Oi,composeFlipCapabilities as Di,computeTemplateDigest as fi,deriveRetainFlipTemplate as Ci,findMarkedResourcesByOpId as Ni,proveFlipMetadataOnly as gi,readRetainFlipState as Li,verifyRetainFlipDiff as Ii,FORGET_MARKER_KEY as yi,FORGET_FLIP_SPEC as hi,RECREATE_MARKER_KEY as vi,assessForgetResumability as xi,completeForgetAfterConverge as Fi,completeForgetAfterDeploy as Mi,formatRecreateInFlightCures as Ui,partitionPreFlightByRemediation as ki,runForgetSurgery as bi,synthTemplateDeclaresResource as Vi,runRecreateSurgery as Yi,snapshotPolicyForType as Bi,SNAPSHOT_CAPABLE_RESOURCE_TYPES as Gi,runRecreatePreFlight as Ki,deriveRemovalTemplate as Xi,findRemovalDeletionFailures as Hi,findResourcesPresent as Ji,proveRemovalTargetsOnly as wi,advertisableDriftVerbs as ji,buildDriftRepairTicket as Qi,runDriftRepairGate as Wi,formatPinOutcomeDetail as qi,pinProbeCoverage as Zi,renderPinReportLines as zi,runPinRemediation as $i,composePostFailureRepairOffer as ea,formatDriftRepairOffer as ra,DriftRepairAvailableError as ta,checkDeployPathStackAvailability as oa,isDeployPathBlockingStatus as ia,StackUnavailableError as aa,assertLeaseBeforeStack as sa,LeaseDeniedError as na}from"./orchestration/index.js";import{unlockBucket as Ea,unlockQueue as Sa}from"./orchestration/index.js";import{triageBucketPolicy as pa,isEnforceSslStatement as Ta,toResourcePolicyStatements as Aa,restoreBucketPolicy as Ra,synthesiseEnforceSslDocument as _a,ensureEnforceSsl as ma,restoreAndReconcileQuarantinedBucket as ua}from"./orchestration/index.js";import{verifyOrgTrailDelivery as Pa}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as Da,isRootTaskPolicyArn as fa,ROOT_TASK_POLICY_ARNS as Ca,MAX_ROOT_SESSION_SECONDS as Na}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as La,flattenAccountsToEnvironments as Ia,extractAllAccountNames as ya,accountsConfigToOUTree as ha,isStringArray as va,isAccountsConfig as xa,isOuOnlyAccountBucket as Fa,OU_ONLY_ACCOUNT_BUCKETS as Ma}from"./orchestration/index.js";import{runOpenNextBuild as ka}from"./orchestration/index.js";import{runOrganisationSetup as Va,ORG_SETUP_PHASES as Ya}from"./orchestration/index.js";import{resolveBuildSecrets as Ga,resolveSecretRefValue as Ka,resolveBuildSecretSessionProvider as Xa,sourcedRefsFromBuildArgs as Ha,resolveBuildArgs as Ja,buildBuildSecretSessionPolicy as wa,buildDeploySessionPolicy as ja,partitionForRegion as Qa,validateBuildGroup as Wa}from"./orchestration/index.js";import{FrameworkRegistry as Za}from"./orchestration/index.js";import{openNextBuilder as $a,staticSiteBuilder as es,dockerBuilder as rs}from"./orchestration/index.js";import{StepRegistry as os,getDestroyStepId as is}from"./steps/index.js";import{buildDeployPlan as ss,computeDeployPlan as ns,computeAssemblyDigest as cs,digestHead as Es,classifyImpact as Ss,derivePropertyChanges as ls,isDataLoss as ps,isStatefulResourceType as Ts,renderPlanSummary as As,renderPlanLines as Rs,toWirePlanChanges as _s,signApprovalToken as ms,verifyApprovalToken as us,DEFAULT_APPROVAL_TTL_MS as ds,APPROVAL_TOKEN_PATTERN as Ps,runApprovalGate as Os}from"./orchestration/index.js";import{runDestructionGate as fs,buildDestructionTicket as Cs,evaluateDestructionConsents as Ns,computeTicketDigest as gs,legalRemediationVerbs as Ls,executableRemediationVerbs as Is,advertisableRemediationVerbs as ys,renderDestructionTicketLines as hs,renderConsentVerdictLines as vs,loadDeployPlan as xs,createMemoisedPlanLoader as Fs}from"./orchestration/index.js";export{X as ALL_PROGRESS_KINDS,Pr as APPLICATION_DEPLOY_ORDER,Or as APPLICATION_DESTROY_ORDER,ur as APPLICATION_STACKS,K as APPROVAL_DECISIONS,G as APPROVAL_KINDS,Ps as APPROVAL_TOKEN_PATTERN,Qr as ApplicationError,kt as ApplicationStackService,Kt as AuthError,Xt as AwsError,b as BUILDERS,Bt as BaseServiceError,F as CASCADE_ACCOUNT_PHASES,E as CASCADE_ACCOUNT_STATUSES,V as CASCADE_OUTCOME_RESULTS,c as CASCADE_PHASES,wr as CDK_NO_STACKS_MATCH,qe as CONSENT_VERDICTS,pt as CdkArgumentBuilder,ht as CdkContextBuilder,Vt as CdkError,At as CdkEventMonitor,Tt as CdkProcessManager,lt as CdkService,_ as ChangeCountsSchema,Ct as CloudFormationError,Et as CloudFormationEventMonitor,ft as CloudFormationService,jt as ConfigError,ds as DEFAULT_APPROVAL_TTL_MS,_t as DEFAULT_DEPLOY_TIMEOUT_MS,Le as DEFAULT_MAX_PAGES,s as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,i as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,a as DEPLOYMENT_EVENT_STATUS_REASON_MAX,n as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,o as DEPLOYMENT_EVENT_TYPES,I as DEPLOY_EVENT_ARN_MAX,m as DEPLOY_EVENT_CONTRACT,u as DEPLOY_EVENT_CONTRACT_MAJOR,d as DEPLOY_EVENT_CONTRACT_MINOR,N as DEPLOY_EVENT_ERROR_MESSAGE_MAX,O as DEPLOY_EVENT_ID_MAX,f as DEPLOY_EVENT_MESSAGE_MAX,D as DEPLOY_EVENT_NAME_MAX,L as DEPLOY_EVENT_OUTPUT_MAX,C as DEPLOY_EVENT_STATUS_REASON_MAX,g as DEPLOY_EVENT_TRAIL_DETAIL_MAX,y as DEPLOY_EVENT_URL_MAX,M as DEPLOY_RESULTS,We as DESTRUCTION_FINDINGS,U as DETECTION_PHASES,ni as DRIFT_PREFLIGHT_BUDGET_MS,si as DRIFT_PREFLIGHT_TRIGGER_STATUSES,er as DRIFT_VERDICTS,l as DeployEventSchema,to as DeployModeSchema,T as DeployResourceSchema,Ht as DeploymentError,t as DeploymentEventSchema,je as DestructionConsentSchema,He as DestructionFindingSchema,Qe as DestructionOutcomeSchema,Je as DestructionTicketResourceSchema,we as DestructionTicketSchema,or as DriftFindingSchema,ir as DriftJournalRecordSchema,zo as DriftProbe,ta as DriftRepairAvailableError,tr as DriftSuspectSchema,rr as DriftVerdictSchema,gt as EcsError,Nt as EcsService,Lt as EcsServiceResolver,hi as FORGET_FLIP_SPEC,yi as FORGET_MARKER_KEY,wt as FileSystemError,et as FjallStateFileSchema,Za as FrameworkRegistry,Ie as IDENTITY_STORE_PAGE_SIZE,jr as INFRASTRUCTURE_FILENAME,Ye as INFRASTRUCTURE_STEP_NAMES,Be as INFRA_STEP_NAME,v as LOG_LEVELS,na as LeaseDeniedError,Na as MAX_ROOT_SESSION_SECONDS,Jt as NetworkError,Dr as OPENNEXT_DEPLOY_ORDER,fr as OPENNEXT_DESTROY_ORDER,gr as OPENNEXT_PARALLEL_GROUPS,Xr as OPENNEXT_PATTERNS,dr as ORGANISATION_TYPES,Ya as ORG_SETUP_PHASES,wo as ORG_TRAIL_BUCKET_OUTPUT_KEY,Ma as OU_ONLY_ACCOUNT_BUCKETS,Cr as PARALLEL_DEPLOY_GROUPS,Nr as PARALLEL_DESTROY_GROUPS,Lr as PARALLEL_OPERATION_TYPES,k as PHASE_STATUSES,Y as PLAN_ACTIONS,xt as PROGRESS_MESSAGES,A as PlanChangeSchema,R as PlanPropertyChangeSchema,mr as ProgressReporter,vi as RECREATE_MARKER_KEY,ui as REMEDIATION_JOURNAL_RETENTION_DAYS,nr as REMEDIATION_PHASES,Xe as REMEDIATION_VERB_GLOSS,B as REPLACEMENT_MODES,Me as ROOT_ACCESS_FEATURES,Ca as ROOT_TASK_POLICY_ARNS,Sr as RemediationFlipProofSchema,lr as RemediationJournalRecordSchema,cr as RemediationPhaseSchema,Er as RemediationTargetSchema,Ke as RemediationVerbSchema,pr as RemediationVerbWithSurgerySchema,Ue as RootAccessEnablementError,xe as SECURITY_SERVICE_PRINCIPALS,Ee as SERVICE_PRINCIPALS,Gi as SNAPSHOT_CAPABLE_RESOURCE_TYPES,x as STACK_CLEANUP_PHASES,Jr as STACK_FAILED_STATE_PATTERN,Hr as STACK_NOT_FOUND_PATTERN,h as STEP_COMPLETE_STATUSES,be as STEP_IDS,Ve as STEP_NAMES,P as SUPPORTED_CONTRACT_MARKERS,oo as ServiceArtefactSchema,io as ServiceArtefactsSchema,Q as SimpleAwsProvider,aa as StackUnavailableError,p as StepProgressSchema,os as StepRegistry,Ze as TICKET_VERDICT_SOURCES,jo as TRAIL_BUCKET_OUTPUT_KEY,Qo as TRAIL_KEY_ARN_OUTPUT_KEY,yt as TemplateHashError,It as TemplateHashService,ze as TicketVerdictSourceSchema,Gt as ValidationError,ha as accountsConfigToOUTree,Oe as activateCostAllocationTags,le as activateTrustedAccess,ji as advertisableDriftVerbs,ys as advertisableRemediationVerbs,Oi as applyRetainFlip,Ei as archiveCompletedRemediationJournal,ro as artefactOutputKey,sa as assertLeaseBeforeStack,xi as assessForgetResumability,Da as assumeRootForTask,Fo as buildAccountRegionPairs,de as buildAccountToOUMap,wa as buildBuildSecretSessionPolicy,ss as buildDeployPlan,ja as buildDeploySessionPolicy,Cs as buildDestructionTicket,Qi as buildDriftRepairTicket,xo as buildRegionList,Mt as buildStepContextBuildConfig,$ as buildTargetSetUnreadyAdvisory,z as buildTargetUnreadyAdvisory,di as captureRemediationForensics,Mo as cascadeHomeRegion,Uo as cascadeOperationKey,oa as checkDeployPathStackAvailability,De as checkIdentityCentreStatus,te as checkRegionEnabled,q as checkTargetReadiness,qo as classifyDriftFailure,Ss as classifyImpact,$o as clearDriftSuspects,Fi as completeForgetAfterConverge,Mi as completeForgetAfterDeploy,Di as composeFlipCapabilities,ea as composePostFailureRepairOffer,Ce as composeSdkAbortSignal,cs as computeAssemblyDigest,ns as computeDeployPlan,Si as computeRemediationOpId,go as computeSecretsDrift,fi as computeTemplateDigest,gs as computeTicketDigest,Ut as convertCloudFormationOutputsToRecord,_e as createAccount,H as createDeployEmitter,ot as createEmptyState,Fs as createMemoisedPlanLoader,So as createSequencedCallbacks,Xo as decideNextTransition,Jo as decommissionMemberTrailStorage,ei as defaultDriftJournalDir,Pi as defaultRemediationForensicsDir,li as defaultRemediationJournalDir,it as deleteStateFile,Po as deploy,ls as derivePropertyChanges,Xi as deriveRemovalTemplate,zr as deriveResourcesFromManifestStacks,Ci as deriveRetainFlipTemplate,Lo as deriveStaleParameters,se as describeOrganisation,Z as describeTargetReadinessReason,Do as destroy,oi as detectStackDrift,Es as digestHead,rs as dockerBuilder,ye as drainPages,vt as emitProgress,Fe as enableCentralisedRootAccess,pe as enableIpamDelegatedAdmin,ne as enablePolicyTypes,Se as enableRamSharing,ce as enableServiceAccess,ma as ensureEnforceSsl,ae as ensureOrganisationExists,me as ensureOrganisationalUnitsExist,Ns as evaluateDestructionConsents,Is as executableRemediationVerbs,ya as extractAllAccountNames,Io as extractConsumedSsmParameters,Ne as extractErrorName,Ro as failure,Zo as fetchLastOperationEvents,po as fileExists,qt as filterDangerousEnvVars,Re as findAccount,Pe as findDevelopmentOuId,Ni as findMarkedResourcesByOpId,pi as findRemediationJournalByOpId,Hi as findRemovalDeletionFailures,Ji as findResourcesPresent,Ia as flattenAccountsToEnvironments,ai as formatDriftPreFlightBlock,ra as formatDriftRepairOffer,ut as formatInfrastructureError,qi as formatPinOutcomeDetail,Ui as formatRecreateInFlightCures,xr as getApplicationDeployOrder,Fr as getApplicationDestroyOrder,Mr as getApplicationStackName,Br as getApplicationStepId,Yr as getApplicationStepName,is as getDestroyStepId,Ur as getOrganisationStackName,hr as getParallelDeployGroups,vr as getParallelDestroyGroups,Pt as getSourceContext,st as getStateFilePath,dt as getStructuralHint,Ot as hasCdkDifferences,so as hasDockerfile,ge as isAborted,xa as isAccountsConfig,Ir as isApplicationOperation,kr as isApplicationStack,mt as isCdkError,ps as isDataLoss,ia as isDeployPathBlockingStatus,Ta as isEnforceSslStatement,mo as isFailure,he as isOULeaf,Kr as isOpenNextPattern,yr as isOrganisationOperation,Fa as isOuOnlyAccountBucket,br as isQuarantineDetail,Rr as isRemediationPlaceholderPhysicalId,Vr as isRetainedBucketsDetail,fa as isRootTaskPolicyArn,Ts as isStatefulResourceType,va as isStringArray,_o as isSuccess,Ls as legalRemediationVerbs,Ae as listAccounts,Ti as listActiveRemediationOps,Ai as listActiveRemediationOpsForContext,xs as loadDeployPlan,Zt as maskSensitiveOutput,Go as mergeReconciledProviderAccounts,$a as openNextBuilder,La as parseAccountsConfiguration,Ft as parseBuildPhase,w as parseDeployContractVersion,J as parseDeployEvent,Dt as parseDiffOutput,zt as parseShellArgs,ho as partitionAccounts,Qa as partitionForRegion,ki as partitionPreFlightByRemediation,Zi as pinProbeCoverage,ue as placeAccountsInOUs,ee as probeAccountStackExists,No as probeSecretsDrift,Vo as projectAccountRows,bo as projectScalarSummary,gi as proveFlipMetadataOnly,wi as proveRemovalTargetsOnly,ri as readDriftSuspects,Ri as readRemediationJournal,Li as readRetainFlipState,rt as readStateFile,Bo as reconcileProviderAccounts,Ho as reconcileTrailMigration,ti as recordDriftSuspects,oe as regionDisabledMessage,nt as regionSuffix,ve as registerSecurityDelegates,Tr as remediationPhaseRank,Ar as remediationPlaceholderPhysicalId,vs as renderConsentVerdictLines,hs as renderDestructionTicketLines,zi as renderPinReportLines,Rs as renderPlanLines,As as renderPlanSummary,Ja as resolveBuildArgs,Xa as resolveBuildSecretSessionProvider,Ga as resolveBuildSecrets,Ka as resolveSecretRefValue,Co as restart,ua as restoreAndReconcileQuarantinedBucket,Ra as restoreBucketPolicy,Os as runApprovalGate,fs as runDestructionGate,ii as runDriftPreFlight,Wi as runDriftRepairGate,bi as runForgetSurgery,ka as runOpenNextBuild,Va as runOrganisationSetup,$i as runPinRemediation,Ki as runRecreatePreFlight,Yi as runRecreateSurgery,ms as signApprovalToken,$t as sleep,co as sleepAbortable,fe as snapshotIdentityCentre,Bi as snapshotPolicyForType,Ha as sourcedRefsFromBuildArgs,Rt as startStackMonitoring,es as staticSiteBuilder,qr as stubCallerIdentity,Ao as success,_i as sweepExpiredRemediationJournals,Vi as synthTemplateDeclaresResource,_a as synthesiseEnforceSslDocument,Gr as toPascalCase,Aa as toResourcePolicyStatements,Qt as toServiceError,_s as toWirePlanChanges,pa as triageBucketPolicy,Ea as unlockBucket,Sa as unlockQueue,Te as updateBackupGlobalSettings,at as updateTemplateHash,Wa as validateBuildGroup,ar as verbsForDriftVerdict,us as verifyApprovalToken,Pa as verifyOrgTrailDelivery,Ii as verifyRetainFlipDiff,Wr as wrapApplicationError,mi as writeRemediationJournal,tt as writeStateFile};
+import{DeploymentEventSchema as t,DEPLOYMENT_EVENT_TYPES as o,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as i,DEPLOYMENT_EVENT_STATUS_REASON_MAX as a,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as n,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as s,CASCADE_PHASES as E,CASCADE_ACCOUNT_STATUSES as c}from"./types/index.js";import{DeployEventSchema as l,StepProgressSchema as T,DeployResourceSchema as A,PlanChangeSchema as R,PlanPropertyChangeSchema as _,ChangeCountsSchema as p,DEPLOY_EVENT_CONTRACT as m,DEPLOY_EVENT_CONTRACT_MAJOR as u,DEPLOY_EVENT_CONTRACT_MINOR as d,SUPPORTED_CONTRACT_MARKERS as P,DEPLOY_EVENT_ID_MAX as O,DEPLOY_EVENT_NAME_MAX as D,DEPLOY_EVENT_MESSAGE_MAX as f,DEPLOY_EVENT_STATUS_REASON_MAX as C,DEPLOY_EVENT_ERROR_MESSAGE_MAX as N,DEPLOY_EVENT_TRAIL_DETAIL_MAX as g,DEPLOY_EVENT_OUTPUT_MAX as L,DEPLOY_EVENT_ARN_MAX as I,DEPLOY_EVENT_URL_MAX as y,STEP_COMPLETE_STATUSES as h,LOG_LEVELS as F,STACK_CLEANUP_PHASES as U,CASCADE_ACCOUNT_PHASES as v,DEPLOY_RESULTS as x,DETECTION_PHASES as M,PHASE_STATUSES as k,BUILDERS as b,CASCADE_OUTCOME_RESULTS as V,PLAN_ACTIONS as Y,REPLACEMENT_MODES as B,APPROVAL_KINDS as G,APPROVAL_DECISIONS as K,ALL_PROGRESS_KINDS as X,createDeployEmitter as H,parseDeployEvent as w,parseDeployContractVersion as J}from"./types/index.js";import{SimpleAwsProvider as j}from"./aws/index.js";import{checkTargetReadiness as q,describeTargetReadinessReason as Z,buildTargetUnreadyAdvisory as z,buildTargetSetUnreadyAdvisory as $,probeAccountStackExists as ee}from"./aws/index.js";import{checkRegionEnabled as te,regionDisabledMessage as oe}from"./aws/index.js";import{ensureOrganisationExists as ae,describeOrganisation as ne,enablePolicyTypes as se,enableServiceAccess as Ee,SERVICE_PRINCIPALS as ce,enableRamSharing as Se,activateTrustedAccess as le,enableIpamDelegatedAdmin as Te,updateBackupGlobalSettings as Ae,listAccounts as Re,findAccount as _e,createAccount as pe,ensureOrganisationalUnitsExist as me,placeAccountsInOUs as ue,buildAccountToOUMap as de,findDevelopmentOuId as Pe,activateCostAllocationTags as Oe,checkIdentityCentreStatus as De,snapshotIdentityCentre as fe,composeSdkAbortSignal as Ce,extractErrorName as Ne,isAborted as ge,DEFAULT_MAX_PAGES as Le,IDENTITY_STORE_PAGE_SIZE as Ie,drainPages as ye,isOULeaf as he,registerSecurityDelegates as Fe,SECURITY_SERVICE_PRINCIPALS as Ue,enableCentralisedRootAccess as ve,ROOT_ACCESS_FEATURES as xe,RootAccessEnablementError as Me}from"./aws/index.js";import{STEP_IDS as be,STEP_NAMES as Ve,INFRASTRUCTURE_STEP_NAMES as Ye,INFRA_STEP_NAME as Be}from"./types/index.js";import{RemediationVerbSchema as Ke,REMEDIATION_VERB_GLOSS as Xe,DestructionFindingSchema as He,DestructionTicketResourceSchema as we,DestructionTicketSchema as Je,DestructionConsentSchema as Qe,DestructionOutcomeSchema as je,DESTRUCTION_FINDINGS as We,CONSENT_VERDICTS as qe,TICKET_VERDICT_SOURCES as Ze,TicketVerdictSourceSchema as ze}from"./types/index.js";import{DRIFT_VERDICTS as er,DriftVerdictSchema as rr,DriftSuspectSchema as tr,DriftFindingSchema as or,DriftJournalRecordSchema as ir,verbsForDriftVerdict as ar}from"./types/index.js";import{REMEDIATION_PHASES as sr,RemediationPhaseSchema as Er,RemediationTargetSchema as cr,RemediationFlipProofSchema as Sr,RemediationJournalRecordSchema as lr,RemediationVerbWithSurgerySchema as Tr,remediationPhaseRank as Ar,remediationPlaceholderPhysicalId as Rr,isRemediationPlaceholderPhysicalId as _r}from"./types/index.js";import{ProgressReporter as mr,APPLICATION_STACKS as ur,ORGANISATION_TYPES as dr,APPLICATION_DEPLOY_ORDER as Pr,APPLICATION_DESTROY_ORDER as Or,OPENNEXT_DEPLOY_ORDER as Dr,OPENNEXT_DESTROY_ORDER as fr,PARALLEL_DEPLOY_GROUPS as Cr,PARALLEL_DESTROY_GROUPS as Nr,OPENNEXT_PARALLEL_GROUPS as gr,PARALLEL_OPERATION_TYPES as Lr,isApplicationOperation as Ir,isOrganisationOperation as yr,getParallelDeployGroups as hr,getParallelDestroyGroups as Fr,getApplicationDeployOrder as Ur,getApplicationDestroyOrder as vr,getApplicationStackName as xr,getOrganisationStackName as Mr,isApplicationStack as kr,isQuarantineDetail as br,isRetainedBucketsDetail as Vr,getApplicationStepName as Yr,getApplicationStepId as Br,toPascalCase as Gr,isOpenNextPattern as Kr,OPENNEXT_PATTERNS as Xr,STACK_NOT_FOUND_PATTERN as Hr,STACK_FAILED_STATE_PATTERN as wr,CDK_NO_STACKS_MATCH as Jr,INFRASTRUCTURE_FILENAME as Qr,ApplicationError as jr,wrapApplicationError as Wr,stubCallerIdentity as qr}from"./types/index.js";import{deriveResourcesFromManifestStacks as zr}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as et,readStateFile as rt,writeStateFile as tt,createEmptyState as ot,deleteStateFile as it,updateTemplateHash as at,getStateFilePath as nt,regionSuffix as st}from"./types/config/FjallState.js";import{CloudFormationEventMonitor as ct}from"./aws/index.js";import{CdkService as lt,CdkArgumentBuilder as Tt,CdkProcessManager as At,CdkEventMonitor as Rt,startStackMonitoring as _t,DEFAULT_DEPLOY_TIMEOUT_MS as pt,isCdkError as mt,formatInfrastructureError as ut,getStructuralHint as dt,getSourceContext as Pt,hasCdkDifferences as Ot,parseDiffOutput as Dt,CloudFormationService as ft,CloudFormationError as Ct,EcsService as Nt,EcsError as gt,EcsServiceResolver as Lt,TemplateHashService as It,TemplateHashError as yt,CdkContextBuilder as ht,emitProgress as Ft,PROGRESS_MESSAGES as Ut,parseBuildPhase as vt,buildStepContextBuildConfig as xt,convertCloudFormationOutputsToRecord as Mt,ApplicationStackService as kt}from"./services/index.js";import{CdkError as Vt}from"./types/errors/index.js";import{BaseServiceError as Bt,ValidationError as Gt,AuthError as Kt,AwsError as Xt,DeploymentError as Ht,NetworkError as wt,FileSystemError as Jt,ConfigError as Qt,toServiceError as jt}from"./types/errors/index.js";import{filterDangerousEnvVars as qt,maskSensitiveOutput as Zt,parseShellArgs as zt,sleep as $t}from"@fjall/util";import{artefactOutputKey as ro,DeployModeSchema as to,ServiceArtefactSchema as oo,ServiceArtefactsSchema as io}from"@fjall/util";import{hasDockerfile as no}from"./util/dockerfileDetection.js";import{sleepAbortable as Eo}from"./util/sleepAbortable.js";import{createSequencedCallbacks as So}from"./util/sequencedCallbacks.js";import{fileExists as To}from"@fjall/util/fsHelpers";import{success as Ro,failure as _o,isSuccess as po,isFailure as mo}from"@fjall/generator";import{deploy as Po}from"./orchestration/index.js";import{destroy as Do}from"./orchestration/index.js";import{restart as Co,probeSecretsDrift as No,computeSecretsDrift as go,deriveStaleParameters as Lo,extractConsumedSsmParameters as Io}from"./orchestration/index.js";import{partitionAccounts as ho}from"./orchestration/index.js";import{buildRegionList as Uo,buildAccountRegionPairs as vo,cascadeHomeRegion as xo,cascadeOperationKey as Mo}from"./orchestration/index.js";import{projectScalarSummary as bo,projectAccountRows as Vo}from"./orchestration/index.js";import{reconcileProviderAccounts as Bo,mergeReconciledProviderAccounts as Go}from"./orchestration/index.js";import{decideNextTransition as Xo,reconcileTrailMigration as Ho,decommissionMemberTrailStorage as wo,ORG_TRAIL_BUCKET_OUTPUT_KEY as Jo,TRAIL_BUCKET_OUTPUT_KEY as Qo,TRAIL_KEY_ARN_OUTPUT_KEY as jo}from"./orchestration/index.js";import{classifyDriftFailure as qo,fetchLastOperationEvents as Zo,DriftProbe as zo,clearDriftSuspects as $o,defaultDriftJournalDir as ei,readDriftSuspects as ri,recordDriftSuspects as ti,detectStackDrift as oi,runDriftPreFlight as ii,formatDriftPreFlightBlock as ai,DRIFT_PREFLIGHT_TRIGGER_STATUSES as ni,DRIFT_PREFLIGHT_BUDGET_MS as si,runRoute53RecordPreflight as Ei}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Si,computeRemediationOpId as li,defaultRemediationJournalDir as Ti,findRemediationJournalByOpId as Ai,listActiveRemediationOps as Ri,listActiveRemediationOpsForContext as _i,readRemediationJournal as pi,sweepExpiredRemediationJournals as mi,writeRemediationJournal as ui,REMEDIATION_JOURNAL_RETENTION_DAYS as di,captureRemediationForensics as Pi,defaultRemediationForensicsDir as Oi,applyRetainFlip as Di,composeFlipCapabilities as fi,computeTemplateDigest as Ci,deriveRetainFlipTemplate as Ni,findMarkedResourcesByOpId as gi,proveFlipMetadataOnly as Li,readRetainFlipState as Ii,verifyRetainFlipDiff as yi,FORGET_MARKER_KEY as hi,FORGET_FLIP_SPEC as Fi,RECREATE_MARKER_KEY as Ui,assessForgetResumability as vi,completeForgetAfterConverge as xi,completeForgetAfterDeploy as Mi,formatRecreateInFlightCures as ki,partitionPreFlightByRemediation as bi,runForgetSurgery as Vi,synthTemplateDeclaresResource as Yi,runRecreateSurgery as Bi,snapshotPolicyForType as Gi,SNAPSHOT_CAPABLE_RESOURCE_TYPES as Ki,runRecreatePreFlight as Xi,deriveRemovalTemplate as Hi,findRemovalDeletionFailures as wi,findResourcesPresent as Ji,proveRemovalTargetsOnly as Qi,advertisableDriftVerbs as ji,buildDriftRepairTicket as Wi,runDriftRepairGate as qi,formatPinOutcomeDetail as Zi,pinProbeCoverage as zi,renderPinReportLines as $i,runPinRemediation as ea,composePostFailureRepairOffer as ra,formatDriftRepairOffer as ta,DriftRepairAvailableError as oa,checkDeployPathStackAvailability as ia,isDeployPathBlockingStatus as aa,StackUnavailableError as na,assertLeaseBeforeStack as sa,LeaseDeniedError as Ea}from"./orchestration/index.js";import{unlockBucket as Sa,unlockQueue as la}from"./orchestration/index.js";import{triageBucketPolicy as Aa,isEnforceSslStatement as Ra,toResourcePolicyStatements as _a,restoreBucketPolicy as pa,synthesiseEnforceSslDocument as ma,ensureEnforceSsl as ua,restoreAndReconcileQuarantinedBucket as da}from"./orchestration/index.js";import{verifyOrgTrailDelivery as Oa}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as fa,isRootTaskPolicyArn as Ca,ROOT_TASK_POLICY_ARNS as Na,MAX_ROOT_SESSION_SECONDS as ga}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as Ia,flattenAccountsToEnvironments as ya,extractAllAccountNames as ha,accountsConfigToOUTree as Fa,isStringArray as Ua,isAccountsConfig as va,isOuOnlyAccountBucket as xa,OU_ONLY_ACCOUNT_BUCKETS as Ma}from"./orchestration/index.js";import{runOpenNextBuild as ba}from"./orchestration/index.js";import{runOrganisationSetup as Ya,ORG_SETUP_PHASES as Ba}from"./orchestration/index.js";import{DOMAIN_DELEGATION_ERROR_TYPES as Ka,DomainDelegationError as Xa,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as Ha,PUBLIC_DNS_QUERY_TIMEOUT_MS as wa,createPublicResolvers as Ja,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Qa,NS_PROPAGATION_DEFAULT_INTERVAL_MS as ja,waitForNsPropagation as Wa,ACM_CAA_ISSUERS as qa,runCaaPreflight as Za,deployDelegatedDomain as za,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as $a,templateOwnsDelegationRecord as en,deleteChildNsFromParent as rn,nsDelegationPhysicalName as tn,runDelegatedDomainDestroy as on}from"./orchestration/index.js";import{resolveBuildSecrets as nn,resolveSecretRefValue as sn,resolveBuildSecretSessionProvider as En,sourcedRefsFromBuildArgs as cn,resolveBuildArgs as Sn,buildBuildSecretSessionPolicy as ln,buildDeploySessionPolicy as Tn,partitionForRegion as An,validateBuildGroup as Rn}from"./orchestration/index.js";import{FrameworkRegistry as pn}from"./orchestration/index.js";import{openNextBuilder as un,staticSiteBuilder as dn,dockerBuilder as Pn}from"./orchestration/index.js";import{StepRegistry as Dn,getDestroyStepId as fn}from"./steps/index.js";import{buildDeployPlan as Nn,computeDeployPlan as gn,computeAssemblyDigest as Ln,digestHead as In,classifyImpact as yn,derivePropertyChanges as hn,isDataLoss as Fn,isStatefulResourceType as Un,renderPlanSummary as vn,renderPlanLines as xn,toWirePlanChanges as Mn,signApprovalToken as kn,verifyApprovalToken as bn,DEFAULT_APPROVAL_TTL_MS as Vn,APPROVAL_TOKEN_PATTERN as Yn,runApprovalGate as Bn}from"./orchestration/index.js";import{runDestructionGate as Kn,buildDestructionTicket as Xn,evaluateDestructionConsents as Hn,computeTicketDigest as wn,legalRemediationVerbs as Jn,executableRemediationVerbs as Qn,advertisableRemediationVerbs as jn,renderDestructionTicketLines as Wn,renderConsentVerdictLines as qn,loadDeployPlan as Zn,createMemoisedPlanLoader as zn}from"./orchestration/index.js";export{qa as ACM_CAA_ISSUERS,X as ALL_PROGRESS_KINDS,Pr as APPLICATION_DEPLOY_ORDER,Or as APPLICATION_DESTROY_ORDER,ur as APPLICATION_STACKS,K as APPROVAL_DECISIONS,G as APPROVAL_KINDS,Yn as APPROVAL_TOKEN_PATTERN,jr as ApplicationError,kt as ApplicationStackService,Kt as AuthError,Xt as AwsError,b as BUILDERS,Bt as BaseServiceError,v as CASCADE_ACCOUNT_PHASES,c as CASCADE_ACCOUNT_STATUSES,V as CASCADE_OUTCOME_RESULTS,E as CASCADE_PHASES,Jr as CDK_NO_STACKS_MATCH,qe as CONSENT_VERDICTS,$a as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Tt as CdkArgumentBuilder,ht as CdkContextBuilder,Vt as CdkError,Rt as CdkEventMonitor,At as CdkProcessManager,lt as CdkService,p as ChangeCountsSchema,Ct as CloudFormationError,ct as CloudFormationEventMonitor,ft as CloudFormationService,Qt as ConfigError,Vn as DEFAULT_APPROVAL_TTL_MS,pt as DEFAULT_DEPLOY_TIMEOUT_MS,Le as DEFAULT_MAX_PAGES,Ha as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,n as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,i as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,a as DEPLOYMENT_EVENT_STATUS_REASON_MAX,s as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,o as DEPLOYMENT_EVENT_TYPES,I as DEPLOY_EVENT_ARN_MAX,m as DEPLOY_EVENT_CONTRACT,u as DEPLOY_EVENT_CONTRACT_MAJOR,d as DEPLOY_EVENT_CONTRACT_MINOR,N as DEPLOY_EVENT_ERROR_MESSAGE_MAX,O as DEPLOY_EVENT_ID_MAX,f as DEPLOY_EVENT_MESSAGE_MAX,D as DEPLOY_EVENT_NAME_MAX,L as DEPLOY_EVENT_OUTPUT_MAX,C as DEPLOY_EVENT_STATUS_REASON_MAX,g as DEPLOY_EVENT_TRAIL_DETAIL_MAX,y as DEPLOY_EVENT_URL_MAX,x as DEPLOY_RESULTS,We as DESTRUCTION_FINDINGS,M as DETECTION_PHASES,Ka as DOMAIN_DELEGATION_ERROR_TYPES,si as DRIFT_PREFLIGHT_BUDGET_MS,ni as DRIFT_PREFLIGHT_TRIGGER_STATUSES,er as DRIFT_VERDICTS,l as DeployEventSchema,to as DeployModeSchema,A as DeployResourceSchema,Ht as DeploymentError,t as DeploymentEventSchema,Qe as DestructionConsentSchema,He as DestructionFindingSchema,je as DestructionOutcomeSchema,we as DestructionTicketResourceSchema,Je as DestructionTicketSchema,Xa as DomainDelegationError,or as DriftFindingSchema,ir as DriftJournalRecordSchema,zo as DriftProbe,oa as DriftRepairAvailableError,tr as DriftSuspectSchema,rr as DriftVerdictSchema,gt as EcsError,Nt as EcsService,Lt as EcsServiceResolver,Fi as FORGET_FLIP_SPEC,hi as FORGET_MARKER_KEY,Jt as FileSystemError,et as FjallStateFileSchema,pn as FrameworkRegistry,Ie as IDENTITY_STORE_PAGE_SIZE,Qr as INFRASTRUCTURE_FILENAME,Ye as INFRASTRUCTURE_STEP_NAMES,Be as INFRA_STEP_NAME,F as LOG_LEVELS,Ea as LeaseDeniedError,ga as MAX_ROOT_SESSION_SECONDS,ja as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Qa as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,wt as NetworkError,Dr as OPENNEXT_DEPLOY_ORDER,fr as OPENNEXT_DESTROY_ORDER,gr as OPENNEXT_PARALLEL_GROUPS,Xr as OPENNEXT_PATTERNS,dr as ORGANISATION_TYPES,Ba as ORG_SETUP_PHASES,Jo as ORG_TRAIL_BUCKET_OUTPUT_KEY,Ma as OU_ONLY_ACCOUNT_BUCKETS,Cr as PARALLEL_DEPLOY_GROUPS,Nr as PARALLEL_DESTROY_GROUPS,Lr as PARALLEL_OPERATION_TYPES,k as PHASE_STATUSES,Y as PLAN_ACTIONS,Ut as PROGRESS_MESSAGES,wa as PUBLIC_DNS_QUERY_TIMEOUT_MS,R as PlanChangeSchema,_ as PlanPropertyChangeSchema,mr as ProgressReporter,Ui as RECREATE_MARKER_KEY,di as REMEDIATION_JOURNAL_RETENTION_DAYS,sr as REMEDIATION_PHASES,Xe as REMEDIATION_VERB_GLOSS,B as REPLACEMENT_MODES,xe as ROOT_ACCESS_FEATURES,Na as ROOT_TASK_POLICY_ARNS,Sr as RemediationFlipProofSchema,lr as RemediationJournalRecordSchema,Er as RemediationPhaseSchema,cr as RemediationTargetSchema,Ke as RemediationVerbSchema,Tr as RemediationVerbWithSurgerySchema,Me as RootAccessEnablementError,Ue as SECURITY_SERVICE_PRINCIPALS,ce as SERVICE_PRINCIPALS,Ki as SNAPSHOT_CAPABLE_RESOURCE_TYPES,U as STACK_CLEANUP_PHASES,wr as STACK_FAILED_STATE_PATTERN,Hr as STACK_NOT_FOUND_PATTERN,h as STEP_COMPLETE_STATUSES,be as STEP_IDS,Ve as STEP_NAMES,P as SUPPORTED_CONTRACT_MARKERS,oo as ServiceArtefactSchema,io as ServiceArtefactsSchema,j as SimpleAwsProvider,na as StackUnavailableError,T as StepProgressSchema,Dn as StepRegistry,Ze as TICKET_VERDICT_SOURCES,Qo as TRAIL_BUCKET_OUTPUT_KEY,jo as TRAIL_KEY_ARN_OUTPUT_KEY,yt as TemplateHashError,It as TemplateHashService,ze as TicketVerdictSourceSchema,Gt as ValidationError,Fa as accountsConfigToOUTree,Oe as activateCostAllocationTags,le as activateTrustedAccess,ji as advertisableDriftVerbs,jn as advertisableRemediationVerbs,Di as applyRetainFlip,Si as archiveCompletedRemediationJournal,ro as artefactOutputKey,sa as assertLeaseBeforeStack,vi as assessForgetResumability,fa as assumeRootForTask,vo as buildAccountRegionPairs,de as buildAccountToOUMap,ln as buildBuildSecretSessionPolicy,Nn as buildDeployPlan,Tn as buildDeploySessionPolicy,Xn as buildDestructionTicket,Wi as buildDriftRepairTicket,Uo as buildRegionList,xt as buildStepContextBuildConfig,$ as buildTargetSetUnreadyAdvisory,z as buildTargetUnreadyAdvisory,Pi as captureRemediationForensics,xo as cascadeHomeRegion,Mo as cascadeOperationKey,ia as checkDeployPathStackAvailability,De as checkIdentityCentreStatus,te as checkRegionEnabled,q as checkTargetReadiness,qo as classifyDriftFailure,yn as classifyImpact,$o as clearDriftSuspects,xi as completeForgetAfterConverge,Mi as completeForgetAfterDeploy,fi as composeFlipCapabilities,ra as composePostFailureRepairOffer,Ce as composeSdkAbortSignal,Ln as computeAssemblyDigest,gn as computeDeployPlan,li as computeRemediationOpId,go as computeSecretsDrift,Ci as computeTemplateDigest,wn as computeTicketDigest,Mt as convertCloudFormationOutputsToRecord,pe as createAccount,H as createDeployEmitter,ot as createEmptyState,zn as createMemoisedPlanLoader,Ja as createPublicResolvers,So as createSequencedCallbacks,Xo as decideNextTransition,wo as decommissionMemberTrailStorage,ei as defaultDriftJournalDir,Oi as defaultRemediationForensicsDir,Ti as defaultRemediationJournalDir,rn as deleteChildNsFromParent,it as deleteStateFile,Po as deploy,za as deployDelegatedDomain,hn as derivePropertyChanges,Hi as deriveRemovalTemplate,zr as deriveResourcesFromManifestStacks,Ni as deriveRetainFlipTemplate,Lo as deriveStaleParameters,ne as describeOrganisation,Z as describeTargetReadinessReason,Do as destroy,oi as detectStackDrift,In as digestHead,Pn as dockerBuilder,ye as drainPages,Ft as emitProgress,ve as enableCentralisedRootAccess,Te as enableIpamDelegatedAdmin,se as enablePolicyTypes,Se as enableRamSharing,Ee as enableServiceAccess,ua as ensureEnforceSsl,ae as ensureOrganisationExists,me as ensureOrganisationalUnitsExist,Hn as evaluateDestructionConsents,Qn as executableRemediationVerbs,ha as extractAllAccountNames,Io as extractConsumedSsmParameters,Ne as extractErrorName,_o as failure,Zo as fetchLastOperationEvents,To as fileExists,qt as filterDangerousEnvVars,_e as findAccount,Pe as findDevelopmentOuId,gi as findMarkedResourcesByOpId,Ai as findRemediationJournalByOpId,wi as findRemovalDeletionFailures,Ji as findResourcesPresent,ya as flattenAccountsToEnvironments,ai as formatDriftPreFlightBlock,ta as formatDriftRepairOffer,ut as formatInfrastructureError,Zi as formatPinOutcomeDetail,ki as formatRecreateInFlightCures,Ur as getApplicationDeployOrder,vr as getApplicationDestroyOrder,xr as getApplicationStackName,Br as getApplicationStepId,Yr as getApplicationStepName,fn as getDestroyStepId,Mr as getOrganisationStackName,hr as getParallelDeployGroups,Fr as getParallelDestroyGroups,Pt as getSourceContext,nt as getStateFilePath,dt as getStructuralHint,Ot as hasCdkDifferences,no as hasDockerfile,ge as isAborted,va as isAccountsConfig,Ir as isApplicationOperation,kr as isApplicationStack,mt as isCdkError,Fn as isDataLoss,aa as isDeployPathBlockingStatus,Ra as isEnforceSslStatement,mo as isFailure,he as isOULeaf,Kr as isOpenNextPattern,yr as isOrganisationOperation,xa as isOuOnlyAccountBucket,br as isQuarantineDetail,_r as isRemediationPlaceholderPhysicalId,Vr as isRetainedBucketsDetail,Ca as isRootTaskPolicyArn,Un as isStatefulResourceType,Ua as isStringArray,po as isSuccess,Jn as legalRemediationVerbs,Re as listAccounts,Ri as listActiveRemediationOps,_i as listActiveRemediationOpsForContext,Zn as loadDeployPlan,Zt as maskSensitiveOutput,Go as mergeReconciledProviderAccounts,tn as nsDelegationPhysicalName,un as openNextBuilder,Ia as parseAccountsConfiguration,vt as parseBuildPhase,J as parseDeployContractVersion,w as parseDeployEvent,Dt as parseDiffOutput,zt as parseShellArgs,ho as partitionAccounts,An as partitionForRegion,bi as partitionPreFlightByRemediation,zi as pinProbeCoverage,ue as placeAccountsInOUs,ee as probeAccountStackExists,No as probeSecretsDrift,Vo as projectAccountRows,bo as projectScalarSummary,Li as proveFlipMetadataOnly,Qi as proveRemovalTargetsOnly,ri as readDriftSuspects,pi as readRemediationJournal,Ii as readRetainFlipState,rt as readStateFile,Bo as reconcileProviderAccounts,Ho as reconcileTrailMigration,ti as recordDriftSuspects,oe as regionDisabledMessage,st as regionSuffix,Fe as registerSecurityDelegates,Ar as remediationPhaseRank,Rr as remediationPlaceholderPhysicalId,qn as renderConsentVerdictLines,Wn as renderDestructionTicketLines,$i as renderPinReportLines,xn as renderPlanLines,vn as renderPlanSummary,Sn as resolveBuildArgs,En as resolveBuildSecretSessionProvider,nn as resolveBuildSecrets,sn as resolveSecretRefValue,Co as restart,da as restoreAndReconcileQuarantinedBucket,pa as restoreBucketPolicy,Bn as runApprovalGate,Za as runCaaPreflight,on as runDelegatedDomainDestroy,Kn as runDestructionGate,ii as runDriftPreFlight,qi as runDriftRepairGate,Vi as runForgetSurgery,ba as runOpenNextBuild,Ya as runOrganisationSetup,ea as runPinRemediation,Xi as runRecreatePreFlight,Bi as runRecreateSurgery,Ei as runRoute53RecordPreflight,kn as signApprovalToken,$t as sleep,Eo as sleepAbortable,fe as snapshotIdentityCentre,Gi as snapshotPolicyForType,cn as sourcedRefsFromBuildArgs,_t as startStackMonitoring,dn as staticSiteBuilder,qr as stubCallerIdentity,Ro as success,mi as sweepExpiredRemediationJournals,Yi as synthTemplateDeclaresResource,ma as synthesiseEnforceSslDocument,en as templateOwnsDelegationRecord,Gr as toPascalCase,_a as toResourcePolicyStatements,jt as toServiceError,Mn as toWirePlanChanges,Aa as triageBucketPolicy,Sa as unlockBucket,la as unlockQueue,Ae as updateBackupGlobalSettings,at as updateTemplateHash,Rn as validateBuildGroup,ar as verbsForDriftVerdict,bn as verifyApprovalToken,Oa as verifyOrgTrailDelivery,yi as verifyRetainFlipDiff,Wa as waitForNsPropagation,Wr as wrapApplicationError,ui as writeRemediationJournal,tt as writeStateFile};

package/dist/src/orchestration/activeDeploymentGuard.js

@@ -1,9 +1,9 @@
-import{success as u,failure as c}from"@fjall/generator";import{stackStatusMap as l}from"../aws/utils/stackStatus.js";import{BaseServiceError as f}from"../types/errors/ServiceError.js";class d extends f{stacks;constructor(r,o){super("STACK_UNAVAILABLE",r),this.stacks=o}}async function y(t,r,o){if(t.length===0)return u(void 0);const i=await Promise.all(t.map(async n=>{const e=await r.getStackStatus(n,void 0,o);return{name:n,result:e}})),a=[];for(const{name:n,result:e}of i){if(!e.success)return c(e.error);const s=e.data;if(s===null||s.status==="DOES_NOT_EXIST")continue;l[s.status]?.safeToRedeploy==="No"&&a.push({name:n,status:s.status})}if(a.length>0){const n=a.map(e=>`  ${e.name}: ${e.status}`).join(`
-`);return c(new Error(`Cannot proceed while stacks are busy:
+var d=Object.defineProperty;var u=(t,s)=>d(t,"name",{value:s,configurable:!0});import{success as c,failure as l}from"@fjall/generator";import{stackStatusMap as f}from"../aws/utils/stackStatus.js";import{BaseServiceError as p}from"../types/errors/ServiceError.js";class S extends p{static{u(this,"StackUnavailableError")}stacks;constructor(s,o){super("STACK_UNAVAILABLE",s),this.stacks=o}}async function _(t,s,o){if(t.length===0)return c(void 0);const i=await Promise.all(t.map(async n=>{const e=await s.getStackStatus(n,void 0,o);return{name:n,result:e}})),r=[];for(const{name:n,result:e}of i){if(!e.success)return l(e.error);const a=e.data;if(a===null||a.status==="DOES_NOT_EXIST")continue;f[a.status]?.safeToRedeploy==="No"&&r.push({name:n,status:a.status})}if(r.length>0){const n=r.map(e=>`  ${e.name}: ${e.status}`).join(`
+`);return l(new Error(`Cannot proceed while stacks are busy:
 ${n}
 
-Wait for the in-progress operation to complete, or use --force to override.`))}return u(void 0)}function p(t){return t==="REVIEW_IN_PROGRESS"?!1:t.endsWith("_IN_PROGRESS")||t==="DELETE_FAILED"?!0:l[t]===void 0||t==="UNKNOWN"}function S(t){const r=t.map(i=>`  ${i.name}: ${i.status}`).join(`
+Wait for the in-progress operation to complete, or use --force to override.`))}return c(void 0)}u(_,"checkActiveDeployments");function h(t){return t==="REVIEW_IN_PROGRESS"?!1:t.endsWith("_IN_PROGRESS")||t==="DELETE_FAILED"?!0:f[t]===void 0||t==="UNKNOWN"}u(h,"isDeployPathBlockingStatus");function m(t){const s=t.map(i=>`  ${i.name}: ${i.status}`).join(`
 `);return`Cannot start this deployment \u2014 ${t.length===1?"a CloudFormation stack is not available":"CloudFormation stacks are not available"}:
-${r}
+${s}
 
-Another operation may be in progress or need attention. Wait for it to finish, then retry. Check progress in the Fjall dashboard.`}async function b(t,r,o){if(t.length===0)return u(void 0);const i=await Promise.all(t.map(async n=>{const e=await r.getStackStatus(n,void 0,o);return{name:n,result:e}})),a=[];for(const{name:n,result:e}of i){if(!e.success)return c(e.error);const s=e.data;s===null||s.status==="DOES_NOT_EXIST"||p(s.status)&&a.push({name:n,status:s.status})}return a.length>0?c(new d(S(a),a)):u(void 0)}export{d as StackUnavailableError,y as checkActiveDeployments,b as checkDeployPathStackAvailability,p as isDeployPathBlockingStatus};
+Another operation may be in progress or need attention. Wait for it to finish, then retry. Check progress in the Fjall dashboard.`}u(m,"buildStackUnavailableMessage");async function v(t,s,o){if(t.length===0)return c(void 0);const i=await Promise.all(t.map(async n=>{const e=await s.getStackStatus(n,void 0,o);return{name:n,result:e}})),r=[];for(const{name:n,result:e}of i){if(!e.success)return l(e.error);const a=e.data;a===null||a.status==="DOES_NOT_EXIST"||h(a.status)&&r.push({name:n,status:a.status})}return r.length>0?l(new S(m(r),r)):c(void 0)}u(v,"checkDeployPathStackAvailability");export{S as StackUnavailableError,_ as checkActiveDeployments,v as checkDeployPathStackAvailability,h as isDeployPathBlockingStatus};

package/dist/src/orchestration/application/applicationDeploy.js

@@ -1 +1 @@
-import{join as se}from"path";import{CloudFormationClient as he}from"@aws-sdk/client-cloudformation";import{EC2Client as be}from"@aws-sdk/client-ec2";import{success as P,failure as d}from"@fjall/generator";import{logger as M}from"@fjall/util/logger";import{ImageTagSchema as we,getErrorMessage as ce,imageTagParameterName as Te,maskSensitiveOutput as S}from"@fjall/util";import{parseDockerDeclarationsFromManifest as Ee}from"@fjall/util/manifest";import{stubCallerIdentity as Ne}from"../../types/deployment/index.js";import{getApplicationDeployOrder as Pe,getApplicationStackName as C,getApplicationStepName as le,getApplicationStepId as de,APPLICATION_STACKS as N}from"../../types/operations.js";import{CdkContextBuilder as De}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as ve,bootstrapOrFail as Re}from"../contextHelpers.js";import{runDetectionPipeline as Ce}from"./detectionPipeline.js";import{STEP_IDS as U,STEP_NAMES as Ie}from"../../types/stepDefinitions.js";import{StepRegistry as Oe}from"../../steps/stepRegistry.js";import{checkTargetReadiness as Ae}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as Le}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as Me}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as ue,runDockerBuild as Be}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as Fe,getStackNamesToDeploy as $e,deployParallelPhase as xe,deployStackSequential as je,runDockerPreCompute as Ge,runLambdaVersionPublish as Ue,createBuildCallbacks as _e}from"./applicationDeployHelpers.js";import{captureDatabaseConnectionOutputs as He,captureServiceTaskDefinitions as Ke,reconcileDatabaseEndpointChange as We}from"./databaseEndpointReconcile.js";import{deployCodeOnly as qe}from"./codeOnlyDeploy.js";import{checkDeployPathStackAvailability as ge}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as _}from"./leaseGate.js";import{collectFullDeployArtefacts as Ve}from"./artefactCollection.js";import{CfnRegistryService as ze}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as Je}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as Ye}from"./approvalGate.js";import{buildDestructionTicket as Qe,runDestructionGate as Xe}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as Ze,signApprovalToken as et}from"./plan/approvalToken.js";import{computeAssemblyDigest as tt}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as rt}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as at}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as nt}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as pe}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as ot,runPinRemediation as it}from"../remediation/pinRemediation.js";import{runRecreatePreFlight as st}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as ct}from"../remediation/recreateResource.js";const B="applicationDeploy";function lt(e){const a=Object.entries(e);if(a.length===0)return;const n={};for(const[t,i]of a){const h=Te(t);n[h]=i}return n}function dt(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return d(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return d(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return d(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return d(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return d(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const a=Object.entries(e.serviceImageTags);if(a.length===0)return d(new Error("serviceImageTags must name at least one service"));for(const[n,t]of a){const i=we.safeParse(t);if(!i.success)return d(new Error(`serviceImageTags.${n} is not a valid image tag: ${i.error.message}`))}}return P(void 0)}function fe(e,a,n){if(e.onStackTargets===void 0||n.length===0)return;const t=a.awsProvider.getAccountId(),i=a.awsProvider.getRegion();e.onStackTargets(n.map(h=>({stackName:h,...t!==""?{accountId:t}:{},...i!==""?{region:i}:{}})))}async function zt(e,a,n){const{callbacks:t,options:i}=e,h=Date.now(),F=i?.mode??(i?.imageTag||i?.serviceImageTags?"rollback":i?.deployOnly?"code-only":"full");if(F==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),d(r)}const V=dt(i);if(!V.success){const r=S(V.error.message),o=new Error(r);return t.onError?.(o),d(o)}const $=De.buildDeploymentContext({deployType:"application",target:n.appName,path:n.path,region:a.awsProvider.getRegion(),callerIdentity:Ne(a.awsProvider.getAccountId()),...ve({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc})},{verbose:i?.verbose,infraOnly:i?.infraOnly},e.orgConfig),b=a.frameworkRegistry.resolve({appPath:n.path});let z;const I=F==="rollback";if(b&&!I){z=b.builder.plan({appPath:n.path},b.detection);const r=_e(t),o=await b.builder.build(n.path,z,r,{skipBuild:i?.skipBuild,infraOnly:i?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!o.success){const s=new Error(S(o.error.message));return t.onError?.(s),d(s)}}if(F==="code-only"||I){t.onLog?.(I?i?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(i.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${i?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=se(n.path,"cdk.out"),o=Ee(r),s=o.declaresBuild,g=b?.detection.hasDockerfile===!0,c=s||g;M.debug(B,"Deploy-only branch entered",{mode:F,imageTag:i?.imageTag,serviceImageTags:i?.serviceImageTags,appName:n.appName,appPath:n.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:b?.builder.name,hasDockerfileFromManifest:s,hasDockerfileFromDisk:g,hasDockerfile:c,manifestDockerServiceCount:o.ecsServices.length,manifestDockerPaths:o.ecsServices.map(p=>p.docker.path),manifestLambdaDockerEntryCount:o.lambdaEntries.length}),!s&&!g&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const u=await ge([C(n.appName,N.COMPUTE)],a.cfnService,e.abortSignal);if(!u.success)return t.onError?.(u.error),d(u.error);fe(t,a,[C(n.appName,N.COMPUTE)]);let y={},l;if(!I&&e.dockerProvider!==void 0&&c){M.debug(B,"Running Docker build before code-only deploy",{source:s?"manifest":"disk"});const p=await Be(e,a,n,t);if(!p.success)return d(p.error);y=p.data.contentHashTagsByService,l=p.data}else M.debug(B,"Skipping Docker build",{reason:I?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const k=await _(e.assertLeaseForStack,C(n.appName,N.COMPUTE),e.abortSignal);return k!==void 0?(t.onError?.(k),d(k)):qe(e,a,n,y,l)}t.onLog?.("Analysing infrastructure\u2026","info");const x=await Ce(n,a,$,t,e.abortSignal);if(!x.success){const r=new Error(S(x.error.message),{cause:x.error});return t.onError?.(r),d(r)}const m=x.data;try{await t.onDetectionComplete?.({...m,builderName:b?.builder.name??"unknown"})}catch(r){const o=new Error(S(ce(r)),{cause:r});return t.onError?.(o),d(o)}const me={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:i?.infraOnly??!1,hasDockerfile:m.hasDockerfile,pattern:m.pattern,resources:m.resources,...b&&{builderName:b.builder.name}},J=Oe.getSteps(me),Y=J.findIndex(r=>r.id===U.TARGET_READINESS),Q=await Me(t,{stepId:U.TARGET_READINESS,stepName:Ie.TARGET_READINESS,...Y>=0&&{stepIndex:Y,totalSteps:J.length}},async()=>{if(i?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=a.awsProvider.getAccountId(),o=e.orgConfig?.providerAccounts.find(u=>u.id===r)?.name,s=a.awsProvider.getCredentials(),g=Le(e.orgConfig),c=await Ae({cloudFormation:a.awsProvider.getClient(he),ec2:new be({region:g,...s!==void 0&&{credentials:s}})},{id:r,...o!==void 0&&{name:o}},a.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return c.success?c.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(S(c.data.advisory))}:{kind:"error",error:new Error(S(c.error.message),{cause:c.error})}},e.abortSignal);if(!Q.success)return Q;const w=Pe({pattern:m.pattern,resources:m.resources}),D=w.length,X=m.hasDockerfile&&e.dockerProvider!==void 0&&w.includes(N.COMPUTE)&&i?.infraOnly!==!0;if(!m.hasDifferences&&!i?.force&&!X){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(i?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=m.hasDockerfile&&e.dockerProvider!==void 0&&w.includes(N.COMPUTE);for(let s=0;s<w.length;s++){const g=w[s];r&&g===N.COMPUTE&&(t.onStepStart?.(U.DOCKER_OPERATIONS,ue),t.onStepComplete?.(U.DOCKER_OPERATIONS,ue,"skipped"));const c=de(g,"deploy"),u=le(g,"deploy");t.onStepStart?.(c,u,s,D),t.onStepComplete?.(c,u,"skipped",s,D)}const o=await a.stackService.resolveWebsiteUrl(n.appName);return P({target:n.appName,deploymentType:"application",outputs:o?{websiteUrl:o}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-h})}const j=se(n.path,"cdk.out"),E=$e({deployOrder:w,stackChanges:m.stackChanges,appName:n.appName,force:i?.force===!0,computeBuildPossible:X});fe(t,a,[...E]);const H=await ge([...E],a.cfnService,e.abortSignal);if(!H.success)return t.onError?.(H.error),d(H.error);const Z=tt(m.currentHashes),K=rt({cfnService:a.cfnService,cdkOutPath:j,changedStacks:[...E],assemblyDigest:Z,registry:new ze(a.awsProvider),changeSetProbe:new Je(a.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),W=await at(a.awsProvider,{stackNames:[...E],cdkOutPath:j,cfnService:a.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(W.kind==="blocked"){const r=new Error(W.message);return t.onError?.(r),d(r)}const ee=W.verifiedAbsentByNecessity??[],te=e.approvalGate!==void 0||i?.approvalToken!==void 0&&i.approvalToken!==""||i?.planOnly===!0;if(te){const r=await Ye({approvalGate:e.approvalGate,options:i??{},target:n.appName,cdkOutPath:j,detection:{stackChanges:m.stackChanges,currentHashes:m.currentHashes},cfnService:a.cfnService,loadPlan:K,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const o=r.data;if(o.kind==="rejected")return t.onLog?.(`Deploy rejected: ${S(o.reason)}`,"warn"),P({target:n.appName,deploymentType:"application",rejected:!0,artefacts:[],...o.planDetail!==void 0?{planDetail:o.planDetail}:{},durationMs:Date.now()-h});if(o.kind==="awaiting"){const s=await K(),g=s.success?Qe(s.data,ee):void 0;return P({target:n.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:o.approvalToken,assemblyDigest:o.assemblyDigest,planDetail:o.planDetail,...g!==void 0?{destructionTicket:g}:{},artefacts:[],durationMs:Date.now()-h})}}const T=await Xe({loadPlan:K,options:i??{},target:n.appName,callbacks:t,verifiedAbsentByNecessity:ee,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!T.success)return t.onError?.(T.error),d(T.error);if(T.data.kind==="withheld"){const r=te?et({assemblyDigest:Z,ttlMs:Ze}):void 0;return P({target:n.appName,deploymentType:"application",destructionPending:!0,destructionTicket:T.data.ticket,destructionOutcome:T.data.outcome,destructionHaltReasons:T.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-h})}if(T.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:o}=T.data,s=r.resources.filter(c=>o.get(c.physicalName)==="pin");if(s.length>0){t.onLog?.(`Pin remediation for ${n.appName}: probing live value(s) for ${s.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied`,"warn");const c=await it(a.awsProvider,{targets:s.map(u=>({stack:u.stack,logicalId:u.logicalId,resourceType:u.resourceType,physicalName:u.physicalName,offendingProperties:u.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const u of ot(c))t.onLog?.(u,"warn");return s.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),P({target:n.appName,deploymentType:"application",pinPending:!0,pinReport:c,pinDeferredConsents:r.resources.length-s.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-h})}const g=r.resources.filter(c=>c.finding==="pinned-name-replacement"&&o.get(c.physicalName)==="recreate");if(g.length>0){const c=new Map;for(const l of g){const k=c.get(l.stack)??[];k.push(l),c.set(l.stack,k)}const u=await st(a.awsProvider,{stacks:[...c].map(([l,k])=>({stackName:l,targets:k.map(p=>({logicalId:p.logicalId,resourceType:p.resourceType,physicalId:p.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!u.success){const l=new Error(S(u.error.message),{cause:u.error});return t.onError?.(l),d(l)}const y=[];for(const[l,k]of c){const p=await _(e.assertLeaseForStack,l,e.abortSignal,"destroy");if(p!==void 0)return y.length>0&&t.onLog?.(`Surgery already completed on ${y.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(p),d(p);const R=k.map(f=>f.physicalName);t.onLog?.(`Recreate remediation for ${n.appName}: orchestrating the pinned-name replacement of ${R.join(", ")} on ${l}`,"warn");const L=await ct(a.awsProvider,{stackName:l,targets:k.map(f=>({logicalId:f.logicalId,resourceType:f.resourceType,physicalId:f.physicalName})),appName:n.appName,consentedPhysicalNames:R,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:k.map(f=>f.logicalId),onProgress:f=>t.onLog?.(f,"info"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!L.success){const f=y.length>0?` Surgery already completed on ${y.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",G=new Error(S(`${L.error.message}${f}`));return t.onError?.(G),d(G)}y.push(`${l} (${R.join(", ")})`)}}}const re=await Re(a,$,t);if(!re.success)return re;const ae=C(n.appName,N.DATABASE),q=E.has(ae),ke=q?await He(a.cfnService,n.appName,e.abortSignal):void 0,ye=q?await Ke(a.ecsResolver,a.ecsService,n.appName,e.abortSignal):void 0,O={},A=new Map;let ne,oe={};const v=async()=>{!q||!A.has(ae)||await We({appName:n.appName,connectionOutputsBefore:ke,serviceTaskDefinitionsBefore:ye,services:{cfnService:a.cfnService,ecsService:a.ecsService,ecsResolver:a.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})};for(let r=0;r<w.length;r++){const o=w[r],s=C(n.appName,o),g=de(o,"deploy"),c=le(o,"deploy");if(!E.has(s)){t.onStepStart?.(g,c,r,D),t.onLog?.(`Skipping ${o} \u2014 no changes detected`,"info"),t.onStepComplete?.(g,c,"skipped",r,D);continue}const u=await _(e.assertLeaseForStack,s,e.abortSignal);if(u!==void 0)return await v(),t.onError?.(u),d(u);const y=Fe(w,r,n.appName,E);if(y.length>=2){const f=await xe(y,n,a,$,t,r,D,m,O,A);if(!f.success)return await v(),d(await pe(a.awsProvider,{stackNames:y.map(G=>C(n.appName,G)),appName:n.appName,originalError:f.error,cfnService:a.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=y.length-1;continue}const l=await Ge(o,e,a,n,t,m.hasDockerfile);if(l!==null&&!l.success)return await v(),d(l.error);l!==null&&l.success&&(ne=l.data);const k=l!==null&&l.success?l.data.contentHashTagsByService:{},p=lt(k);if(l!==null){const f=await _(e.assertLeaseForStack,s,e.abortSignal);if(f!==void 0)return await v(),t.onError?.(f),d(f)}const R=await je(o,a,$,t,r,D,O,p!==void 0||e.abortSignal!==void 0?{...p!==void 0?{parameters:p}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!R.success)return await v(),d(await pe(a.awsProvider,{stackNames:[s],appName:n.appName,originalError:R.error,cfnService:a.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));o===N.COMPUTE&&(oe=await Ue(n,a,t,k,e.abortSignal));const L=m.currentHashes.get(s);L&&A.set(s,L)}if(await v(),A.size>0){const r=await a.hashService.updateStateAfterDeploy(n.path,A);if(!r.success){const o=S(r.error.message);M.debug(B,"Failed to update state file",{error:o}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${o}`,"warn")}}const ie=await a.stackService.resolveWebsiteUrl(n.appName);ie&&(O.websiteUrl=ie);const Se=await Ve(a,n.appName,ne,t,j,oe,e.abortSignal);return await nt(a.awsProvider,{stackNames:[...E],appName:n.appName,onLog:(r,o)=>t.onLog?.(r,o),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{M.debug(B,"Forget completion sweep failed",{error:S(ce(r))})}),P({target:n.appName,deploymentType:"application",outputs:Object.keys(O).length>0?O:void 0,artefacts:Se,durationMs:Date.now()-h})}export{zt as deployApplication,fe as emitStackTargets};
+var be=Object.defineProperty;var N=(e,n)=>be(e,"name",{value:n,configurable:!0});import{join as ce}from"path";import{CloudFormationClient as we}from"@aws-sdk/client-cloudformation";import{EC2Client as Te}from"@aws-sdk/client-ec2";import{success as P,failure as d}from"@fjall/generator";import{logger as B}from"@fjall/util/logger";import{ImageTagSchema as Ee,getErrorMessage as le,imageTagParameterName as Ne,maskSensitiveOutput as S}from"@fjall/util";import{parseDockerDeclarationsFromManifest as De}from"@fjall/util/manifest";import{stubCallerIdentity as Pe}from"../../types/deployment/index.js";import{getApplicationDeployOrder as ve,getApplicationStackName as I,getApplicationStepName as de,getApplicationStepId as ue,APPLICATION_STACKS as D}from"../../types/operations.js";import{CdkContextBuilder as Re}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as Ce,bootstrapOrFail as Ie}from"../contextHelpers.js";import{runDetectionPipeline as Oe}from"./detectionPipeline.js";import{STEP_IDS as _,STEP_NAMES as Ae}from"../../types/stepDefinitions.js";import{StepRegistry as Le}from"../../steps/stepRegistry.js";import{checkTargetReadiness as Me}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as Be}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as Fe}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as ge,runDockerBuild as $e}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as xe,getStackNamesToDeploy as je,deployParallelPhase as Ge,deployStackSequential as Ue,runDockerPreCompute as _e,runLambdaVersionPublish as He,createBuildCallbacks as Ke}from"./applicationDeployHelpers.js";import{captureDatabaseConnectionOutputs as We,captureServiceTaskDefinitions as qe,reconcileDatabaseEndpointChange as Ve}from"./databaseEndpointReconcile.js";import{deployCodeOnly as ze}from"./codeOnlyDeploy.js";import{checkDeployPathStackAvailability as pe}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as H}from"./leaseGate.js";import{collectFullDeployArtefacts as Je}from"./artefactCollection.js";import{CfnRegistryService as Ye}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as Qe}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as Xe}from"./approvalGate.js";import{buildDestructionTicket as Ze,runDestructionGate as et}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as tt,signApprovalToken as rt}from"./plan/approvalToken.js";import{computeAssemblyDigest as nt}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as at}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as ot}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as it}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as fe}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as st,runPinRemediation as ct}from"../remediation/pinRemediation.js";import{runRecreatePreFlight as lt}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as dt}from"../remediation/recreateResource.js";const F="applicationDeploy";function ut(e){const n=Object.entries(e);if(n.length===0)return;const a={};for(const[t,i]of n){const h=Ne(t);a[h]=i}return a}N(ut,"buildCdkImageTagParameters");function gt(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return d(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return d(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return d(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return d(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return d(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const n=Object.entries(e.serviceImageTags);if(n.length===0)return d(new Error("serviceImageTags must name at least one service"));for(const[a,t]of n){const i=Ee.safeParse(t);if(!i.success)return d(new Error(`serviceImageTags.${a} is not a valid image tag: ${i.error.message}`))}}return P(void 0)}N(gt,"validateRollbackOptions");function me(e,n,a){if(e.onStackTargets===void 0||a.length===0)return;const t=n.awsProvider.getAccountId(),i=n.awsProvider.getRegion();e.onStackTargets(a.map(h=>({stackName:h,...t!==""?{accountId:t}:{},...i!==""?{region:i}:{}})))}N(me,"emitStackTargets");async function Qt(e,n,a){const{callbacks:t,options:i}=e,h=Date.now(),$=i?.mode??(i?.imageTag||i?.serviceImageTags?"rollback":i?.deployOnly?"code-only":"full");if($==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),d(r)}const z=gt(i);if(!z.success){const r=S(z.error.message),o=new Error(r);return t.onError?.(o),d(o)}const x=Re.buildDeploymentContext({deployType:"application",target:a.appName,path:a.path,region:n.awsProvider.getRegion(),callerIdentity:Pe(n.awsProvider.getAccountId()),...Ce({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc}),...e.managedDomainBindings!==void 0?{managedDomainBindings:e.managedDomainBindings}:{}},{verbose:i?.verbose,infraOnly:i?.infraOnly},e.orgConfig),b=n.frameworkRegistry.resolve({appPath:a.path});let J;const O=$==="rollback";if(b&&!O){J=b.builder.plan({appPath:a.path},b.detection);const r=Ke(t),o=await b.builder.build(a.path,J,r,{skipBuild:i?.skipBuild,infraOnly:i?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!o.success){const s=new Error(S(o.error.message));return t.onError?.(s),d(s)}}if($==="code-only"||O){t.onLog?.(O?i?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(i.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${i?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=ce(a.path,"cdk.out"),o=De(r),s=o.declaresBuild,g=b?.detection.hasDockerfile===!0,c=s||g;B.debug(F,"Deploy-only branch entered",{mode:$,imageTag:i?.imageTag,serviceImageTags:i?.serviceImageTags,appName:a.appName,appPath:a.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:b?.builder.name,hasDockerfileFromManifest:s,hasDockerfileFromDisk:g,hasDockerfile:c,manifestDockerServiceCount:o.ecsServices.length,manifestDockerPaths:o.ecsServices.map(p=>p.docker.path),manifestLambdaDockerEntryCount:o.lambdaEntries.length}),!s&&!g&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const u=await pe([I(a.appName,D.COMPUTE)],n.cfnService,e.abortSignal);if(!u.success)return t.onError?.(u.error),d(u.error);me(t,n,[I(a.appName,D.COMPUTE)]);let y={},l;if(!O&&e.dockerProvider!==void 0&&c){B.debug(F,"Running Docker build before code-only deploy",{source:s?"manifest":"disk"});const p=await $e(e,n,a,t);if(!p.success)return d(p.error);y=p.data.contentHashTagsByService,l=p.data}else B.debug(F,"Skipping Docker build",{reason:O?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const k=await H(e.assertLeaseForStack,I(a.appName,D.COMPUTE),e.abortSignal);return k!==void 0?(t.onError?.(k),d(k)):ze(e,n,a,y,l)}t.onLog?.("Analysing infrastructure\u2026","info");const j=await Oe(a,n,x,t,e.abortSignal);if(!j.success){const r=new Error(S(j.error.message),{cause:j.error});return t.onError?.(r),d(r)}const m=j.data;try{await t.onDetectionComplete?.({...m,builderName:b?.builder.name??"unknown"})}catch(r){const o=new Error(S(le(r)),{cause:r});return t.onError?.(o),d(o)}const ke={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:i?.infraOnly??!1,hasDockerfile:m.hasDockerfile,pattern:m.pattern,resources:m.resources,...b&&{builderName:b.builder.name}},Y=Le.getSteps(ke),Q=Y.findIndex(r=>r.id===_.TARGET_READINESS),X=await Fe(t,{stepId:_.TARGET_READINESS,stepName:Ae.TARGET_READINESS,...Q>=0&&{stepIndex:Q,totalSteps:Y.length}},async()=>{if(i?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=n.awsProvider.getAccountId(),o=e.orgConfig?.providerAccounts.find(u=>u.id===r)?.name,s=n.awsProvider.getCredentials(),g=Be(e.orgConfig),c=await Me({cloudFormation:n.awsProvider.getClient(we),ec2:new Te({region:g,...s!==void 0&&{credentials:s}})},{id:r,...o!==void 0&&{name:o}},n.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return c.success?c.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(S(c.data.advisory))}:{kind:"error",error:new Error(S(c.error.message),{cause:c.error})}},e.abortSignal);if(!X.success)return X;const w=ve({pattern:m.pattern,resources:m.resources}),v=w.length,Z=m.hasDockerfile&&e.dockerProvider!==void 0&&w.includes(D.COMPUTE)&&i?.infraOnly!==!0;if(!m.hasDifferences&&!i?.force&&!Z){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(i?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=m.hasDockerfile&&e.dockerProvider!==void 0&&w.includes(D.COMPUTE);for(let s=0;s<w.length;s++){const g=w[s];r&&g===D.COMPUTE&&(t.onStepStart?.(_.DOCKER_OPERATIONS,ge),t.onStepComplete?.(_.DOCKER_OPERATIONS,ge,"skipped"));const c=ue(g,"deploy"),u=de(g,"deploy");t.onStepStart?.(c,u,s,v),t.onStepComplete?.(c,u,"skipped",s,v)}const o=await n.stackService.resolveWebsiteUrl(a.appName);return P({target:a.appName,deploymentType:"application",outputs:o?{websiteUrl:o}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-h})}const G=ce(a.path,"cdk.out"),E=je({deployOrder:w,stackChanges:m.stackChanges,appName:a.appName,force:i?.force===!0,computeBuildPossible:Z});me(t,n,[...E]);const K=await pe([...E],n.cfnService,e.abortSignal);if(!K.success)return t.onError?.(K.error),d(K.error);const ee=nt(m.currentHashes),W=at({cfnService:n.cfnService,cdkOutPath:G,changedStacks:[...E],assemblyDigest:ee,registry:new Ye(n.awsProvider),changeSetProbe:new Qe(n.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),q=await ot(n.awsProvider,{stackNames:[...E],cdkOutPath:G,cfnService:n.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(q.kind==="blocked"){const r=new Error(q.message);return t.onError?.(r),d(r)}const te=q.verifiedAbsentByNecessity??[],re=e.approvalGate!==void 0||i?.approvalToken!==void 0&&i.approvalToken!==""||i?.planOnly===!0;if(re){const r=await Xe({approvalGate:e.approvalGate,options:i??{},target:a.appName,cdkOutPath:G,detection:{stackChanges:m.stackChanges,currentHashes:m.currentHashes},cfnService:n.cfnService,loadPlan:W,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const o=r.data;if(o.kind==="rejected")return t.onLog?.(`Deploy rejected: ${S(o.reason)}`,"warn"),P({target:a.appName,deploymentType:"application",rejected:!0,artefacts:[],...o.planDetail!==void 0?{planDetail:o.planDetail}:{},durationMs:Date.now()-h});if(o.kind==="awaiting"){const s=await W(),g=s.success?Ze(s.data,te):void 0;return P({target:a.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:o.approvalToken,assemblyDigest:o.assemblyDigest,planDetail:o.planDetail,...g!==void 0?{destructionTicket:g}:{},artefacts:[],durationMs:Date.now()-h})}}const T=await et({loadPlan:W,options:i??{},target:a.appName,callbacks:t,verifiedAbsentByNecessity:te,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!T.success)return t.onError?.(T.error),d(T.error);if(T.data.kind==="withheld"){const r=re?rt({assemblyDigest:ee,ttlMs:tt}):void 0;return P({target:a.appName,deploymentType:"application",destructionPending:!0,destructionTicket:T.data.ticket,destructionOutcome:T.data.outcome,destructionHaltReasons:T.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-h})}if(T.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:o}=T.data,s=r.resources.filter(c=>o.get(c.physicalName)==="pin");if(s.length>0){t.onLog?.(`Pin remediation for ${a.appName}: probing live value(s) for ${s.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied`,"warn");const c=await ct(n.awsProvider,{targets:s.map(u=>({stack:u.stack,logicalId:u.logicalId,resourceType:u.resourceType,physicalName:u.physicalName,offendingProperties:u.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const u of st(c))t.onLog?.(u,"warn");return s.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),P({target:a.appName,deploymentType:"application",pinPending:!0,pinReport:c,pinDeferredConsents:r.resources.length-s.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-h})}const g=r.resources.filter(c=>c.finding==="pinned-name-replacement"&&o.get(c.physicalName)==="recreate");if(g.length>0){const c=new Map;for(const l of g){const k=c.get(l.stack)??[];k.push(l),c.set(l.stack,k)}const u=await lt(n.awsProvider,{stacks:[...c].map(([l,k])=>({stackName:l,targets:k.map(p=>({logicalId:p.logicalId,resourceType:p.resourceType,physicalId:p.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!u.success){const l=new Error(S(u.error.message),{cause:u.error});return t.onError?.(l),d(l)}const y=[];for(const[l,k]of c){const p=await H(e.assertLeaseForStack,l,e.abortSignal,"destroy");if(p!==void 0)return y.length>0&&t.onLog?.(`Surgery already completed on ${y.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(p),d(p);const C=k.map(f=>f.physicalName);t.onLog?.(`Recreate remediation for ${a.appName}: orchestrating the pinned-name replacement of ${C.join(", ")} on ${l}`,"warn");const M=await dt(n.awsProvider,{stackName:l,targets:k.map(f=>({logicalId:f.logicalId,resourceType:f.resourceType,physicalId:f.physicalName})),appName:a.appName,consentedPhysicalNames:C,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:k.map(f=>f.logicalId),onProgress:N(f=>t.onLog?.(f,"info"),"onProgress"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!M.success){const f=y.length>0?` Surgery already completed on ${y.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",U=new Error(S(`${M.error.message}${f}`));return t.onError?.(U),d(U)}y.push(`${l} (${C.join(", ")})`)}}}const ne=await Ie(n,x,t);if(!ne.success)return ne;const ae=I(a.appName,D.DATABASE),V=E.has(ae),ye=V?await We(n.cfnService,a.appName,e.abortSignal):void 0,Se=V?await qe(n.ecsResolver,n.ecsService,a.appName,e.abortSignal):void 0,A={},L=new Map;let oe,ie={};const R=N(async()=>{!V||!L.has(ae)||await Ve({appName:a.appName,connectionOutputsBefore:ye,serviceTaskDefinitionsBefore:Se,services:{cfnService:n.cfnService,ecsService:n.ecsService,ecsResolver:n.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let r=0;r<w.length;r++){const o=w[r],s=I(a.appName,o),g=ue(o,"deploy"),c=de(o,"deploy");if(!E.has(s)){t.onStepStart?.(g,c,r,v),t.onLog?.(`Skipping ${o} \u2014 no changes detected`,"info"),t.onStepComplete?.(g,c,"skipped",r,v);continue}const u=await H(e.assertLeaseForStack,s,e.abortSignal);if(u!==void 0)return await R(),t.onError?.(u),d(u);const y=xe(w,r,a.appName,E);if(y.length>=2){const f=await Ge(y,a,n,x,t,r,v,m,A,L);if(!f.success)return await R(),d(await fe(n.awsProvider,{stackNames:y.map(U=>I(a.appName,U)),appName:a.appName,originalError:f.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=y.length-1;continue}const l=await _e(o,e,n,a,t,m.hasDockerfile);if(l!==null&&!l.success)return await R(),d(l.error);l!==null&&l.success&&(oe=l.data);const k=l!==null&&l.success?l.data.contentHashTagsByService:{},p=ut(k);if(l!==null){const f=await H(e.assertLeaseForStack,s,e.abortSignal);if(f!==void 0)return await R(),t.onError?.(f),d(f)}const C=await Ue(o,n,x,t,r,v,A,p!==void 0||e.abortSignal!==void 0?{...p!==void 0?{parameters:p}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!C.success)return await R(),d(await fe(n.awsProvider,{stackNames:[s],appName:a.appName,originalError:C.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));o===D.COMPUTE&&(ie=await He(a,n,t,k,e.abortSignal));const M=m.currentHashes.get(s);M&&L.set(s,M)}if(await R(),L.size>0){const r=await n.hashService.updateStateAfterDeploy(a.path,L);if(!r.success){const o=S(r.error.message);B.debug(F,"Failed to update state file",{error:o}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${o}`,"warn")}}const se=await n.stackService.resolveWebsiteUrl(a.appName);se&&(A.websiteUrl=se);const he=await Je(n,a.appName,oe,t,G,ie,e.abortSignal);return await it(n.awsProvider,{stackNames:[...E],appName:a.appName,onLog:N((r,o)=>t.onLog?.(r,o),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{B.debug(F,"Forget completion sweep failed",{error:S(le(r))})}),P({target:a.appName,deploymentType:"application",outputs:Object.keys(A).length>0?A:void 0,artefacts:he,durationMs:Date.now()-h})}N(Qt,"deployApplication");export{Qt as deployApplication,me as emitStackTargets};

package/dist/src/orchestration/application/applicationDeployHelpers.js

@@ -1,4 +1,4 @@
-import{join as O}from"node:path";import{success as P,failure as S}from"@fjall/generator";import{maskSensitiveOutput as y}from"@fjall/util";import{parseLambdaDockerEntriesFromManifest as B}from"@fjall/util/manifest";import{isAborted as L}from"../../aws/organisations/types.js";import{APPLICATION_STACKS as C,getApplicationStackName as w,getApplicationStepName as N,getApplicationStepId as b,PARALLEL_DEPLOY_GROUPS as $}from"../../types/operations.js";import{emitProgress as R}from"../../services/supporting/helpers.js";import{forwardOutput as k,forwardResourceProgress as T}from"../contextHelpers.js";import{emptyBuildProducts as j,runDockerBuild as D}from"./dockerBuildHelper.js";import{runWelcomeImageSetup as I}from"./welcomeImageHelper.js";import{withStepLifecycle as _}from"../stepLifecycle.js";function z(e){const n=new Set;for(const s of e.deployOrder){const i=w(e.appName,s),r=e.stackChanges.get(i)??!0,a=s===C.COMPUTE&&e.computeBuildPossible;(r||e.force||a)&&n.add(i)}return n}function J(e,n,s,i){const r=new Set($.PHASE_2.stacks),a=[];for(let o=n;o<e.length&&r.has(e[o]);o++)a.push(e[o]);if(a.length<2)return[];const c=a.filter(o=>i.has(w(s,o)));return c.length>=2?c:[]}async function Q(e,n,s,i,r,a,c,o,f,l){for(let t=0;t<e.length;t++){const d=e[t],p=b(d,"deploy"),m=N(d,"deploy");r.onStepStart?.(p,m,a+t,c)}R(r,"Deploying infrastructure in parallel\u2026"),r.onParallelPhaseStart?.(e,"Storage and database resources (parallel)");const u=await s.stackService.deployStacksInParallel(e,i,{onOutput:k(r),onResourceProgress:(t,d)=>{r.onResourceProgress?.(t),d&&r.onParallelStackResourceProgress?.(d,t)},onStackComplete:(t,d,p,m)=>{const h=b(t,"deploy"),x=N(t,"deploy"),A=a+e.indexOf(t),E=L(s.abortSignal);r.onStepComplete?.(h,x,d?"completed":E?"cancelled":"error",A,c),!d&&m&&!E&&r.onError?.(new Error(y(m.message)))}});if(!u.success)return r.onParallelPhaseComplete?.([]),S(u.error);const g=u.data.filter(t=>!t.success);if(r.onParallelPhaseComplete?.(u.data.map(t=>({stack:t.stack,success:t.success,error:t.error}))),g.length>0){const t=g.map(p=>p.stack).join(", "),d=g.map(p=>`${p.stack}: ${y(p.error?.message??"Unknown error")}`).join(`
-`);return S(new Error(`Failed to deploy stacks: ${t}
+var B=Object.defineProperty;var d=(e,r)=>B(e,"name",{value:r,configurable:!0});import{join as $}from"node:path";import{success as y,failure as h}from"@fjall/generator";import{maskSensitiveOutput as w}from"@fjall/util";import{parseLambdaDockerEntriesFromManifest as R}from"@fjall/util/manifest";import{isAborted as C}from"../../aws/organisations/types.js";import{APPLICATION_STACKS as k,getApplicationStackName as N,getApplicationStepName as b,getApplicationStepId as E,PARALLEL_DEPLOY_GROUPS as T}from"../../types/operations.js";import{emitProgress as j}from"../../services/supporting/helpers.js";import{forwardOutput as x,forwardResourceProgress as D}from"../contextHelpers.js";import{emptyBuildProducts as I,runDockerBuild as _}from"./dockerBuildHelper.js";import{runWelcomeImageSetup as v}from"./welcomeImageHelper.js";import{withStepLifecycle as U}from"../stepLifecycle.js";function X(e){const r=new Set;for(const s of e.deployOrder){const i=N(e.appName,s),o=e.stackChanges.get(i)??!0,a=s===k.COMPUTE&&e.computeBuildPossible;(o||e.force||a)&&r.add(i)}return r}d(X,"getStackNamesToDeploy");function Z(e,r,s,i){const o=new Set(T.PHASE_2.stacks),a=[];for(let n=r;n<e.length&&o.has(e[n]);n++)a.push(e[n]);if(a.length<2)return[];const l=a.filter(n=>i.has(N(s,n)));return l.length>=2?l:[]}d(Z,"getParallelPhase2Stacks");async function ee(e,r,s,i,o,a,l,n,m,p){for(let t=0;t<e.length;t++){const c=e[t],f=E(c,"deploy"),g=b(c,"deploy");o.onStepStart?.(f,g,a+t,l)}j(o,"Deploying infrastructure in parallel\u2026"),o.onParallelPhaseStart?.(e,"Storage and database resources (parallel)");const u=await s.stackService.deployStacksInParallel(e,i,{onOutput:x(o),onResourceProgress:d((t,c)=>{o.onResourceProgress?.(t),c&&o.onParallelStackResourceProgress?.(c,t)},"onResourceProgress"),onStackComplete:d((t,c,f,g)=>{const P=E(t,"deploy"),A=b(t,"deploy"),O=a+e.indexOf(t),L=C(s.abortSignal);o.onStepComplete?.(P,A,c?"completed":L?"cancelled":"error",O,l),!c&&g&&!L&&o.onError?.(new Error(w(g.message)))},"onStackComplete")});if(!u.success)return o.onParallelPhaseComplete?.([]),h(u.error);const S=u.data.filter(t=>!t.success);if(o.onParallelPhaseComplete?.(u.data.map(t=>({stack:t.stack,success:t.success,error:t.error}))),S.length>0){const t=S.map(f=>f.stack).join(", "),c=S.map(f=>`${f.stack}: ${w(f.error?.message??"Unknown error")}`).join(`
+`);return h(new Error(`Failed to deploy stacks: ${t}
 
-${d}`))}for(const t of u.data){if(t.success&&t.outputs)for(const[m,h]of Object.entries(t.outputs))f[m]=String(h);const d=w(n.appName,t.stack),p=o.currentHashes.get(d);p&&l.set(d,p)}return P(void 0)}async function X(e,n,s,i,r,a,c,o){const f=b(e,"deploy"),l=N(e,"deploy");return _(i,{stepId:f,stepName:l,stepIndex:r,totalSteps:a},async()=>{const u=await n.stackService.deployStack(e,s,{onOutput:k(i),onResourceProgress:T(i)},o?.parameters!==void 0||o?.abortSignal!==void 0?{...o?.parameters!==void 0?{parameters:o.parameters}:{},...o?.abortSignal!==void 0?{abortSignal:o.abortSignal}:{}}:void 0);if(!u.success)return{kind:"error",error:u.error};if(u.data.outputs)for(const[g,t]of Object.entries(u.data.outputs))c[g]=String(t);return{kind:"completed",data:void 0}},n.abortSignal)}async function Z(e,n,s,i,r,a){if(e!==C.COMPUTE||!n.dockerProvider)return null;if(a){const o=await D(n,s,i,r);return o.success?P(o.data):S(o.error)}const c=await I(n,s,i,r);return c.success?P(j()):S(c.error)}async function ee(e,n,s,i,r){if(Object.keys(i).length===0)return{};const a=O(e.path,"cdk.out"),o=B(a).filter(l=>i[l.imageKey]!==void 0);if(o.length===0)return{};const f={};for(const l of o){if(L(r)){s.onLog?.(`Skipping the Lambda version publish for '${l.name}' \u2014 the deployment was cancelled. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}const u=await n.lambdaService.publishVersion(l.name,r);if(!u.success){s.onLog?.(`Published image for Lambda '${l.name}', but publishing a new version failed: ${y(u.error.message)}. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}f[l.name]=u.data}return f}function te(e){return{onBuildStart:n=>{e.onOpenNextBuildStart?.(),e.onLog?.(`${n} build started`,"info")},onBuildProgress:(n,s)=>{e.onOpenNextProgress?.(s)},onBuildComplete:n=>{e.onOpenNextBuildComplete?.(),e.onLog?.(`${n} build complete`,"info")},onBuildError:(n,s)=>{e.onOpenNextBuildError?.(s)}}}export{te as createBuildCallbacks,Q as deployParallelPhase,X as deployStackSequential,J as getParallelPhase2Stacks,z as getStackNamesToDeploy,Z as runDockerPreCompute,ee as runLambdaVersionPublish};
+${c}`))}for(const t of u.data){if(t.success&&t.outputs)for(const[g,P]of Object.entries(t.outputs))m[g]=String(P);const c=N(r.appName,t.stack),f=n.currentHashes.get(c);f&&p.set(c,f)}return y(void 0)}d(ee,"deployParallelPhase");async function te(e,r,s,i,o,a,l,n){const m=E(e,"deploy"),p=b(e,"deploy");return U(i,{stepId:m,stepName:p,stepIndex:o,totalSteps:a},async()=>{const u=await r.stackService.deployStack(e,s,{onOutput:x(i),onResourceProgress:D(i)},n?.parameters!==void 0||n?.abortSignal!==void 0?{...n?.parameters!==void 0?{parameters:n.parameters}:{},...n?.abortSignal!==void 0?{abortSignal:n.abortSignal}:{}}:void 0);if(!u.success)return{kind:"error",error:u.error};if(u.data.outputs)for(const[S,t]of Object.entries(u.data.outputs))l[S]=String(t);return{kind:"completed",data:void 0}},r.abortSignal)}d(te,"deployStackSequential");async function re(e,r,s,i,o,a){if(e!==k.COMPUTE||!r.dockerProvider)return null;if(a){const n=await _(r,s,i,o);return n.success?y(n.data):h(n.error)}const l=await v(r,s,i,o);return l.success?y(I()):h(l.error)}d(re,"runDockerPreCompute");async function oe(e,r,s,i,o){if(Object.keys(i).length===0)return{};const a=$(e.path,"cdk.out"),n=R(a).filter(p=>i[p.imageKey]!==void 0);if(n.length===0)return{};const m={};for(const p of n){if(C(o)){s.onLog?.(`Skipping the Lambda version publish for '${p.name}' \u2014 the deployment was cancelled. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}const u=await r.lambdaService.publishVersion(p.name,o);if(!u.success){s.onLog?.(`Published image for Lambda '${p.name}', but publishing a new version failed: ${w(u.error.message)}. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}m[p.name]=u.data}return m}d(oe,"runLambdaVersionPublish");function ne(e){return{onBuildStart:d(r=>{e.onOpenNextBuildStart?.(),e.onLog?.(`${r} build started`,"info")},"onBuildStart"),onBuildProgress:d((r,s)=>{e.onOpenNextProgress?.(s)},"onBuildProgress"),onBuildComplete:d(r=>{e.onOpenNextBuildComplete?.(),e.onLog?.(`${r} build complete`,"info")},"onBuildComplete"),onBuildError:d((r,s)=>{e.onOpenNextBuildError?.(s)},"onBuildError")}}d(ne,"createBuildCallbacks");export{ne as createBuildCallbacks,ee as deployParallelPhase,te as deployStackSequential,Z as getParallelPhase2Stacks,X as getStackNamesToDeploy,re as runDockerPreCompute,oe as runLambdaVersionPublish};

package/dist/src/orchestration/application/applicationDestroy.js

@@ -1 +1 @@
-import{success as x,failure as y}from"@fjall/generator";import{getErrorMessage as P}from"@fjall/util";import{logger as k}from"@fjall/util/logger";import{getApplicationDestroyOrder as D,getApplicationStackName as F,getApplicationStepName as C,getApplicationStepId as w}from"../../types/operations.js";import{emitStackTargets as L}from"./applicationDeploy.js";import{runDestroyPreFlight as R}from"./destroyPreFlight.js";import{stubCallerIdentity as A}from"../../types/deployment/index.js";import{deriveResourcesFromManifestStacks as I}from"../../types/detection/patternDetection.js";import{CdkContextBuilder as O}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as $}from"../contextHelpers.js";import{deleteStateFile as v,readStateFile as E}from"../../types/config/FjallState.js";async function V(r,s,a){const{callbacks:t}=r,b=Date.now(),f=s.frameworkRegistry.resolve({appPath:a.path})?.detection.pattern??null;let d;try{const e=await E(a.path);if(e!==null){const o=Object.keys(e.templateHashes);o.length>0&&(d=I(o))}}catch(e){k.debug("applicationDestroy","Could not read state file for resource detection",{error:P(e)}),t.onLog?.("Could not read state file for resource detection \u2014 falling back to pattern detection","warn")}const N=O.buildDeploymentContext({deployType:"application",target:a.appName,path:a.path,region:s.awsProvider.getRegion(),callerIdentity:A(s.awsProvider.getAccountId()),...$({orgConfig:r.orgConfig,identity:r.identity})},{verbose:r.options?.verbose},r.orgConfig),p=D({pattern:f,resources:d}),l=p.length;t.onLog?.(`Destroying ${a.appName} (${l} stacks, ${f??"standard"} pattern)`,"info");const u=p.map(e=>F(a.appName,e));L(t,s,u);const g=await R(s.awsProvider,{stackNames:u,abortSignal:r.abortSignal});if(!g.success)return t.onError?.(g.error),y(g.error);const S=[],h=[],m=await s.stackService.destroyAllStacks(N,{onOutput:e=>{t.onOutput?.(e)},onLog:t.onLog,onStackCleanupProgress:t.onStackCleanupProgress,onResourceProgress:(e,o)=>{t.onResourceProgress?.(e),o&&t.onParallelStackResourceProgress?.(o,e)},onStackStart:(e,o)=>{const n=w(e,"destroy"),i=C(e,"destroy"),c=p.indexOf(e);t.onStepStart?.(n,i,c,l)},onStackComplete:async(e,o)=>{const n=w(e,"destroy"),i=C(e,"destroy"),c=p.indexOf(e);o.success?o.data?.skipped?(h.push(o.data.stackName||e),t.onStepComplete?.(n,i,"skipped",c,l)):(S.push(o.data?.stackName||e),t.onStepComplete?.(n,i,"completed",c,l)):(t.onStepComplete?.(n,i,"error",c,l),t.onError?.(o.error))},onParallelPhaseStart:(e,o)=>{t.onLog?.(`Parallel phase: ${o}`,"info"),t.onParallelPhaseStart?.(e,o)},onParallelPhaseComplete:e=>{const o=e.filter(n=>!n.success);o.length>0&&t.onLog?.(`Parallel phase completed with ${o.length} failure(s)`,"warn"),t.onParallelPhaseComplete?.(e)}},d,r.abortSignal,r.assertLeaseForStack);if(!m.success)return t.onError?.(m.error),y(m.error);try{await v(a.path)}catch(e){k.debug("applicationDestroy","Failed to delete state file (non-critical)",{error:P(e)}),t.onLog?.("Failed to delete state file (non-critical)","warn")}return x({target:a.appName,deploymentType:"application",stacksDestroyed:S,skippedStacks:h,durationMs:Date.now()-b})}export{V as destroyApplication};
+var D=Object.defineProperty;var s=(r,a)=>D(r,"name",{value:a,configurable:!0});import{success as F,failure as P}from"@fjall/generator";import{getErrorMessage as k}from"@fjall/util";import{logger as C}from"@fjall/util/logger";import{getApplicationDestroyOrder as L,getApplicationStackName as R,getApplicationStepName as w,getApplicationStepId as b}from"../../types/operations.js";import{emitStackTargets as A}from"./applicationDeploy.js";import{runDestroyPreFlight as I}from"./destroyPreFlight.js";import{stubCallerIdentity as O}from"../../types/deployment/index.js";import{deriveResourcesFromManifestStacks as $}from"../../types/detection/patternDetection.js";import{CdkContextBuilder as v}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as E}from"../contextHelpers.js";import{deleteStateFile as M,readStateFile as j}from"../../types/config/FjallState.js";async function Y(r,a,n){const{callbacks:t}=r,N=Date.now(),u=a.frameworkRegistry.resolve({appPath:n.path})?.detection.pattern??null;let g;try{const e=await j(n.path);if(e!==null){const o=Object.keys(e.templateHashes);o.length>0&&(g=$(o))}}catch(e){C.debug("applicationDestroy","Could not read state file for resource detection",{error:k(e)}),t.onLog?.("Could not read state file for resource detection \u2014 falling back to pattern detection","warn")}const x=v.buildDeploymentContext({deployType:"application",target:n.appName,path:n.path,region:a.awsProvider.getRegion(),callerIdentity:O(a.awsProvider.getAccountId()),...E({orgConfig:r.orgConfig,identity:r.identity})},{verbose:r.options?.verbose},r.orgConfig),d=L({pattern:u,resources:g}),i=d.length;t.onLog?.(`Destroying ${n.appName} (${i} stacks, ${u??"standard"} pattern)`,"info");const S=d.map(e=>R(n.appName,e));A(t,a,S);const m=await I(a.awsProvider,{stackNames:S,abortSignal:r.abortSignal});if(!m.success)return t.onError?.(m.error),P(m.error);const h=[],y=[],f=await a.stackService.destroyAllStacks(x,{onOutput:s(e=>{t.onOutput?.(e)},"onOutput"),onLog:t.onLog,onStackCleanupProgress:t.onStackCleanupProgress,onResourceProgress:s((e,o)=>{t.onResourceProgress?.(e),o&&t.onParallelStackResourceProgress?.(o,e)},"onResourceProgress"),onStackStart:s((e,o)=>{const l=b(e,"destroy"),c=w(e,"destroy"),p=d.indexOf(e);t.onStepStart?.(l,c,p,i)},"onStackStart"),onStackComplete:s(async(e,o)=>{const l=b(e,"destroy"),c=w(e,"destroy"),p=d.indexOf(e);o.success?o.data?.skipped?(y.push(o.data.stackName||e),t.onStepComplete?.(l,c,"skipped",p,i)):(h.push(o.data?.stackName||e),t.onStepComplete?.(l,c,"completed",p,i)):(t.onStepComplete?.(l,c,"error",p,i),t.onError?.(o.error))},"onStackComplete"),onParallelPhaseStart:s((e,o)=>{t.onLog?.(`Parallel phase: ${o}`,"info"),t.onParallelPhaseStart?.(e,o)},"onParallelPhaseStart"),onParallelPhaseComplete:s(e=>{const o=e.filter(l=>!l.success);o.length>0&&t.onLog?.(`Parallel phase completed with ${o.length} failure(s)`,"warn"),t.onParallelPhaseComplete?.(e)},"onParallelPhaseComplete")},g,r.abortSignal,r.assertLeaseForStack);if(!f.success)return t.onError?.(f.error),P(f.error);try{await M(n.path)}catch(e){C.debug("applicationDestroy","Failed to delete state file (non-critical)",{error:k(e)}),t.onLog?.("Failed to delete state file (non-critical)","warn")}return F({target:n.appName,deploymentType:"application",stacksDestroyed:h,skippedStacks:y,durationMs:Date.now()-N})}s(Y,"destroyApplication");export{Y as destroyApplication};

package/dist/src/orchestration/application/approvalGate.js

@@ -1 +1 @@
-import{success as o,failure as g}from"@fjall/generator";import{computeAssemblyDigest as k}from"./plan/assemblyDigest.js";import{loadDeployPlan as v}from"./plan/loadDeployPlan.js";import{renderPlanLines as h}from"./plan/renderDeployPlan.js";import{signApprovalToken as y,verifyApprovalToken as A}from"./plan/approvalToken.js";function w(e){switch(e){case"superseded":return"the plan changed since it was approved (re-plan and approve again)";case"expired":return"the approval window expired";case"tampered":return"the approval signature did not verify";case"malformed":return"the approval token was malformed"}}function m(e,n,r){const i=n.changeCount===0&&r.length>0?`no resource changes against the live stacks; template hashes differ from the last recorded deploy for ${r.length} stack(s) (${r.join(", ")}) \u2014 applying will redeploy them`:n.summary;e.onLog?.(`Deploy plan: ${i}`,"info");for(const d of h(n))e.onLog?.(d,"info")}async function D(e){const n=k(e.detection.currentHashes),r=e.options.approvalToken;if(r!==void 0&&r!==""){const t=A({token:r,assemblyDigest:n});if(t.ok)return e.callbacks.onLog?.("Approval token verified against the current plan \u2014 proceeding","info"),o({kind:"proceed"});const u=w(t.reason);return e.callbacks.onLog?.(`Approval refused: ${u}`,"warn"),o({kind:"rejected",reason:u})}const i=[...e.detection.stackChanges.entries()].filter(([,t])=>t).map(([t])=>t),p=await(e.loadPlan??(()=>v({cfnService:e.cfnService,cdkOutPath:e.cdkOutPath,changedStacks:i,assemblyDigest:n,...e.registry!==void 0?{registry:e.registry}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})))();if(!p.success)return g(p.error);const s=p.data;m(e.callbacks,s,i);const c={hashDriftStacks:i,resourceChangeCount:s.changeCount,resourceChangedStacks:[...new Set(s.changes.map(t=>t.stack))]},a=y({assemblyDigest:n});if(e.options.autoApprove===!0)return e.callbacks.onLog?.("Plan auto-approved (--auto-approve)","info"),o({kind:"proceed"});if(e.options.planOnly===!0)return o({kind:"awaiting",approvalToken:a.token,assemblyDigest:n,expiresAt:a.expiresAt,planDetail:c});if(e.approvalGate===void 0)return o({kind:"awaiting",approvalToken:a.token,assemblyDigest:n,expiresAt:a.expiresAt,planDetail:c});const f={target:e.target,plan:s,approvalToken:a.token,expiresAt:a.expiresAt,hasDestructiveChanges:s.hasDestructiveChanges},l=await e.approvalGate.resolve(f);switch(l.kind){case"approved":return o({kind:"proceed"});case"rejected":return o({kind:"rejected",reason:l.reason,planDetail:c});case"suspended":return o({kind:"awaiting",approvalToken:l.approvalToken,assemblyDigest:n,expiresAt:a.expiresAt,planDetail:c})}}export{D as runApprovalGate};
+var k=Object.defineProperty;var p=(e,n)=>k(e,"name",{value:n,configurable:!0});import{success as o,failure as v}from"@fjall/generator";import{computeAssemblyDigest as h}from"./plan/assemblyDigest.js";import{loadDeployPlan as y}from"./plan/loadDeployPlan.js";import{renderPlanLines as A}from"./plan/renderDeployPlan.js";import{signApprovalToken as w,verifyApprovalToken as m}from"./plan/approvalToken.js";function x(e){switch(e){case"superseded":return"the plan changed since it was approved (re-plan and approve again)";case"expired":return"the approval window expired";case"tampered":return"the approval signature did not verify";case"malformed":return"the approval token was malformed"}}p(x,"refusalReason");function P(e,n,r){const i=n.changeCount===0&&r.length>0?`no resource changes against the live stacks; template hashes differ from the last recorded deploy for ${r.length} stack(s) (${r.join(", ")}) \u2014 applying will redeploy them`:n.summary;e.onLog?.(`Deploy plan: ${i}`,"info");for(const u of A(n))e.onLog?.(u,"info")}p(P,"emitPlanSummary");async function j(e){const n=h(e.detection.currentHashes),r=e.options.approvalToken;if(r!==void 0&&r!==""){const t=m({token:r,assemblyDigest:n});if(t.ok)return e.callbacks.onLog?.("Approval token verified against the current plan \u2014 proceeding","info"),o({kind:"proceed"});const f=x(t.reason);return e.callbacks.onLog?.(`Approval refused: ${f}`,"warn"),o({kind:"rejected",reason:f})}const i=[...e.detection.stackChanges.entries()].filter(([,t])=>t).map(([t])=>t),l=await(e.loadPlan??(()=>y({cfnService:e.cfnService,cdkOutPath:e.cdkOutPath,changedStacks:i,assemblyDigest:n,...e.registry!==void 0?{registry:e.registry}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})))();if(!l.success)return v(l.error);const s=l.data;P(e.callbacks,s,i);const c={hashDriftStacks:i,resourceChangeCount:s.changeCount,resourceChangedStacks:[...new Set(s.changes.map(t=>t.stack))]},a=w({assemblyDigest:n});if(e.options.autoApprove===!0)return e.callbacks.onLog?.("Plan auto-approved (--auto-approve)","info"),o({kind:"proceed"});if(e.options.planOnly===!0)return o({kind:"awaiting",approvalToken:a.token,assemblyDigest:n,expiresAt:a.expiresAt,planDetail:c});if(e.approvalGate===void 0)return o({kind:"awaiting",approvalToken:a.token,assemblyDigest:n,expiresAt:a.expiresAt,planDetail:c});const g={target:e.target,plan:s,approvalToken:a.token,expiresAt:a.expiresAt,hasDestructiveChanges:s.hasDestructiveChanges},d=await e.approvalGate.resolve(g);switch(d.kind){case"approved":return o({kind:"proceed"});case"rejected":return o({kind:"rejected",reason:d.reason,planDetail:c});case"suspended":return o({kind:"awaiting",approvalToken:d.approvalToken,assemblyDigest:n,expiresAt:a.expiresAt,planDetail:c})}}p(j,"runApprovalGate");export{j as runApprovalGate};

package/dist/src/orchestration/application/artefactCollection.js

@@ -1 +1 @@
-import{maskSensitiveOutput as L}from"@fjall/util";import{parseDockerServicesFromManifest as b,parseLambdaDockerEntriesFromManifest as C}from"@fjall/util/manifest";import{logger as D}from"@fjall/util/logger";import{extractEcsServiceName as w}from"../../aws/utils/arnParser.js";import{deriveEcrRepositoryArn as E}from"./codeOnlyDeploy.js";const N="artefactCollection";async function K(c,i,n,o,r,a={},t){if(n===void 0||n.repoUri===void 0)return[];const d=Object.entries(n.contentHashTagsByService);if(d.length===0)return[];const u=n.repoUri,e=E(u),m=await $(c,i,o,t),v=new Map;for(const s of C(r)){const f=v.get(s.imageKey)??[];f.push(s.name),v.set(s.imageKey,f)}const k=new Set(b(r).map(s=>s.name)),l=[];for(const[s,f]of d){const g=n.imageDigestsByService[s],S=v.get(s);if(S!==void 0){for(const h of S){const y=a[h];l.push({serviceName:h,imageTag:f,imageUri:`${u}:${f}`,...g!==void 0?{imageDigest:g}:{},...e!==""?{ecrRepositoryArn:e}:{},...y!==void 0?{functionArn:y.functionArn,publishedVersion:y.version}:{}})}if(!k.has(s))continue}const p=R(s,m);l.push({serviceName:p?.ecsServiceName??s,imageTag:f,imageUri:`${u}:${f}`,...g!==void 0?{imageDigest:g}:{},...e!==""?{ecrRepositoryArn:e}:{},...p?.taskDefinitionArn!==void 0?{taskDefinitionArn:p.taskDefinitionArn}:{}})}return l}async function $(c,i,n,o){try{const r=await c.ecsResolver.getDeployableClusterAndServices(i,o);if(!r.success)return A(n,i,r.error.message),[];const{clusterArn:a,serviceArns:t}=r.data;if(!a||t.length===0)return D.debug(N,"No deployable ECS services discovered",{appName:i}),[];const d=await c.ecsService.describeServices(a,t,o);if(!d.success)return A(n,i,d.error.message),t.map(e=>w(e)).filter(e=>e!==void 0&&e!=="").map(e=>({ecsServiceName:e}));const u=[];for(const e of d.data){const m=e.serviceName??(e.serviceArn!==void 0?w(e.serviceArn):void 0);m===void 0||m===""||u.push({ecsServiceName:m,...e.taskDefinition!==void 0?{taskDefinitionArn:e.taskDefinition}:{}})}return u}catch(r){return A(n,i,r instanceof Error?r.message:String(r)),[]}}function R(c,i){const n=c.toLowerCase(),o=i.find(t=>t.ecsServiceName.toLowerCase()===n);if(o)return o;const r=i.filter(t=>t.ecsServiceName.toLowerCase().includes(n));if(r.length===1)return r[0];const a=r.filter(t=>t.ecsServiceName.toLowerCase().endsWith(`-${n}`));if(a.length===1)return a[0]}function A(c,i,n){const o=L(n);D.debug(N,"Post-deploy artefact resolution degraded",{appName:i,error:o}),c.onLog?.(`Deploy succeeded, but resolving live task definitions for release artefacts failed: ${o}. Artefacts are recorded without task definition ARNs.`,"warn")}export{K as collectFullDeployArtefacts};
+var b=Object.defineProperty;var g=(o,r)=>b(o,"name",{value:r,configurable:!0});import{maskSensitiveOutput as C}from"@fjall/util";import{parseDockerServicesFromManifest as E,parseLambdaDockerEntriesFromManifest as $}from"@fjall/util/manifest";import{logger as w}from"@fjall/util/logger";import{extractEcsServiceName as N}from"../../aws/utils/arnParser.js";import{deriveEcrRepositoryArn as R}from"./codeOnlyDeploy.js";const k="artefactCollection";async function G(o,r,n,c,i,a={},t){if(n===void 0||n.repoUri===void 0)return[];const d=Object.entries(n.contentHashTagsByService);if(d.length===0)return[];const u=n.repoUri,e=R(u),m=await U(o,r,c,t),l=new Map;for(const s of $(i)){const f=l.get(s.imageKey)??[];f.push(s.name),l.set(s.imageKey,f)}const L=new Set(E(i).map(s=>s.name)),p=[];for(const[s,f]of d){const v=n.imageDigestsByService[s],h=l.get(s);if(h!==void 0){for(const D of h){const A=a[D];p.push({serviceName:D,imageTag:f,imageUri:`${u}:${f}`,...v!==void 0?{imageDigest:v}:{},...e!==""?{ecrRepositoryArn:e}:{},...A!==void 0?{functionArn:A.functionArn,publishedVersion:A.version}:{}})}if(!L.has(s))continue}const y=x(s,m);p.push({serviceName:y?.ecsServiceName??s,imageTag:f,imageUri:`${u}:${f}`,...v!==void 0?{imageDigest:v}:{},...e!==""?{ecrRepositoryArn:e}:{},...y?.taskDefinitionArn!==void 0?{taskDefinitionArn:y.taskDefinitionArn}:{}})}return p}g(G,"collectFullDeployArtefacts");async function U(o,r,n,c){try{const i=await o.ecsResolver.getDeployableClusterAndServices(r,c);if(!i.success)return S(n,r,i.error.message),[];const{clusterArn:a,serviceArns:t}=i.data;if(!a||t.length===0)return w.debug(k,"No deployable ECS services discovered",{appName:r}),[];const d=await o.ecsService.describeServices(a,t,c);if(!d.success)return S(n,r,d.error.message),t.map(e=>N(e)).filter(e=>e!==void 0&&e!=="").map(e=>({ecsServiceName:e}));const u=[];for(const e of d.data){const m=e.serviceName??(e.serviceArn!==void 0?N(e.serviceArn):void 0);m===void 0||m===""||u.push({ecsServiceName:m,...e.taskDefinition!==void 0?{taskDefinitionArn:e.taskDefinition}:{}})}return u}catch(i){return S(n,r,i instanceof Error?i.message:String(i)),[]}}g(U,"resolveLiveServices");function x(o,r){const n=o.toLowerCase(),c=r.find(t=>t.ecsServiceName.toLowerCase()===n);if(c)return c;const i=r.filter(t=>t.ecsServiceName.toLowerCase().includes(n));if(i.length===1)return i[0];const a=i.filter(t=>t.ecsServiceName.toLowerCase().endsWith(`-${n}`));if(a.length===1)return a[0]}g(x,"matchLiveService");function S(o,r,n){const c=C(n);w.debug(k,"Post-deploy artefact resolution degraded",{appName:r,error:c}),o.onLog?.(`Deploy succeeded, but resolving live task definitions for release artefacts failed: ${c}. Artefacts are recorded without task definition ARNs.`,"warn")}g(S,"warnDegraded");export{G as collectFullDeployArtefacts};

package/dist/src/orchestration/application/buildArgResolver.js

@@ -1 +1 @@
-import{readFile as k}from"node:fs/promises";import{join as A}from"node:path";import{success as h,failure as g}from"@fjall/generator";import{getErrorMessage as V,maskSensitiveOutput as B}from"@fjall/util";import{isPublicBuildVarName as D}from"@fjall/util/docker";async function $(e){const o=e.manifestBuildArgs??{},a=e.flagBuildArgs??{};let r,i;try{r=await w(e,[".env",".env.production"]),i=e.stage!==void 0&&e.stage!==""?await w(e,[`.env.${e.stage}`]):{}}catch(n){return g(new Error(`Failed to read .env build-arg sources: ${B(V(n))}`))}const s=new Set([...Object.keys(o),...Object.keys(a)]),f=[];for(const n of new Set([...Object.keys(i),...Object.keys(r)]))s.has(n)||D(n)&&f.push(n);const t=new Set([...s,...f]);if(t.size===0)return h({buildArgs:{},inferredDotenvKeys:[]});const u={};for(const n of t){const p=c(a[n]);if(p!==void 0){u[n]=p;continue}const m=c(e.shellEnv[n]);if(m!==void 0){u[n]=m;continue}const v=c(i[n]);if(v!==void 0){u[n]=v;continue}const y=c(r[n]);if(y!==void 0){u[n]=y;continue}const d=o[n];if(d===void 0)continue;if(typeof d=="string"){const b=c(d);b!==void 0&&(u[n]=b);continue}if(e.resolveSourcedValue===void 0)return g(new Error(`buildArg "${n}" is sourced from a secret store but no resolver was provided to read it.`));const l=await e.resolveSourcedValue(n,d);if(!l.success)return g(l.error);u[n]=l.data}return h({buildArgs:u,inferredDotenvKeys:f})}function c(e){return e!==void 0&&e!==""?e:void 0}async function w(e,o){const a=[e.serviceDir,...e.appDir?[e.appDir]:[]];for(const r of a)for(const i of o){const s=await S(A(r,i));if(s!==void 0)return O(s)}return{}}async function S(e){try{return await k(e,"utf8")}catch{return}}function O(e){const o={};for(const a of e.split(/\r?\n/)){const r=a.trim();if(r===""||r.startsWith("#"))continue;const i=r.replace(/^export\s+/,""),s=i.indexOf("=");if(s<=0)continue;const f=i.slice(0,s).trim();if(f==="")continue;let t=i.slice(s+1).trim();t.length>=2&&(t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'"))&&(t=t.slice(1,-1)),o[f]=t}return o}export{$ as resolveBuildArgs};
+var A=Object.defineProperty;var c=(e,r)=>A(e,"name",{value:r,configurable:!0});import{readFile as V}from"node:fs/promises";import{join as B}from"node:path";import{success as w,failure as p}from"@fjall/generator";import{getErrorMessage as D,maskSensitiveOutput as S}from"@fjall/util";import{isPublicBuildVarName as O}from"@fjall/util/docker";async function L(e){const r=e.manifestBuildArgs??{},a=e.flagBuildArgs??{};let i,s;try{i=await k(e,[".env",".env.production"]),s=e.stage!==void 0&&e.stage!==""?await k(e,[`.env.${e.stage}`]):{}}catch(n){return p(new Error(`Failed to read .env build-arg sources: ${S(D(n))}`))}const o=new Set([...Object.keys(r),...Object.keys(a)]),f=[];for(const n of new Set([...Object.keys(s),...Object.keys(i)]))o.has(n)||O(n)&&f.push(n);const t=new Set([...o,...f]);if(t.size===0)return w({buildArgs:{},inferredDotenvKeys:[]});const u={};for(const n of t){const m=d(a[n]);if(m!==void 0){u[n]=m;continue}const v=d(e.shellEnv[n]);if(v!==void 0){u[n]=v;continue}const y=d(s[n]);if(y!==void 0){u[n]=y;continue}const b=d(i[n]);if(b!==void 0){u[n]=b;continue}const l=r[n];if(l===void 0)continue;if(typeof l=="string"){const h=d(l);h!==void 0&&(u[n]=h);continue}if(e.resolveSourcedValue===void 0)return p(new Error(`buildArg "${n}" is sourced from a secret store but no resolver was provided to read it.`));const g=await e.resolveSourcedValue(n,l);if(!g.success)return p(g.error);u[n]=g.data}return w({buildArgs:u,inferredDotenvKeys:f})}c(L,"resolveBuildArgs");function d(e){return e!==void 0&&e!==""?e:void 0}c(d,"present");async function k(e,r){const a=[e.serviceDir,...e.appDir?[e.appDir]:[]];for(const i of a)for(const s of r){const o=await j(B(i,s));if(o!==void 0)return E(o)}return{}}c(k,"loadDotenvTier");async function j(e){try{return await V(e,"utf8")}catch{return}}c(j,"readEnvFile");function E(e){const r={};for(const a of e.split(/\r?\n/)){const i=a.trim();if(i===""||i.startsWith("#"))continue;const s=i.replace(/^export\s+/,""),o=s.indexOf("=");if(o<=0)continue;const f=s.slice(0,o).trim();if(f==="")continue;let t=s.slice(o+1).trim();t.length>=2&&(t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'"))&&(t=t.slice(1,-1)),r[f]=t}return r}c(E,"parseDotenv");export{L as resolveBuildArgs};

package/dist/src/orchestration/application/buildGroupValidator.js

@@ -1 +1 @@
-import{existsSync as a,statSync as u}from"node:fs";import{success as f,failure as t}from"@fjall/generator";import{BUILDKIT_SECRET_ID_PATTERN as b}from"@fjall/util/manifest/schemas";function c(e){return n({buildArgs:e.buildArgs??null,buildSecrets:e.buildSecrets??null})}function n(e){return Array.isArray(e)?`[${e.map(n).join(",")}]`:e!==null&&typeof e=="object"?`{${Object.keys(e).sort().map(i=>`${JSON.stringify(i)}:${n(e[i])}`).join(",")}}`:JSON.stringify(e)}function w(e){const o=e.buildSecrets??[];for(const r of o)if(!b.test(r.id))return t(new Error(`Build secret id "${r.id}" for service '${e.serviceName}' contains characters outside the allowed BuildKit set [A-Za-z0-9_.-]; rename it (no comma, '=', or whitespace, which break the buildx --secret argv).`));const i=new Set;for(const r of o){if(i.has(r.id))return t(new Error(`Duplicate build secret id "${r.id}" for service '${e.serviceName}'; each buildSecrets[].id must be unique within a build group (the resolver writes each value to a temp file keyed by id, so a duplicate is silently overwritten).`));i.add(r.id)}const l=e.buildArgs??{};for(const r of Object.keys(l))if(i.has(r))return t(new Error(`buildArg key "${r}" for service '${e.serviceName}' collides with a buildSecrets[].id; a public --build-arg would shadow the secret mount of the same name. Rename one of them.`));if(!a(e.buildContext)||!u(e.buildContext).isDirectory())return t(new Error(`Build context "${e.buildContext}" for service '${e.serviceName}' is not an existing directory.`));const d=e.members;if(d!==void 0&&d.length>0){const r=c({serviceName:e.serviceName,...e.buildArgs!==void 0&&{buildArgs:e.buildArgs},...e.buildSecrets!==void 0&&{buildSecrets:e.buildSecrets}});for(const s of d)if(s.serviceName!==e.serviceName&&c(s)!==r)return t(new Error(`Service '${s.serviceName}' shares a build group with leader '${e.serviceName}' but declares different docker buildArgs/buildSecrets. Only the group leader's docker inputs are resolved and built, so '${s.serviceName}' would ship an image built with the leader's inputs, not its own. Give it a distinct Dockerfile path, context, or target so it builds independently, or align its buildArgs/buildSecrets with the leader.`))}return f(void 0)}export{w as validateBuildGroup};
+var u=Object.defineProperty;var d=(e,t)=>u(e,"name",{value:t,configurable:!0});import{existsSync as f,statSync as b}from"node:fs";import{success as m,failure as s}from"@fjall/generator";import{BUILDKIT_SECRET_ID_PATTERN as h}from"@fjall/util/manifest/schemas";function l(e){return c({buildArgs:e.buildArgs??null,buildSecrets:e.buildSecrets??null})}d(l,"canonicaliseInputs");function c(e){return Array.isArray(e)?`[${e.map(c).join(",")}]`:e!==null&&typeof e=="object"?`{${Object.keys(e).sort().map(i=>`${JSON.stringify(i)}:${c(e[i])}`).join(",")}}`:JSON.stringify(e)}d(c,"stableStringify");function v(e){const t=e.buildSecrets??[];for(const r of t)if(!h.test(r.id))return s(new Error(`Build secret id "${r.id}" for service '${e.serviceName}' contains characters outside the allowed BuildKit set [A-Za-z0-9_.-]; rename it (no comma, '=', or whitespace, which break the buildx --secret argv).`));const i=new Set;for(const r of t){if(i.has(r.id))return s(new Error(`Duplicate build secret id "${r.id}" for service '${e.serviceName}'; each buildSecrets[].id must be unique within a build group (the resolver writes each value to a temp file keyed by id, so a duplicate is silently overwritten).`));i.add(r.id)}const a=e.buildArgs??{};for(const r of Object.keys(a))if(i.has(r))return s(new Error(`buildArg key "${r}" for service '${e.serviceName}' collides with a buildSecrets[].id; a public --build-arg would shadow the secret mount of the same name. Rename one of them.`));if(!f(e.buildContext)||!b(e.buildContext).isDirectory())return s(new Error(`Build context "${e.buildContext}" for service '${e.serviceName}' is not an existing directory.`));const n=e.members;if(n!==void 0&&n.length>0){const r=l({serviceName:e.serviceName,...e.buildArgs!==void 0&&{buildArgs:e.buildArgs},...e.buildSecrets!==void 0&&{buildSecrets:e.buildSecrets}});for(const o of n)if(o.serviceName!==e.serviceName&&l(o)!==r)return s(new Error(`Service '${o.serviceName}' shares a build group with leader '${e.serviceName}' but declares different docker buildArgs/buildSecrets. Only the group leader's docker inputs are resolved and built, so '${o.serviceName}' would ship an image built with the leader's inputs, not its own. Give it a distinct Dockerfile path, context, or target so it builds independently, or align its buildArgs/buildSecrets with the leader.`))}return m(void 0)}d(v,"validateBuildGroup");export{v as validateBuildGroup};

package/dist/src/orchestration/application/buildSecretResolver.js

@@ -1 +1 @@
-import{mkdtemp as $,writeFile as B,rm as E}from"node:fs/promises";import{tmpdir as R}from"node:os";import{join as w}from"node:path";import{SecretsManagerClient as b,GetSecretValueCommand as x}from"@aws-sdk/client-secrets-manager";import{SSMClient as F,GetParameterCommand as N}from"@aws-sdk/client-ssm";import{success as a,failure as i}from"@fjall/generator";import{getErrorMessage as f,maskSensitiveOutput as m}from"@fjall/util";import{composeSdkAbortSignal as M}from"../../aws/organisations/types.js";import{buildBuildSecretSessionPolicy as O}from"./buildSecretSession.js";const A="fjall-build-secret-read",v=3e4;function q(n){return n===void 0?[]:Object.entries(n).flatMap(([e,r])=>typeof r=="string"||r.env!==void 0?[]:r.ssm!==void 0?[{id:e,ssm:r.ssm}]:r.secretsManager!==void 0?[{id:e,secretsManager:r.secretsManager}]:[])}function C(n){return n.flatMap(e=>e.ssm!==void 0?[{ssm:e.ssm}]:e.secretsManager!==void 0?[{...e.secretsManager.name!==void 0&&{secretsManagerName:e.secretsManager.name},...e.secretsManager.arn!==void 0&&{secretsManagerArn:e.secretsManager.arn}}]:[])}async function _(n,e,r){if(r===void 0||n.assumeScopedBuildSecretSession===void 0)return a(n);const t=O(r,C(e));if(!t.success)return i(t.error);try{const s=await n.assumeScopedBuildSecretSession(t.data,A);return a(s)}catch(s){return i(new Error(`Failed to assume scoped build-secret session: ${m(f(s))}`))}}async function z(n,e,r,t){if(e.length===0)return a({resolved:[],cleanup:()=>Promise.resolve()});const s=await _(n,e,t);if(!s.success)return i(s.error);const c=s.data;let u;try{const o=await $(w(R(),"fjall-build-secret-"));u=o;const p=()=>E(o,{recursive:!0,force:!0}),S=[];for(const d of e){const l=await h(c,d,r);if(!l.success)return await p(),i(l.error);const g=w(o,d.id);await B(g,l.data,{mode:384}),S.push({id:d.id,source:{kind:"file",path:g}})}return a({resolved:S,cleanup:p})}catch(o){return u!==void 0&&await E(u,{recursive:!0,force:!0}).catch(()=>{}),i(new Error(`Failed to resolve build secrets: ${m(f(o))}`))}}async function H(n,e,r){return h(n,e,r)}async function h(n,e,r){if(e.ssm!==void 0)return j(n,e.ssm,r);if(e.secretsManager!==void 0)return D(n,e.id,e.secretsManager,r);if(e.env!==void 0){const t=process.env[e.env];return t===void 0||t===""?i(new Error(`Build secret "${e.id}" reads env var "${e.env}", which is unset or empty.`)):a(t)}return i(new Error(`Build secret "${e.id}" has no resolvable source.`))}async function j(n,e,r){const t=n.getClient(F);try{const c=(await t.send(new N({Name:e,WithDecryption:!0}),{abortSignal:M(r,v)})).Parameter?.Value;return c===void 0||c===""?i(new Error(`SSM parameter "${e}" returned no value.`)):a(c)}catch(s){return i(y("SSM parameter",e,s))}}async function D(n,e,r,t){const s=r.arn??r.name;if(s===void 0)return i(new Error(`Build secret "${e}" secretsManager has neither name nor arn.`));const c=n.getClient(b);try{const o=(await c.send(new x({SecretId:s}),{abortSignal:M(t,v)})).SecretString;return o===void 0||o===""?i(new Error(`Secret "${s}" returned no string value.`)):r.field===void 0?a(o):T(o,r.field,s)}catch(u){return i(y("secret",s,u))}}function T(n,e,r){let t;try{t=JSON.parse(n)}catch{return i(new Error(`Secret "${r}" is not valid JSON; cannot extract field.`))}if(typeof t!="object"||t===null||Array.isArray(t)||!(e in t))return i(new Error(`Secret "${r}" has no field "${e}".`));const s=t[e];return typeof s!="string"||s===""?i(new Error(`Secret "${r}" field "${e}" is empty or not a string.`)):a(s)}function y(n,e,r){const t=r instanceof Error?r.name:"";return t==="ResourceNotFoundException"||t==="ParameterNotFound"?new Error(`${n} "${e}" does not exist in this account/region \u2014 create it or fix the reference.`):t==="AccessDeniedException"||t==="AccessDenied"?new Error(`The deploy identity lacks read access to ${n} "${e}" \u2014 grant the build-time read on this reference.`):new Error(`Failed to resolve ${n} "${e}": ${m(f(r))}`)}export{_ as resolveBuildSecretSessionProvider,z as resolveBuildSecrets,H as resolveSecretRefValue,q as sourcedRefsFromBuildArgs};
+var B=Object.defineProperty;var o=(n,e)=>B(n,"name",{value:e,configurable:!0});import{mkdtemp as R,writeFile as b,rm as w}from"node:fs/promises";import{tmpdir as x}from"node:os";import{join as M}from"node:path";import{SecretsManagerClient as F,GetSecretValueCommand as N}from"@aws-sdk/client-secrets-manager";import{SSMClient as O,GetParameterCommand as A}from"@aws-sdk/client-ssm";import{success as c,failure as i}from"@fjall/generator";import{getErrorMessage as m,maskSensitiveOutput as p}from"@fjall/util";import{composeSdkAbortSignal as v}from"../../aws/organisations/types.js";import{buildBuildSecretSessionPolicy as C}from"./buildSecretSession.js";const _="fjall-build-secret-read",h=3e4;function K(n){return n===void 0?[]:Object.entries(n).flatMap(([e,r])=>typeof r=="string"||r.env!==void 0?[]:r.ssm!==void 0?[{id:e,ssm:r.ssm}]:r.secretsManager!==void 0?[{id:e,secretsManager:r.secretsManager}]:[])}o(K,"sourcedRefsFromBuildArgs");function j(n){return n.flatMap(e=>e.ssm!==void 0?[{ssm:e.ssm}]:e.secretsManager!==void 0?[{...e.secretsManager.name!==void 0&&{secretsManagerName:e.secretsManager.name},...e.secretsManager.arn!==void 0&&{secretsManagerArn:e.secretsManager.arn}}]:[])}o(j,"toBuildSecretRefs");async function D(n,e,r){if(r===void 0||n.assumeScopedBuildSecretSession===void 0)return c(n);const t=C(r,j(e));if(!t.success)return i(t.error);try{const s=await n.assumeScopedBuildSecretSession(t.data,_);return c(s)}catch(s){return i(new Error(`Failed to assume scoped build-secret session: ${p(m(s))}`))}}o(D,"resolveBuildSecretSessionProvider");async function Q(n,e,r,t){if(e.length===0)return c({resolved:[],cleanup:o(()=>Promise.resolve(),"cleanup")});const s=await D(n,e,t);if(!s.success)return i(s.error);const u=s.data;let d;try{const a=await R(M(x(),"fjall-build-secret-"));d=a;const S=o(()=>w(a,{recursive:!0,force:!0}),"cleanup"),g=[];for(const l of e){const f=await y(u,l,r);if(!f.success)return await S(),i(f.error);const E=M(a,l.id);await b(E,f.data,{mode:384}),g.push({id:l.id,source:{kind:"file",path:E}})}return c({resolved:g,cleanup:S})}catch(a){return d!==void 0&&await w(d,{recursive:!0,force:!0}).catch(()=>{}),i(new Error(`Failed to resolve build secrets: ${p(m(a))}`))}}o(Q,"resolveBuildSecrets");async function X(n,e,r){return y(n,e,r)}o(X,"resolveSecretRefValue");async function y(n,e,r){if(e.ssm!==void 0)return T(n,e.ssm,r);if(e.secretsManager!==void 0)return V(n,e.id,e.secretsManager,r);if(e.env!==void 0){const t=process.env[e.env];return t===void 0||t===""?i(new Error(`Build secret "${e.id}" reads env var "${e.env}", which is unset or empty.`)):c(t)}return i(new Error(`Build secret "${e.id}" has no resolvable source.`))}o(y,"resolveOneValue");async function T(n,e,r){const t=n.getClient(O);try{const u=(await t.send(new A({Name:e,WithDecryption:!0}),{abortSignal:v(r,h)})).Parameter?.Value;return u===void 0||u===""?i(new Error(`SSM parameter "${e}" returned no value.`)):c(u)}catch(s){return i($("SSM parameter",e,s))}}o(T,"resolveSsm");async function V(n,e,r,t){const s=r.arn??r.name;if(s===void 0)return i(new Error(`Build secret "${e}" secretsManager has neither name nor arn.`));const u=n.getClient(F);try{const a=(await u.send(new N({SecretId:s}),{abortSignal:v(t,h)})).SecretString;return a===void 0||a===""?i(new Error(`Secret "${s}" returned no string value.`)):r.field===void 0?c(a):P(a,r.field,s)}catch(d){return i($("secret",s,d))}}o(V,"resolveSecretsManager");function P(n,e,r){let t;try{t=JSON.parse(n)}catch{return i(new Error(`Secret "${r}" is not valid JSON; cannot extract field.`))}if(typeof t!="object"||t===null||Array.isArray(t)||!(e in t))return i(new Error(`Secret "${r}" has no field "${e}".`));const s=t[e];return typeof s!="string"||s===""?i(new Error(`Secret "${r}" field "${e}" is empty or not a string.`)):c(s)}o(P,"extractField");function $(n,e,r){const t=r instanceof Error?r.name:"";return t==="ResourceNotFoundException"||t==="ParameterNotFound"?new Error(`${n} "${e}" does not exist in this account/region \u2014 create it or fix the reference.`):t==="AccessDeniedException"||t==="AccessDenied"?new Error(`The deploy identity lacks read access to ${n} "${e}" \u2014 grant the build-time read on this reference.`):new Error(`Failed to resolve ${n} "${e}": ${p(m(r))}`)}o($,"toResolveError");export{D as resolveBuildSecretSessionProvider,Q as resolveBuildSecrets,X as resolveSecretRefValue,K as sourcedRefsFromBuildArgs};

package/dist/src/orchestration/application/buildSecretSession.js

@@ -1 +1 @@
-import{success as $,failure as g}from"@fjall/generator";import{toKebab as p}from"@fjall/util";const l=2048;function w(s){return s.startsWith("cn-")?"aws-cn":"aws"}function R(s,f){const{region:r,accountId:n,partition:a}=s,i=p(s.appName),u=`arn:${a}:ssm:${r}:${n}:parameter/${i}/*`,m=`arn:${a}:secretsmanager:${r}:${n}:secret:fjall-${i}-*`,t=new Set;for(const e of f){if(e.ssm!==void 0&&e.ssm!==""){const c=e.ssm.startsWith("/")?e.ssm.slice(1):e.ssm;c.startsWith(`${i}/`)||t.add(`arn:${a}:ssm:${r}:${n}:parameter/${c}`)}if(e.secretsManagerArn!==void 0&&e.secretsManagerArn!==""){const c=m.replace(/\*$/,"");e.secretsManagerArn.startsWith(c)||t.add(e.secretsManagerArn)}e.secretsManagerName!==void 0&&e.secretsManagerName!==""&&!e.secretsManagerName.startsWith(`fjall-${i}-`)&&t.add(`arn:${a}:secretsmanager:${r}:${n}:secret:${e.secretsManagerName}-*`)}const d=[{Sid:"FjallBuildSsmRead",Effect:"Allow",Action:["ssm:GetParameter","ssm:GetParameters"],Resource:[u,...[...t].filter(S)]},{Sid:"FjallBuildSecretsManagerRead",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:[m,...[...t].filter(A)]},{Sid:"FjallBuildKmsDecrypt",Effect:"Allow",Action:["kms:Decrypt"],Resource:"*",Condition:{StringEquals:{"kms:ViaService":[`ssm.${r}.amazonaws.com`,`secretsmanager.${r}.amazonaws.com`]}}}],o=JSON.stringify({Version:"2012-10-17",Statement:d});return o.length>l?g(new Error(`Build-secret session policy is ${o.length} chars, exceeding the ${l}-char AWS inline-policy limit. Reduce the number of out-of-prefix secret/parameter references for this build.`)):$(o)}function S(s){return s.includes(":ssm:")}function A(s){return s.includes(":secretsmanager:")}export{l as MAX_INLINE_POLICY_CHARS,R as buildBuildSecretSessionPolicy,w as partitionForRegion};
+var g=Object.defineProperty;var n=(s,m)=>g(s,"name",{value:m,configurable:!0});import{success as p,failure as S}from"@fjall/generator";import{toKebab as A}from"@fjall/util";const u=2048;function b(s){return s.startsWith("cn-")?"aws-cn":"aws"}n(b,"partitionForRegion");function x(s,m){const{region:r,accountId:a,partition:i}=s,c=A(s.appName),d=`arn:${i}:ssm:${r}:${a}:parameter/${c}/*`,f=`arn:${i}:secretsmanager:${r}:${a}:secret:fjall-${c}-*`,t=new Set;for(const e of m){if(e.ssm!==void 0&&e.ssm!==""){const o=e.ssm.startsWith("/")?e.ssm.slice(1):e.ssm;o.startsWith(`${c}/`)||t.add(`arn:${i}:ssm:${r}:${a}:parameter/${o}`)}if(e.secretsManagerArn!==void 0&&e.secretsManagerArn!==""){const o=f.replace(/\*$/,"");e.secretsManagerArn.startsWith(o)||t.add(e.secretsManagerArn)}e.secretsManagerName!==void 0&&e.secretsManagerName!==""&&!e.secretsManagerName.startsWith(`fjall-${c}-`)&&t.add(`arn:${i}:secretsmanager:${r}:${a}:secret:${e.secretsManagerName}-*`)}const $=[{Sid:"FjallBuildSsmRead",Effect:"Allow",Action:["ssm:GetParameter","ssm:GetParameters"],Resource:[d,...[...t].filter(h)]},{Sid:"FjallBuildSecretsManagerRead",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:[f,...[...t].filter(M)]},{Sid:"FjallBuildKmsDecrypt",Effect:"Allow",Action:["kms:Decrypt"],Resource:"*",Condition:{StringEquals:{"kms:ViaService":[`ssm.${r}.amazonaws.com`,`secretsmanager.${r}.amazonaws.com`]}}}],l=JSON.stringify({Version:"2012-10-17",Statement:$});return l.length>u?S(new Error(`Build-secret session policy is ${l.length} chars, exceeding the ${u}-char AWS inline-policy limit. Reduce the number of out-of-prefix secret/parameter references for this build.`)):p(l)}n(x,"buildBuildSecretSessionPolicy");function h(s){return s.includes(":ssm:")}n(h,"isSsmArn");function M(s){return s.includes(":secretsmanager:")}n(M,"isSecretsArn");export{u as MAX_INLINE_POLICY_CHARS,x as buildBuildSecretSessionPolicy,b as partitionForRegion};

package/dist/src/orchestration/application/codeOnlyDeploy.js

@@ -1 +1 @@
-import{join as J}from"path";import{success as Q,failure as z}from"@fjall/generator";import{logger as b}from"@fjall/util/logger";import{artefactOutputKey as P,imageTagParameterName as re,maskSensitiveOutput as A}from"@fjall/util";import{parseDockerServicesFromManifest as ae,parseLambdaDockerEntriesFromManifest as ne}from"@fjall/util/manifest";import{APPLICATION_STACKS as G,getApplicationStackName as ie,getApplicationStepId as oe,getApplicationStepName as se}from"../../types/operations.js";import{extractEcsServiceName as j}from"../../aws/utils/arnParser.js";import{isAborted as V}from"../../aws/organisations/types.js";import{stripTagOrDigest as ce}from"../../services/infrastructure/EcrImageInspectorService.js";import{withStepLifecycle as ge}from"../stepLifecycle.js";import{registerAndRollTaskDefinition as le}from"./taskDefinitionRoll.js";import{ecrRepoUri as de}from"./dockerBuildHelper.js";import{matchesServiceName as me,matchServiceImageTagsToLiveServices as fe,preflightResolveServiceImageTagDigests as ue,resolveServiceTaskDefinition as pe}from"./serviceImageTagsRollback.js";import{executeLambdaServiceImageTagsRollout as he,matchesLambdaFunctionName as ve,preflightLambdaServiceImageTags as ke,rolloutLambdaImageTag as $e,rolloutLambdaPrimary as we}from"./lambdaCodeOnlyRollout.js";const N="codeOnlyDeploy";function ye(t,r){if(t)return r[t.name]}function Se(t,r){const e=r.toLowerCase();return t.find(a=>a.name.toLowerCase()===e)??t.find(a=>e.includes(a.name.toLowerCase()))}function De(t,r,e){const a=r.toLowerCase(),l=t.toLowerCase(),n=e.map(s=>s.toLowerCase()).filter(s=>s!==""&&l.startsWith(`${s}-`)).sort((s,v)=>v.length-s.length)[0];if(n===void 0||n===a)return t;const h=t.slice(n.length);return`${a}${h}`}const Te=0,be=1;function Z(t,r,e,a,l){a[P(t,"TaskDefinition")]=e.taskDefinitionArn,a[P(t,"PreviousTaskDefinition")]=e.previousTaskDefinitionArn,a[P(t,"ImageTag")]=r,a[P(t,"ImageUri")]=e.imageUri,a[P(t,"EcrRepositoryArn")]=e.ecrRepositoryArn,e.imageDigest!==void 0&&(a[P(t,"ImageDigest")]=e.imageDigest),l.push({serviceName:t,imageTag:r,imageUri:e.imageUri,taskDefinitionArn:e.taskDefinitionArn,previousTaskDefinitionArn:e.previousTaskDefinitionArn,...e.imageDigest!==void 0?{imageDigest:e.imageDigest}:{},...e.ecrRepositoryArn!==""?{ecrRepositoryArn:e.ecrRepositoryArn}:{}})}async function W(t,r,e,a,l){if(e.length===0)return;const n=ie(r,G.COMPUTE),h={};for(const{serviceName:v,imageTag:S}of e)h[re(v)]=S;const s=await t.cfnService.updateStackParameters(n,h,l);if(!s.success){a.onLog?.(`Rollback succeeded but the CloudFormation ImageTag parameter reconcile failed \u2014 the next full deploy may revert this rollback. Reason: ${A(s.error.message)}`,"warn");return}s.data.skippedKeys.length>0&&(a.onLog?.(`Rollback succeeded but ${s.data.skippedKeys.length} ImageTag parameter(s) were not found on stack ${n} (${s.data.skippedKeys.join(", ")}) \u2014 the next full deploy may revert those services`,"warn"),b.debug(N,"ImageTag reconcile skipped stale parameters",{stackName:n,skippedKeys:s.data.skippedKeys}))}function B(t,r,e,a){if(t.kind==="error")return r.failures.length>0?{kind:"error",error:new Error(`${t.error.message}; Lambda rollout failures: ${r.failures.join("; ")}`)}:t;if(r.failures.length>0)return{kind:"error",error:new Error(`Lambda rollout failures: ${r.failures.join("; ")}`)};const l=t.data,n={...l.outputs??{},...r.outputs};return{kind:"completed",data:{target:e.appName,deploymentType:"application",outputs:Object.keys(n).length>0?n:void 0,artefacts:[...l.artefacts,...r.artefacts],durationMs:Date.now()-a}}}async function ze(t,r,e,a,l){const{callbacks:n,options:h}=t,s=Date.now(),v=oe(G.COMPUTE,"deploy"),S=se(G.COMPUTE,"deploy");return ge(n,{stepId:v,stepName:S,stepIndex:Te,totalSteps:be},async()=>{const c=h?.imageTag,$=h?.serviceImageTags;c?n.onLog?.(`Rolling to supplied image tag ${c}`,"info"):$&&n.onLog?.(`Rolling ${Object.keys($).length} service(s) to their release-recorded image tags`,"info");const u=ae(J(e.path,"cdk.out"));b.debug(N,"Code-only rollout starting",{explicitRollbackTag:c,serviceImageTags:$,workingDirectory:t.workingDirectory,contentHashTagsByService:a,manifestServiceCount:u.length,manifestServices:u.map(i=>({name:i.name,target:i.docker.target}))}),n.onLog?.("Discovering ECS cluster and services\u2026","info");const o=await r.ecsResolver.getDeployableClusterAndServices(e.appName,t.abortSignal);if(!o.success)return b.debug(N,"ECS discovery failed",{appName:e.appName,error:A(o.error.message)}),{kind:"error",error:o.error};const{clusterArn:p,serviceArns:k}=o.data;b.debug(N,"ECS discovery complete",{appName:e.appName,clusterArn:p,serviceCount:k.length,serviceArns:k});const f=ne(J(e.path,"cdk.out")),M=Array.from(new Set(f.map(i=>i.imageKey))),x=p!==void 0&&k.length>0,U=f.length>0;if(!x&&!U){const i=`No deployable ECS services or container-image Lambda functions found for ${e.appName}`;return n.onLog?.(i,"warn"),{kind:"skipped",data:{target:e.appName,deploymentType:"application",durationMs:Date.now()-s,noChanges:!0,artefacts:[]}}}const d=p??"";if($!==void 0){const i=fe(x?k:[],$),m=await ke(r,e,$,t.abortSignal);if(!m.success)return{kind:"error",error:m.error};const g=new Set(m.data.matched.map(w=>w.entry.name));for(const w of i.unmatchedLiveServiceNames)n.onLog?.(`Service ${w} is not part of this release \u2014 leaving it untouched`,"warn");for(const w of i.staleMapKeys)g.has(w)||n.onLog?.(`Service ${w} from the release no longer exists in the stack`,"warn");if(i.matched.length===0&&g.size===0)return{kind:"error",error:new Error("None of the services in serviceImageTags matched a live ECS service or container-image Lambda function in this stack \u2014 nothing to roll")};const O=i.matched.length>0?await ue(r,d,i.matched,t.abortSignal):Q(new Map);if(!O.success)return{kind:"error",error:O.error};const I=i.matched.length>0?await Ae(r,e,d,i.matched,O.data,n,t.abortSignal,s):{kind:"completed",data:{target:e.appName,deploymentType:"application",artefacts:[],durationMs:Date.now()-s}},R=await he(r,m.data,n,t.abortSignal),y=[...I.kind==="completed"?I.data.artefacts.map(w=>({serviceName:w.serviceName,imageTag:w.imageTag})):[],...R.rolledImageKeys];return await W(r,e.appName,y,n,t.abortSignal),B(I,R,e,s)}const C=h?.serviceName?.toLowerCase(),L=C===""?void 0:C,T=L?k.filter(i=>me(j(i)??"",L)):k;if(L){const i=f.some(m=>ve(m.name,L));if(T.length===0&&!i){const m=[...k.map(g=>j(g)??"unknown"),...f.map(g=>g.name)];return{kind:"error",error:new Error(`Service '${L}' not found. Available: ${m.join(", ")||"none"}`)}}}const F={},K=[],E=[],_=[...k.map(i=>j(i)).filter(i=>i!==void 0&&i!==""),...M];for(let i=0;i<T.length;i++){if(V(t.abortSignal))return{kind:"error",error:new Error(`Rollout cancelled after ${K.length}/${T.length} services`)};const m=T[i];if(!m)continue;const g=j(m)??`service-${i+1}`,O=`[${i+1}/${T.length}] ${g}`,I=Se(u,g),R=ye(I,a);let y,w;if(c!==void 0)y=De(c,g,_),y!==c?(w=c,n.onLog?.(`Re-based image tag ${c} \u2192 ${y} for ${g}`,"info")):_.length>1&&!c.toLowerCase().startsWith(`${g.toLowerCase()}-`)&&n.onLog?.(`Image tag ${c} has no recognised service prefix; applying verbatim to ${g} \u2014 confirm it points at this service's image`,"warn");else if(R!==void 0)y=R;else{const H=`No image available to deploy for ${g}: no content-hash tag was produced this run. Run a full deploy to build the image, or pass --image-tag <tag> to roll a specific existing image.`;n.onLog?.(H,"warn"),E.push(`${g}: ${H}`);continue}b.debug(N,"Starting service rollout",{serviceName:g,serviceArn:m,imageTag:y,explicitRollbackTag:c,contentHashTag:R,manifestServiceMatched:I?.name,dockerTarget:I?.docker.target,index:i,total:T.length}),n.onECSUpdate?.(`${O}: rolling out image tag ${y}`,g);const D=await ee(r,d,m,g,y,n,w,void 0,t.abortSignal);if(b.debug(N,"Service rollout completed",{serviceName:g,success:D.success,...D.success?{taskDefinitionArn:D.data.taskDefinitionArn,imageDigest:D.data.imageDigest,durationMs:D.data.durationMs}:{error:A(D.error.message)}}),!D.success){E.push(`${g}: ${A(D.error.message)}`);continue}Z(g,y,D.data,F,K)}const te=Date.now()-s;if(E.length>0){const i=T.length-E.length,m=T.length,g=E.length===m?`All ${m} ECS service rollouts failed: ${E.join("; ")}`:`Partial rollout: ${i}/${m} services succeeded. Failures: ${E.join("; ")}`;return{kind:"error",error:new Error(g)}}const X=K.map(i=>({serviceName:i.serviceName,imageTag:i.imageTag})),Y={kind:"completed",data:{target:e.appName,deploymentType:"application",outputs:Object.keys(F).length>0?F:void 0,artefacts:K,durationMs:te}};if(!U)return c!==void 0&&await W(r,e.appName,X,n,t.abortSignal),Y;const q=c!==void 0?await $e(r,e,c,_,n,L,t.abortSignal):await we(r,e,a,l?.imageDigestsByService??{},l?.repoUri??de(r.awsProvider.getAccountId(),r.awsProvider.getRegion(),e.appName),n,L,t.abortSignal);return c!==void 0&&await W(r,e.appName,[...X,...q.rolledImageKeys],n,t.abortSignal),B(Y,q,e,s)},t.abortSignal)}async function Ae(t,r,e,a,l,n,h,s){const v={},S=[],c=[];for(let u=0;u<a.length;u++){if(V(h))return{kind:"error",error:new Error(`Rollout cancelled after ${S.length}/${a.length} services`)};const o=a[u];if(!o)continue;const p=`[${u+1}/${a.length}] ${o.serviceName}`,k=l.get(o.serviceArn);if(k===void 0){c.push(`${o.serviceName}: pre-flight digest missing after a successful pre-flight`);continue}b.debug(N,"Starting service rollout (serviceImageTags)",{serviceName:o.serviceName,serviceArn:o.serviceArn,imageTag:o.tag,mapKey:o.mapKey,index:u,total:a.length}),n.onECSUpdate?.(`${p}: rolling out image tag ${o.tag}`,o.serviceName);const f=await ee(t,e,o.serviceArn,o.serviceName,o.tag,n,void 0,k,h);if(b.debug(N,"Service rollout completed (serviceImageTags)",{serviceName:o.serviceName,success:f.success,...f.success?{taskDefinitionArn:f.data.taskDefinitionArn,imageDigest:f.data.imageDigest,durationMs:f.data.durationMs}:{error:A(f.error.message)}}),!f.success){c.push(`${o.serviceName}: ${A(f.error.message)}`);continue}Z(o.serviceName,o.tag,f.data,v,S)}const $=Date.now()-s;if(c.length>0){const u=a.length-c.length,o=a.length,p=c.length===o?`All ${o} ECS service rollouts failed: ${c.join("; ")}`:`Partial rollout: ${u}/${o} services succeeded. Failures: ${c.join("; ")}`;return{kind:"error",error:new Error(p)}}return{kind:"completed",data:{target:r.appName,deploymentType:"application",outputs:Object.keys(v).length>0?v:void 0,artefacts:S,durationMs:$}}}async function ee(t,r,e,a,l,n,h,s,v){const S=Date.now();let c,$,u,o,p;if(s!==void 0)c=s.taskDefinition.previousTaskDefArn,$=s.taskDefinition.taskDefinition,u=s.taskDefinition.containerDefinitions,o=s.taskDefinition.repoUri,p=s.imageDigest;else{const d=await pe(t,r,e,a,v);if(!d.success)return z(d.error);c=d.data.previousTaskDefArn,$=d.data.taskDefinition,u=d.data.containerDefinitions,o=d.data.repoUri;const C=await t.ecrImageInspector.getImageDigest(o,l,v);if(C.success)p=C.data;else{if(h!==void 0)return z(new Error(`Re-based image tag '${l}' (from supplied '${h}') was not found in ECR for ${a}: ${A(C.error.message)}. The supplied tag's build has no image for ${a} \u2014 supply that service's own tag, or pass --service to roll a single service.`));n.onLog?.(`Could not resolve image digest for ${a} (${A(C.error.message)}); falling back to tag pinning`,"warn")}}const k=d=>p!==void 0?`${d}@${p}`:`${d}:${l}`,f=u.map(d=>d.image?{...d,image:k(ce(d.image))}:d),M=await le(t,{clusterArn:r,serviceArn:e,serviceName:a,taskDefinition:$,containerDefinitions:f,previousTaskDefArn:c,...p!==void 0?{imageDigest:p}:{},startedAtMs:S},n,v);if(!M.success)return z(M.error);const x=`${o}:${l}`,U=Ne(o);return Q({taskDefinitionArn:M.data.newTaskDefArn,previousTaskDefinitionArn:c,imageUri:x,ecrRepositoryArn:U,imageDigest:p,durationMs:M.data.durationMs})}function Ne(t){const r=t.match(/^(\d{12})\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com\/(.+)$/);if(!r)return"";const[,e,a,l]=r;return`arn:aws:ecr:${a}:${e}:repository/${l}`}export{ze as deployCodeOnly,Ne as deriveEcrRepositoryArn,ye as lookupContentHashTag,De as rebaseRollbackTagForService};
+var ae=Object.defineProperty;var y=(e,r)=>ae(e,"name",{value:r,configurable:!0});import{join as Q}from"path";import{success as V,failure as G}from"@fjall/generator";import{logger as A}from"@fjall/util/logger";import{artefactOutputKey as O,imageTagParameterName as ne,maskSensitiveOutput as N}from"@fjall/util";import{parseDockerServicesFromManifest as ie,parseLambdaDockerEntriesFromManifest as oe}from"@fjall/util/manifest";import{APPLICATION_STACKS as W,getApplicationStackName as se,getApplicationStepId as ce,getApplicationStepName as ge}from"../../types/operations.js";import{extractEcsServiceName as F}from"../../aws/utils/arnParser.js";import{isAborted as Z}from"../../aws/organisations/types.js";import{stripTagOrDigest as le}from"../../services/infrastructure/EcrImageInspectorService.js";import{withStepLifecycle as de}from"../stepLifecycle.js";import{registerAndRollTaskDefinition as me}from"./taskDefinitionRoll.js";import{ecrRepoUri as fe}from"./dockerBuildHelper.js";import{matchesServiceName as ue,matchServiceImageTagsToLiveServices as pe,preflightResolveServiceImageTagDigests as he,resolveServiceTaskDefinition as ve}from"./serviceImageTagsRollback.js";import{executeLambdaServiceImageTagsRollout as ke,matchesLambdaFunctionName as $e,preflightLambdaServiceImageTags as we,rolloutLambdaImageTag as ye,rolloutLambdaPrimary as Se}from"./lambdaCodeOnlyRollout.js";const C="codeOnlyDeploy";function De(e,r){if(e)return r[e.name]}y(De,"lookupContentHashTag");function Te(e,r){const t=r.toLowerCase();return e.find(a=>a.name.toLowerCase()===t)??e.find(a=>t.includes(a.name.toLowerCase()))}y(Te,"findManifestServiceForEcsService");function be(e,r,t){const a=r.toLowerCase(),l=e.toLowerCase(),n=t.map(s=>s.toLowerCase()).filter(s=>s!==""&&l.startsWith(`${s}-`)).sort((s,v)=>v.length-s.length)[0];if(n===void 0||n===a)return e;const h=e.slice(n.length);return`${a}${h}`}y(be,"rebaseRollbackTagForService");const Ae=0,Ne=1;function B(e,r,t,a,l){a[O(e,"TaskDefinition")]=t.taskDefinitionArn,a[O(e,"PreviousTaskDefinition")]=t.previousTaskDefinitionArn,a[O(e,"ImageTag")]=r,a[O(e,"ImageUri")]=t.imageUri,a[O(e,"EcrRepositoryArn")]=t.ecrRepositoryArn,t.imageDigest!==void 0&&(a[O(e,"ImageDigest")]=t.imageDigest),l.push({serviceName:e,imageTag:r,imageUri:t.imageUri,taskDefinitionArn:t.taskDefinitionArn,previousTaskDefinitionArn:t.previousTaskDefinitionArn,...t.imageDigest!==void 0?{imageDigest:t.imageDigest}:{},...t.ecrRepositoryArn!==""?{ecrRepositoryArn:t.ecrRepositoryArn}:{}})}y(B,"recordRolloutOutputs");async function X(e,r,t,a,l){if(t.length===0)return;const n=se(r,W.COMPUTE),h={};for(const{serviceName:v,imageTag:D}of t)h[ne(v)]=D;const s=await e.cfnService.updateStackParameters(n,h,l);if(!s.success){a.onLog?.(`Rollback succeeded but the CloudFormation ImageTag parameter reconcile failed \u2014 the next full deploy may revert this rollback. Reason: ${N(s.error.message)}`,"warn");return}s.data.skippedKeys.length>0&&(a.onLog?.(`Rollback succeeded but ${s.data.skippedKeys.length} ImageTag parameter(s) were not found on stack ${n} (${s.data.skippedKeys.join(", ")}) \u2014 the next full deploy may revert those services`,"warn"),A.debug(C,"ImageTag reconcile skipped stale parameters",{stackName:n,skippedKeys:s.data.skippedKeys}))}y(X,"reconcileImageTagParameters");function ee(e,r,t,a){if(e.kind==="error")return r.failures.length>0?{kind:"error",error:new Error(`${e.error.message}; Lambda rollout failures: ${r.failures.join("; ")}`)}:e;if(r.failures.length>0)return{kind:"error",error:new Error(`Lambda rollout failures: ${r.failures.join("; ")}`)};const l=e.data,n={...l.outputs??{},...r.outputs};return{kind:"completed",data:{target:t.appName,deploymentType:"application",outputs:Object.keys(n).length>0?n:void 0,artefacts:[...l.artefacts,...r.artefacts],durationMs:Date.now()-a}}}y(ee,"mergeEcsAndLambdaOutcomes");async function Xe(e,r,t,a,l){const{callbacks:n,options:h}=e,s=Date.now(),v=ce(W.COMPUTE,"deploy"),D=ge(W.COMPUTE,"deploy");return de(n,{stepId:v,stepName:D,stepIndex:Ae,totalSteps:Ne},async()=>{const c=h?.imageTag,$=h?.serviceImageTags;c?n.onLog?.(`Rolling to supplied image tag ${c}`,"info"):$&&n.onLog?.(`Rolling ${Object.keys($).length} service(s) to their release-recorded image tags`,"info");const u=ie(Q(t.path,"cdk.out"));A.debug(C,"Code-only rollout starting",{explicitRollbackTag:c,serviceImageTags:$,workingDirectory:e.workingDirectory,contentHashTagsByService:a,manifestServiceCount:u.length,manifestServices:u.map(i=>({name:i.name,target:i.docker.target}))}),n.onLog?.("Discovering ECS cluster and services\u2026","info");const o=await r.ecsResolver.getDeployableClusterAndServices(t.appName,e.abortSignal);if(!o.success)return A.debug(C,"ECS discovery failed",{appName:t.appName,error:N(o.error.message)}),{kind:"error",error:o.error};const{clusterArn:p,serviceArns:k}=o.data;A.debug(C,"ECS discovery complete",{appName:t.appName,clusterArn:p,serviceCount:k.length,serviceArns:k});const f=oe(Q(t.path,"cdk.out")),R=Array.from(new Set(f.map(i=>i.imageKey))),U=p!==void 0&&k.length>0,K=f.length>0;if(!U&&!K){const i=`No deployable ECS services or container-image Lambda functions found for ${t.appName}`;return n.onLog?.(i,"warn"),{kind:"skipped",data:{target:t.appName,deploymentType:"application",durationMs:Date.now()-s,noChanges:!0,artefacts:[]}}}const d=p??"";if($!==void 0){const i=pe(U?k:[],$),m=await we(r,t,$,e.abortSignal);if(!m.success)return{kind:"error",error:m.error};const g=new Set(m.data.matched.map(w=>w.entry.name));for(const w of i.unmatchedLiveServiceNames)n.onLog?.(`Service ${w} is not part of this release \u2014 leaving it untouched`,"warn");for(const w of i.staleMapKeys)g.has(w)||n.onLog?.(`Service ${w} from the release no longer exists in the stack`,"warn");if(i.matched.length===0&&g.size===0)return{kind:"error",error:new Error("None of the services in serviceImageTags matched a live ECS service or container-image Lambda function in this stack \u2014 nothing to roll")};const x=i.matched.length>0?await he(r,d,i.matched,e.abortSignal):V(new Map);if(!x.success)return{kind:"error",error:x.error};const M=i.matched.length>0?await Ce(r,t,d,i.matched,x.data,n,e.abortSignal,s):{kind:"completed",data:{target:t.appName,deploymentType:"application",artefacts:[],durationMs:Date.now()-s}},P=await ke(r,m.data,n,e.abortSignal),S=[...M.kind==="completed"?M.data.artefacts.map(w=>({serviceName:w.serviceName,imageTag:w.imageTag})):[],...P.rolledImageKeys];return await X(r,t.appName,S,n,e.abortSignal),ee(M,P,t,s)}const L=h?.serviceName?.toLowerCase(),E=L===""?void 0:L,b=E?k.filter(i=>ue(F(i)??"",E)):k;if(E){const i=f.some(m=>$e(m.name,E));if(b.length===0&&!i){const m=[...k.map(g=>F(g)??"unknown"),...f.map(g=>g.name)];return{kind:"error",error:new Error(`Service '${E}' not found. Available: ${m.join(", ")||"none"}`)}}}const _={},j=[],I=[],z=[...k.map(i=>F(i)).filter(i=>i!==void 0&&i!==""),...R];for(let i=0;i<b.length;i++){if(Z(e.abortSignal))return{kind:"error",error:new Error(`Rollout cancelled after ${j.length}/${b.length} services`)};const m=b[i];if(!m)continue;const g=F(m)??`service-${i+1}`,x=`[${i+1}/${b.length}] ${g}`,M=Te(u,g),P=De(M,a);let S,w;if(c!==void 0)S=be(c,g,z),S!==c?(w=c,n.onLog?.(`Re-based image tag ${c} \u2192 ${S} for ${g}`,"info")):z.length>1&&!c.toLowerCase().startsWith(`${g.toLowerCase()}-`)&&n.onLog?.(`Image tag ${c} has no recognised service prefix; applying verbatim to ${g} \u2014 confirm it points at this service's image`,"warn");else if(P!==void 0)S=P;else{const J=`No image available to deploy for ${g}: no content-hash tag was produced this run. Run a full deploy to build the image, or pass --image-tag <tag> to roll a specific existing image.`;n.onLog?.(J,"warn"),I.push(`${g}: ${J}`);continue}A.debug(C,"Starting service rollout",{serviceName:g,serviceArn:m,imageTag:S,explicitRollbackTag:c,contentHashTag:P,manifestServiceMatched:M?.name,dockerTarget:M?.docker.target,index:i,total:b.length}),n.onECSUpdate?.(`${x}: rolling out image tag ${S}`,g);const T=await te(r,d,m,g,S,n,w,void 0,e.abortSignal);if(A.debug(C,"Service rollout completed",{serviceName:g,success:T.success,...T.success?{taskDefinitionArn:T.data.taskDefinitionArn,imageDigest:T.data.imageDigest,durationMs:T.data.durationMs}:{error:N(T.error.message)}}),!T.success){I.push(`${g}: ${N(T.error.message)}`);continue}B(g,S,T.data,_,j)}const re=Date.now()-s;if(I.length>0){const i=b.length-I.length,m=b.length,g=I.length===m?`All ${m} ECS service rollouts failed: ${I.join("; ")}`:`Partial rollout: ${i}/${m} services succeeded. Failures: ${I.join("; ")}`;return{kind:"error",error:new Error(g)}}const Y=j.map(i=>({serviceName:i.serviceName,imageTag:i.imageTag})),q={kind:"completed",data:{target:t.appName,deploymentType:"application",outputs:Object.keys(_).length>0?_:void 0,artefacts:j,durationMs:re}};if(!K)return c!==void 0&&await X(r,t.appName,Y,n,e.abortSignal),q;const H=c!==void 0?await ye(r,t,c,z,n,E,e.abortSignal):await Se(r,t,a,l?.imageDigestsByService??{},l?.repoUri??fe(r.awsProvider.getAccountId(),r.awsProvider.getRegion(),t.appName),n,E,e.abortSignal);return c!==void 0&&await X(r,t.appName,[...Y,...H.rolledImageKeys],n,e.abortSignal),ee(q,H,t,s)},e.abortSignal)}y(Xe,"deployCodeOnly");async function Ce(e,r,t,a,l,n,h,s){const v={},D=[],c=[];for(let u=0;u<a.length;u++){if(Z(h))return{kind:"error",error:new Error(`Rollout cancelled after ${D.length}/${a.length} services`)};const o=a[u];if(!o)continue;const p=`[${u+1}/${a.length}] ${o.serviceName}`,k=l.get(o.serviceArn);if(k===void 0){c.push(`${o.serviceName}: pre-flight digest missing after a successful pre-flight`);continue}A.debug(C,"Starting service rollout (serviceImageTags)",{serviceName:o.serviceName,serviceArn:o.serviceArn,imageTag:o.tag,mapKey:o.mapKey,index:u,total:a.length}),n.onECSUpdate?.(`${p}: rolling out image tag ${o.tag}`,o.serviceName);const f=await te(e,t,o.serviceArn,o.serviceName,o.tag,n,void 0,k,h);if(A.debug(C,"Service rollout completed (serviceImageTags)",{serviceName:o.serviceName,success:f.success,...f.success?{taskDefinitionArn:f.data.taskDefinitionArn,imageDigest:f.data.imageDigest,durationMs:f.data.durationMs}:{error:N(f.error.message)}}),!f.success){c.push(`${o.serviceName}: ${N(f.error.message)}`);continue}B(o.serviceName,o.tag,f.data,v,D)}const $=Date.now()-s;if(c.length>0){const u=a.length-c.length,o=a.length,p=c.length===o?`All ${o} ECS service rollouts failed: ${c.join("; ")}`:`Partial rollout: ${u}/${o} services succeeded. Failures: ${c.join("; ")}`;return{kind:"error",error:new Error(p)}}return{kind:"completed",data:{target:r.appName,deploymentType:"application",outputs:Object.keys(v).length>0?v:void 0,artefacts:D,durationMs:$}}}y(Ce,"rollOutServiceImageTagsMap");async function te(e,r,t,a,l,n,h,s,v){const D=Date.now();let c,$,u,o,p;if(s!==void 0)c=s.taskDefinition.previousTaskDefArn,$=s.taskDefinition.taskDefinition,u=s.taskDefinition.containerDefinitions,o=s.taskDefinition.repoUri,p=s.imageDigest;else{const d=await ve(e,r,t,a,v);if(!d.success)return G(d.error);c=d.data.previousTaskDefArn,$=d.data.taskDefinition,u=d.data.containerDefinitions,o=d.data.repoUri;const L=await e.ecrImageInspector.getImageDigest(o,l,v);if(L.success)p=L.data;else{if(h!==void 0)return G(new Error(`Re-based image tag '${l}' (from supplied '${h}') was not found in ECR for ${a}: ${N(L.error.message)}. The supplied tag's build has no image for ${a} \u2014 supply that service's own tag, or pass --service to roll a single service.`));n.onLog?.(`Could not resolve image digest for ${a} (${N(L.error.message)}); falling back to tag pinning`,"warn")}}const k=y(d=>p!==void 0?`${d}@${p}`:`${d}:${l}`,"buildContainerImage"),f=u.map(d=>d.image?{...d,image:k(le(d.image))}:d),R=await me(e,{clusterArn:r,serviceArn:t,serviceName:a,taskDefinition:$,containerDefinitions:f,previousTaskDefArn:c,...p!==void 0?{imageDigest:p}:{},startedAtMs:D},n,v);if(!R.success)return G(R.error);const U=`${o}:${l}`,K=Le(o);return V({taskDefinitionArn:R.data.newTaskDefArn,previousTaskDefinitionArn:c,imageUri:U,ecrRepositoryArn:K,imageDigest:p,durationMs:R.data.durationMs})}y(te,"rolloutService");function Le(e){const r=e.match(/^(\d{12})\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com\/(.+)$/);if(!r)return"";const[,t,a,l]=r;return`arn:aws:ecr:${a}:${t}:repository/${l}`}y(Le,"deriveEcrRepositoryArn");export{Xe as deployCodeOnly,Le as deriveEcrRepositoryArn,De as lookupContentHashTag,be as rebaseRollbackTagForService};

package/dist/src/orchestration/application/databaseEndpointReconcile.js

@@ -1 +1 @@
-import{maskSensitiveOutput as h}from"@fjall/util";import{logger as w}from"@fjall/util/logger";import{getApplicationStackName as R,APPLICATION_STACKS as T}from"../../types/operations.js";import{extractEcsServiceName as N}from"../../aws/utils/arnParser.js";import{isAborted as C}from"../../aws/organisations/types.js";import{resolveServiceTaskDefinition as O}from"./serviceImageTagsRollback.js";import{registerAndRollTaskDefinition as E}from"./taskDefinitionRoll.js";const b="databaseEndpointReconcile",j=["Endpoint","Port"];async function I(s,t,a){const c=R(t,T.DATABASE),e=await s.getStackOutputs(c,void 0,a);if(!e.success){w.debug(b,"Could not read database stack outputs",{stackName:c,error:h(e.error.message)});return}const r={};for(const i of e.data){const l=i.OutputKey,f=i.OutputValue;l===void 0||f===void 0||j.some(d=>l.endsWith(d))&&(r[l]=f)}return r}async function W(s,t,a,c){const e=await s.getDeployableClusterAndServices(a,c);if(!e.success){w.debug(b,"Could not discover services pre-deploy",{appName:a,error:h(e.error.message)});return}const{clusterArn:r,serviceArns:i}=e.data;if(r===void 0||i.length===0)return{};const l=await t.describeServices(r,i,c);if(!l.success){w.debug(b,"Could not describe services pre-deploy",{appName:a,error:h(l.error.message)});return}const f={};for(const d of l.data)d.serviceArn!==void 0&&d.taskDefinition!==void 0&&(f[d.serviceArn]=d.taskDefinition);return f}function x(s,t){return Object.keys(s).filter(a=>t[a]!==void 0&&t[a]!==s[a]).sort()}async function q(s){const{appName:t,connectionOutputsBefore:a,services:c,callbacks:e,abortSignal:r}=s,i=`Run \`fjall rollout ${t}\` to restart them manually.`,l=`Could not verify the database endpoint was unchanged by this deploy. If the database was replaced (e.g. restored from a snapshot), run \`fjall rollout ${t}\` so running services reconnect to it.`;if(a===void 0)return e.onLog?.(l,"warn"),{kind:"unverified"};const f=await I(c.cfnService,t);if(f===void 0)return e.onLog?.(l,"warn"),{kind:"unverified"};const d=x(a,f);if(d.length===0)return{kind:"not-needed"};if(e.onLog?.(`Database connection outputs changed this deploy (${d.join(", ")}) \u2014 the database was replaced.`,"info"),C(r))return e.onLog?.(`Deploy cancelled before services were restarted onto the new database endpoint. ${i}`,"warn"),{kind:"cancelled"};const k=await c.ecsResolver.getDeployableClusterAndServices(t,r);if(!k.success)return e.onLog?.(`Could not discover this application's ECS services to restart them onto the new database endpoint: ${h(k.error.message)}. ${i}`,"warn"),{kind:"failed"};const{clusterArn:m,serviceArns:$}=k.data;if(m===void 0||$.length===0)return e.onLog?.(`Database connection outputs changed but no running ECS services were found to restart. If this application has running services, run \`fjall rollout ${t}\` so they reconnect to the new database endpoint.`,"warn"),{kind:"not-needed"};const A=s.serviceTaskDefinitionsBefore,L=A!==void 0&&Object.keys(A).length>0,p=[];let D=0,S=0;const y=(n,o)=>{e.onLog?.(`Could not restart ${n} onto the new database endpoint: ${h(o)}. ${i}`,"warn"),S+=1};for(const n of $){if(C(r))return e.onLog?.(`Deploy cancelled before services were restarted onto the new database endpoint. ${i}`,"warn"),{kind:"cancelled"};const o=N(n)??n,u=await O({ecsService:c.ecsService},m,n,o,r);if(!u.success){y(o,u.error.message);continue}const v=A?.[n];if(L&&v===void 0){D+=1;continue}if(v!==void 0&&v!==u.data.previousTaskDefArn){D+=1;continue}p.push({serviceArn:n,serviceName:o,resolved:u.data})}if(p.length===0)return S>0?{kind:"failed"}:(e.onLog?.(`Services were already relaunched during this deploy \u2014 no restart needed. If something other than this deploy relaunched them, run \`fjall rollout ${t}\` to be safe.`,"info"),{kind:"already-current"});if(s.confirmRestart!==void 0){const n={appName:t,changedOutputs:d,serviceCount:p.length};let o;try{o=await s.confirmRestart(n)}catch(u){return e.onLog?.(`Restart confirmation failed: ${h(u instanceof Error?u.message:String(u))}. ${i}`,"warn"),{kind:"failed"}}if(!o)return e.onLog?.(`Restart declined \u2014 running containers are still connected to the old database endpoint. ${i}`,"warn"),{kind:"declined"}}e.onLog?.(`Restarting ${p.length} service${p.length===1?"":"s"} so running containers reconnect to the new database\u2026`,"info");const g=[];for(const n of p){if(C(r))return e.onLog?.(`Deploy cancelled before all services were restarted onto the new database endpoint. ${i}`,"warn"),{kind:"cancelled"};let o=n.resolved;if(s.confirmRestart!==void 0){const v=await O({ecsService:c.ecsService},m,n.serviceArn,n.serviceName,r);if(!v.success){y(n.serviceName,v.error.message);continue}if(v.data.previousTaskDefArn!==n.resolved.previousTaskDefArn){e.onLog?.(`${n.serviceName} was relaunched while awaiting confirmation \u2014 skipping its restart.`,"info");continue}o=v.data}const u=await E({ecsService:c.ecsService},{clusterArn:m,serviceArn:n.serviceArn,serviceName:n.serviceName,taskDefinition:o.taskDefinition,containerDefinitions:o.containerDefinitions,previousTaskDefArn:o.previousTaskDefArn,startedAtMs:Date.now()},e,r);if(!u.success){y(n.serviceName,u.error.message);continue}g.push(n.serviceName)}return g.length>0&&(w.debug(b,"Restarted services after database replacement",{appName:t,changedOutputs:d,services:g,alreadyRolled:D}),e.onLog?.(`Restarted ${g.length} service${g.length===1?"":"s"} onto the new database endpoint.`,"info")),S>0?{kind:"failed"}:{kind:"reconciled",services:g}}export{I as captureDatabaseConnectionOutputs,W as captureServiceTaskDefinitions,q as reconcileDatabaseEndpointChange};
+var T=Object.defineProperty;var h=(r,t)=>T(r,"name",{value:t,configurable:!0});import{maskSensitiveOutput as m}from"@fjall/util";import{logger as b}from"@fjall/util/logger";import{getApplicationStackName as N,APPLICATION_STACKS as E}from"../../types/operations.js";import{extractEcsServiceName as j}from"../../aws/utils/arnParser.js";import{isAborted as $}from"../../aws/organisations/types.js";import{resolveServiceTaskDefinition as L}from"./serviceImageTagsRollback.js";import{registerAndRollTaskDefinition as I}from"./taskDefinitionRoll.js";const k="databaseEndpointReconcile",x=["Endpoint","Port"];async function B(r,t,a){const c=N(t,E.DATABASE),e=await r.getStackOutputs(c,void 0,a);if(!e.success){b.debug(k,"Could not read database stack outputs",{stackName:c,error:m(e.error.message)});return}const i={};for(const o of e.data){const l=o.OutputKey,f=o.OutputValue;l===void 0||f===void 0||x.some(d=>l.endsWith(d))&&(i[l]=f)}return i}h(B,"captureDatabaseConnectionOutputs");async function M(r,t,a,c){const e=await r.getDeployableClusterAndServices(a,c);if(!e.success){b.debug(k,"Could not discover services pre-deploy",{appName:a,error:m(e.error.message)});return}const{clusterArn:i,serviceArns:o}=e.data;if(i===void 0||o.length===0)return{};const l=await t.describeServices(i,o,c);if(!l.success){b.debug(k,"Could not describe services pre-deploy",{appName:a,error:m(l.error.message)});return}const f={};for(const d of l.data)d.serviceArn!==void 0&&d.taskDefinition!==void 0&&(f[d.serviceArn]=d.taskDefinition);return f}h(M,"captureServiceTaskDefinitions");function P(r,t){return Object.keys(r).filter(a=>t[a]!==void 0&&t[a]!==r[a]).sort()}h(P,"diffConnectionOutputs");async function V(r){const{appName:t,connectionOutputsBefore:a,services:c,callbacks:e,abortSignal:i}=r,o=`Run \`fjall rollout ${t}\` to restart them manually.`,l=`Could not verify the database endpoint was unchanged by this deploy. If the database was replaced (e.g. restored from a snapshot), run \`fjall rollout ${t}\` so running services reconnect to it.`;if(a===void 0)return e.onLog?.(l,"warn"),{kind:"unverified"};const f=await B(c.cfnService,t);if(f===void 0)return e.onLog?.(l,"warn"),{kind:"unverified"};const d=P(a,f);if(d.length===0)return{kind:"not-needed"};if(e.onLog?.(`Database connection outputs changed this deploy (${d.join(", ")}) \u2014 the database was replaced.`,"info"),$(i))return e.onLog?.(`Deploy cancelled before services were restarted onto the new database endpoint. ${o}`,"warn"),{kind:"cancelled"};const A=await c.ecsResolver.getDeployableClusterAndServices(t,i);if(!A.success)return e.onLog?.(`Could not discover this application's ECS services to restart them onto the new database endpoint: ${m(A.error.message)}. ${o}`,"warn"),{kind:"failed"};const{clusterArn:w,serviceArns:O}=A.data;if(w===void 0||O.length===0)return e.onLog?.(`Database connection outputs changed but no running ECS services were found to restart. If this application has running services, run \`fjall rollout ${t}\` so they reconnect to the new database endpoint.`,"warn"),{kind:"not-needed"};const D=r.serviceTaskDefinitionsBefore,R=D!==void 0&&Object.keys(D).length>0,p=[];let S=0,y=0;const C=h((n,s)=>{e.onLog?.(`Could not restart ${n} onto the new database endpoint: ${m(s)}. ${o}`,"warn"),y+=1},"warnServiceFailure");for(const n of O){if($(i))return e.onLog?.(`Deploy cancelled before services were restarted onto the new database endpoint. ${o}`,"warn"),{kind:"cancelled"};const s=j(n)??n,u=await L({ecsService:c.ecsService},w,n,s,i);if(!u.success){C(s,u.error.message);continue}const v=D?.[n];if(R&&v===void 0){S+=1;continue}if(v!==void 0&&v!==u.data.previousTaskDefArn){S+=1;continue}p.push({serviceArn:n,serviceName:s,resolved:u.data})}if(p.length===0)return y>0?{kind:"failed"}:(e.onLog?.(`Services were already relaunched during this deploy \u2014 no restart needed. If something other than this deploy relaunched them, run \`fjall rollout ${t}\` to be safe.`,"info"),{kind:"already-current"});if(r.confirmRestart!==void 0){const n={appName:t,changedOutputs:d,serviceCount:p.length};let s;try{s=await r.confirmRestart(n)}catch(u){return e.onLog?.(`Restart confirmation failed: ${m(u instanceof Error?u.message:String(u))}. ${o}`,"warn"),{kind:"failed"}}if(!s)return e.onLog?.(`Restart declined \u2014 running containers are still connected to the old database endpoint. ${o}`,"warn"),{kind:"declined"}}e.onLog?.(`Restarting ${p.length} service${p.length===1?"":"s"} so running containers reconnect to the new database\u2026`,"info");const g=[];for(const n of p){if($(i))return e.onLog?.(`Deploy cancelled before all services were restarted onto the new database endpoint. ${o}`,"warn"),{kind:"cancelled"};let s=n.resolved;if(r.confirmRestart!==void 0){const v=await L({ecsService:c.ecsService},w,n.serviceArn,n.serviceName,i);if(!v.success){C(n.serviceName,v.error.message);continue}if(v.data.previousTaskDefArn!==n.resolved.previousTaskDefArn){e.onLog?.(`${n.serviceName} was relaunched while awaiting confirmation \u2014 skipping its restart.`,"info");continue}s=v.data}const u=await I({ecsService:c.ecsService},{clusterArn:w,serviceArn:n.serviceArn,serviceName:n.serviceName,taskDefinition:s.taskDefinition,containerDefinitions:s.containerDefinitions,previousTaskDefArn:s.previousTaskDefArn,startedAtMs:Date.now()},e,i);if(!u.success){C(n.serviceName,u.error.message);continue}g.push(n.serviceName)}return g.length>0&&(b.debug(k,"Restarted services after database replacement",{appName:t,changedOutputs:d,services:g,alreadyRolled:S}),e.onLog?.(`Restarted ${g.length} service${g.length===1?"":"s"} onto the new database endpoint.`,"info")),y>0?{kind:"failed"}:{kind:"reconciled",services:g}}h(V,"reconcileDatabaseEndpointChange");export{B as captureDatabaseConnectionOutputs,M as captureServiceTaskDefinitions,V as reconcileDatabaseEndpointChange};

package/dist/src/orchestration/application/deploySessionPolicy.js

@@ -1 +1 @@
-import{success as p,failure as s}from"@fjall/generator";import{toKebab as m,toPascalCase as d}from"@fjall/util";import{buildCacheRepositoryName as u}from"@fjall/util/docker";import{MAX_INLINE_POLICY_CHARS as i}from"./buildSecretSession.js";const f=["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:CreateChangeSet","cloudformation:ExecuteChangeSet","cloudformation:DeleteChangeSet","cloudformation:CancelUpdateStack","cloudformation:ContinueUpdateRollback","cloudformation:RollbackStack","cloudformation:SetStackPolicy","cloudformation:UpdateTerminationProtection"],y=["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchDeleteImage","ecr:DeleteRepository","ecr:SetRepositoryPolicy","ecr:DeleteRepositoryPolicy"];function k(a){const{region:o,accountId:e,partition:t}=a,n=d(a.appName),c=m(a.appName),l=[{Sid:"FjallDeployInheritAdmin",Effect:"Allow",Action:"*",Resource:"*"},{Sid:"FjallDeployDenyForeignStackMutation",Effect:"Deny",Action:f,NotResource:[`arn:${t}:cloudformation:${o}:${e}:stack/${n}*/*`,`arn:${t}:cloudformation:${o}:${e}:stack/CDKToolkit/*`]},{Sid:"FjallDeployDenyForeignEcrMutation",Effect:"Deny",Action:y,NotResource:[`arn:${t}:ecr:${o}:${e}:repository/${c}`,`arn:${t}:ecr:${o}:${e}:repository/${u(c)}`,`arn:${t}:ecr:${o}:${e}:repository/cdk-*`]}],r=JSON.stringify({Version:"2012-10-17",Statement:l});return r.length>i?s(new Error(`Deploy session policy is ${r.length} chars, exceeding the ${i}-char AWS inline-policy limit.`)):p(r)}export{k as buildDeploySessionPolicy};
+var s=Object.defineProperty;var i=(e,o)=>s(e,"name",{value:o,configurable:!0});import{success as m,failure as d}from"@fjall/generator";import{toKebab as u,toPascalCase as f}from"@fjall/util";import{buildCacheRepositoryName as y}from"@fjall/util/docker";import{MAX_INLINE_POLICY_CHARS as n}from"./buildSecretSession.js";const S=["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:CreateChangeSet","cloudformation:ExecuteChangeSet","cloudformation:DeleteChangeSet","cloudformation:CancelUpdateStack","cloudformation:ContinueUpdateRollback","cloudformation:RollbackStack","cloudformation:SetStackPolicy","cloudformation:UpdateTerminationProtection"],$=["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchDeleteImage","ecr:DeleteRepository","ecr:SetRepositoryPolicy","ecr:DeleteRepositoryPolicy"];function A(e){const{region:o,accountId:t,partition:a}=e,l=f(e.appName),c=u(e.appName),p=[{Sid:"FjallDeployInheritAdmin",Effect:"Allow",Action:"*",Resource:"*"},{Sid:"FjallDeployDenyForeignStackMutation",Effect:"Deny",Action:S,NotResource:[`arn:${a}:cloudformation:${o}:${t}:stack/${l}*/*`,`arn:${a}:cloudformation:${o}:${t}:stack/CDKToolkit/*`]},{Sid:"FjallDeployDenyForeignEcrMutation",Effect:"Deny",Action:$,NotResource:[`arn:${a}:ecr:${o}:${t}:repository/${c}`,`arn:${a}:ecr:${o}:${t}:repository/${y(c)}`,`arn:${a}:ecr:${o}:${t}:repository/cdk-*`]}],r=JSON.stringify({Version:"2012-10-17",Statement:p});return r.length>n?d(new Error(`Deploy session policy is ${r.length} chars, exceeding the ${n}-char AWS inline-policy limit.`)):m(r)}i(A,"buildDeploySessionPolicy");export{A as buildDeploySessionPolicy};

package/dist/src/orchestration/application/destroyPreFlight.js

@@ -1 +1 @@
-import{CloudFormationClient as l}from"@aws-sdk/client-cloudformation";import{success as u,failure as n}from"@fjall/generator";import{getErrorMessage as f,maskSensitiveOutput as y}from"@fjall/util";import{logger as h}from"@fjall/util/logger";import{isAborted as g}from"../../aws/organisations/types.js";import{STACK_NOT_FOUND_PATTERN as p}from"../../types/constants.js";import{DELETE_BLOCK_PROBES as a}from"../probes/deleteBlockProbes.js";import{collectStackResources as m}from"../stackCleanup/stackResources.js";const b="DestroyPreFlight";async function S(s,r){const c=s.getClient(l);for(const t of r.stackNames){if(g(r.abortSignal))return n(new Error(`Destroy pre-flight aborted before ${t} was checked \u2014 nothing was destroyed in this run.`));let d;try{d=await m(c,t,e=>e.ResourceType!==void 0&&a[e.ResourceType]!==void 0&&e.ResourceStatus!=="DELETE_COMPLETE",e=>e.LogicalResourceId!==void 0&&e.PhysicalResourceId!==void 0&&e.PhysicalResourceId!==""&&e.ResourceType!==void 0?{logicalId:e.LogicalResourceId,physicalId:e.PhysicalResourceId,resourceType:e.ResourceType}:void 0,r.abortSignal)}catch(e){if(e instanceof Error&&e.message.includes(p)){h.debug(b,`Stack ${t} does not exist \u2014 nothing to probe`);continue}return n(new Error(`Destroy pre-flight for ${t}: could not list stack resources to verify deletability: ${y(f(e))}. Retry the destroy. Nothing was destroyed in this run.`))}for(const e of d){const o=a[e.resourceType];if(o===void 0)continue;const i=await o.probe(s,e.physicalId,r.abortSignal);if(!i.success)return n(new Error(`Destroy pre-flight for ${t}: could not verify that ${e.physicalId} (${e.logicalId}) is deletable \u2014 ${o.method} failed: ${i.error.message}. Retry the destroy. Nothing was destroyed in this run.`));if(i.data.blocked)return n(new Error(`Destroy pre-flight for ${t}: ${e.physicalId} (${e.logicalId}) has ${i.data.setting} enabled \u2014 CloudFormation cannot delete it, so the destroy would fail partway after other resources were already removed. Disable it on the live resource (e.g. '${o.disableCommand(e.physicalId)}'), then re-run the destroy. Nothing was destroyed in this run.`))}}return u(void 0)}export{S as runDestroyPreFlight};
+var u=Object.defineProperty;var a=(o,t)=>u(o,"name",{value:t,configurable:!0});import{CloudFormationClient as f}from"@aws-sdk/client-cloudformation";import{success as y,failure as s}from"@fjall/generator";import{getErrorMessage as h,maskSensitiveOutput as g}from"@fjall/util";import{logger as p}from"@fjall/util/logger";import{isAborted as m}from"../../aws/organisations/types.js";import{STACK_NOT_FOUND_PATTERN as b}from"../../types/constants.js";import{DELETE_BLOCK_PROBES as c}from"../probes/deleteBlockProbes.js";import{collectStackResources as E}from"../stackCleanup/stackResources.js";const R="DestroyPreFlight";async function P(o,t){const l=o.getClient(f);for(const r of t.stackNames){if(m(t.abortSignal))return s(new Error(`Destroy pre-flight aborted before ${r} was checked \u2014 nothing was destroyed in this run.`));let d;try{d=await E(l,r,e=>e.ResourceType!==void 0&&c[e.ResourceType]!==void 0&&e.ResourceStatus!=="DELETE_COMPLETE",e=>e.LogicalResourceId!==void 0&&e.PhysicalResourceId!==void 0&&e.PhysicalResourceId!==""&&e.ResourceType!==void 0?{logicalId:e.LogicalResourceId,physicalId:e.PhysicalResourceId,resourceType:e.ResourceType}:void 0,t.abortSignal)}catch(e){if(e instanceof Error&&e.message.includes(b)){p.debug(R,`Stack ${r} does not exist \u2014 nothing to probe`);continue}return s(new Error(`Destroy pre-flight for ${r}: could not list stack resources to verify deletability: ${g(h(e))}. Retry the destroy. Nothing was destroyed in this run.`))}for(const e of d){const i=c[e.resourceType];if(i===void 0)continue;const n=await i.probe(o,e.physicalId,t.abortSignal);if(!n.success)return s(new Error(`Destroy pre-flight for ${r}: could not verify that ${e.physicalId} (${e.logicalId}) is deletable \u2014 ${i.method} failed: ${n.error.message}. Retry the destroy. Nothing was destroyed in this run.`));if(n.data.blocked)return s(new Error(`Destroy pre-flight for ${r}: ${e.physicalId} (${e.logicalId}) has ${n.data.setting} enabled \u2014 CloudFormation cannot delete it, so the destroy would fail partway after other resources were already removed. Disable it on the live resource (e.g. '${i.disableCommand(e.physicalId)}'), then re-run the destroy. Nothing was destroyed in this run.`))}}return y(void 0)}a(P,"runDestroyPreFlight");export{P as runDestroyPreFlight};