@fjall/deploy-core 2.8.0 → 2.9.0

package/dist/.minified

@@ -1 +1 @@
-120 files minified at 2026-06-02T01:05:50.743Z
+120 files minified at 2026-06-02T05:28:03.549Z

package/dist/src/aws/organisations/backup.d.ts

@@ -1,5 +1,6 @@
 import { type BackupClient } from "@aws-sdk/client-backup";
 import { type Result } from "@fjall/generator";
+export declare const BACKUP_VAULT_NAME = "backupVault";
 export interface BackupGlobalSettings {
     enableCrossAccountBackup?: boolean;
     enableDelegatedAdministrator?: boolean;
@@ -10,3 +11,14 @@ export interface BackupGlobalSettings {
  * Idempotent — safe to call repeatedly with the same settings.
  */
 export declare function updateBackupGlobalSettings(client: BackupClient, settings?: BackupGlobalSettings): Promise<Result<void>>;
+/**
+ * Probe whether the disaster-recovery backup vault already exists in the target
+ * account/region, to decide adopt-vs-create. A retained, vault-locked DR vault
+ * survives stack teardown and collides on the next CREATE.
+ *
+ * Returns success(true) when present and success(false) ONLY on
+ * ResourceNotFoundException. Every other error (AccessDenied, throttling)
+ * propagates as failure — a mis-read "exists" would flip a vault-less region
+ * into a broken by-reference deploy.
+ */
+export declare function describeBackupVaultExists(client: BackupClient): Promise<Result<boolean>>;

package/dist/src/aws/organisations/backup.js

@@ -1 +1 @@
-import{UpdateGlobalSettingsCommand as r}from"@aws-sdk/client-backup";import{success as o,failure as i}from"@fjall/generator";import{getErrorMessage as s}from"@fjall/util";import{SDK_TIMEOUT_MS as l}from"./types.js";const c={enableCrossAccountBackup:!0,enableDelegatedAdministrator:!0,enableMpa:!1};async function p(e,a){try{const t={...c,...a},n={isCrossAccountBackupEnabled:t.enableCrossAccountBackup.toString(),isDelegatedAdministratorEnabled:t.enableDelegatedAdministrator.toString(),isMpaEnabled:t.enableMpa.toString()};return await e.send(new r({GlobalSettings:n}),{abortSignal:AbortSignal.timeout(l)}),o(void 0)}catch(t){return i(new Error(`Failed to update backup global settings: ${s(t)}`))}}export{p as updateBackupGlobalSettings};
+import{DescribeBackupVaultCommand as l,UpdateGlobalSettingsCommand as c}from"@aws-sdk/client-backup";import{success as r,failure as n}from"@fjall/generator";import{getErrorMessage as o,maskSensitiveOutput as p}from"@fjall/util";import{SDK_TIMEOUT_MS as i}from"./types.js";const s="backupVault",b={enableCrossAccountBackup:!0,enableDelegatedAdministrator:!0,enableMpa:!1};async function f(a,t){try{const e={...b,...t},u={isCrossAccountBackupEnabled:e.enableCrossAccountBackup.toString(),isDelegatedAdministratorEnabled:e.enableDelegatedAdministrator.toString(),isMpaEnabled:e.enableMpa.toString()};return await a.send(new c({GlobalSettings:u}),{abortSignal:AbortSignal.timeout(i)}),r(void 0)}catch(e){return n(new Error(`Failed to update backup global settings: ${o(e)}`))}}async function A(a){try{return await a.send(new l({BackupVaultName:s}),{abortSignal:AbortSignal.timeout(i)}),r(!0)}catch(t){return t instanceof Error&&t.name==="ResourceNotFoundException"?r(!1):n(new Error(`Failed to describe backup vault "${s}": ${p(o(t))}`))}}export{s as BACKUP_VAULT_NAME,A as describeBackupVaultExists,f as updateBackupGlobalSettings};

package/dist/src/orchestration/cascadeHelpers.js

@@ -1 +1 @@
-import{join as T}from"path";import{success as L,failure as h}from"@fjall/generator";import{logger as g}from"@fjall/util/logger";import{maskSensitiveOutput as f}from"@fjall/util";import{ORGANISATION_TYPES as C,getOrganisationStackName as M}from"../types/operations.js";import{CdkContextBuilder as H}from"../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as b}from"../types/deployment/index.js";import{CloudFormationService as U}from"../services/infrastructure/CloudFormationService.js";import{getCascadeStateFilePath as V}from"../types/FjallState.js";import{buildParamsContext as z,collectStackOutputs as _,assumeCascadeRole as j,forwardOutput as D}from"./contextHelpers.js";import{STRUCTURAL_ENVIRONMENTS as k}from"@fjall/util";import{DEFAULT_REGION as K}from"../aws/utils/regions.js";const re=4;function ae(s){const r=s.find(e=>e.environment===k.PLATFORM),i=s.filter(e=>e.environment!==k.ROOT&&e.environment!==k.PLATFORM);return{platformAccount:r,memberAccounts:i}}function ie(s){const r=s?.primaryRegion??K,i=s?.secondaryRegions??[],e=[r,...i],a=s?.disasterRecoveryRegion;return a&&!e.includes(a)&&e.push(a),e}function ce(s,r){const i=[];for(const e of r)for(const a of s)i.push({account:a,region:e});return i}import{buildCascadeRoleArn as le}from"./contextHelpers.js";async function ue(s,r,i,e,a,n,u){const t=u?.region??e.region??r.awsProvider.getRegion(),o=`${e.name} (${t})`,c=u?.orgConfig??s.orgConfig,p=u?.ipamPoolId;n.onCascadeAccountStart?.(o,e.id,t,a);const d=await j(r.awsProvider,e.id,t,`fjall-cascade-${e.name}`);if(!d.success)return n.onCascadeAccountComplete?.(o,!1,f(d.error.message),t),h(new Error(`Failed to assume role for ${e.name}: ${f(d.error.message)}`));const{provider:R,credentials:A}=d.data,P=T(s.workingDirectory,"fjall",a==="platform"?C.PLATFORM:C.ACCOUNT),B=t.replace(/-/g,""),x=T(P,`cdk.out.${e.id}.${B}`),y=H.buildDeploymentContext({deployType:a,target:i.target,path:P,assemblyDir:x,environment:e.environment,region:t,accountName:e.name,callerIdentity:b(e.id),ipamPoolId:p,...z({orgConfig:c,identity:s.identity,skipOidc:s.options?.skipOidc,skipAccountGlobals:u?.skipAccountGlobals})},{verbose:s.options?.verbose},c);n.onCascadeAccountPhaseChange?.(o,"synth",t);const O=await r.cdkService.runCdkSynth(y,D(n),A);if(!O.success)return n.onCascadeAccountComplete?.(o,!1,f(`Synth failed: ${O.error}`),t),h(new Error(`Synth failed for ${e.name}: ${f(O.error)}`));const m=M(a==="platform"?C.PLATFORM:C.ACCOUNT),v=V(P,e.id,t),S=new U(R),{changed:G,currentHash:I}=await r.hashService.compareCascadeStack(x,m,v);if(!G&&s.options?.force!==!0&&await S.stackExists(m)){const l=await S.getStackOutputs(m);l.success||g.debug("cascadeHelpers","Failed to read outputs for skipped cascade account (non-critical)",{stackName:m,account:e.name});const E=_(l);return n.onLog?.(`${e.name}: no infrastructure changes \u2014 skipping deploy`,"info"),n.onCascadeAccountComplete?.(o,!0,void 0,t,E,!0),L({outputs:E,skipped:!0})}n.onCascadeAccountPhaseChange?.(o,"bootstrap",t);const w=await r.cdkService.runCdkBootstrap(y,D(n),A);if(!w.success)return n.onCascadeAccountComplete?.(o,!1,f(`Bootstrap failed: ${w.error}`),t),h(new Error(`Bootstrap failed for ${e.name}: ${f(w.error)}`));n.onCascadeAccountPhaseChange?.(o,"deploy",t);const $=await r.cdkService.runCdkDeploy(y,m,D(n),l=>n.onCascadeAccountResourceProgress?.(o,l,t),R,A);if(!$.success)return n.onCascadeAccountComplete?.(o,!1,f($.error),t),h(new Error(f($.error)));const F=await S.getStackOutputs(m);F.success||g.debug("cascadeHelpers","Failed to read cascade account stack outputs (non-critical)",{stackName:m,account:e.name});const N=_(F);return I!==void 0&&((await r.hashService.persistCascadeStack(v,m,I)).success||g.debug("cascadeHelpers","Failed to persist cascade hash state (non-critical)",{stackName:m,account:e.name})),n.onCascadeAccountComplete?.(o,!0,void 0,t,N,!1),L({outputs:N,skipped:!1})}async function de(s,r,i){const e=new Map,a=s.awsProvider.getRegion(),n=await j(s.awsProvider,r.id,a,`fjall-ipam-read-${r.name}`);if(!n.success)return g.debug("organisationDeploy",`Cannot read Platform outputs: ${n.error.message}`),e;const u=new U(n.data.provider),t=M(C.PLATFORM),o=await u.getStackOutputs(t);if(!o.success)return g.debug("organisationDeploy",`Failed to read Platform stack outputs: ${o.error.message}`),e;const c=/^IpamPoolId(\d{12})(\w+)$/;for(const p of o.data){const d=p.OutputKey?.match(c);if(d&&p.OutputValue){const R=`${d[1]}-${d[2]}`;e.set(R,p.OutputValue)}}return e.size>0&&i.onLog?.(`Read ${e.size} IPAM pool ID(s) from Platform stack`,"info"),e}async function pe(s,r){const i=s.getDomains();if(i.length===0)return{domainsDeployed:0,errors:[]};r.onCascadePhaseStart?.("domains");const e=i.filter(t=>t.type==="apex"),a=i.filter(t=>t.type==="delegated");let n=0;const u=[];for(const t of e){const o=await s.deployDomain(t.name,r);o.success?n++:u.push(`${t.name}: ${o.error.message}`)}if(a.length>0){const t=await Promise.allSettled(a.map(o=>s.deployDomain(o.name,r)));for(let o=0;o<t.length;o++){const c=t[o],p=a[o];if(!(!c||!p))if(c.status==="fulfilled")c.value.success?n++:u.push(`${p.name}: ${c.value.error.message}`);else{const d=c.reason instanceof Error?c.reason.message:String(c.reason);u.push(`${p.name}: ${d}`)}}}return r.onCascadePhaseComplete?.("domains"),{domainsDeployed:n,errors:u}}export{re as CASCADE_MAX_CONCURRENCY,ce as buildAccountRegionPairs,le as buildCascadeRoleArn,ie as buildRegionList,ue as deployCascadeAccount,pe as deployDomains,ae as partitionAccounts,de as readPlatformIpamPoolIds};
+import{join as L}from"path";import{success as M,failure as C}from"@fjall/generator";import{logger as R}from"@fjall/util/logger";import{maskSensitiveOutput as p}from"@fjall/util";import{ORGANISATION_TYPES as h,getOrganisationStackName as B}from"../types/operations.js";import{CdkContextBuilder as G}from"../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as H}from"../types/deployment/index.js";import{CloudFormationService as U}from"../services/infrastructure/CloudFormationService.js";import{getCascadeStateFilePath as z}from"../types/FjallState.js";import{BackupClient as K}from"@aws-sdk/client-backup";import{describeBackupVaultExists as Y}from"../aws/organisations/backup.js";import{buildParamsContext as X,collectStackOutputs as b,assumeCascadeRole as j,forwardOutput as D}from"./contextHelpers.js";import{STRUCTURAL_ENVIRONMENTS as v}from"@fjall/util";import{DEFAULT_REGION as q}from"../aws/utils/regions.js";const de=4;function pe(s){const n=s.find(e=>e.environment===v.PLATFORM),i=s.filter(e=>e.environment!==v.ROOT&&e.environment!==v.PLATFORM);return{platformAccount:n,memberAccounts:i}}function me(s){const n=s?.primaryRegion??q,i=s?.secondaryRegions??[],e=[n,...i],a=s?.disasterRecoveryRegion;return a&&!e.includes(a)&&e.push(a),e}function fe(s,n){const i=[];for(const e of n)for(const a of s)i.push({account:a,region:e});return i}import{buildCascadeRoleArn as Ae}from"./contextHelpers.js";async function le(s,n,i,e,a,r,u){const t=u?.region??e.region??n.awsProvider.getRegion(),o=`${e.name} (${t})`,c=u?.orgConfig??s.orgConfig,m=u?.ipamPoolId;r.onCascadeAccountStart?.(o,e.id,t,a);const d=await j(n.awsProvider,e.id,t,`fjall-cascade-${e.name}`);if(!d.success)return r.onCascadeAccountComplete?.(o,!1,p(d.error.message),t),C(new Error(`Failed to assume role for ${e.name}: ${p(d.error.message)}`));const{provider:l,credentials:y}=d.data,w=L(s.workingDirectory,"fjall",a==="platform"?h.PLATFORM:h.ACCOUNT),V=t.replace(/-/g,""),x=L(w,`cdk.out.${e.id}.${V}`),A=G.buildDeploymentContext({deployType:a,target:i.target,path:w,assemblyDir:x,environment:e.environment,region:t,accountName:e.name,callerIdentity:H(e.id),ipamPoolId:m,...X({orgConfig:c,identity:s.identity,skipOidc:s.options?.skipOidc,skipAccountGlobals:u?.skipAccountGlobals})},{verbose:s.options?.verbose},c),P=await Y(l.getClient(K));if(!P.success)return r.onCascadeAccountComplete?.(o,!1,p(P.error.message),t),C(new Error(`Backup vault probe failed for ${e.name}: ${p(P.error.message)}`));A.fjallAdoptBackupVault=P.data,r.onCascadeAccountPhaseChange?.(o,"synth",t);const O=await n.cdkService.runCdkSynth(A,D(r),y);if(!O.success)return r.onCascadeAccountComplete?.(o,!1,p(`Synth failed: ${O.error}`),t),C(new Error(`Synth failed for ${e.name}: ${p(O.error)}`));const f=B(a==="platform"?h.PLATFORM:h.ACCOUNT),E=z(w,e.id,t),S=new U(l),{changed:_,currentHash:I}=await n.hashService.compareCascadeStack(x,f,E);if(!_&&s.options?.force!==!0&&await S.stackExists(f)){const g=await S.getStackOutputs(f);g.success||R.debug("cascadeHelpers","Failed to read outputs for skipped cascade account (non-critical)",{stackName:f,account:e.name});const T=b(g);return r.onLog?.(`${e.name}: no infrastructure changes \u2014 skipping deploy`,"info"),r.onCascadeAccountComplete?.(o,!0,void 0,t,T,!0),M({outputs:T,skipped:!0})}r.onCascadeAccountPhaseChange?.(o,"bootstrap",t);const $=await n.cdkService.runCdkBootstrap(A,D(r),y);if(!$.success)return r.onCascadeAccountComplete?.(o,!1,p(`Bootstrap failed: ${$.error}`),t),C(new Error(`Bootstrap failed for ${e.name}: ${p($.error)}`));r.onCascadeAccountPhaseChange?.(o,"deploy",t);const k=await n.cdkService.runCdkDeploy(A,f,D(r),g=>r.onCascadeAccountResourceProgress?.(o,g,t),l,y);if(!k.success)return r.onCascadeAccountComplete?.(o,!1,p(k.error),t),C(new Error(p(k.error)));const F=await S.getStackOutputs(f);F.success||R.debug("cascadeHelpers","Failed to read cascade account stack outputs (non-critical)",{stackName:f,account:e.name});const N=b(F);return I!==void 0&&((await n.hashService.persistCascadeStack(E,f,I)).success||R.debug("cascadeHelpers","Failed to persist cascade hash state (non-critical)",{stackName:f,account:e.name})),r.onCascadeAccountComplete?.(o,!0,void 0,t,N,!1),M({outputs:N,skipped:!1})}async function ge(s,n,i){const e=new Map,a=s.awsProvider.getRegion(),r=await j(s.awsProvider,n.id,a,`fjall-ipam-read-${n.name}`);if(!r.success)return R.debug("organisationDeploy",`Cannot read Platform outputs: ${r.error.message}`),e;const u=new U(r.data.provider),t=B(h.PLATFORM),o=await u.getStackOutputs(t);if(!o.success)return R.debug("organisationDeploy",`Failed to read Platform stack outputs: ${o.error.message}`),e;const c=/^IpamPoolId(\d{12})(\w+)$/;for(const m of o.data){const d=m.OutputKey?.match(c);if(d&&m.OutputValue){const l=`${d[1]}-${d[2]}`;e.set(l,m.OutputValue)}}return e.size>0&&i.onLog?.(`Read ${e.size} IPAM pool ID(s) from Platform stack`,"info"),e}async function Ce(s,n){const i=s.getDomains();if(i.length===0)return{domainsDeployed:0,errors:[]};n.onCascadePhaseStart?.("domains");const e=i.filter(t=>t.type==="apex"),a=i.filter(t=>t.type==="delegated");let r=0;const u=[];for(const t of e){const o=await s.deployDomain(t.name,n);o.success?r++:u.push(`${t.name}: ${o.error.message}`)}if(a.length>0){const t=await Promise.allSettled(a.map(o=>s.deployDomain(o.name,n)));for(let o=0;o<t.length;o++){const c=t[o],m=a[o];if(!(!c||!m))if(c.status==="fulfilled")c.value.success?r++:u.push(`${m.name}: ${c.value.error.message}`);else{const d=c.reason instanceof Error?c.reason.message:String(c.reason);u.push(`${m.name}: ${d}`)}}}return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:r,errors:u}}export{de as CASCADE_MAX_CONCURRENCY,fe as buildAccountRegionPairs,Ae as buildCascadeRoleArn,me as buildRegionList,le as deployCascadeAccount,Ce as deployDomains,pe as partitionAccounts,ge as readPlatformIpamPoolIds};

package/dist/src/orchestration/organisationDeploy.js

@@ -1,5 +1,5 @@
-import{join as It}from"node:path";import{success as ot,failure as y}from"@fjall/generator";import{OrganizationsClient as yt}from"@aws-sdk/client-organizations";import{ORGANISATION_TYPES as H,getOrganisationStackName as gt}from"../types/operations.js";import{CdkContextBuilder as wt}from"../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as Nt}from"../types/deployment/index.js";import{ensureOrganisationExists as Dt}from"../aws/organisations/organisation.js";import{buildParamsContext as Tt,collectStackOutputs as nt,synthOrFail as mt,bootstrapOrFail as ft,forwardOutput as Ct,forwardResourceProgress as St}from"./contextHelpers.js";import{partitionAccounts as Ot,deployCascadeAccount as At,readPlatformIpamPoolIds as kt,deployDomains as Lt,buildRegionList as bt,buildAccountRegionPairs as Mt,CASCADE_MAX_CONCURRENCY as _t}from"./cascadeHelpers.js";import{projectScalarSummary as Et}from"./cascadeSummary.js";import{reconcileProviderAccounts as $t,mergeReconciledProviderAccounts as Gt}from"./reconcileProviderAccounts.js";import{maskSensitiveOutput as i,STRUCTURAL_ENVIRONMENTS as Yt,mapSettledWithConcurrency as Ft}from"@fjall/util";import{INFRA_STEP_NAME as K,STEP_IDS as k,STEP_NAMES as rt}from"../types/stepDefinitions.js";async function Zt(o,e,a){const f=Date.now();switch(a.type){case H.ORGANISATION:return xt(o,e,a,f);case H.PLATFORM:return ht(o,e,a,"platform",f);case H.ACCOUNT:return ht(o,e,a,"account",f);default:{const t=a.type;return y(new Error(`Unsupported organisation type: ${String(t)}`))}}}function Rt(o,e,a,f,t,s){return wt.buildDeploymentContext({deployType:f,target:a.target,path:a.path,region:e.awsProvider.getRegion(),accountName:s,callerIdentity:Nt(e.awsProvider.getAccountId()),orgId:t.orgId,rootId:t.rootId,managementAccountId:t.managementAccountId,...Tt({orgConfig:o.orgConfig,identity:o.identity,skipOidc:o.options?.skipOidc})},{verbose:o.options?.verbose,infraOnly:o.options?.infraOnly},o.orgConfig)}async function Pt(o){const e=o.awsProvider.getClient(yt),a=await Dt(e);return a.success?ot({orgId:a.data.orgId,rootId:a.data.rootId,managementAccountId:a.data.managementAccountId}):y(a.error)}const r={CONNECT:{id:k.CONNECT,name:K.CONNECT},PREPARE:{id:k.PREPARE_ENVIRONMENT,name:K.PREPARE},DEPLOY:{id:k.DEPLOY,name:K.DEPLOY},MONITORING:{id:k.MONITORING,name:K.MONITORING},ORG_DEPLOY:{id:k.ORG_DEPLOY,name:rt.ORG_DEPLOY},CASCADE_PLATFORM:{id:k.CASCADE_PLATFORM,name:rt.CASCADE_PLATFORM},CASCADE_ACCOUNTS:{id:k.CASCADE_ACCOUNTS,name:rt.CASCADE_ACCOUNTS}},O=4;async function ht(o,e,a,f,t){const{callbacks:s}=o;s.onStepComplete?.(r.CONNECT.id,r.CONNECT.name,"completed",0,O),s.onStepStart?.(r.PREPARE.id,r.PREPARE.name,1,O);const d=await Pt(e);if(!d.success){s.onStepComplete?.(r.PREPARE.id,r.PREPARE.name,"error",1,O);const w=new Error(i(d.error.message));return s.onError?.(w),y(w)}const x=Rt(o,e,a,f,d.data,f==="account"?a.target:void 0);s.onLog?.(`Synthesising ${f} infrastructure\u2026`,"info");const M=await mt(e,x,s,"CDK synthesis failed");if(!M.success)return s.onStepComplete?.(r.PREPARE.id,r.PREPARE.name,"error",1,O),M;const _=await ft(e,x,s);if(!_.success)return s.onStepComplete?.(r.PREPARE.id,r.PREPARE.name,"error",1,O),_;s.onStepComplete?.(r.PREPARE.id,r.PREPARE.name,"completed",1,O);const L=gt(a.type);s.onStepStart?.(r.DEPLOY.id,r.DEPLOY.name,2,O);const P=await e.cdkService.runCdkDeploy(x,L,Ct(s),St(s),e.awsProvider);if(!P.success){s.onStepComplete?.(r.DEPLOY.id,r.DEPLOY.name,"error",2,O);const w=new Error(i(P.error));return s.onError?.(w),y(w)}s.onStepComplete?.(r.DEPLOY.id,r.DEPLOY.name,"completed",2,O);const b=await e.cfnService.getStackOutputs(L);b.success||s.onLog?.("Failed to read stack outputs (non-critical)","debug");const V=nt(b);return s.onStepStart?.(r.MONITORING.id,r.MONITORING.name,3,O),s.onStepComplete?.(r.MONITORING.id,r.MONITORING.name,"completed",3,O),ot({target:a.target,deploymentType:"organisation",outputs:V,durationMs:Date.now()-t})}async function xt(o,e,a,f){const{callbacks:t,options:s}=o;let d=o.orgConfig?.providerAccounts??[];if(d.length===0||d.every(n=>n.environment===Yt.ROOT)){const n=await $t(e,o.workingDirectory);if(n.success){const{providerAccounts:c,missingAccountNames:g}=n.data;c.length>0&&(d=Gt(o.orgConfig,c).providerAccounts,t.onLog?.(`Reconciled ${c.length} account(s) from AWS Organizations`,"info")),g.length>0&&(t.onCascadeMissingAccounts?.(g),t.onProgress?.({type:"warning",message:i(`Accounts declared in ACCOUNTS but not yet in AWS Organizations (cascade will skip): ${g.join(", ")}`)}))}else t.onProgress?.({type:"warning",message:i(`Could not reconcile accounts from AWS Organizations \u2014 cascade may skip accounts: ${n.error.message}`)})}const M=o.orgConfig?.primaryRegion??e.awsProvider.getRegion();d=d.map(n=>n.region!==void 0?n:{...n,region:M});const _=o.orgConfig!==void 0?{...o.orgConfig,providerAccounts:d}:d.length>0?{providerAccounts:d}:void 0,L=await Pt(e);if(!L.success){const n=new Error(i(L.error.message));return t.onError?.(n),y(n)}const P=Rt(o,e,a,"organisation",L.data),b=s?.cascade!==!1,{platformAccount:V,memberAccounts:w}=Ot(d),at=b&&V!==void 0?1:0,st=b&&w.length>0?1:0,l=2+at+st;t.onCascadeAccountsReconciled?.({hasPlatformAccount:at>0,hasMemberAccounts:st>0});const{id:U,name:v}=r.PREPARE;t.onStepStart?.(U,v,0,l),t.onLog?.("Synthesising organisation infrastructure\u2026","info");const ct=await mt(e,P,t,"CDK synthesis failed");if(!ct.success)return t.onStepComplete?.(U,v,"error",0,l),ct;const it=await ft(e,P,t);if(!it.success)return t.onStepComplete?.(U,v,"error",0,l),it;t.onStepComplete?.(U,v,"completed",0,l);const{id:B,name:X}=r.ORG_DEPLOY,N=gt(H.ORGANISATION);let dt=!0;const $=await e.hashService.getTemplateHashes(It(P.path,"cdk.out"));if($.success){const n=await e.hashService.compareWithState($.data,P.path);n.success?dt=n.data.stackChanges.get(N)??!0:t.onLog?.(i(`Org root change detection failed \u2014 deploying to be safe: ${n.error.message}`),"warn")}else t.onLog?.(i(`Org root template hashing failed \u2014 deploying to be safe: ${$.error.message}`),"warn");const q=dt||s?.force===!0||!await e.cfnService.stackExists(N);t.onOrgChangesDetected?.({hasOrgChanges:q});let J;if(q){t.onStepStart?.(B,X,1,l);const n=await e.cdkService.runCdkDeploy(P,N,Ct(t),St(t),e.awsProvider);if(!n.success){t.onStepComplete?.(B,X,"error",1,l);const A=new Error(i(n.error));return t.onError?.(A),y(A)}const c=await e.cfnService.getStackOutputs(N);c.success||t.onLog?.("Failed to read org stack outputs (non-critical)","debug"),J=nt(c);const g=$.success?$.data.get(N):void 0;if(g!==void 0){const A=await e.hashService.updateStateAfterDeploy(P.path,new Map([[N,g]]));A.success||t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy the org root: ${i(A.error.message)}`,"warn")}t.onStepComplete?.(B,X,"completed",1,l)}else{t.onLog?.("Organisation root: no infrastructure changes \u2014 skipping deploy","info");const n=await e.cfnService.getStackOutputs(N);n.success||t.onLog?.("Failed to read org stack outputs (non-critical)","debug"),J=nt(n)}const p=[],W=[];let j=q;if(b&&d.length>0){t.onCascadeStart?.();const n=Date.now();let c=2,g=!1,A,Q=!1;const z=[],ut=u=>({members:z,...A!==void 0?{platform:A}:{},domainsDeployed:Q,errors:p,totalDurationMs:u}),{platformAccount:E,memberAccounts:Z}=Ot(d);if(E){const{id:u,name:m}=r.CASCADE_PLATFORM;t.onStepStart?.(u,m,c,l),t.onCascadePhaseStart?.("platform");let C;const tt=Date.now();try{C=await At(o,e,a,E,"platform",t,{orgConfig:_})}catch(R){const Y=i(R instanceof Error?R.message:String(R));p.push({accountId:E.id,error:Y}),t.onCascadePhaseComplete?.("platform"),t.onStepComplete?.(u,m,"error",c,l),C=y(new Error(Y))}const G=Date.now()-tt;if(C.success){g=!0;const R=C.data.skipped===!0;R||(j=!0),C.data.outputs&&W.push({accountId:E.id,outputs:C.data.outputs}),t.onCascadePhaseComplete?.("platform"),t.onStepComplete?.(u,m,R?"skipped":"completed",c,l),A={accountId:E.id,result:R?"skipped":"succeeded",durationMs:G}}else p.some(R=>R.accountId===E.id)||(p.push({accountId:E.id,error:i(C.error.message)}),t.onCascadePhaseComplete?.("platform"),t.onStepComplete?.(u,m,"error",c,l)),A={accountId:E.id,result:"failed",durationMs:G,error:i(C.error.message)};c++}let lt=new Map;if(g&&E&&(lt=await kt(e,E,t)),o.domainProvider){const u=await Lt(o.domainProvider,t);Q=u.domainsDeployed>0,Q&&(j=!0);for(const m of u.errors)p.push({accountId:"domains",error:i(m)})}if(Z.length>0){const{id:u,name:m}=r.CASCADE_ACCOUNTS;t.onStepStart?.(u,m,c,l),t.onCascadePhaseStart?.("accounts");const C=bt(o.orgConfig),tt=C[0]??M,G=Mt(Z,C);(await Ft(G,_t,async({account:h,region:F})=>{const D=F.replace(/-/g,""),S=lt.get(`${h.id}-${D}`),T=Date.now();return{result:await At(o,e,a,h,"account",t,{ipamPoolId:S,orgConfig:_,region:F,skipAccountGlobals:F!==tt}),durationMs:Date.now()-T}})).forEach((h,F)=>{const D=G[F];if(!D)return;const S=D.account;if(h.status==="rejected"){const I=i(h.reason instanceof Error?h.reason.message:String(h.reason));z.push({accountId:S.id,accountName:S.name,region:D.region,result:"failed",durationMs:0,error:I}),p.push({accountId:S.id,error:I});return}const{result:T,durationMs:et}=h.value;if(T.success){const I=T.data.skipped===!0;I||(j=!0),T.data.outputs&&W.push({accountId:S.id,outputs:T.data.outputs}),z.push({accountId:S.id,accountName:S.name,region:D.region,result:I?"skipped":"succeeded",durationMs:et})}else{const I=i(T.error.message);z.push({accountId:S.id,accountName:S.name,region:D.region,result:"failed",durationMs:et,error:I}),p.push({accountId:S.id,error:I})}});const Y=Et(ut(0));t.onCascadePhaseComplete?.("accounts"),t.onStepComplete?.(u,m,Y.accountsFailed>0?"error":Y.accountsSkipped===Z.length?"skipped":"completed",c,l)}const pt=ut(Date.now()-n);if(t.onCascadeComplete?.(Et(pt)),t.onCascadeLedger?.(pt),p.length>0){const u=p.map(m=>`  ${m.accountId}: ${m.error}`).join(`
-`);t.onLog?.(i(`Cascade failed for ${p.length} target(s):
-${u}`),"warn")}}if(p.length>0){const n=p.map(g=>i(`${g.accountId}: ${g.error}`)).join(`
-`),c=new Error(`Organisation root deployed, but the cascade failed for ${p.length} target(s):
-${n}`);return t.onError?.(c),y(c)}return ot({target:a.target,deploymentType:"organisation",outputs:J,...W.length>0?{cascadeOutputs:W}:{},...j?{}:{noChanges:!0},durationMs:Date.now()-f})}export{Zt as deployOrganisation};
+import{join as It}from"node:path";import{success as nt,failure as I}from"@fjall/generator";import{OrganizationsClient as wt}from"@aws-sdk/client-organizations";import{BackupClient as yt}from"@aws-sdk/client-backup";import{ORGANISATION_TYPES as H,getOrganisationStackName as mt}from"../types/operations.js";import{CdkContextBuilder as Nt}from"../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as Dt}from"../types/deployment/index.js";import{ensureOrganisationExists as kt}from"../aws/organisations/organisation.js";import{describeBackupVaultExists as Tt}from"../aws/organisations/backup.js";import{buildParamsContext as bt,collectStackOutputs as rt,synthOrFail as gt,bootstrapOrFail as ft,forwardOutput as Ct,forwardResourceProgress as St}from"./contextHelpers.js";import{partitionAccounts as Et,deployCascadeAccount as At,readPlatformIpamPoolIds as Lt,deployDomains as Mt,buildRegionList as _t,buildAccountRegionPairs as $t,CASCADE_MAX_CONCURRENCY as Gt}from"./cascadeHelpers.js";import{projectScalarSummary as Ot}from"./cascadeSummary.js";import{reconcileProviderAccounts as Yt,mergeReconciledProviderAccounts as xt}from"./reconcileProviderAccounts.js";import{maskSensitiveOutput as c,STRUCTURAL_ENVIRONMENTS as Ft,mapSettledWithConcurrency as vt}from"@fjall/util";import{INFRA_STEP_NAME as V,STEP_IDS as T,STEP_NAMES as at}from"../types/stepDefinitions.js";async function ne(o,e,s){const C=Date.now();switch(s.type){case H.ORGANISATION:return Ut(o,e,s,C);case H.PLATFORM:return ht(o,e,s,"platform",C);case H.ACCOUNT:return ht(o,e,s,"account",C);default:{const t=s.type;return I(new Error(`Unsupported organisation type: ${String(t)}`))}}}function Rt(o,e,s,C,t,r){return Nt.buildDeploymentContext({deployType:C,target:s.target,path:s.path,region:e.awsProvider.getRegion(),accountName:r,callerIdentity:Dt(e.awsProvider.getAccountId()),orgId:t.orgId,rootId:t.rootId,managementAccountId:t.managementAccountId,...bt({orgConfig:o.orgConfig,identity:o.identity,skipOidc:o.options?.skipOidc})},{verbose:o.options?.verbose,infraOnly:o.options?.infraOnly},o.orgConfig)}async function Pt(o){const e=o.awsProvider.getClient(wt),s=await kt(e);return s.success?nt({orgId:s.data.orgId,rootId:s.data.rootId,managementAccountId:s.data.managementAccountId}):I(s.error)}const n={CONNECT:{id:T.CONNECT,name:V.CONNECT},PREPARE:{id:T.PREPARE_ENVIRONMENT,name:V.PREPARE},DEPLOY:{id:T.DEPLOY,name:V.DEPLOY},MONITORING:{id:T.MONITORING,name:V.MONITORING},ORG_DEPLOY:{id:T.ORG_DEPLOY,name:at.ORG_DEPLOY},CASCADE_PLATFORM:{id:T.CASCADE_PLATFORM,name:at.CASCADE_PLATFORM},CASCADE_ACCOUNTS:{id:T.CASCADE_ACCOUNTS,name:at.CASCADE_ACCOUNTS}},f=4;async function ht(o,e,s,C,t){const{callbacks:r}=o;r.onStepComplete?.(n.CONNECT.id,n.CONNECT.name,"completed",0,f),r.onStepStart?.(n.PREPARE.id,n.PREPARE.name,1,f);const d=await Pt(e);if(!d.success){r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,f);const S=new Error(c(d.error.message));return r.onError?.(S),I(S)}const _=Rt(o,e,s,C,d.data,C==="account"?s.target:void 0),b=await Tt(e.awsProvider.getClient(yt));if(!b.success){r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,f);const S=new Error(c(b.error.message));return r.onError?.(S),I(S)}_.fjallAdoptBackupVault=b.data,r.onLog?.(`Synthesising ${C} infrastructure\u2026`,"info");const $=await gt(e,_,r,"CDK synthesis failed");if(!$.success)return r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,f),$;const L=await ft(e,_,r);if(!L.success)return r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,f),L;r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"completed",1,f);const h=mt(s.type);r.onStepStart?.(n.DEPLOY.id,n.DEPLOY.name,2,f);const M=await e.cdkService.runCdkDeploy(_,h,Ct(r),St(r),e.awsProvider);if(!M.success){r.onStepComplete?.(n.DEPLOY.id,n.DEPLOY.name,"error",2,f);const S=new Error(c(M.error));return r.onError?.(S),I(S)}r.onStepComplete?.(n.DEPLOY.id,n.DEPLOY.name,"completed",2,f);const v=await e.cfnService.getStackOutputs(h);v.success||r.onLog?.("Failed to read stack outputs (non-critical)","debug");const K=rt(v);return r.onStepStart?.(n.MONITORING.id,n.MONITORING.name,3,f),r.onStepComplete?.(n.MONITORING.id,n.MONITORING.name,"completed",3,f),nt({target:s.target,deploymentType:"organisation",outputs:K,durationMs:Date.now()-t})}async function Ut(o,e,s,C){const{callbacks:t,options:r}=o;let d=o.orgConfig?.providerAccounts??[];if(d.length===0||d.every(a=>a.environment===Ft.ROOT)){const a=await Yt(e,o.workingDirectory);if(a.success){const{providerAccounts:i,missingAccountNames:m}=a.data;i.length>0&&(d=xt(o.orgConfig,i).providerAccounts,t.onLog?.(`Reconciled ${i.length} account(s) from AWS Organizations`,"info")),m.length>0&&(t.onCascadeMissingAccounts?.(m),t.onProgress?.({type:"warning",message:c(`Accounts declared in ACCOUNTS but not yet in AWS Organizations (cascade will skip): ${m.join(", ")}`)}))}else t.onProgress?.({type:"warning",message:c(`Could not reconcile accounts from AWS Organizations \u2014 cascade may skip accounts: ${a.error.message}`)})}const b=o.orgConfig?.primaryRegion??e.awsProvider.getRegion();d=d.map(a=>a.region!==void 0?a:{...a,region:b});const $=o.orgConfig!==void 0?{...o.orgConfig,providerAccounts:d}:d.length>0?{providerAccounts:d}:void 0,L=await Pt(e);if(!L.success){const a=new Error(c(L.error.message));return t.onError?.(a),I(a)}const h=Rt(o,e,s,"organisation",L.data),M=r?.cascade!==!1,{platformAccount:v,memberAccounts:K}=Et(d),S=M&&v!==void 0?1:0,st=M&&K.length>0?1:0,l=2+S+st;t.onCascadeAccountsReconciled?.({hasPlatformAccount:S>0,hasMemberAccounts:st>0});const{id:U,name:W}=n.PREPARE;t.onStepStart?.(U,W,0,l),t.onLog?.("Synthesising organisation infrastructure\u2026","info");const ct=await gt(e,h,t,"CDK synthesis failed");if(!ct.success)return t.onStepComplete?.(U,W,"error",0,l),ct;const it=await ft(e,h,t);if(!it.success)return t.onStepComplete?.(U,W,"error",0,l),it;t.onStepComplete?.(U,W,"completed",0,l);const{id:X,name:q}=n.ORG_DEPLOY,N=mt(H.ORGANISATION);let dt=!0;const G=await e.hashService.getTemplateHashes(It(h.path,"cdk.out"));if(G.success){const a=await e.hashService.compareWithState(G.data,h.path);a.success?dt=a.data.stackChanges.get(N)??!0:t.onLog?.(c(`Org root change detection failed \u2014 deploying to be safe: ${a.error.message}`),"warn")}else t.onLog?.(c(`Org root template hashing failed \u2014 deploying to be safe: ${G.error.message}`),"warn");const J=dt||r?.force===!0||!await e.cfnService.stackExists(N);t.onOrgChangesDetected?.({hasOrgChanges:J});let Q;if(J){t.onStepStart?.(X,q,1,l);const a=await e.cdkService.runCdkDeploy(h,N,Ct(t),St(t),e.awsProvider);if(!a.success){t.onStepComplete?.(X,q,"error",1,l);const O=new Error(c(a.error));return t.onError?.(O),I(O)}const i=await e.cfnService.getStackOutputs(N);i.success||t.onLog?.("Failed to read org stack outputs (non-critical)","debug"),Q=rt(i);const m=G.success?G.data.get(N):void 0;if(m!==void 0){const O=await e.hashService.updateStateAfterDeploy(h.path,new Map([[N,m]]));O.success||t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy the org root: ${c(O.error.message)}`,"warn")}t.onStepComplete?.(X,q,"completed",1,l)}else{t.onLog?.("Organisation root: no infrastructure changes \u2014 skipping deploy","info");const a=await e.cfnService.getStackOutputs(N);a.success||t.onLog?.("Failed to read org stack outputs (non-critical)","debug"),Q=rt(a)}const p=[],j=[];let z=J;if(M&&d.length>0){t.onCascadeStart?.();const a=Date.now();let i=2,m=!1,O,Z=!1;const B=[],ut=u=>({members:B,...O!==void 0?{platform:O}:{},domainsDeployed:Z,errors:p,totalDurationMs:u}),{platformAccount:R,memberAccounts:tt}=Et(d);if(R){const{id:u,name:g}=n.CASCADE_PLATFORM;t.onStepStart?.(u,g,i,l),t.onCascadePhaseStart?.("platform");let E;const et=Date.now();try{E=await At(o,e,s,R,"platform",t,{orgConfig:$})}catch(P){const x=c(P instanceof Error?P.message:String(P));p.push({accountId:R.id,error:x}),t.onCascadePhaseComplete?.("platform"),t.onStepComplete?.(u,g,"error",i,l),E=I(new Error(x))}const Y=Date.now()-et;if(E.success){m=!0;const P=E.data.skipped===!0;P||(z=!0),E.data.outputs&&j.push({accountId:R.id,outputs:E.data.outputs}),t.onCascadePhaseComplete?.("platform"),t.onStepComplete?.(u,g,P?"skipped":"completed",i,l),O={accountId:R.id,result:P?"skipped":"succeeded",durationMs:Y}}else p.some(P=>P.accountId===R.id)||(p.push({accountId:R.id,error:c(E.error.message)}),t.onCascadePhaseComplete?.("platform"),t.onStepComplete?.(u,g,"error",i,l)),O={accountId:R.id,result:"failed",durationMs:Y,error:c(E.error.message)};i++}let lt=new Map;if(m&&R&&(lt=await Lt(e,R,t)),o.domainProvider){const u=await Mt(o.domainProvider,t);Z=u.domainsDeployed>0,Z&&(z=!0);for(const g of u.errors)p.push({accountId:"domains",error:c(g)})}if(tt.length>0){const{id:u,name:g}=n.CASCADE_ACCOUNTS;t.onStepStart?.(u,g,i,l),t.onCascadePhaseStart?.("accounts");const E=_t(o.orgConfig),et=E[0]??b,Y=$t(tt,E);(await vt(Y,Gt,async({account:w,region:F})=>{const D=F.replace(/-/g,""),A=lt.get(`${w.id}-${D}`),k=Date.now();return{result:await At(o,e,s,w,"account",t,{ipamPoolId:A,orgConfig:$,region:F,skipAccountGlobals:F!==et}),durationMs:Date.now()-k}})).forEach((w,F)=>{const D=Y[F];if(!D)return;const A=D.account;if(w.status==="rejected"){const y=c(w.reason instanceof Error?w.reason.message:String(w.reason));B.push({accountId:A.id,accountName:A.name,region:D.region,result:"failed",durationMs:0,error:y}),p.push({accountId:A.id,error:y});return}const{result:k,durationMs:ot}=w.value;if(k.success){const y=k.data.skipped===!0;y||(z=!0),k.data.outputs&&j.push({accountId:A.id,outputs:k.data.outputs}),B.push({accountId:A.id,accountName:A.name,region:D.region,result:y?"skipped":"succeeded",durationMs:ot})}else{const y=c(k.error.message);B.push({accountId:A.id,accountName:A.name,region:D.region,result:"failed",durationMs:ot,error:y}),p.push({accountId:A.id,error:y})}});const x=Ot(ut(0));t.onCascadePhaseComplete?.("accounts"),t.onStepComplete?.(u,g,x.accountsFailed>0?"error":x.accountsSkipped===tt.length?"skipped":"completed",i,l)}const pt=ut(Date.now()-a);if(t.onCascadeComplete?.(Ot(pt)),t.onCascadeLedger?.(pt),p.length>0){const u=p.map(g=>`  ${g.accountId}: ${g.error}`).join(`
+`);t.onLog?.(c(`Cascade failed for ${p.length} target(s):
+${u}`),"warn")}}if(p.length>0){const a=p.map(m=>c(`${m.accountId}: ${m.error}`)).join(`
+`),i=new Error(`Organisation root deployed, but the cascade failed for ${p.length} target(s):
+${a}`);return t.onError?.(i),I(i)}return nt({target:s.target,deploymentType:"organisation",outputs:Q,...j.length>0?{cascadeOutputs:j}:{},...z?{}:{noChanges:!0},durationMs:Date.now()-C})}export{ne as deployOrganisation};

package/dist/src/services/infrastructure/CdkArgumentBuilder.js

@@ -1 +1 @@
-import{filterDangerousEnvVars as i}from"@fjall/util";class d{buildContextArgs(r){const e=[];return r?.accountId&&e.push("-c",`accountId=${r.accountId}`),r?.environment&&e.push("-c",`environment=${r.environment}`),r?.managedAccount&&e.push("-c","managedAccount=true"),r?.accountName&&e.push("-c",`accountName=${r.accountName}`),r?.orgId&&e.push("-c",`orgId=${r.orgId}`),r?.rootId&&e.push("-c",`rootId=${r.rootId}`),r?.managementAccountId&&e.push("-c",`managementAccountId=${r.managementAccountId}`),r?.ipamPoolId&&e.push("-c",`ipamPoolId=${r.ipamPoolId}`),r?.fjallOrgId&&e.push("-c",`fjallOrgId=${r.fjallOrgId}`),r?.fjallOidcConfigured&&e.push("-c",`fjallOidcConfigured=${r.fjallOidcConfigured}`),r?.fjallAccountGlobalsConfigured&&e.push("-c",`fjallAccountGlobalsConfigured=${r.fjallAccountGlobalsConfigured}`),r?.orgConfig&&e.push("-c",`orgConfig=${r.orgConfig}`),e}buildParameterArgs(r){if(r===void 0)return[];const e=Object.entries(r);if(e.length===0)return[];const o=[];for(const[a,n]of e){if(!/^[A-Za-z][A-Za-z0-9]*$/.test(a))throw new Error(`Invalid CloudFormation parameter name "${a}": must match /^[A-Za-z][A-Za-z0-9]*$/ (alphanumeric, leading letter, no separators).`);if(n==="")throw new Error(`CloudFormation parameter "${a}" has an empty value.`);if(/[,\n\r]/.test(n))throw new Error(`CloudFormation parameter "${a}" value contains "," or newline \u2014 cdk's --parameters splits on "," so the deploy would silently fragment.`);o.push("--parameters",`${a}=${n}`)}return o}injectCascadeCredentials(r,e){e&&(r.AWS_ACCESS_KEY_ID=e.accessKeyId,r.AWS_SECRET_ACCESS_KEY=e.secretAccessKey,delete r.AWS_SESSION_TOKEN,e.sessionToken&&(r.AWS_SESSION_TOKEN=e.sessionToken))}buildCdkEnv(r){const e={...i(process.env),CI:"true",FORCE_COLOR:"0",CDK_DISABLE_VERSION_CHECK:"1"};return r?.context?.region&&(e.AWS_REGION=r.context.region,e.AWS_DEFAULT_REGION=r.context.region,e.CDK_DEFAULT_REGION=r.context.region),r?.context?.accountId&&(e.CDK_DEFAULT_ACCOUNT=r.context.accountId),this.injectCascadeCredentials(e,r?.credentials),e}}export{d as CdkArgumentBuilder};
+import{filterDangerousEnvVars as u}from"@fjall/util";class s{buildContextArgs(r){const a=[];return r?.accountId&&a.push("-c",`accountId=${r.accountId}`),r?.environment&&a.push("-c",`environment=${r.environment}`),r?.managedAccount&&a.push("-c","managedAccount=true"),r?.accountName&&a.push("-c",`accountName=${r.accountName}`),r?.orgId&&a.push("-c",`orgId=${r.orgId}`),r?.rootId&&a.push("-c",`rootId=${r.rootId}`),r?.managementAccountId&&a.push("-c",`managementAccountId=${r.managementAccountId}`),r?.ipamPoolId&&a.push("-c",`ipamPoolId=${r.ipamPoolId}`),r?.fjallOrgId&&a.push("-c",`fjallOrgId=${r.fjallOrgId}`),r?.fjallOidcConfigured&&a.push("-c",`fjallOidcConfigured=${r.fjallOidcConfigured}`),r?.fjallAccountGlobalsConfigured&&a.push("-c",`fjallAccountGlobalsConfigured=${r.fjallAccountGlobalsConfigured}`),r?.orgConfig&&a.push("-c",`orgConfig=${r.orgConfig}`),r?.fjallAdoptBackupVault&&a.push("-c","fjallAdoptBackupVault=true"),a}buildParameterArgs(r){if(r===void 0)return[];const a=Object.entries(r);if(a.length===0)return[];const o=[];for(const[e,n]of a){if(!/^[A-Za-z][A-Za-z0-9]*$/.test(e))throw new Error(`Invalid CloudFormation parameter name "${e}": must match /^[A-Za-z][A-Za-z0-9]*$/ (alphanumeric, leading letter, no separators).`);if(n==="")throw new Error(`CloudFormation parameter "${e}" has an empty value.`);if(/[,\n\r]/.test(n))throw new Error(`CloudFormation parameter "${e}" value contains "," or newline \u2014 cdk's --parameters splits on "," so the deploy would silently fragment.`);o.push("--parameters",`${e}=${n}`)}return o}injectCascadeCredentials(r,a){a&&(r.AWS_ACCESS_KEY_ID=a.accessKeyId,r.AWS_SECRET_ACCESS_KEY=a.secretAccessKey,delete r.AWS_SESSION_TOKEN,a.sessionToken&&(r.AWS_SESSION_TOKEN=a.sessionToken))}buildCdkEnv(r){const a={...u(process.env),CI:"true",FORCE_COLOR:"0",CDK_DISABLE_VERSION_CHECK:"1"};return r?.context?.region&&(a.AWS_REGION=r.context.region,a.AWS_DEFAULT_REGION=r.context.region,a.CDK_DEFAULT_REGION=r.context.region),r?.context?.accountId&&(a.CDK_DEFAULT_ACCOUNT=r.context.accountId),this.injectCascadeCredentials(a,r?.credentials),a}}export{s as CdkArgumentBuilder};

package/dist/src/services/infrastructure/CdkServiceTypes.d.ts

@@ -14,6 +14,7 @@ export interface CdkContext {
     fjallOidcConfigured?: string;
     fjallAccountGlobalsConfigured?: string;
     orgConfig?: string;
+    fjallAdoptBackupVault?: string;
 }
 export interface CdkOptions {
     verbose?: boolean;

package/dist/src/services/infrastructure/cdkServiceHelpers.js

@@ -1 +1 @@
-import{getApplicationStackName as i,getOrganisationStackName as u,isApplicationStack as d}from"../../types/operations.js";const c=5e3;function t(o,n){if(o&&!o.includes("*"))return o;if(o){const e=o.match(/\*?(\w+)\*?/);if(e?.[1]){const a=e[1],r=n.target;return d(a)?i(r,a):`${r}${a}`}return o}}function p(o){const n=o.deployType;return n==="organisation"||n==="platform"||n==="account"?u(n):`${o.target}Network`}function f(o,n,e){return{accountId:n,region:e,environment:o.environment,managedAccount:o.isManagedAccount,accountName:o.accountName,orgId:o.orgId,rootId:o.rootId,managementAccountId:o.managementAccountId,ipamPoolId:o.ipamPoolId,fjallOrgId:o.fjallOrgId,fjallOidcConfigured:o.fjallOidcConfigured?"true":void 0,fjallAccountGlobalsConfigured:o.fjallAccountGlobalsConfigured?"true":void 0,orgConfig:o.orgConfig}}export{c as STACK_DETECTION_FALLBACK_MS,f as buildDeploymentCdkContext,p as getFallbackStackName,t as resolveStackName};
+import{getApplicationStackName as i,getOrganisationStackName as u,isApplicationStack as l}from"../../types/operations.js";const p=5e3;function t(a,o){if(a&&!a.includes("*"))return a;if(a){const e=a.match(/\*?(\w+)\*?/);if(e?.[1]){const n=e[1],r=o.target;return l(n)?i(r,n):`${r}${n}`}return a}}function c(a){const o=a.deployType;return o==="organisation"||o==="platform"||o==="account"?u(o):`${a.target}Network`}function f(a,o,e){return{accountId:o,region:e,environment:a.environment,managedAccount:a.isManagedAccount,accountName:a.accountName,orgId:a.orgId,rootId:a.rootId,managementAccountId:a.managementAccountId,ipamPoolId:a.ipamPoolId,fjallOrgId:a.fjallOrgId,fjallOidcConfigured:a.fjallOidcConfigured?"true":void 0,fjallAccountGlobalsConfigured:a.fjallAccountGlobalsConfigured?"true":void 0,orgConfig:a.orgConfig,fjallAdoptBackupVault:a.fjallAdoptBackupVault?"true":void 0}}export{p as STACK_DETECTION_FALLBACK_MS,f as buildDeploymentCdkContext,c as getFallbackStackName,t as resolveStackName};

package/dist/src/types/deployment/DeploymentTypes.d.ts

@@ -24,6 +24,7 @@ export interface DeploymentContext {
     fjallOidcConfigured?: boolean;
     fjallAccountGlobalsConfigured?: boolean;
     orgConfig?: string;
+    fjallAdoptBackupVault?: boolean;
     options: {
         verbose?: boolean;
         infraOnly?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "description": "Shared deployment engine for Fjall — used by CLI and webapp worker",
   "type": "module",
   "main": "dist/src/index.js",
@@ -73,8 +73,8 @@
     "@aws-sdk/client-s3": "^3.1038.0",
     "@aws-sdk/client-sso-admin": "^3.1038.0",
     "@aws-sdk/client-sts": "^3.1038.0",
-    "@fjall/generator": "^2.8.0",
-    "@fjall/util": "^2.8.0",
+    "@fjall/generator": "^2.9.0",
+    "@fjall/util": "^2.9.0",
     "@smithy/node-http-handler": "^4.6.1",
     "tsx": "^4.21.0",
     "zod": "^4.4.3"
@@ -83,5 +83,5 @@
     "@types/node": "^25.6.0",
     "vitest": "^4.1.5"
   },
-  "gitHead": "6f82ea5b7fa9a4b23532708c5646a68e940c0b75"
+  "gitHead": "72c4668ef5ead59c0b981eca8037620875bcd1ba"
 }