@fjall/deploy-core 2.9.0 → 2.9.1

package/dist/.minified

@@ -1 +1 @@
-120 files minified at 2026-06-02T05:28:03.549Z
+120 files minified at 2026-06-02T21:42:55.155Z

package/dist/src/aws/organisations/backup.d.ts

@@ -11,6 +11,18 @@ export interface BackupGlobalSettings {
  * Idempotent — safe to call repeatedly with the same settings.
  */
 export declare function updateBackupGlobalSettings(client: BackupClient, settings?: BackupGlobalSettings): Promise<Result<void>>;
+/**
+ * Whether an account's synthesised stack will create the DR backup vault — and
+ * so whether the adopt-vs-create probe needs to run for it. Mirror of the
+ * DisasterRecovery construct gate in @fjall/components-infrastructure
+ * patterns/aws/account.ts: the vault is synthesised only when
+ * `disasterRecoveryRegion` is set AND the account is production or compliance.
+ *
+ * Probing accounts that synthesise no vault (platform/staging/development) is
+ * dead work that fails on a `backup:DescribeBackupVault` permission those
+ * accounts never grant. Keep this predicate in lockstep with account.ts:122-125.
+ */
+export declare function accountHasDisasterRecovery(environment: string | undefined, disasterRecoveryRegion: string | undefined): boolean;
 /**
  * Probe whether the disaster-recovery backup vault already exists in the target
  * account/region, to decide adopt-vs-create. A retained, vault-locked DR vault

package/dist/src/aws/organisations/backup.js

@@ -1 +1 @@
-import{DescribeBackupVaultCommand as l,UpdateGlobalSettingsCommand as c}from"@aws-sdk/client-backup";import{success as r,failure as n}from"@fjall/generator";import{getErrorMessage as o,maskSensitiveOutput as p}from"@fjall/util";import{SDK_TIMEOUT_MS as i}from"./types.js";const s="backupVault",b={enableCrossAccountBackup:!0,enableDelegatedAdministrator:!0,enableMpa:!1};async function f(a,t){try{const e={...b,...t},u={isCrossAccountBackupEnabled:e.enableCrossAccountBackup.toString(),isDelegatedAdministratorEnabled:e.enableDelegatedAdministrator.toString(),isMpaEnabled:e.enableMpa.toString()};return await a.send(new c({GlobalSettings:u}),{abortSignal:AbortSignal.timeout(i)}),r(void 0)}catch(e){return n(new Error(`Failed to update backup global settings: ${o(e)}`))}}async function A(a){try{return await a.send(new l({BackupVaultName:s}),{abortSignal:AbortSignal.timeout(i)}),r(!0)}catch(t){return t instanceof Error&&t.name==="ResourceNotFoundException"?r(!1):n(new Error(`Failed to describe backup vault "${s}": ${p(o(t))}`))}}export{s as BACKUP_VAULT_NAME,A as describeBackupVaultExists,f as updateBackupGlobalSettings};
+import{DescribeBackupVaultCommand as c,UpdateGlobalSettingsCommand as l}from"@aws-sdk/client-backup";import{success as r,failure as n}from"@fjall/generator";import{getErrorMessage as o,maskSensitiveOutput as p}from"@fjall/util";import{SDK_TIMEOUT_MS as i}from"./types.js";const s="backupVault",d={enableCrossAccountBackup:!0,enableDelegatedAdministrator:!0,enableMpa:!1};async function S(e,t){try{const a={...d,...t},u={isCrossAccountBackupEnabled:a.enableCrossAccountBackup.toString(),isDelegatedAdministratorEnabled:a.enableDelegatedAdministrator.toString(),isMpaEnabled:a.enableMpa.toString()};return await e.send(new l({GlobalSettings:u}),{abortSignal:AbortSignal.timeout(i)}),r(void 0)}catch(a){return n(new Error(`Failed to update backup global settings: ${o(a)}`))}}function A(e,t){return t===void 0||t===""?!1:e==="production"||e==="compliance"}async function E(e){try{return await e.send(new c({BackupVaultName:s}),{abortSignal:AbortSignal.timeout(i)}),r(!0)}catch(t){return t instanceof Error&&t.name==="ResourceNotFoundException"?r(!1):n(new Error(`Failed to describe backup vault "${s}": ${p(o(t))}`))}}export{s as BACKUP_VAULT_NAME,A as accountHasDisasterRecovery,E as describeBackupVaultExists,S as updateBackupGlobalSettings};

package/dist/src/orchestration/cascadeHelpers.js

@@ -1 +1 @@
-import{join as L}from"path";import{success as M,failure as C}from"@fjall/generator";import{logger as R}from"@fjall/util/logger";import{maskSensitiveOutput as p}from"@fjall/util";import{ORGANISATION_TYPES as h,getOrganisationStackName as B}from"../types/operations.js";import{CdkContextBuilder as G}from"../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as H}from"../types/deployment/index.js";import{CloudFormationService as U}from"../services/infrastructure/CloudFormationService.js";import{getCascadeStateFilePath as z}from"../types/FjallState.js";import{BackupClient as K}from"@aws-sdk/client-backup";import{describeBackupVaultExists as Y}from"../aws/organisations/backup.js";import{buildParamsContext as X,collectStackOutputs as b,assumeCascadeRole as j,forwardOutput as D}from"./contextHelpers.js";import{STRUCTURAL_ENVIRONMENTS as v}from"@fjall/util";import{DEFAULT_REGION as q}from"../aws/utils/regions.js";const de=4;function pe(s){const n=s.find(e=>e.environment===v.PLATFORM),i=s.filter(e=>e.environment!==v.ROOT&&e.environment!==v.PLATFORM);return{platformAccount:n,memberAccounts:i}}function me(s){const n=s?.primaryRegion??q,i=s?.secondaryRegions??[],e=[n,...i],a=s?.disasterRecoveryRegion;return a&&!e.includes(a)&&e.push(a),e}function fe(s,n){const i=[];for(const e of n)for(const a of s)i.push({account:a,region:e});return i}import{buildCascadeRoleArn as Ae}from"./contextHelpers.js";async function le(s,n,i,e,a,r,u){const t=u?.region??e.region??n.awsProvider.getRegion(),o=`${e.name} (${t})`,c=u?.orgConfig??s.orgConfig,m=u?.ipamPoolId;r.onCascadeAccountStart?.(o,e.id,t,a);const d=await j(n.awsProvider,e.id,t,`fjall-cascade-${e.name}`);if(!d.success)return r.onCascadeAccountComplete?.(o,!1,p(d.error.message),t),C(new Error(`Failed to assume role for ${e.name}: ${p(d.error.message)}`));const{provider:l,credentials:y}=d.data,w=L(s.workingDirectory,"fjall",a==="platform"?h.PLATFORM:h.ACCOUNT),V=t.replace(/-/g,""),x=L(w,`cdk.out.${e.id}.${V}`),A=G.buildDeploymentContext({deployType:a,target:i.target,path:w,assemblyDir:x,environment:e.environment,region:t,accountName:e.name,callerIdentity:H(e.id),ipamPoolId:m,...X({orgConfig:c,identity:s.identity,skipOidc:s.options?.skipOidc,skipAccountGlobals:u?.skipAccountGlobals})},{verbose:s.options?.verbose},c),P=await Y(l.getClient(K));if(!P.success)return r.onCascadeAccountComplete?.(o,!1,p(P.error.message),t),C(new Error(`Backup vault probe failed for ${e.name}: ${p(P.error.message)}`));A.fjallAdoptBackupVault=P.data,r.onCascadeAccountPhaseChange?.(o,"synth",t);const O=await n.cdkService.runCdkSynth(A,D(r),y);if(!O.success)return r.onCascadeAccountComplete?.(o,!1,p(`Synth failed: ${O.error}`),t),C(new Error(`Synth failed for ${e.name}: ${p(O.error)}`));const f=B(a==="platform"?h.PLATFORM:h.ACCOUNT),E=z(w,e.id,t),S=new U(l),{changed:_,currentHash:I}=await n.hashService.compareCascadeStack(x,f,E);if(!_&&s.options?.force!==!0&&await S.stackExists(f)){const g=await S.getStackOutputs(f);g.success||R.debug("cascadeHelpers","Failed to read outputs for skipped cascade account (non-critical)",{stackName:f,account:e.name});const T=b(g);return r.onLog?.(`${e.name}: no infrastructure changes \u2014 skipping deploy`,"info"),r.onCascadeAccountComplete?.(o,!0,void 0,t,T,!0),M({outputs:T,skipped:!0})}r.onCascadeAccountPhaseChange?.(o,"bootstrap",t);const $=await n.cdkService.runCdkBootstrap(A,D(r),y);if(!$.success)return r.onCascadeAccountComplete?.(o,!1,p(`Bootstrap failed: ${$.error}`),t),C(new Error(`Bootstrap failed for ${e.name}: ${p($.error)}`));r.onCascadeAccountPhaseChange?.(o,"deploy",t);const k=await n.cdkService.runCdkDeploy(A,f,D(r),g=>r.onCascadeAccountResourceProgress?.(o,g,t),l,y);if(!k.success)return r.onCascadeAccountComplete?.(o,!1,p(k.error),t),C(new Error(p(k.error)));const F=await S.getStackOutputs(f);F.success||R.debug("cascadeHelpers","Failed to read cascade account stack outputs (non-critical)",{stackName:f,account:e.name});const N=b(F);return I!==void 0&&((await n.hashService.persistCascadeStack(E,f,I)).success||R.debug("cascadeHelpers","Failed to persist cascade hash state (non-critical)",{stackName:f,account:e.name})),r.onCascadeAccountComplete?.(o,!0,void 0,t,N,!1),M({outputs:N,skipped:!1})}async function ge(s,n,i){const e=new Map,a=s.awsProvider.getRegion(),r=await j(s.awsProvider,n.id,a,`fjall-ipam-read-${n.name}`);if(!r.success)return R.debug("organisationDeploy",`Cannot read Platform outputs: ${r.error.message}`),e;const u=new U(r.data.provider),t=B(h.PLATFORM),o=await u.getStackOutputs(t);if(!o.success)return R.debug("organisationDeploy",`Failed to read Platform stack outputs: ${o.error.message}`),e;const c=/^IpamPoolId(\d{12})(\w+)$/;for(const m of o.data){const d=m.OutputKey?.match(c);if(d&&m.OutputValue){const l=`${d[1]}-${d[2]}`;e.set(l,m.OutputValue)}}return e.size>0&&i.onLog?.(`Read ${e.size} IPAM pool ID(s) from Platform stack`,"info"),e}async function Ce(s,n){const i=s.getDomains();if(i.length===0)return{domainsDeployed:0,errors:[]};n.onCascadePhaseStart?.("domains");const e=i.filter(t=>t.type==="apex"),a=i.filter(t=>t.type==="delegated");let r=0;const u=[];for(const t of e){const o=await s.deployDomain(t.name,n);o.success?r++:u.push(`${t.name}: ${o.error.message}`)}if(a.length>0){const t=await Promise.allSettled(a.map(o=>s.deployDomain(o.name,n)));for(let o=0;o<t.length;o++){const c=t[o],m=a[o];if(!(!c||!m))if(c.status==="fulfilled")c.value.success?r++:u.push(`${m.name}: ${c.value.error.message}`);else{const d=c.reason instanceof Error?c.reason.message:String(c.reason);u.push(`${m.name}: ${d}`)}}}return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:r,errors:u}}export{de as CASCADE_MAX_CONCURRENCY,fe as buildAccountRegionPairs,Ae as buildCascadeRoleArn,me as buildRegionList,le as deployCascadeAccount,Ce as deployDomains,pe as partitionAccounts,ge as readPlatformIpamPoolIds};
+import{join as T}from"path";import{success as L,failure as C}from"@fjall/generator";import{logger as R}from"@fjall/util/logger";import{maskSensitiveOutput as m}from"@fjall/util";import{ORGANISATION_TYPES as h,getOrganisationStackName as M}from"../types/operations.js";import{CdkContextBuilder as V}from"../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as _}from"../types/deployment/index.js";import{CloudFormationService as B}from"../services/infrastructure/CloudFormationService.js";import{getCascadeStateFilePath as G}from"../types/FjallState.js";import{BackupClient as z}from"@aws-sdk/client-backup";import{accountHasDisasterRecovery as K,describeBackupVaultExists as Y}from"../aws/organisations/backup.js";import{buildParamsContext as X,collectStackOutputs as U,assumeCascadeRole as b,forwardOutput as k}from"./contextHelpers.js";import{STRUCTURAL_ENVIRONMENTS as v}from"@fjall/util";import{DEFAULT_REGION as q}from"../aws/utils/regions.js";const de=4;function pe(s){const n=s.find(e=>e.environment===v.PLATFORM),i=s.filter(e=>e.environment!==v.ROOT&&e.environment!==v.PLATFORM);return{platformAccount:n,memberAccounts:i}}function me(s){const n=s?.primaryRegion??q,i=s?.secondaryRegions??[],e=[n,...i],a=s?.disasterRecoveryRegion;return a&&!e.includes(a)&&e.push(a),e}function fe(s,n){const i=[];for(const e of n)for(const a of s)i.push({account:a,region:e});return i}import{buildCascadeRoleArn as Ae}from"./contextHelpers.js";async function le(s,n,i,e,a,r,u){const t=u?.region??e.region??n.awsProvider.getRegion(),o=`${e.name} (${t})`,c=u?.orgConfig??s.orgConfig,f=u?.ipamPoolId;r.onCascadeAccountStart?.(o,e.id,t,a);const d=await b(n.awsProvider,e.id,t,`fjall-cascade-${e.name}`);if(!d.success)return r.onCascadeAccountComplete?.(o,!1,m(d.error.message),t),C(new Error(`Failed to assume role for ${e.name}: ${m(d.error.message)}`));const{provider:g,credentials:y}=d.data,P=T(s.workingDirectory,"fjall",a==="platform"?h.PLATFORM:h.ACCOUNT),j=t.replace(/-/g,""),D=T(P,`cdk.out.${e.id}.${j}`),A=V.buildDeploymentContext({deployType:a,target:i.target,path:P,assemblyDir:D,environment:e.environment,region:t,accountName:e.name,callerIdentity:_(e.id),ipamPoolId:f,...X({orgConfig:c,identity:s.identity,skipOidc:s.options?.skipOidc,skipAccountGlobals:u?.skipAccountGlobals})},{verbose:s.options?.verbose},c);if(K(e.environment,c?.disasterRecoveryRegion)){const p=await Y(g.getClient(z));if(!p.success)return r.onCascadeAccountComplete?.(o,!1,m(p.error.message),t),C(new Error(`Backup vault probe failed for ${e.name}: ${m(p.error.message)}`));A.fjallAdoptBackupVault=p.data}r.onCascadeAccountPhaseChange?.(o,"synth",t);const w=await n.cdkService.runCdkSynth(A,k(r),y);if(!w.success)return r.onCascadeAccountComplete?.(o,!1,m(`Synth failed: ${w.error}`),t),C(new Error(`Synth failed for ${e.name}: ${m(w.error)}`));const l=M(a==="platform"?h.PLATFORM:h.ACCOUNT),x=G(P,e.id,t),O=new B(g),{changed:H,currentHash:E}=await n.hashService.compareCascadeStack(D,l,x);if(!H&&s.options?.force!==!0&&await O.stackExists(l)){const p=await O.getStackOutputs(l);p.success||R.debug("cascadeHelpers","Failed to read outputs for skipped cascade account (non-critical)",{stackName:l,account:e.name});const N=U(p);return r.onLog?.(`${e.name}: no infrastructure changes \u2014 skipping deploy`,"info"),r.onCascadeAccountComplete?.(o,!0,void 0,t,N,!0),L({outputs:N,skipped:!0})}r.onCascadeAccountPhaseChange?.(o,"bootstrap",t);const S=await n.cdkService.runCdkBootstrap(A,k(r),y);if(!S.success)return r.onCascadeAccountComplete?.(o,!1,m(`Bootstrap failed: ${S.error}`),t),C(new Error(`Bootstrap failed for ${e.name}: ${m(S.error)}`));r.onCascadeAccountPhaseChange?.(o,"deploy",t);const $=await n.cdkService.runCdkDeploy(A,l,k(r),p=>r.onCascadeAccountResourceProgress?.(o,p,t),g,y);if(!$.success)return r.onCascadeAccountComplete?.(o,!1,m($.error),t),C(new Error(m($.error)));const I=await O.getStackOutputs(l);I.success||R.debug("cascadeHelpers","Failed to read cascade account stack outputs (non-critical)",{stackName:l,account:e.name});const F=U(I);return E!==void 0&&((await n.hashService.persistCascadeStack(x,l,E)).success||R.debug("cascadeHelpers","Failed to persist cascade hash state (non-critical)",{stackName:l,account:e.name})),r.onCascadeAccountComplete?.(o,!0,void 0,t,F,!1),L({outputs:F,skipped:!1})}async function ge(s,n,i){const e=new Map,a=s.awsProvider.getRegion(),r=await b(s.awsProvider,n.id,a,`fjall-ipam-read-${n.name}`);if(!r.success)return R.debug("organisationDeploy",`Cannot read Platform outputs: ${r.error.message}`),e;const u=new B(r.data.provider),t=M(h.PLATFORM),o=await u.getStackOutputs(t);if(!o.success)return R.debug("organisationDeploy",`Failed to read Platform stack outputs: ${o.error.message}`),e;const c=/^IpamPoolId(\d{12})(\w+)$/;for(const f of o.data){const d=f.OutputKey?.match(c);if(d&&f.OutputValue){const g=`${d[1]}-${d[2]}`;e.set(g,f.OutputValue)}}return e.size>0&&i.onLog?.(`Read ${e.size} IPAM pool ID(s) from Platform stack`,"info"),e}async function Ce(s,n){const i=s.getDomains();if(i.length===0)return{domainsDeployed:0,errors:[]};n.onCascadePhaseStart?.("domains");const e=i.filter(t=>t.type==="apex"),a=i.filter(t=>t.type==="delegated");let r=0;const u=[];for(const t of e){const o=await s.deployDomain(t.name,n);o.success?r++:u.push(`${t.name}: ${o.error.message}`)}if(a.length>0){const t=await Promise.allSettled(a.map(o=>s.deployDomain(o.name,n)));for(let o=0;o<t.length;o++){const c=t[o],f=a[o];if(!(!c||!f))if(c.status==="fulfilled")c.value.success?r++:u.push(`${f.name}: ${c.value.error.message}`);else{const d=c.reason instanceof Error?c.reason.message:String(c.reason);u.push(`${f.name}: ${d}`)}}}return n.onCascadePhaseComplete?.("domains"),{domainsDeployed:r,errors:u}}export{de as CASCADE_MAX_CONCURRENCY,fe as buildAccountRegionPairs,Ae as buildCascadeRoleArn,me as buildRegionList,le as deployCascadeAccount,Ce as deployDomains,pe as partitionAccounts,ge as readPlatformIpamPoolIds};

package/dist/src/orchestration/organisationDeploy.js

@@ -1,5 +1,5 @@
-import{join as It}from"node:path";import{success as nt,failure as I}from"@fjall/generator";import{OrganizationsClient as wt}from"@aws-sdk/client-organizations";import{BackupClient as yt}from"@aws-sdk/client-backup";import{ORGANISATION_TYPES as H,getOrganisationStackName as mt}from"../types/operations.js";import{CdkContextBuilder as Nt}from"../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as Dt}from"../types/deployment/index.js";import{ensureOrganisationExists as kt}from"../aws/organisations/organisation.js";import{describeBackupVaultExists as Tt}from"../aws/organisations/backup.js";import{buildParamsContext as bt,collectStackOutputs as rt,synthOrFail as gt,bootstrapOrFail as ft,forwardOutput as Ct,forwardResourceProgress as St}from"./contextHelpers.js";import{partitionAccounts as Et,deployCascadeAccount as At,readPlatformIpamPoolIds as Lt,deployDomains as Mt,buildRegionList as _t,buildAccountRegionPairs as $t,CASCADE_MAX_CONCURRENCY as Gt}from"./cascadeHelpers.js";import{projectScalarSummary as Ot}from"./cascadeSummary.js";import{reconcileProviderAccounts as Yt,mergeReconciledProviderAccounts as xt}from"./reconcileProviderAccounts.js";import{maskSensitiveOutput as c,STRUCTURAL_ENVIRONMENTS as Ft,mapSettledWithConcurrency as vt}from"@fjall/util";import{INFRA_STEP_NAME as V,STEP_IDS as T,STEP_NAMES as at}from"../types/stepDefinitions.js";async function ne(o,e,s){const C=Date.now();switch(s.type){case H.ORGANISATION:return Ut(o,e,s,C);case H.PLATFORM:return ht(o,e,s,"platform",C);case H.ACCOUNT:return ht(o,e,s,"account",C);default:{const t=s.type;return I(new Error(`Unsupported organisation type: ${String(t)}`))}}}function Rt(o,e,s,C,t,r){return Nt.buildDeploymentContext({deployType:C,target:s.target,path:s.path,region:e.awsProvider.getRegion(),accountName:r,callerIdentity:Dt(e.awsProvider.getAccountId()),orgId:t.orgId,rootId:t.rootId,managementAccountId:t.managementAccountId,...bt({orgConfig:o.orgConfig,identity:o.identity,skipOidc:o.options?.skipOidc})},{verbose:o.options?.verbose,infraOnly:o.options?.infraOnly},o.orgConfig)}async function Pt(o){const e=o.awsProvider.getClient(wt),s=await kt(e);return s.success?nt({orgId:s.data.orgId,rootId:s.data.rootId,managementAccountId:s.data.managementAccountId}):I(s.error)}const n={CONNECT:{id:T.CONNECT,name:V.CONNECT},PREPARE:{id:T.PREPARE_ENVIRONMENT,name:V.PREPARE},DEPLOY:{id:T.DEPLOY,name:V.DEPLOY},MONITORING:{id:T.MONITORING,name:V.MONITORING},ORG_DEPLOY:{id:T.ORG_DEPLOY,name:at.ORG_DEPLOY},CASCADE_PLATFORM:{id:T.CASCADE_PLATFORM,name:at.CASCADE_PLATFORM},CASCADE_ACCOUNTS:{id:T.CASCADE_ACCOUNTS,name:at.CASCADE_ACCOUNTS}},f=4;async function ht(o,e,s,C,t){const{callbacks:r}=o;r.onStepComplete?.(n.CONNECT.id,n.CONNECT.name,"completed",0,f),r.onStepStart?.(n.PREPARE.id,n.PREPARE.name,1,f);const d=await Pt(e);if(!d.success){r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,f);const S=new Error(c(d.error.message));return r.onError?.(S),I(S)}const _=Rt(o,e,s,C,d.data,C==="account"?s.target:void 0),b=await Tt(e.awsProvider.getClient(yt));if(!b.success){r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,f);const S=new Error(c(b.error.message));return r.onError?.(S),I(S)}_.fjallAdoptBackupVault=b.data,r.onLog?.(`Synthesising ${C} infrastructure\u2026`,"info");const $=await gt(e,_,r,"CDK synthesis failed");if(!$.success)return r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,f),$;const L=await ft(e,_,r);if(!L.success)return r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,f),L;r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"completed",1,f);const h=mt(s.type);r.onStepStart?.(n.DEPLOY.id,n.DEPLOY.name,2,f);const M=await e.cdkService.runCdkDeploy(_,h,Ct(r),St(r),e.awsProvider);if(!M.success){r.onStepComplete?.(n.DEPLOY.id,n.DEPLOY.name,"error",2,f);const S=new Error(c(M.error));return r.onError?.(S),I(S)}r.onStepComplete?.(n.DEPLOY.id,n.DEPLOY.name,"completed",2,f);const v=await e.cfnService.getStackOutputs(h);v.success||r.onLog?.("Failed to read stack outputs (non-critical)","debug");const K=rt(v);return r.onStepStart?.(n.MONITORING.id,n.MONITORING.name,3,f),r.onStepComplete?.(n.MONITORING.id,n.MONITORING.name,"completed",3,f),nt({target:s.target,deploymentType:"organisation",outputs:K,durationMs:Date.now()-t})}async function Ut(o,e,s,C){const{callbacks:t,options:r}=o;let d=o.orgConfig?.providerAccounts??[];if(d.length===0||d.every(a=>a.environment===Ft.ROOT)){const a=await Yt(e,o.workingDirectory);if(a.success){const{providerAccounts:i,missingAccountNames:m}=a.data;i.length>0&&(d=xt(o.orgConfig,i).providerAccounts,t.onLog?.(`Reconciled ${i.length} account(s) from AWS Organizations`,"info")),m.length>0&&(t.onCascadeMissingAccounts?.(m),t.onProgress?.({type:"warning",message:c(`Accounts declared in ACCOUNTS but not yet in AWS Organizations (cascade will skip): ${m.join(", ")}`)}))}else t.onProgress?.({type:"warning",message:c(`Could not reconcile accounts from AWS Organizations \u2014 cascade may skip accounts: ${a.error.message}`)})}const b=o.orgConfig?.primaryRegion??e.awsProvider.getRegion();d=d.map(a=>a.region!==void 0?a:{...a,region:b});const $=o.orgConfig!==void 0?{...o.orgConfig,providerAccounts:d}:d.length>0?{providerAccounts:d}:void 0,L=await Pt(e);if(!L.success){const a=new Error(c(L.error.message));return t.onError?.(a),I(a)}const h=Rt(o,e,s,"organisation",L.data),M=r?.cascade!==!1,{platformAccount:v,memberAccounts:K}=Et(d),S=M&&v!==void 0?1:0,st=M&&K.length>0?1:0,l=2+S+st;t.onCascadeAccountsReconciled?.({hasPlatformAccount:S>0,hasMemberAccounts:st>0});const{id:U,name:W}=n.PREPARE;t.onStepStart?.(U,W,0,l),t.onLog?.("Synthesising organisation infrastructure\u2026","info");const ct=await gt(e,h,t,"CDK synthesis failed");if(!ct.success)return t.onStepComplete?.(U,W,"error",0,l),ct;const it=await ft(e,h,t);if(!it.success)return t.onStepComplete?.(U,W,"error",0,l),it;t.onStepComplete?.(U,W,"completed",0,l);const{id:X,name:q}=n.ORG_DEPLOY,N=mt(H.ORGANISATION);let dt=!0;const G=await e.hashService.getTemplateHashes(It(h.path,"cdk.out"));if(G.success){const a=await e.hashService.compareWithState(G.data,h.path);a.success?dt=a.data.stackChanges.get(N)??!0:t.onLog?.(c(`Org root change detection failed \u2014 deploying to be safe: ${a.error.message}`),"warn")}else t.onLog?.(c(`Org root template hashing failed \u2014 deploying to be safe: ${G.error.message}`),"warn");const J=dt||r?.force===!0||!await e.cfnService.stackExists(N);t.onOrgChangesDetected?.({hasOrgChanges:J});let Q;if(J){t.onStepStart?.(X,q,1,l);const a=await e.cdkService.runCdkDeploy(h,N,Ct(t),St(t),e.awsProvider);if(!a.success){t.onStepComplete?.(X,q,"error",1,l);const O=new Error(c(a.error));return t.onError?.(O),I(O)}const i=await e.cfnService.getStackOutputs(N);i.success||t.onLog?.("Failed to read org stack outputs (non-critical)","debug"),Q=rt(i);const m=G.success?G.data.get(N):void 0;if(m!==void 0){const O=await e.hashService.updateStateAfterDeploy(h.path,new Map([[N,m]]));O.success||t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy the org root: ${c(O.error.message)}`,"warn")}t.onStepComplete?.(X,q,"completed",1,l)}else{t.onLog?.("Organisation root: no infrastructure changes \u2014 skipping deploy","info");const a=await e.cfnService.getStackOutputs(N);a.success||t.onLog?.("Failed to read org stack outputs (non-critical)","debug"),Q=rt(a)}const p=[],j=[];let z=J;if(M&&d.length>0){t.onCascadeStart?.();const a=Date.now();let i=2,m=!1,O,Z=!1;const B=[],ut=u=>({members:B,...O!==void 0?{platform:O}:{},domainsDeployed:Z,errors:p,totalDurationMs:u}),{platformAccount:R,memberAccounts:tt}=Et(d);if(R){const{id:u,name:g}=n.CASCADE_PLATFORM;t.onStepStart?.(u,g,i,l),t.onCascadePhaseStart?.("platform");let E;const et=Date.now();try{E=await At(o,e,s,R,"platform",t,{orgConfig:$})}catch(P){const x=c(P instanceof Error?P.message:String(P));p.push({accountId:R.id,error:x}),t.onCascadePhaseComplete?.("platform"),t.onStepComplete?.(u,g,"error",i,l),E=I(new Error(x))}const Y=Date.now()-et;if(E.success){m=!0;const P=E.data.skipped===!0;P||(z=!0),E.data.outputs&&j.push({accountId:R.id,outputs:E.data.outputs}),t.onCascadePhaseComplete?.("platform"),t.onStepComplete?.(u,g,P?"skipped":"completed",i,l),O={accountId:R.id,result:P?"skipped":"succeeded",durationMs:Y}}else p.some(P=>P.accountId===R.id)||(p.push({accountId:R.id,error:c(E.error.message)}),t.onCascadePhaseComplete?.("platform"),t.onStepComplete?.(u,g,"error",i,l)),O={accountId:R.id,result:"failed",durationMs:Y,error:c(E.error.message)};i++}let lt=new Map;if(m&&R&&(lt=await Lt(e,R,t)),o.domainProvider){const u=await Mt(o.domainProvider,t);Z=u.domainsDeployed>0,Z&&(z=!0);for(const g of u.errors)p.push({accountId:"domains",error:c(g)})}if(tt.length>0){const{id:u,name:g}=n.CASCADE_ACCOUNTS;t.onStepStart?.(u,g,i,l),t.onCascadePhaseStart?.("accounts");const E=_t(o.orgConfig),et=E[0]??b,Y=$t(tt,E);(await vt(Y,Gt,async({account:w,region:F})=>{const D=F.replace(/-/g,""),A=lt.get(`${w.id}-${D}`),k=Date.now();return{result:await At(o,e,s,w,"account",t,{ipamPoolId:A,orgConfig:$,region:F,skipAccountGlobals:F!==et}),durationMs:Date.now()-k}})).forEach((w,F)=>{const D=Y[F];if(!D)return;const A=D.account;if(w.status==="rejected"){const y=c(w.reason instanceof Error?w.reason.message:String(w.reason));B.push({accountId:A.id,accountName:A.name,region:D.region,result:"failed",durationMs:0,error:y}),p.push({accountId:A.id,error:y});return}const{result:k,durationMs:ot}=w.value;if(k.success){const y=k.data.skipped===!0;y||(z=!0),k.data.outputs&&j.push({accountId:A.id,outputs:k.data.outputs}),B.push({accountId:A.id,accountName:A.name,region:D.region,result:y?"skipped":"succeeded",durationMs:ot})}else{const y=c(k.error.message);B.push({accountId:A.id,accountName:A.name,region:D.region,result:"failed",durationMs:ot,error:y}),p.push({accountId:A.id,error:y})}});const x=Ot(ut(0));t.onCascadePhaseComplete?.("accounts"),t.onStepComplete?.(u,g,x.accountsFailed>0?"error":x.accountsSkipped===tt.length?"skipped":"completed",i,l)}const pt=ut(Date.now()-a);if(t.onCascadeComplete?.(Ot(pt)),t.onCascadeLedger?.(pt),p.length>0){const u=p.map(g=>`  ${g.accountId}: ${g.error}`).join(`
-`);t.onLog?.(c(`Cascade failed for ${p.length} target(s):
-${u}`),"warn")}}if(p.length>0){const a=p.map(m=>c(`${m.accountId}: ${m.error}`)).join(`
-`),i=new Error(`Organisation root deployed, but the cascade failed for ${p.length} target(s):
-${a}`);return t.onError?.(i),I(i)}return nt({target:s.target,deploymentType:"organisation",outputs:Q,...j.length>0?{cascadeOutputs:j}:{},...z?{}:{noChanges:!0},durationMs:Date.now()-C})}export{ne as deployOrganisation};
+import{join as Ie}from"node:path";import{success as re,failure as h}from"@fjall/generator";import{OrganizationsClient as we}from"@aws-sdk/client-organizations";import{BackupClient as Ne}from"@aws-sdk/client-backup";import{ORGANISATION_TYPES as K,getOrganisationStackName as me}from"../types/operations.js";import{CdkContextBuilder as ye}from"../services/supporting/CdkContextBuilder.js";import{stubCallerIdentity as De}from"../types/deployment/index.js";import{ensureOrganisationExists as ke}from"../aws/organisations/organisation.js";import{accountHasDisasterRecovery as Te,describeBackupVaultExists as be}from"../aws/organisations/backup.js";import{buildParamsContext as Le,collectStackOutputs as ae,synthOrFail as ge,bootstrapOrFail as fe,forwardOutput as Ce,forwardResourceProgress as Se}from"./contextHelpers.js";import{partitionAccounts as Ae,deployCascadeAccount as Ee,readPlatformIpamPoolIds as Me,deployDomains as _e,buildRegionList as $e,buildAccountRegionPairs as Fe,CASCADE_MAX_CONCURRENCY as Ge}from"./cascadeHelpers.js";import{projectScalarSummary as Oe}from"./cascadeSummary.js";import{reconcileProviderAccounts as Ye,mergeReconciledProviderAccounts as ve}from"./reconcileProviderAccounts.js";import{maskSensitiveOutput as i,STRUCTURAL_ENVIRONMENTS as xe,mapSettledWithConcurrency as Ue}from"@fjall/util";import{INFRA_STEP_NAME as X,STEP_IDS as b,STEP_NAMES as se}from"../types/stepDefinitions.js";async function at(o,t,s){const g=Date.now();switch(s.type){case K.ORGANISATION:return We(o,t,s,g);case K.PLATFORM:return he(o,t,s,"platform",g);case K.ACCOUNT:return he(o,t,s,"account",g);default:{const e=s.type;return h(new Error(`Unsupported organisation type: ${String(e)}`))}}}function Re(o,t,s,g,e,r){return ye.buildDeploymentContext({deployType:g,target:s.target,path:s.path,region:t.awsProvider.getRegion(),accountName:r,callerIdentity:De(t.awsProvider.getAccountId()),orgId:e.orgId,rootId:e.rootId,managementAccountId:e.managementAccountId,...Le({orgConfig:o.orgConfig,identity:o.identity,skipOidc:o.options?.skipOidc})},{verbose:o.options?.verbose,infraOnly:o.options?.infraOnly},o.orgConfig)}async function Pe(o){const t=o.awsProvider.getClient(we),s=await ke(t);return s.success?re({orgId:s.data.orgId,rootId:s.data.rootId,managementAccountId:s.data.managementAccountId}):h(s.error)}const n={CONNECT:{id:b.CONNECT,name:X.CONNECT},PREPARE:{id:b.PREPARE_ENVIRONMENT,name:X.PREPARE},DEPLOY:{id:b.DEPLOY,name:X.DEPLOY},MONITORING:{id:b.MONITORING,name:X.MONITORING},ORG_DEPLOY:{id:b.ORG_DEPLOY,name:se.ORG_DEPLOY},CASCADE_PLATFORM:{id:b.CASCADE_PLATFORM,name:se.CASCADE_PLATFORM},CASCADE_ACCOUNTS:{id:b.CASCADE_ACCOUNTS,name:se.CASCADE_ACCOUNTS}},S=4;async function he(o,t,s,g,e){const{callbacks:r}=o;r.onStepComplete?.(n.CONNECT.id,n.CONNECT.name,"completed",0,S),r.onStepStart?.(n.PREPARE.id,n.PREPARE.name,1,S);const p=await Pe(t);if(!p.success){r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,S);const l=new Error(i(p.error.message));return r.onError?.(l),h(l)}const $=Re(o,t,s,g,p.data,g==="account"?s.target:void 0),L=o.orgConfig?.disasterRecoveryRegion,W=L!==void 0&&L!=="",M=g==="account"?o.orgConfig?.providerAccounts.find(l=>l.name===s.target):void 0;if(g==="account"&&W&&(M===void 0||Te(M.environment,L))){const l=await be(t.awsProvider.getClient(Ne));if(!l.success){r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,S);const y=new Error(i(l.error.message));return r.onError?.(y),h(y)}$.fjallAdoptBackupVault=l.data}r.onLog?.(`Synthesising ${g} infrastructure\u2026`,"info");const _=await ge(t,$,r,"CDK synthesis failed");if(!_.success)return r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,S),_;const j=await fe(t,$,r);if(!j.success)return r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"error",1,S),j;r.onStepComplete?.(n.PREPARE.id,n.PREPARE.name,"completed",1,S);const V=me(s.type);r.onStepStart?.(n.DEPLOY.id,n.DEPLOY.name,2,S);const F=await t.cdkService.runCdkDeploy($,V,Ce(r),Se(r),t.awsProvider);if(!F.success){r.onStepComplete?.(n.DEPLOY.id,n.DEPLOY.name,"error",2,S);const l=new Error(i(F.error));return r.onError?.(l),h(l)}r.onStepComplete?.(n.DEPLOY.id,n.DEPLOY.name,"completed",2,S);const G=await t.cfnService.getStackOutputs(V);G.success||r.onLog?.("Failed to read stack outputs (non-critical)","debug");const d=ae(G);return r.onStepStart?.(n.MONITORING.id,n.MONITORING.name,3,S),r.onStepComplete?.(n.MONITORING.id,n.MONITORING.name,"completed",3,S),re({target:s.target,deploymentType:"organisation",outputs:d,durationMs:Date.now()-e})}async function We(o,t,s,g){const{callbacks:e,options:r}=o;let p=o.orgConfig?.providerAccounts??[];if(p.length===0||p.every(a=>a.environment===xe.ROOT)){const a=await Ye(t,o.workingDirectory);if(a.success){const{providerAccounts:c,missingAccountNames:C}=a.data;c.length>0&&(p=ve(o.orgConfig,c).providerAccounts,e.onLog?.(`Reconciled ${c.length} account(s) from AWS Organizations`,"info")),C.length>0&&(e.onCascadeMissingAccounts?.(C),e.onProgress?.({type:"warning",message:i(`Accounts declared in ACCOUNTS but not yet in AWS Organizations (cascade will skip): ${C.join(", ")}`)}))}else e.onProgress?.({type:"warning",message:i(`Could not reconcile accounts from AWS Organizations \u2014 cascade may skip accounts: ${a.error.message}`)})}const L=o.orgConfig?.primaryRegion??t.awsProvider.getRegion();p=p.map(a=>a.region!==void 0?a:{...a,region:L});const W=o.orgConfig!==void 0?{...o.orgConfig,providerAccounts:p}:p.length>0?{providerAccounts:p}:void 0,M=await Pe(t);if(!M.success){const a=new Error(i(M.error.message));return e.onError?.(a),h(a)}const N=Re(o,t,s,"organisation",M.data),_=r?.cascade!==!1,{platformAccount:j,memberAccounts:V}=Ae(p),F=_&&j!==void 0?1:0,G=_&&V.length>0?1:0,d=2+F+G;e.onCascadeAccountsReconciled?.({hasPlatformAccount:F>0,hasMemberAccounts:G>0});const{id:l,name:y}=n.PREPARE;e.onStepStart?.(l,y,0,d),e.onLog?.("Synthesising organisation infrastructure\u2026","info");const ce=await ge(t,N,e,"CDK synthesis failed");if(!ce.success)return e.onStepComplete?.(l,y,"error",0,d),ce;const ie=await fe(t,N,e);if(!ie.success)return e.onStepComplete?.(l,y,"error",0,d),ie;e.onStepComplete?.(l,y,"completed",0,d);const{id:J,name:Q}=n.ORG_DEPLOY,D=me(K.ORGANISATION);let de=!0;const Y=await t.hashService.getTemplateHashes(Ie(N.path,"cdk.out"));if(Y.success){const a=await t.hashService.compareWithState(Y.data,N.path);a.success?de=a.data.stackChanges.get(D)??!0:e.onLog?.(i(`Org root change detection failed \u2014 deploying to be safe: ${a.error.message}`),"warn")}else e.onLog?.(i(`Org root template hashing failed \u2014 deploying to be safe: ${Y.error.message}`),"warn");const Z=de||r?.force===!0||!await t.cfnService.stackExists(D);e.onOrgChangesDetected?.({hasOrgChanges:Z});let ee;if(Z){e.onStepStart?.(J,Q,1,d);const a=await t.cdkService.runCdkDeploy(N,D,Ce(e),Se(e),t.awsProvider);if(!a.success){e.onStepComplete?.(J,Q,"error",1,d);const R=new Error(i(a.error));return e.onError?.(R),h(R)}const c=await t.cfnService.getStackOutputs(D);c.success||e.onLog?.("Failed to read org stack outputs (non-critical)","debug"),ee=ae(c);const C=Y.success?Y.data.get(D):void 0;if(C!==void 0){const R=await t.hashService.updateStateAfterDeploy(N.path,new Map([[D,C]]));R.success||e.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy the org root: ${i(R.error.message)}`,"warn")}e.onStepComplete?.(J,Q,"completed",1,d)}else{e.onLog?.("Organisation root: no infrastructure changes \u2014 skipping deploy","info");const a=await t.cfnService.getStackOutputs(D);a.success||e.onLog?.("Failed to read org stack outputs (non-critical)","debug"),ee=ae(a)}const f=[],H=[];let z=Z;if(_&&p.length>0){e.onCascadeStart?.();const a=Date.now();let c=2,C=!1,R,te=!1;const B=[],ue=u=>({members:B,...R!==void 0?{platform:R}:{},domainsDeployed:te,errors:f,totalDurationMs:u}),{platformAccount:A,memberAccounts:q}=Ae(p);if(A){const{id:u,name:m}=n.CASCADE_PLATFORM;e.onStepStart?.(u,m,c,d),e.onCascadePhaseStart?.("platform");let E;const oe=Date.now();try{E=await Ee(o,t,s,A,"platform",e,{orgConfig:W})}catch(P){const x=i(P instanceof Error?P.message:String(P));f.push({accountId:A.id,error:x}),e.onCascadePhaseComplete?.("platform"),e.onStepComplete?.(u,m,"error",c,d),E=h(new Error(x))}const v=Date.now()-oe;if(E.success){C=!0;const P=E.data.skipped===!0;P||(z=!0),E.data.outputs&&H.push({accountId:A.id,outputs:E.data.outputs}),e.onCascadePhaseComplete?.("platform"),e.onStepComplete?.(u,m,P?"skipped":"completed",c,d),R={accountId:A.id,result:P?"skipped":"succeeded",durationMs:v}}else f.some(P=>P.accountId===A.id)||(f.push({accountId:A.id,error:i(E.error.message)}),e.onCascadePhaseComplete?.("platform"),e.onStepComplete?.(u,m,"error",c,d)),R={accountId:A.id,result:"failed",durationMs:v,error:i(E.error.message)};c++}let le=new Map;if(C&&A&&(le=await Me(t,A,e)),o.domainProvider){const u=await _e(o.domainProvider,e);te=u.domainsDeployed>0,te&&(z=!0);for(const m of u.errors)f.push({accountId:"domains",error:i(m)})}if(A!==void 0&&!C&&q.length>0){const{id:u,name:m}=n.CASCADE_ACCOUNTS;e.onStepStart?.(u,m,c,d),e.onStepComplete?.(u,m,"skipped",c,d),e.onLog?.("Skipping account cascade \u2014 platform deployment failed; platform is a prerequisite for member accounts.","warn")}else if(q.length>0){const{id:u,name:m}=n.CASCADE_ACCOUNTS;e.onStepStart?.(u,m,c,d),e.onCascadePhaseStart?.("accounts");const E=$e(o.orgConfig),oe=E[0]??L,v=Fe(q,E);(await Ue(v,Ge,async({account:I,region:U})=>{const k=U.replace(/-/g,""),O=le.get(`${I.id}-${k}`),T=Date.now();return{result:await Ee(o,t,s,I,"account",e,{ipamPoolId:O,orgConfig:W,region:U,skipAccountGlobals:U!==oe}),durationMs:Date.now()-T}})).forEach((I,U)=>{const k=v[U];if(!k)return;const O=k.account;if(I.status==="rejected"){const w=i(I.reason instanceof Error?I.reason.message:String(I.reason));B.push({accountId:O.id,accountName:O.name,region:k.region,result:"failed",durationMs:0,error:w}),f.push({accountId:O.id,error:w});return}const{result:T,durationMs:ne}=I.value;if(T.success){const w=T.data.skipped===!0;w||(z=!0),T.data.outputs&&H.push({accountId:O.id,outputs:T.data.outputs}),B.push({accountId:O.id,accountName:O.name,region:k.region,result:w?"skipped":"succeeded",durationMs:ne})}else{const w=i(T.error.message);B.push({accountId:O.id,accountName:O.name,region:k.region,result:"failed",durationMs:ne,error:w}),f.push({accountId:O.id,error:w})}});const x=Oe(ue(0));e.onCascadePhaseComplete?.("accounts"),e.onStepComplete?.(u,m,x.accountsFailed>0?"error":x.accountsSkipped===q.length?"skipped":"completed",c,d)}const pe=ue(Date.now()-a);if(e.onCascadeComplete?.(Oe(pe)),e.onCascadeLedger?.(pe),f.length>0){const u=f.map(m=>`  ${m.accountId}: ${m.error}`).join(`
+`);e.onLog?.(i(`Cascade failed for ${f.length} target(s):
+${u}`),"warn")}}if(f.length>0){const a=f.map(C=>i(`${C.accountId}: ${C.error}`)).join(`
+`),c=new Error(`Organisation root deployed, but the cascade failed for ${f.length} target(s):
+${a}`);return e.onError?.(c),h(c)}return re({target:s.target,deploymentType:"organisation",outputs:ee,...H.length>0?{cascadeOutputs:H}:{},...z?{}:{noChanges:!0},durationMs:Date.now()-g})}export{at as deployOrganisation};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "2.9.0",
+  "version": "2.9.1",
   "description": "Shared deployment engine for Fjall — used by CLI and webapp worker",
   "type": "module",
   "main": "dist/src/index.js",
@@ -73,8 +73,8 @@
     "@aws-sdk/client-s3": "^3.1038.0",
     "@aws-sdk/client-sso-admin": "^3.1038.0",
     "@aws-sdk/client-sts": "^3.1038.0",
-    "@fjall/generator": "^2.9.0",
-    "@fjall/util": "^2.9.0",
+    "@fjall/generator": "^2.9.1",
+    "@fjall/util": "^2.9.1",
     "@smithy/node-http-handler": "^4.6.1",
     "tsx": "^4.21.0",
     "zod": "^4.4.3"
@@ -83,5 +83,5 @@
     "@types/node": "^25.6.0",
     "vitest": "^4.1.5"
   },
-  "gitHead": "72c4668ef5ead59c0b981eca8037620875bcd1ba"
+  "gitHead": "a97423cf3df727994364a0907fa2b5c544a86b0d"
 }