@fjall/deploy-core 20.0.0 → 21.0.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "113537bde5a6e3edff17ddca162a3c5067d070220c2ef8cf4127f926c107001a",
+  "hash": "623b78ba79d83f6ebcae4b84de5070792c13fb7d4d7c6cdc07f41e9f44d64d4d",
   "files": {
     "src/__test-utils__/awsMockHelpers.ts": "fea371c1b1869678",
     "src/__test-utils__/index.ts": "e03cf35821157dc4",
@@ -72,8 +72,8 @@
     "src/orchestration/application/detectionPipeline.ts": "69b7dfcedf22fe01",
     "src/orchestration/application/directDestroy.ts": "4fac968ba765cd76",
     "src/orchestration/application/dockerBuildHelper.ts": "e7a7259e987d93be",
-    "src/orchestration/application/ecrCacheRepository.ts": "d7a5602ccabde493",
-    "src/orchestration/application/ecsDeploymentTail.ts": "d9ff18631984b2e5",
+    "src/orchestration/application/ecrCacheRepository.ts": "bf396177c8c66e4a",
+    "src/orchestration/application/ecsDeploymentTail.ts": "51974290626f5d47",
     "src/orchestration/application/engineCompat.ts": "d3e1cbf906bc785d",
     "src/orchestration/application/lambdaCodeOnlyRollout.ts": "fc347b90ff55c1fd",
     "src/orchestration/application/leaseGate.ts": "26be2e119b32bef4",
@@ -92,7 +92,7 @@
     "src/orchestration/application/plan/renameDetection.ts": "7242d45be616625f",
     "src/orchestration/application/plan/renderDeployPlan.ts": "d2d77c37aa7b4ed6",
     "src/orchestration/application/plan/types.ts": "191929198672081c",
-    "src/orchestration/application/schemaGateImage.ts": "587a115432c6678e",
+    "src/orchestration/application/schemaGateImage.ts": "0146ae1ce875a9b6",
     "src/orchestration/application/serviceImageTagsRollback.ts": "55e23a493545511c",
     "src/orchestration/application/taskDefinitionRoll.ts": "d9378c509c7ec287",
     "src/orchestration/application/welcomeImageHelper.ts": "1721ea7edc37a96e",
@@ -269,12 +269,12 @@
     "src/util/dockerfileDetection.ts": "c407ab8208fb65ec",
     "src/util/index.ts": "6fcf776825c4518e",
     "src/util/sequencedCallbacks.ts": "e0eb541cff459083",
-    "src/util/sleepAbortable.ts": "f9cac3bf8a79a476",
+    "src/util/sleepAbortable.ts": "ee2facc7b89ab9f5",
     "src/version.ts": "1811a4475823b27e",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "9d8f15f79dbb510e",
+    "package.json": "5c18b2116f2213eb",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "6eb87f3f8211bf3109bca773e60e254893b2972dc5f7b812a9bc7d608aea136e",
+  "outputHash": "bfe4f6996414bbbd7e15a07e23aaa67569487e9295fb0ef5dac3afdc6acd1715",
   "outputFileCount": 513
 }

package/dist/.minified

@@ -1 +1 @@
-256 files minified at 2026-08-24T18:05:15.785Z
+256 files minified at 2026-08-26T08:33:04.444Z

package/dist/src/orchestration/application/ecrCacheRepository.js

@@ -1 +1 @@
-var u=Object.defineProperty;var n=(t,r)=>u(t,"name",{value:r,configurable:!0});import{ECRClient as m,CreateRepositoryCommand as y,PutLifecyclePolicyCommand as d}from"@aws-sdk/client-ecr";import{success as p,failure as c}from"@fjall/generator";import{getErrorMessage as a,maskSensitiveOutput as l}from"@fjall/util";import{untaggedLifecyclePolicyText as f,CACHE_REPO_UNTAGGED_RETENTION_DAYS as g}from"@fjall/util/docker";import{logger as C}from"@fjall/util/logger";import{composeSdkAbortSignal as s,extractErrorName as E}from"../../aws/organisations/types.js";const T="EcrCacheRepository";async function _(t,r,o){const i=t.getClient(m);try{await i.send(new y({repositoryName:r,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"MUTABLE"}),{abortSignal:s(o)}),C.debug(T,"Created build-cache repository",{cacheRepositoryName:r})}catch(e){if(E(e)!=="RepositoryAlreadyExistsException")return c(new Error(`Could not create build-cache repository '${r}': ${l(a(e))}`))}try{await i.send(new d({repositoryName:r,lifecyclePolicyText:f(g)}),{abortSignal:s(o)})}catch(e){return c(new Error(`Could not set lifecycle policy on build-cache repository '${r}': ${l(a(e))}`))}return p(void 0)}n(_,"ensureBuildCacheRepository");export{_ as ensureBuildCacheRepository};
+var u=Object.defineProperty;var n=(t,r)=>u(t,"name",{value:r,configurable:!0});import{ECRClient as m,CreateRepositoryCommand as y,PutLifecyclePolicyCommand as d}from"@aws-sdk/client-ecr";import{success as g,failure as a}from"@fjall/generator";import{getErrorMessage as c,maskSensitiveOutput as s}from"@fjall/util";import{ecrCreateRepositoryTags as p}from"@fjall/util/aws";import{untaggedLifecyclePolicyText as f,CACHE_REPO_UNTAGGED_RETENTION_DAYS as C}from"@fjall/util/docker";import{logger as E}from"@fjall/util/logger";import{composeSdkAbortSignal as l,extractErrorName as T}from"../../aws/organisations/types.js";const b="EcrCacheRepository";async function L(t,r,o){const i=t.getClient(m);try{await i.send(new y({repositoryName:r,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"MUTABLE",tags:p(r)}),{abortSignal:l(o)}),E.debug(b,"Created build-cache repository",{cacheRepositoryName:r})}catch(e){if(T(e)!=="RepositoryAlreadyExistsException")return a(new Error(`Could not create build-cache repository '${r}': ${s(c(e))}`))}try{await i.send(new d({repositoryName:r,lifecyclePolicyText:f(C)}),{abortSignal:l(o)})}catch(e){return a(new Error(`Could not set lifecycle policy on build-cache repository '${r}': ${s(c(e))}`))}return g(void 0)}n(L,"ensureBuildCacheRepository");export{L as ensureBuildCacheRepository};

package/dist/src/orchestration/application/ecsDeploymentTail.js

@@ -1,3 +1,3 @@
-var B=Object.defineProperty;var d=(o,s)=>B(o,"name",{value:s,configurable:!0});import{logger as u}from"@fjall/util/logger";import{getErrorMessage as I,maskSensitiveOutput as f}from"@fjall/util";import{isAborted as _}from"../../aws/organisations/types.js";import{sleepAbortable as U}from"../../util/sleepAbortable.js";const p="EcsDeploymentTail",z="AWS::ECS::Service",K="AWS::CloudFormation::Stack",G=new Set(["CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS"]),Y=15e3,j=3e4,W=["CloudFormation entered UPDATE_ROLLBACK_FAILED \u2014 the stack is wedged and will refuse further updates until the rollback completes.","To unstick it:","  1. Find the resource(s) that failed to roll back: aws cloudformation describe-stack-events --stack-name <stack> (look for UPDATE_ROLLBACK_FAILED resource events and their status reasons).","  2. Fix the underlying cause if possible (an ECS service that cannot stabilise usually means the previous image cannot boot \u2014 check stopped-task reasons above).","  3. Resume the rollback: aws cloudformation continue-update-rollback --stack-name <stack> [--resources-to-skip <logical-ids>].","  4. Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-update-rollback-failed"].join(`
-`);function Z(o){const{ecsService:s,callbacks:i,abortSignal:c}=o,b=o.pollIntervalMs??Y,S=new Map,h=new AbortController,D=c!==void 0?AbortSignal.any([c,h.signal]):h.signal;let E=!1,N=!1;const C=d(e=>{i.onECSProgress?.(f(e))},"emitProgress"),$=d((e,t)=>t.createdAt!==void 0&&t.createdAt.getTime()>=e.updateStartedAt.getTime()-j,"isFreshDeployment"),O=d(async e=>{const t=await s.describeServices(e.clusterName,[e.serviceArn],D);if(!t.success){u.debug(p,"DescribeServices poll failed (transient, observing)",{serviceArn:e.serviceArn,error:f(t.error.message)});return}const r=t.data[0];if(r===void 0)return;const n=r.deployments?.find(l=>l.status==="PRIMARY");if(n?.id!==void 0&&(e.targetDeploymentId===void 0?$(e,n)&&(e.targetDeploymentId=n.id,e.targetTaskDefinitionArn=n.taskDefinition):n.id!==e.targetDeploymentId&&n.id!==e.replacedByDeploymentId&&(e.replacedByDeploymentId=n.id,C(`${e.serviceName}: ECS replaced the in-flight deployment \u2014 now rolling out ${w(n.taskDefinition)}`)),(n.id===e.targetDeploymentId||n.id===e.replacedByDeploymentId)&&n.rolloutState!==void 0)){const k=`${n.id}:${n.rolloutState}`;if(k!==e.lastNarratedRollout){e.lastNarratedRollout=k;const A=n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""?` (${n.rolloutStateReason})`:"";C(`${e.serviceName}: rollout ${n.rolloutState}${A} \u2014 running ${n.runningCount??0}/${n.desiredCount??0}`),i.onECSUpdate?.(n.rolloutState,e.serviceName)}n.id===e.targetDeploymentId&&(e.lastRolloutState=n.rolloutState,n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""&&(e.lastRolloutReason=n.rolloutStateReason))}if(e.targetDeploymentId===void 0)return;const R=await s.listStoppedTasks(e.clusterName,e.targetDeploymentId,D);if(!R.success){u.debug(p,"ListTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:f(R.error.message)});return}const a=R.data.filter(l=>!e.stoppedTaskArns.has(l));if(a.length===0&&e.pendingForensicArns.size===0)return;for(const l of a)e.stoppedTaskArns.add(l);const y=e.pendingForensicArns.size>0,v=[...e.pendingForensicArns,...a];let m=!1;const T=await s.describeTasks(e.clusterName,v,D);if(T.success)m=y,e.pendingForensicArns.clear(),T.data.length>0&&(e.latestForensic=T.data[T.data.length-1]);else{for(const l of v)e.pendingForensicArns.add(l);u.debug(p,"DescribeTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:f(T.error.message)})}if(a.length===0&&!m)return;const g=e.latestForensic!==void 0?` \u2014 latest: ${F(e.latestForensic)}`:"";C(`${e.serviceName}: ${e.stoppedTaskArns.size} task(s) from the new revision stopped since the update began${g}`)},"pollOnce"),P=d(async e=>{for(;!E&&!_(D);){try{await O(e)}catch(t){u.debug(p,"Tail poll threw (transient, observing)",{serviceArn:e.serviceArn,error:f(I(t))})}await U(b,D)}},"runTailLoop"),L=d((e,t)=>{const r=V(e);if(r===void 0){u.debug(p,"Cannot derive cluster from legacy-format service ARN; skipping tail",{serviceArn:e});return}const n={serviceArn:e,clusterName:r.clusterName,serviceName:r.serviceName,startedAtMs:Date.now(),updateStartedAt:t,stoppedTaskArns:new Set,pendingForensicArns:new Set,loop:Promise.resolve()};n.loop=P(n),S.set(e,n),u.debug(p,"ECS deployment tail started",{serviceArn:e,clusterName:r.clusterName})},"startTail");return{observeResourceEvent(e){if(!E){if(e.resourceType===z&&G.has(e.status)&&e.physicalId!==void 0&&e.physicalId!==""&&!S.has(e.physicalId)){L(e.physicalId,e.timestamp);return}e.resourceType===K&&e.status==="UPDATE_ROLLBACK_FAILED"&&!N&&(N=!0,i.onOutput?.(`${W}
-`))}},async finalise(e){if(E)return;E=!0,h.abort();const t=e?.deploySucceeded===!0;await Promise.all([...S.values()].map(async r=>{await r.loop.catch(n=>{u.debug(p,"Tail loop rejected during finalise",{serviceArn:r.serviceArn,error:f(I(n))})}),await M(r,t).catch(n=>{u.debug(p,"Tail completion emission failed",{serviceArn:r.serviceArn,error:f(I(n))})})}))}};async function M(e,t){if(e.targetDeploymentId===void 0){u.debug(p,"No fresh deployment was ever adopted; skipping ECS completion event",{serviceArn:e.serviceArn});return}let r,n,R,a=e.lastRolloutState,y=e.lastRolloutReason;if(!_(c)){const l=await s.describeServices(e.clusterName,[e.serviceArn],c);if(l.success&&l.data[0]!==void 0){const k=l.data[0];r=k.taskDefinition,n=k.runningCount,R=k.desiredCount;const A=k.deployments?.find(x=>x.status==="PRIMARY");A?.id!==void 0&&(A.id===e.targetDeploymentId?A.rolloutState!==void 0&&(a=A.rolloutState,y=A.rolloutStateReason??y):e.replacedByDeploymentId===void 0&&(e.replacedByDeploymentId=A.id))}else l.success||u.debug(p,"Final DescribeServices snapshot failed",{serviceArn:e.serviceArn,error:f(l.error.message)})}const v=e.replacedByDeploymentId!==void 0;let m;v?m=!1:a==="COMPLETED"?m=!0:a==="FAILED"?m=!1:m=t,r!==void 0&&e.targetTaskDefinitionArn!==void 0&&r!==e.targetTaskDefinitionArn&&C(`${e.serviceName}: service settled on ${w(r)}, not the deployment's target ${w(e.targetTaskDefinitionArn)} \u2014 ECS rolled the service back`);const g=[];m||(y!==void 0?g.push(y):v||g.push(`rollout state ${a??"unknown"} when monitoring ended`),v&&g.push("ECS replaced the in-flight deployment before it completed"),e.stoppedTaskArns.size>0&&g.push(`${e.stoppedTaskArns.size} distinct task(s) from the new revision stopped`),e.latestForensic!==void 0&&g.push(`latest: ${F(e.latestForensic)}`)),i.onECSComplete?.({serviceName:e.serviceName,serviceArn:e.serviceArn,success:m,taskDefinitionArn:r??e.targetTaskDefinitionArn??"unknown",durationMs:Date.now()-e.startedAtMs,...g.length>0&&{reason:f(g.join("; "))},...n!==void 0&&{finalRunningCount:n},...R!==void 0&&{finalDesiredCount:R},...a!==void 0&&{rolloutState:a},...v&&{replaced:!0},...e.stoppedTaskArns.size>0&&{stoppedTaskCount:e.stoppedTaskArns.size},...e.latestForensic?.stopCode!==void 0&&{stopCode:e.latestForensic.stopCode},...e.latestForensic?.stoppedReason!==void 0&&{stoppedReason:f(e.latestForensic.stoppedReason)}})}}d(Z,"createEcsDeploymentTail");function V(o){const s=":service/",i=o.indexOf(s);if(i===-1)return;const b=o.slice(i+s.length).split("/");if(b.length<2)return;const S=b[0],h=b[1];if(!(S===void 0||S===""||h===void 0||h===""))return{clusterName:S,serviceName:h}}d(V,"parseServiceArn");function w(o){if(o===void 0)return"unknown revision";const s=o.split("/"),i=s[s.length-1];return i!==void 0&&i!==""?i:o}d(w,"shortTaskDefinition");function F(o){const s=o.containers.filter(c=>c.exitCode!==void 0).map(c=>`${c.name??"container"} exit ${c.exitCode}`).join(", "),i=o.stoppedReason??o.stopCode??"no stopped reason recorded";return s!==""?`${i} (${s})`:i}d(F,"formatForensic");export{Y as ECS_TAIL_POLL_INTERVAL_MS,W as UPDATE_ROLLBACK_FAILED_RUNBOOK,Z as createEcsDeploymentTail};
+var B=Object.defineProperty;var c=(o,i)=>B(o,"name",{value:i,configurable:!0});import{logger as f}from"@fjall/util/logger";import{getErrorMessage as I,maskSensitiveOutput as p}from"@fjall/util";import{SCHEMA_GATE_CONTAINER_NAME as U,SCHEMA_GATE_EXIT_HINTS as K,schemaGateExitKind as z}from"@fjall/util/migration";import{isAborted as w}from"../../aws/organisations/types.js";import{sleepAbortable as G}from"../../util/sleepAbortable.js";const m="EcsDeploymentTail",Y="AWS::ECS::Service",j="AWS::CloudFormation::Stack",W=new Set(["CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS"]),H=15e3,V=3e4,X=["CloudFormation entered UPDATE_ROLLBACK_FAILED \u2014 the stack is wedged and will refuse further updates until the rollback completes.","To unstick it:","  1. Find the resource(s) that failed to roll back: aws cloudformation describe-stack-events --stack-name <stack> (look for UPDATE_ROLLBACK_FAILED resource events and their status reasons).","  2. Fix the underlying cause if possible (an ECS service that cannot stabilise usually means the previous image cannot boot \u2014 check stopped-task reasons above).","  3. Resume the rollback: aws cloudformation continue-update-rollback --stack-name <stack> [--resources-to-skip <logical-ids>].","  4. Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-update-rollback-failed"].join(`
+`);function oe(o){const{ecsService:i,callbacks:s,abortSignal:a}=o,S=o.pollIntervalMs??H,u=new Map,E=new AbortController,b=a!==void 0?AbortSignal.any([a,E.signal]):E.signal;let C=!1,N=!1;const D=c(e=>{s.onECSProgress?.(p(e))},"emitProgress"),$=c((e,t)=>t.createdAt!==void 0&&t.createdAt.getTime()>=e.updateStartedAt.getTime()-V,"isFreshDeployment"),O=c(async e=>{const t=await i.describeServices(e.clusterName,[e.serviceArn],b);if(!t.success){f.debug(m,"DescribeServices poll failed (transient, observing)",{serviceArn:e.serviceArn,error:p(t.error.message)});return}const r=t.data[0];if(r===void 0)return;const n=r.deployments?.find(l=>l.status==="PRIMARY");if(n?.id!==void 0&&(e.targetDeploymentId===void 0?$(e,n)&&(e.targetDeploymentId=n.id,e.targetTaskDefinitionArn=n.taskDefinition):n.id!==e.targetDeploymentId&&n.id!==e.replacedByDeploymentId&&(e.replacedByDeploymentId=n.id,D(`${e.serviceName}: ECS replaced the in-flight deployment \u2014 now rolling out ${_(n.taskDefinition)}`)),(n.id===e.targetDeploymentId||n.id===e.replacedByDeploymentId)&&n.rolloutState!==void 0)){const v=`${n.id}:${n.rolloutState}`;if(v!==e.lastNarratedRollout){e.lastNarratedRollout=v;const h=n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""?` (${n.rolloutStateReason})`:"";D(`${e.serviceName}: rollout ${n.rolloutState}${h} \u2014 running ${n.runningCount??0}/${n.desiredCount??0}`),s.onECSUpdate?.(n.rolloutState,e.serviceName)}n.id===e.targetDeploymentId&&(e.lastRolloutState=n.rolloutState,n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""&&(e.lastRolloutReason=n.rolloutStateReason))}if(e.targetDeploymentId===void 0)return;const T=await i.listStoppedTasks(e.clusterName,e.targetDeploymentId,b);if(!T.success){f.debug(m,"ListTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:p(T.error.message)});return}const d=T.data.filter(l=>!e.stoppedTaskArns.has(l));if(d.length===0&&e.pendingForensicArns.size===0)return;for(const l of d)e.stoppedTaskArns.add(l);const k=e.pendingForensicArns.size>0,R=[...e.pendingForensicArns,...d];let g=!1;const y=await i.describeTasks(e.clusterName,R,b);if(y.success)g=k,e.pendingForensicArns.clear(),y.data.length>0&&(e.latestForensic=y.data[y.data.length-1]);else{for(const l of R)e.pendingForensicArns.add(l);f.debug(m,"DescribeTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:p(y.error.message)})}if(d.length===0&&!g)return;const A=e.latestForensic!==void 0?` \u2014 latest: ${F(e.latestForensic)}`:"";D(`${e.serviceName}: ${e.stoppedTaskArns.size} task(s) from the new revision stopped since the update began${A}`)},"pollOnce"),P=c(async e=>{for(;!C&&!w(b);){try{await O(e)}catch(t){f.debug(m,"Tail poll threw (transient, observing)",{serviceArn:e.serviceArn,error:p(I(t))})}await G(S,b)}},"runTailLoop"),L=c((e,t)=>{const r=q(e);if(r===void 0){f.debug(m,"Cannot derive cluster from legacy-format service ARN; skipping tail",{serviceArn:e});return}const n={serviceArn:e,clusterName:r.clusterName,serviceName:r.serviceName,startedAtMs:Date.now(),updateStartedAt:t,stoppedTaskArns:new Set,pendingForensicArns:new Set,loop:Promise.resolve()};n.loop=P(n),u.set(e,n),f.debug(m,"ECS deployment tail started",{serviceArn:e,clusterName:r.clusterName})},"startTail");return{observeResourceEvent(e){if(!C){if(e.resourceType===Y&&W.has(e.status)&&e.physicalId!==void 0&&e.physicalId!==""&&!u.has(e.physicalId)){L(e.physicalId,e.timestamp);return}e.resourceType===j&&e.status==="UPDATE_ROLLBACK_FAILED"&&!N&&(N=!0,s.onOutput?.(`${X}
+`))}},async finalise(e){if(C)return;C=!0,E.abort();const t=e?.deploySucceeded===!0;await Promise.all([...u.values()].map(async r=>{await r.loop.catch(n=>{f.debug(m,"Tail loop rejected during finalise",{serviceArn:r.serviceArn,error:p(I(n))})}),await M(r,t).catch(n=>{f.debug(m,"Tail completion emission failed",{serviceArn:r.serviceArn,error:p(I(n))})})}))}};async function M(e,t){if(e.targetDeploymentId===void 0){f.debug(m,"No fresh deployment was ever adopted; skipping ECS completion event",{serviceArn:e.serviceArn});return}let r,n,T,d=e.lastRolloutState,k=e.lastRolloutReason;if(!w(a)){const l=await i.describeServices(e.clusterName,[e.serviceArn],a);if(l.success&&l.data[0]!==void 0){const v=l.data[0];r=v.taskDefinition,n=v.runningCount,T=v.desiredCount;const h=v.deployments?.find(x=>x.status==="PRIMARY");h?.id!==void 0&&(h.id===e.targetDeploymentId?h.rolloutState!==void 0&&(d=h.rolloutState,k=h.rolloutStateReason??k):e.replacedByDeploymentId===void 0&&(e.replacedByDeploymentId=h.id))}else l.success||f.debug(m,"Final DescribeServices snapshot failed",{serviceArn:e.serviceArn,error:p(l.error.message)})}const R=e.replacedByDeploymentId!==void 0;let g;R?g=!1:d==="COMPLETED"?g=!0:d==="FAILED"?g=!1:g=t,r!==void 0&&e.targetTaskDefinitionArn!==void 0&&r!==e.targetTaskDefinitionArn&&D(`${e.serviceName}: service settled on ${_(r)}, not the deployment's target ${_(e.targetTaskDefinitionArn)} \u2014 ECS rolled the service back`);const A=[];g||(k!==void 0?A.push(k):R||A.push(`rollout state ${d??"unknown"} when monitoring ended`),R&&A.push("ECS replaced the in-flight deployment before it completed"),e.stoppedTaskArns.size>0&&A.push(`${e.stoppedTaskArns.size} distinct task(s) from the new revision stopped`),e.latestForensic!==void 0&&A.push(`latest: ${F(e.latestForensic)}`)),s.onECSComplete?.({serviceName:e.serviceName,serviceArn:e.serviceArn,success:g,taskDefinitionArn:r??e.targetTaskDefinitionArn??"unknown",durationMs:Date.now()-e.startedAtMs,...A.length>0&&{reason:p(A.join("; "))},...n!==void 0&&{finalRunningCount:n},...T!==void 0&&{finalDesiredCount:T},...d!==void 0&&{rolloutState:d},...R&&{replaced:!0},...e.stoppedTaskArns.size>0&&{stoppedTaskCount:e.stoppedTaskArns.size},...e.latestForensic?.stopCode!==void 0&&{stopCode:e.latestForensic.stopCode},...e.latestForensic?.stoppedReason!==void 0&&{stoppedReason:p(e.latestForensic.stoppedReason)}})}}c(oe,"createEcsDeploymentTail");function q(o){const i=":service/",s=o.indexOf(i);if(s===-1)return;const S=o.slice(s+i.length).split("/");if(S.length<2)return;const u=S[0],E=S[1];if(!(u===void 0||u===""||E===void 0||E===""))return{clusterName:u,serviceName:E}}c(q,"parseServiceArn");function _(o){if(o===void 0)return"unknown revision";const i=o.split("/"),s=i[i.length-1];return s!==void 0&&s!==""?s:o}c(_,"shortTaskDefinition");function F(o){const i=o.containers.filter(a=>a.exitCode!==void 0).map(a=>{const S=`${a.name??"container"} exit ${a.exitCode}`,u=a.name===U&&a.exitCode!==void 0?z(a.exitCode):void 0;return u===void 0?S:`${S} \u2014 ${K[u]}`}).join(", "),s=o.stoppedReason??o.stopCode??"no stopped reason recorded";return i!==""?`${s} (${i})`:s}c(F,"formatForensic");export{H as ECS_TAIL_POLL_INTERVAL_MS,X as UPDATE_ROLLBACK_FAILED_RUNBOOK,oe as createEcsDeploymentTail};

package/dist/src/orchestration/application/schemaGateImage.js

@@ -1 +1 @@
-var L=Object.defineProperty;var d=(e,t)=>L(e,"name",{value:t,configurable:!0});import{createHash as N}from"node:crypto";import{ECRClient as O,BatchCheckLayerAvailabilityCommand as G,CompleteLayerUploadCommand as D,CreateRepositoryCommand as H,DescribeImagesCommand as j,InitiateLayerUploadCommand as U,PutImageCommand as F,UploadLayerPartCommand as Y}from"@aws-sdk/client-ecr";import{success as S,failure as E}from"@fjall/generator";import{getErrorMessage as w,maskSensitiveOutput as p}from"@fjall/util";import{logger as _}from"@fjall/util/logger";import{parseSchemaGateImageTagsFromManifest as z}from"@fjall/util/manifest";import{SCHEMA_GATE_ECR_REPO_NAME as m,SCHEMA_GATE_PUBLIC_IMAGE_REPO as h}from"@fjall/util/migration";import{composeSdkAbortSignal as l,extractErrorName as $,isAborted as b}from"../../aws/organisations/types.js";const R="SchemaGateImage",k=h.indexOf("/"),g=h.slice(0,k),T=h.slice(k+1),s='The deploy was refused before any stack changed. Fix the cause and re-run, or set schemaGate: { image: "<uri>" } to bring your own gate image, or schemaGate: { materialise: false } to disable the gate container.',J=["application/vnd.oci.image.index.v1+json","application/vnd.oci.image.manifest.v1+json","application/vnd.docker.distribution.manifest.list.v2+json","application/vnd.docker.distribution.manifest.v2+json"].join(", "),V=new Set(["application/vnd.oci.image.index.v1+json","application/vnd.docker.distribution.manifest.list.v2+json"]),W=10*1024*1024,P=12e4;class r extends Error{static{d(this,"SchemaGateImageError")}}function y(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}d(y,"isRecord");async function le(e){const t=z(e.cdkOutPath);if(t.outcome==="manifest-unreadable")return E(new r(`Cannot determine the assembly's schema-gate image tags: ${p(t.reason)}. Re-run the build to regenerate the assembly, or remove the corrupt cdk.out and redeploy.`));const o=t.tags;if(o.length===0)return S(void 0);const a=e.awsProvider.getClient(O),n=e.fetchFn??fetch;try{for(const i of o){if(b(e.abortSignal))throw new r(`Aborted before ensuring schema-gate image '${m}:${i}'`);if(await X(a,i,e.abortSignal)){_.debug(R,"Schema-gate image already present",{tag:i});continue}e.onLog?.(`Schema-gate image ${m}:${i} is not in this account's ECR \u2014 mirroring it from ${h} (one-off per engine version)`,"info"),await Z(a,e.abortSignal),await q(a,n,i,e.abortSignal),e.onLog?.(`Mirrored schema-gate image ${m}:${i}`,"info")}return S(void 0)}catch(i){return i instanceof r?E(i):E(new Error(`Could not ensure the schema-gate image in this account's ECR: ${p(w(i))}. ${s}`))}}d(le,"ensureSchemaGateImage");async function X(e,t,o){try{return await e.send(new j({repositoryName:m,imageIds:[{imageTag:t}]}),{abortSignal:l(o)}),!0}catch(a){const n=$(a);if(n==="ImageNotFoundException"||n==="RepositoryNotFoundException")return!1;throw new r(`Could not check for schema-gate image '${m}:${t}': ${p(w(a))}. ${s}`)}}d(X,"isTagPresent");async function Z(e,t){try{await e.send(new H({repositoryName:m,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"IMMUTABLE"}),{abortSignal:l(t)}),_.debug(R,"Created schema-gate repository",{repositoryName:m})}catch(o){if($(o)!=="RepositoryAlreadyExistsException")throw new r(`Could not create schema-gate repository '${m}': ${p(w(o))}. ${s}`)}}d(Z,"ensureGateRepository");async function q(e,t,o,a){const n=await K(t,a),i=await v(t,n,o,a);if(V.has(i.mediaType))for(const c of ee(i.parsed,o)){if(b(a))throw new r(`Aborted while mirroring schema-gate image '${m}:${o}'`);const f=await v(t,n,c,a);await x(e,t,n,f.parsed,o,a),await M(e,f.raw,f.mediaType,{imageDigest:c},a)}else await x(e,t,n,i.parsed,o,a);await M(e,i.raw,i.mediaType,{imageTag:o},a)}d(q,"mirrorTag");async function K(e,t){const o=`https://${g}/token/?service=${g}&scope=repository:${T}:pull`,a=await e(o,{signal:l(t)});if(!a.ok)throw new r(`Could not obtain an anonymous pull token from ${g}: HTTP ${a.status}. ${s}`);const n=await a.json();if(!y(n)||typeof n.token!="string"||n.token==="")throw new r(`The ${g} token endpoint returned no usable token. ${s}`);return n.token}d(K,"fetchPublicPullToken");async function v(e,t,o,a){const n=await e(`https://${g}/v2/${T}/manifests/${o}`,{headers:{Authorization:`Bearer ${t}`,Accept:J},signal:l(a)});if(!n.ok)throw new r(`Could not fetch manifest '${o}' from ${h}: HTTP ${n.status}. ${s}`);const i=await n.text();o.startsWith("sha256:")&&B(Buffer.from(i),o,`manifest ${o}`);let c;try{c=JSON.parse(i)}catch{throw new r(`Manifest '${o}' from ${h} is not valid JSON. ${s}`)}if(!y(c))throw new r(`Manifest '${o}' from ${h} has an unexpected shape. ${s}`);const f=n.headers.get("content-type"),A=f!==null&&f!==""?f:typeof c.mediaType=="string"?c.mediaType:"";return{raw:i,mediaType:A,parsed:c}}d(v,"fetchPublicManifest");const Q=/^sha256:[0-9a-f]{64}$/;function C(e,t){if(!Q.test(e))throw new r(`A descriptor for '${h}:${t}' carries a malformed digest. ${s}`);return e}d(C,"assertDigestShape");function ee(e,t){if(!Array.isArray(e.manifests))throw new r(`The index manifest for '${h}:${t}' carries no child manifests. ${s}`);const o=[];for(const a of e.manifests){if(!y(a)||typeof a.digest!="string")throw new r(`The index manifest for '${h}:${t}' has a malformed child descriptor. ${s}`);o.push(C(a.digest,t))}return o}d(ee,"collectIndexChildDigests");function te(e,t){const o=[],a=e.config;if(!y(a)||typeof a.digest!="string")throw new r(`An image manifest for '${h}:${t}' has no config digest. ${s}`);if(o.push(C(a.digest,t)),!Array.isArray(e.layers))throw new r(`An image manifest for '${h}:${t}' has no layer list. ${s}`);for(const n of e.layers){if(!y(n)||typeof n.digest!="string")throw new r(`An image manifest for '${h}:${t}' has a malformed layer descriptor. ${s}`);o.push(C(n.digest,t))}return o}d(te,"collectBlobDigests");async function x(e,t,o,a,n,i){const c=te(a,n),f=await e.send(new G({repositoryName:m,layerDigests:c}),{abortSignal:l(i)}),A=new Set((f.layers??[]).filter(u=>u.layerAvailability==="AVAILABLE").map(u=>u.layerDigest));for(const u of c){if(b(i))throw new r(`Aborted while mirroring schema-gate image '${m}:${n}'`);if(A.has(u))continue;const I=await oe(t,o,u,i);B(I,u,`blob ${u}`),await ae(e,u,I,i)}}d(x,"mirrorImageBlobs");async function oe(e,t,o,a){const n=await e(`https://${g}/v2/${T}/blobs/${o}`,{headers:{Authorization:`Bearer ${t}`},signal:l(a,P)});if(!n.ok)throw new r(`Could not download blob ${o} from ${h}: HTTP ${n.status}. ${s}`);return new Uint8Array(await n.arrayBuffer())}d(oe,"fetchPublicBlob");function B(e,t,o){const a=`sha256:${N("sha256").update(e).digest("hex")}`;if(a!==t)throw new r(`Integrity check failed for ${o} from ${h}: downloaded content hashes to ${a}. Refusing to push it. ${s}`)}d(B,"assertDigestMatches");async function ae(e,t,o,a){const i=(await e.send(new U({repositoryName:m}),{abortSignal:l(a)})).uploadId;if(i===void 0)throw new r(`ECR returned no upload id for blob ${t}. ${s}`);let c=0;for(;c<o.length;){if(b(a))throw new r(`Aborted while uploading blob ${t} to '${m}'`);const f=Math.min(c+W,o.length);await e.send(new Y({repositoryName:m,uploadId:i,partFirstByte:c,partLastByte:f-1,layerPartBlob:o.subarray(c,f)}),{abortSignal:l(a,P)}),c=f}try{await e.send(new D({repositoryName:m,uploadId:i,layerDigests:[t]}),{abortSignal:l(a)})}catch(f){if($(f)!=="LayerAlreadyExistsException")throw new r(`Could not complete the upload of blob ${t}: ${p(w(f))}. ${s}`)}}d(ae,"uploadBlob");async function M(e,t,o,a,n){try{await e.send(new F({repositoryName:m,imageManifest:t,...o!==""?{imageManifestMediaType:o}:{},...a}),{abortSignal:l(n)})}catch(i){if($(i)!=="ImageAlreadyExistsException")throw new r(`Could not push a schema-gate manifest to '${m}': ${p(w(i))}. ${s}`)}}d(M,"putImage");export{le as ensureSchemaGateImage};
+var L=Object.defineProperty;var d=(e,t)=>L(e,"name",{value:t,configurable:!0});import{createHash as N}from"node:crypto";import{ECRClient as O,BatchCheckLayerAvailabilityCommand as G,CompleteLayerUploadCommand as D,CreateRepositoryCommand as H,DescribeImagesCommand as j,InitiateLayerUploadCommand as U,PutImageCommand as F,UploadLayerPartCommand as Y}from"@aws-sdk/client-ecr";import{success as S,failure as E}from"@fjall/generator";import{getErrorMessage as w,maskSensitiveOutput as p}from"@fjall/util";import{ecrCreateRepositoryTags as z}from"@fjall/util/aws";import{logger as R}from"@fjall/util/logger";import{parseSchemaGateImageTagsFromManifest as J}from"@fjall/util/manifest";import{SCHEMA_GATE_ECR_REPO_NAME as c,SCHEMA_GATE_PUBLIC_IMAGE_REPO as h}from"@fjall/util/migration";import{composeSdkAbortSignal as l,extractErrorName as $,isAborted as b}from"../../aws/organisations/types.js";const _="SchemaGateImage",k=h.indexOf("/"),g=h.slice(0,k),T=h.slice(k+1),s='The deploy was refused before any stack changed. Fix the cause and re-run, or set schemaGate: { image: "<uri>" } to bring your own gate image, or schemaGate: { materialise: false } to disable the gate container.',V=["application/vnd.oci.image.index.v1+json","application/vnd.oci.image.manifest.v1+json","application/vnd.docker.distribution.manifest.list.v2+json","application/vnd.docker.distribution.manifest.v2+json"].join(", "),W=new Set(["application/vnd.oci.image.index.v1+json","application/vnd.docker.distribution.manifest.list.v2+json"]),X=10*1024*1024,P=12e4;class r extends Error{static{d(this,"SchemaGateImageError")}}function y(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}d(y,"isRecord");async function pe(e){const t=J(e.cdkOutPath);if(t.outcome==="manifest-unreadable")return E(new r(`Cannot determine the assembly's schema-gate image tags: ${p(t.reason)}. Re-run the build to regenerate the assembly, or remove the corrupt cdk.out and redeploy.`));const o=t.tags;if(o.length===0)return S(void 0);const a=e.awsProvider.getClient(O),n=e.fetchFn??fetch;try{for(const i of o){if(b(e.abortSignal))throw new r(`Aborted before ensuring schema-gate image '${c}:${i}'`);if(await Z(a,i,e.abortSignal)){R.debug(_,"Schema-gate image already present",{tag:i});continue}e.onLog?.(`Schema-gate image ${c}:${i} is not in this account's ECR \u2014 mirroring it from ${h} (one-off per engine version)`,"info"),await q(a,e.abortSignal),await K(a,n,i,e.abortSignal),e.onLog?.(`Mirrored schema-gate image ${c}:${i}`,"info")}return S(void 0)}catch(i){return i instanceof r?E(i):E(new Error(`Could not ensure the schema-gate image in this account's ECR: ${p(w(i))}. ${s}`))}}d(pe,"ensureSchemaGateImage");async function Z(e,t,o){try{return await e.send(new j({repositoryName:c,imageIds:[{imageTag:t}]}),{abortSignal:l(o)}),!0}catch(a){const n=$(a);if(n==="ImageNotFoundException"||n==="RepositoryNotFoundException")return!1;throw new r(`Could not check for schema-gate image '${c}:${t}': ${p(w(a))}. ${s}`)}}d(Z,"isTagPresent");async function q(e,t){try{await e.send(new H({repositoryName:c,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"IMMUTABLE",tags:z(c)}),{abortSignal:l(t)}),R.debug(_,"Created schema-gate repository",{repositoryName:c})}catch(o){if($(o)!=="RepositoryAlreadyExistsException")throw new r(`Could not create schema-gate repository '${c}': ${p(w(o))}. ${s}`)}}d(q,"ensureGateRepository");async function K(e,t,o,a){const n=await Q(t,a),i=await v(t,n,o,a);if(W.has(i.mediaType))for(const m of te(i.parsed,o)){if(b(a))throw new r(`Aborted while mirroring schema-gate image '${c}:${o}'`);const f=await v(t,n,m,a);await x(e,t,n,f.parsed,o,a),await M(e,f.raw,f.mediaType,{imageDigest:m},a)}else await x(e,t,n,i.parsed,o,a);await M(e,i.raw,i.mediaType,{imageTag:o},a)}d(K,"mirrorTag");async function Q(e,t){const o=`https://${g}/token/?service=${g}&scope=repository:${T}:pull`,a=await e(o,{signal:l(t)});if(!a.ok)throw new r(`Could not obtain an anonymous pull token from ${g}: HTTP ${a.status}. ${s}`);const n=await a.json();if(!y(n)||typeof n.token!="string"||n.token==="")throw new r(`The ${g} token endpoint returned no usable token. ${s}`);return n.token}d(Q,"fetchPublicPullToken");async function v(e,t,o,a){const n=await e(`https://${g}/v2/${T}/manifests/${o}`,{headers:{Authorization:`Bearer ${t}`,Accept:V},signal:l(a)});if(!n.ok)throw new r(`Could not fetch manifest '${o}' from ${h}: HTTP ${n.status}. ${s}`);const i=await n.text();o.startsWith("sha256:")&&B(Buffer.from(i),o,`manifest ${o}`);let m;try{m=JSON.parse(i)}catch{throw new r(`Manifest '${o}' from ${h} is not valid JSON. ${s}`)}if(!y(m))throw new r(`Manifest '${o}' from ${h} has an unexpected shape. ${s}`);const f=n.headers.get("content-type"),A=f!==null&&f!==""?f:typeof m.mediaType=="string"?m.mediaType:"";return{raw:i,mediaType:A,parsed:m}}d(v,"fetchPublicManifest");const ee=/^sha256:[0-9a-f]{64}$/;function C(e,t){if(!ee.test(e))throw new r(`A descriptor for '${h}:${t}' carries a malformed digest. ${s}`);return e}d(C,"assertDigestShape");function te(e,t){if(!Array.isArray(e.manifests))throw new r(`The index manifest for '${h}:${t}' carries no child manifests. ${s}`);const o=[];for(const a of e.manifests){if(!y(a)||typeof a.digest!="string")throw new r(`The index manifest for '${h}:${t}' has a malformed child descriptor. ${s}`);o.push(C(a.digest,t))}return o}d(te,"collectIndexChildDigests");function oe(e,t){const o=[],a=e.config;if(!y(a)||typeof a.digest!="string")throw new r(`An image manifest for '${h}:${t}' has no config digest. ${s}`);if(o.push(C(a.digest,t)),!Array.isArray(e.layers))throw new r(`An image manifest for '${h}:${t}' has no layer list. ${s}`);for(const n of e.layers){if(!y(n)||typeof n.digest!="string")throw new r(`An image manifest for '${h}:${t}' has a malformed layer descriptor. ${s}`);o.push(C(n.digest,t))}return o}d(oe,"collectBlobDigests");async function x(e,t,o,a,n,i){const m=oe(a,n),f=await e.send(new G({repositoryName:c,layerDigests:m}),{abortSignal:l(i)}),A=new Set((f.layers??[]).filter(u=>u.layerAvailability==="AVAILABLE").map(u=>u.layerDigest));for(const u of m){if(b(i))throw new r(`Aborted while mirroring schema-gate image '${c}:${n}'`);if(A.has(u))continue;const I=await ae(t,o,u,i);B(I,u,`blob ${u}`),await ne(e,u,I,i)}}d(x,"mirrorImageBlobs");async function ae(e,t,o,a){const n=await e(`https://${g}/v2/${T}/blobs/${o}`,{headers:{Authorization:`Bearer ${t}`},signal:l(a,P)});if(!n.ok)throw new r(`Could not download blob ${o} from ${h}: HTTP ${n.status}. ${s}`);return new Uint8Array(await n.arrayBuffer())}d(ae,"fetchPublicBlob");function B(e,t,o){const a=`sha256:${N("sha256").update(e).digest("hex")}`;if(a!==t)throw new r(`Integrity check failed for ${o} from ${h}: downloaded content hashes to ${a}. Refusing to push it. ${s}`)}d(B,"assertDigestMatches");async function ne(e,t,o,a){const i=(await e.send(new U({repositoryName:c}),{abortSignal:l(a)})).uploadId;if(i===void 0)throw new r(`ECR returned no upload id for blob ${t}. ${s}`);let m=0;for(;m<o.length;){if(b(a))throw new r(`Aborted while uploading blob ${t} to '${c}'`);const f=Math.min(m+X,o.length);await e.send(new Y({repositoryName:c,uploadId:i,partFirstByte:m,partLastByte:f-1,layerPartBlob:o.subarray(m,f)}),{abortSignal:l(a,P)}),m=f}try{await e.send(new D({repositoryName:c,uploadId:i,layerDigests:[t]}),{abortSignal:l(a)})}catch(f){if($(f)!=="LayerAlreadyExistsException")throw new r(`Could not complete the upload of blob ${t}: ${p(w(f))}. ${s}`)}}d(ne,"uploadBlob");async function M(e,t,o,a,n){try{await e.send(new F({repositoryName:c,imageManifest:t,...o!==""?{imageManifestMediaType:o}:{},...a}),{abortSignal:l(n)})}catch(i){if($(i)!=="ImageAlreadyExistsException")throw new r(`Could not push a schema-gate manifest to '${c}': ${p(w(i))}. ${s}`)}}d(M,"putImage");export{pe as ensureSchemaGateImage};

package/dist/src/util/sleepAbortable.d.ts

@@ -1,8 +1 @@
-/**
- * Promise-based sleep that short-circuits when the supplied abort signal
- * fires. Long-running poll loops MUST use this for inter-poll delays so a
- * shutdown signal (e.g. SIGTERM in the webapp deployment worker) does not
- * stall for the full sleep duration. Resolves (never rejects) on abort;
- * callers check `signal.aborted` after waking.
- */
-export declare function sleepAbortable(ms: number, signal?: AbortSignal): Promise<void>;
+export { sleepAbortable } from "@fjall/util/migration";

package/dist/src/util/sleepAbortable.js

@@ -1 +1 @@
-var u=Object.defineProperty;var r=(t,e)=>u(t,"name",{value:e,configurable:!0});function m(t,e){return e?.aborted===!0?Promise.resolve():new Promise(o=>{const i=setTimeout(()=>{e?.removeEventListener("abort",n),o()},t),n=r(()=>{clearTimeout(i),o()},"onAbort");e?.addEventListener("abort",n,{once:!0})})}r(m,"sleepAbortable");export{m as sleepAbortable};
+import{sleepAbortable as r}from"@fjall/util/migration";export{r as sleepAbortable};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "20.0.0",
+  "version": "21.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -96,15 +96,15 @@
     "@aws-sdk/client-ssm": "^3.1098.0",
     "@aws-sdk/client-sso-admin": "^3.1098.0",
     "@aws-sdk/client-sts": "^3.1098.0",
-    "@fjall/generator": "^20.0.0",
-    "@fjall/util": "^20.0.0",
+    "@fjall/generator": "^21.0.0",
+    "@fjall/util": "^21.0.0",
     "@smithy/node-http-handler": "^4.9.13",
     "aws-cdk": "^2.1134.0",
     "tsx": "^4.23.1",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@fjall/components-infrastructure": ">=20.0.0 <21.0.0"
+    "@fjall/components-infrastructure": ">=21.0.0 <22.0.0"
   },
   "peerDependenciesMeta": {
     "@fjall/components-infrastructure": {