@fjall/deploy-core 6.0.0 → 7.0.1

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "2cf128888c858b511e2ed41ae6b0c13fc967e030414735b55d3059e8718ccd0f",
+  "hash": "3ed6b740d75832c192b54c10150afb348a91118a0788afb5db2ff383ee1958d2",
   "files": {
     "src/__test-utils__/awsMockHelpers.ts": "fea371c1b1869678",
     "src/__test-utils__/index.ts": "e03cf35821157dc4",
@@ -52,9 +52,9 @@
     "src/aws/utils/regions.ts": "3a5191f4d2242a60",
     "src/aws/utils/stackStatus.ts": "55fb23ba5514bc13",
     "src/events/index.ts": "e55c022f0d9013e6",
-    "src/index.ts": "6d1a403019e14e4f",
+    "src/index.ts": "246666b0fa119a1c",
     "src/orchestration/activeDeploymentGuard.ts": "e8dde742c00ea728",
-    "src/orchestration/application/applicationDeploy.ts": "6a3520b825a24d86",
+    "src/orchestration/application/applicationDeploy.ts": "2da75f7e60474a5a",
     "src/orchestration/application/applicationDeployHelpers.ts": "a8023472f95d3f05",
     "src/orchestration/application/applicationDestroy.ts": "1044d686e026b509",
     "src/orchestration/application/approvalGate.ts": "e4dee819c94fd15c",
@@ -68,11 +68,11 @@
     "src/orchestration/application/databaseEndpointReconcile.ts": "27b14ee41524c632",
     "src/orchestration/application/deploySessionPolicy.ts": "3fdd0e349d2144e6",
     "src/orchestration/application/destroyPreFlight.ts": "cc4978dec60b033e",
-    "src/orchestration/application/destructionGate.ts": "ef8f385b012e93ac",
-    "src/orchestration/application/detectionPipeline.ts": "8f8303454c1eaeea",
+    "src/orchestration/application/destructionGate.ts": "3b64832555e15887",
+    "src/orchestration/application/detectionPipeline.ts": "580a62c8093f96ce",
     "src/orchestration/application/dockerBuildHelper.ts": "e7a7259e987d93be",
     "src/orchestration/application/ecrCacheRepository.ts": "d7a5602ccabde493",
-    "src/orchestration/application/engineCompat.ts": "58115fa12af3313a",
+    "src/orchestration/application/engineCompat.ts": "d3e1cbf906bc785d",
     "src/orchestration/application/lambdaCodeOnlyRollout.ts": "fc347b90ff55c1fd",
     "src/orchestration/application/leaseGate.ts": "26be2e119b32bef4",
     "src/orchestration/application/openNextBuild.ts": "d464cdf10dc8ab73",
@@ -81,13 +81,14 @@
     "src/orchestration/application/plan/buildDeployPlan.ts": "4cb0b57b60712404",
     "src/orchestration/application/plan/changeSetEscalation.ts": "d9ad7a5a65283dc4",
     "src/orchestration/application/plan/classify.ts": "6b310180e0479357",
-    "src/orchestration/application/plan/computeDeployPlan.ts": "9f8b57db33f537ee",
+    "src/orchestration/application/plan/computeDeployPlan.ts": "62d47d2d620895b6",
     "src/orchestration/application/plan/index.ts": "a2292dca615dd021",
-    "src/orchestration/application/plan/loadDeployPlan.ts": "a915eb778d1d33cc",
+    "src/orchestration/application/plan/loadDeployPlan.ts": "f0d4414fd34f68c3",
     "src/orchestration/application/plan/pinnedNames.ts": "d6a90c96c88f13e0",
     "src/orchestration/application/plan/registryOverlay.ts": "920be845c7f4aea2",
-    "src/orchestration/application/plan/renderDeployPlan.ts": "f793593d3b686f94",
-    "src/orchestration/application/plan/types.ts": "32b2d437767af792",
+    "src/orchestration/application/plan/renameDetection.ts": "a4a96ad3c175dd5a",
+    "src/orchestration/application/plan/renderDeployPlan.ts": "13a01fc9b11e1cf7",
+    "src/orchestration/application/plan/types.ts": "45c3bf684cd90f9f",
     "src/orchestration/application/serviceImageTagsRollback.ts": "55e23a493545511c",
     "src/orchestration/application/taskDefinitionRoll.ts": "d9378c509c7ec287",
     "src/orchestration/application/welcomeImageHelper.ts": "1721ea7edc37a96e",
@@ -97,7 +98,7 @@
     "src/orchestration/builders/index.ts": "3b0b2492294c62db",
     "src/orchestration/builders/openNextBuilder.ts": "7416a37e19380660",
     "src/orchestration/builders/staticSiteBuilder.ts": "a0403be58052310f",
-    "src/orchestration/contextHelpers.ts": "6170617e819d96bc",
+    "src/orchestration/contextHelpers.ts": "b38af2503a974f16",
     "src/orchestration/deploy.ts": "4f86b86e797bc04f",
     "src/orchestration/destroy.ts": "b6da154984e63a8d",
     "src/orchestration/dockerBuildParamsKeys.ts": "ac3d6ecd24d68792",
@@ -119,7 +120,7 @@
     "src/orchestration/drift/preFlightGate.ts": "8067a3f474fba0b5",
     "src/orchestration/drift/route53Names.ts": "1ac53cc30ac3260e",
     "src/orchestration/drift/route53RecordPreflight.ts": "f4db16a6c0e69ac9",
-    "src/orchestration/index.ts": "e60beac22e4bde47",
+    "src/orchestration/index.ts": "e97a95546428a69a",
     "src/orchestration/manifestSecretParser.ts": "c5576bd88a3652f8",
     "src/orchestration/organisation/accountsConfig.ts": "a55a3306564e7b2f",
     "src/orchestration/organisation/cascadeDestroyHelpers.ts": "ccebbcfac5d1c374",
@@ -140,6 +141,8 @@
     "src/orchestration/remediation/driftRepairGate.ts": "988e5ba315d8f94d",
     "src/orchestration/remediation/forensicsCapture.ts": "cc4e95ec15783f65",
     "src/orchestration/remediation/forgetResource.ts": "5509613276ed14d4",
+    "src/orchestration/remediation/migrateIdentity.ts": "a2ff062cf3f5c4ee",
+    "src/orchestration/remediation/pinIdentity.ts": "4f9f068fbf7832eb",
     "src/orchestration/remediation/pinRemediation.ts": "d297092ac397c587",
     "src/orchestration/remediation/postFailureRepairOffer.ts": "934b3fbd1c4d34d1",
     "src/orchestration/remediation/recreatePreFlight.ts": "654ef18cabe97777",
@@ -175,7 +178,7 @@
     "src/services/application/applicationStackHelpers.ts": "04e1758b97ffc5fc",
     "src/services/application/index.ts": "ee810be803dfda9c",
     "src/services/index.ts": "cc84cbd35873b20d",
-    "src/services/infrastructure/CdkArgumentBuilder.ts": "c4e27174b9499652",
+    "src/services/infrastructure/CdkArgumentBuilder.ts": "e1b866b72e619bf5",
     "src/services/infrastructure/CdkCommandRunner.ts": "e33d4e529298f518",
     "src/services/infrastructure/CdkErrorFormatter.ts": "e2e017136108a5d1",
     "src/services/infrastructure/CdkEventMonitoring.ts": "2b0ecd84f76c54c1",
@@ -183,9 +186,9 @@
     "src/services/infrastructure/CdkOutputParser.ts": "eed9f3475324118e",
     "src/services/infrastructure/CdkProcessManager.ts": "f68ae4e44adee2fa",
     "src/services/infrastructure/CdkService.ts": "1ec1718dfc3cb587",
-    "src/services/infrastructure/CdkServiceTypes.ts": "c025fcfe025e2052",
+    "src/services/infrastructure/CdkServiceTypes.ts": "6dc7429857b2efee",
     "src/services/infrastructure/CfnRegistryService.ts": "bd4f57d97982cdda",
-    "src/services/infrastructure/CloudFormationService.ts": "df409711c5962464",
+    "src/services/infrastructure/CloudFormationService.ts": "82ce03614feae2db",
     "src/services/infrastructure/EcrImageInspectorService.ts": "e784440b5680df74",
     "src/services/infrastructure/EcsService.ts": "caa79dd5fd7ada9b",
     "src/services/infrastructure/EcsServiceResolver.ts": "bad8ea4dc59c64a8",
@@ -193,7 +196,7 @@
     "src/services/infrastructure/LambdaService.ts": "5b21e34185e77a4c",
     "src/services/infrastructure/SsmParameterMetadataService.ts": "3ff0bb42219cec3d",
     "src/services/infrastructure/cancelInFlightStack.ts": "8388a16a23db725a",
-    "src/services/infrastructure/cdkServiceHelpers.ts": "b75bf0b0fd6e2e0b",
+    "src/services/infrastructure/cdkServiceHelpers.ts": "2db30686382e568a",
     "src/services/infrastructure/cfnRegistrySeed.ts": "b1232b66883d6f90",
     "src/services/infrastructure/changeSetProbe.ts": "5f3e100db396cf9b",
     "src/services/infrastructure/constructMapEnrichment.ts": "7400af9bcfaa0da3",
@@ -201,7 +204,7 @@
     "src/services/infrastructure/index.ts": "1241c6dc24d925fe",
     "src/services/infrastructure/infraTypecheckPreflight.ts": "09e423a8283e3b8b",
     "src/services/infrastructure/transientNetworkRecovery.ts": "44a9333ce963bf50",
-    "src/services/supporting/CdkContextBuilder.ts": "68a8589be91de20f",
+    "src/services/supporting/CdkContextBuilder.ts": "dee16f4302f7312a",
     "src/services/supporting/TemplateHashService.ts": "9fd5351f90b5cefb",
     "src/services/supporting/helpers.ts": "81c0ba7bfdd99366",
     "src/services/supporting/index.ts": "4bf4e746399d80e3",
@@ -225,12 +228,12 @@
     "src/types/deployEventParse.ts": "16bc2371fb747d96",
     "src/types/deployEventTypeGuards.ts": "731c4e5761b13fca",
     "src/types/deployment/DeploymentServiceTypes.ts": "ba257f2e37013afd",
-    "src/types/deployment/DeploymentTypes.ts": "dcc3d03c45843879",
+    "src/types/deployment/DeploymentTypes.ts": "60de9197195ba96e",
     "src/types/deployment/cloudformation.ts": "5a0c51e263827943",
     "src/types/deployment/index.ts": "4bdffd195379a05d",
     "src/types/deployment/parallel.ts": "c06e3ac55fb39eb7",
     "src/types/deploymentEventSchema.ts": "089ffbe9be47297d",
-    "src/types/destruction.ts": "ef2fa3588f01850b",
+    "src/types/destruction.ts": "0aed5544ebc9cdc0",
     "src/types/detection/detection.ts": "800d23c9450ce324",
     "src/types/detection/patternDetection.ts": "6cef991ea486cc94",
     "src/types/detection/patternTypes.ts": "5013f5c0ce1566ac",
@@ -240,10 +243,10 @@
     "src/types/errors/index.ts": "e3bf5e08988d1182",
     "src/types/events.ts": "be04dbe61551d76f",
     "src/types/frameworkBuilder.ts": "41198a0b446f60b6",
-    "src/types/index.ts": "b19b22f6504ccab5",
+    "src/types/index.ts": "eb45188ded4c08b4",
     "src/types/operations.ts": "57a6c9e22a3f37ca",
-    "src/types/params.ts": "c2fcd69d9e12c7d7",
-    "src/types/remediation.ts": "9cdf862934552c0d",
+    "src/types/params.ts": "629366fcf93582ea",
+    "src/types/remediation.ts": "0e1138f0c8fdc6bf",
     "src/types/stepDefinitions.ts": "a5e2aa03b15011b4",
     "src/types/validation.ts": "44aa473ec0e25dc4",
     "src/util/dockerfileDetection.ts": "c407ab8208fb65ec",
@@ -252,9 +255,9 @@
     "src/util/sleepAbortable.ts": "f9cac3bf8a79a476",
     "src/version.ts": "1811a4475823b27e",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "2940218a0dfc0822",
+    "package.json": "e44e24f88fe8f78c",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "c343f98333d746fc930824e633bc53a0e0463de041e688a32b0a51a710fdbb77",
-  "outputFileCount": 473
+  "outputHash": "d65f44a3d1c787fb4b04534f4fd227ff81049a51daa7a7fa18036b4bf1070f3e",
+  "outputFileCount": 479
 }

package/dist/.minified

@@ -1 +1 @@
-236 files minified at 2026-08-01T08:46:10.703Z
+239 files minified at 2026-08-03T05:01:32.712Z

package/dist/src/index.d.ts

@@ -16,7 +16,7 @@ export { DeploymentEventSchema, DEPLOYMENT_EVENT_TYPES, DEPLOYMENT_EVENT_RESOURC
 export type { DeploymentEvent, DeploymentEventType, DeploymentEventResourceCategory, DeploymentEventCascadePhase, DeploymentEventCascadeAccountStatus } from "./types/index.js";
 export { DeployEventSchema, StepProgressSchema, DeployResourceSchema, PlanChangeSchema, PlanPropertyChangeSchema, ChangeCountsSchema, DEPLOY_EVENT_CONTRACT, DEPLOY_EVENT_CONTRACT_MAJOR, DEPLOY_EVENT_CONTRACT_MINOR, SUPPORTED_CONTRACT_MARKERS, DEPLOY_EVENT_ID_MAX, DEPLOY_EVENT_NAME_MAX, DEPLOY_EVENT_MESSAGE_MAX, DEPLOY_EVENT_STATUS_REASON_MAX, DEPLOY_EVENT_ERROR_MESSAGE_MAX, DEPLOY_EVENT_TRAIL_DETAIL_MAX, DEPLOY_EVENT_OUTPUT_MAX, DEPLOY_EVENT_ARN_MAX, DEPLOY_EVENT_URL_MAX, STEP_COMPLETE_STATUSES, LOG_LEVELS, STACK_CLEANUP_PHASES, CASCADE_ACCOUNT_PHASES, DEPLOY_RESULTS, DETECTION_PHASES, PHASE_STATUSES, BUILDERS, CASCADE_OUTCOME_RESULTS, PLAN_ACTIONS, REPLACEMENT_MODES, APPROVAL_KINDS, APPROVAL_DECISIONS, ALL_PROGRESS_KINDS, createDeployEmitter, parseDeployEvent, parseDeployContractVersion } from "./types/index.js";
 export type { DeployEvent, ProgressKind, StepProgress, DeployResource, PlanChange, PlanPropertyChange, ChangeCounts, PlanAction, ReplacementMode, ApprovalKind, ApprovalDecision, DeployRunResult, DeployEmitter, CreateDeployEmitterOptions, ParsedDeployEvent, StackCleanupPhase, CascadeAccountPhase, LogLevel } from "./types/index.js";
-export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter, DeployCallbacks, StepCompleteStatus, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, StackTarget, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DatabaseEndpointRestartRequest, InfrastructureSource, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, StackLeaseVerdict, ApprovalGate, ApprovalGatePlanDetail, ApprovalRequest, GateResolution, RemediationVerb, DestructionFinding, DestructionTicketResource, DestructionTicket, DestructionConsent, ConsentVerdict, ConsentVerdictRow, DestructionConsentReport, DestructionConsentRequest, DestructionConsentResolution, DestructionConsentGate, DestructionOutcome, TicketVerdictSource, RemediationPhase, RemediationTarget, RemediationFlipProof, RemediationJournalRecord, OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession, Entitlements } from "./types/index.js";
+export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter, DeployCallbacks, StepCompleteStatus, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, StackTarget, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DatabaseEndpointRestartRequest, InfrastructureSource, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, StackLeaseVerdict, ApprovalGate, ApprovalGatePlanDetail, ApprovalRequest, GateResolution, RemediationVerb, DestructionFinding, DestructionTicketResource, DestructionTicket, DestructionConsent, ConsentVerdict, ConsentVerdictRow, DestructionConsentReport, DestructionConsentRequest, DestructionConsentResolution, DestructionConsentGate, DestructionOutcome, TicketVerdictSource, RemediationPhase, RemediationTarget, RemediationFlipProof, RemediationJournalRecord, RemediationJournalVerb, PinnedSlotRecord, OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession, Entitlements } from "./types/index.js";
 export type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } from "./aws/index.js";
 export { SimpleAwsProvider } from "./aws/index.js";
 export { checkTargetReadiness, describeTargetReadinessReason, buildTargetUnreadyAdvisory, buildTargetSetUnreadyAdvisory, probeAccountStackExists } from "./aws/index.js";
@@ -26,7 +26,7 @@ export type { RegionAvailability } from "./aws/index.js";
 export { ensureOrganisationExists, describeOrganisation, enablePolicyTypes, enableServiceAccess, SERVICE_PRINCIPALS, enableRamSharing, activateTrustedAccess, enableIpamDelegatedAdmin, updateBackupGlobalSettings, listAccounts, findAccount, createAccount, ensureOrganisationalUnitsExist, placeAccountsInOUs, buildAccountToOUMap, findDevelopmentOuId, activateCostAllocationTags, checkIdentityCentreStatus, snapshotIdentityCentre, composeSdkAbortSignal, extractErrorName, isAborted, DEFAULT_MAX_PAGES, IDENTITY_STORE_PAGE_SIZE, drainPages, isOULeaf, registerSecurityDelegates, SECURITY_SERVICE_PRINCIPALS, enableCentralisedRootAccess, ROOT_ACCESS_FEATURES, RootAccessEnablementError } from "./aws/index.js";
 export type { OrgDetails, OUMap, OUTree, AccountPlacementResult, AccountInfo, DrainPagesOptions, PagedResult, IdentityCentreStatus, IdentityCentreSnapshot, IdentityCentreSnapshotGroup, IdentityCentreSnapshotOptions, IdentityCentreSnapshotResult, IdentityCentreSnapshotUser, BackupGlobalSettings, CostAllocationTag, CreateAccountResult, RootAccessFeature, RootAccessEnablementSummary } from "./aws/index.js";
 export { STEP_IDS, STEP_NAMES, INFRASTRUCTURE_STEP_NAMES, INFRA_STEP_NAME } from "./types/index.js";
-export { RemediationVerbSchema, REMEDIATION_VERB_GLOSS, DestructionFindingSchema, DestructionTicketResourceSchema, DestructionTicketSchema, DestructionConsentSchema, DestructionOutcomeSchema, DESTRUCTION_FINDINGS, CONSENT_VERDICTS, TICKET_VERDICT_SOURCES, TicketVerdictSourceSchema } from "./types/index.js";
+export { RemediationVerbSchema, REMEDIATION_VERB_GLOSS, IDENTITY_PIN_SLOT_SWAP_GLOSS, DestructionFindingSchema, DestructionTicketResourceSchema, DestructionTicketSchema, DestructionConsentSchema, DestructionOutcomeSchema, DESTRUCTION_FINDINGS, CONSENT_VERDICTS, TICKET_VERDICT_SOURCES, TicketVerdictSourceSchema } from "./types/index.js";
 export { DRIFT_VERDICTS, DriftVerdictSchema, DriftSuspectSchema, DriftFindingSchema, DriftJournalRecordSchema, verbsForDriftVerdict } from "./types/index.js";
 export { REMEDIATION_PHASES, RemediationPhaseSchema, RemediationTargetSchema, RemediationFlipProofSchema, RemediationJournalRecordSchema, RemediationVerbWithSurgerySchema, remediationPhaseRank, remediationPlaceholderPhysicalId, isRemediationPlaceholderPhysicalId } from "./types/index.js";
 export type { RemediationVerbWithSurgery } from "./types/index.js";
@@ -53,6 +53,7 @@ export { fileExists } from "@fjall/util/fsHelpers";
 export { type Result, success, failure, isSuccess, isFailure } from "@fjall/generator";
 export { deploy } from "./orchestration/index.js";
 export { destroy } from "./orchestration/index.js";
+export { buildParamsContext } from "./orchestration/contextHelpers.js";
 export { restart, probeSecretsDrift, computeSecretsDrift, deriveStaleParameters, extractConsumedSsmParameters } from "./orchestration/index.js";
 export type { RestartParams, RestartResult, SecretsDriftProbeParams, ApplicationSecretsDrift, ServiceSecretsDrift, StaleParameter } from "./orchestration/index.js";
 export { partitionAccounts } from "./orchestration/index.js";
@@ -66,8 +67,8 @@ export { decideNextTransition, reconcileTrailMigration, decommissionMemberTrailS
 export type { MemberTrailFacts, TrailMigrationTransition, TrailMigrationOutcome, DecommissionClients, DecommissionInput, DecommissionOutcome } from "./orchestration/index.js";
 export { classifyDriftFailure, fetchLastOperationEvents, DriftProbe, clearDriftSuspects, defaultDriftJournalDir, readDriftSuspects, recordDriftSuspects, detectStackDrift, runDriftPreFlight, formatDriftPreFlightBlock, DRIFT_PREFLIGHT_TRIGGER_STATUSES, DRIFT_PREFLIGHT_BUDGET_MS, runRoute53RecordPreflight } from "./orchestration/index.js";
 export type { DriftProbeOptions, DriftProbeRunner, ProbeDriftSuspectsParams, DriftJournalOptions, RecordDriftSuspectsParams, DetectStackDriftDeps, DetectStackDriftParams, StackDriftReport, RunDriftPreFlightParams, DriftPreFlightBlockExtras, DriftPreFlightOutcome, Route53RecordPreflightParams, Route53RecordPreflightOutcome, Route53RecordCollision } from "./orchestration/index.js";
-export { archiveCompletedRemediationJournal, computeRemediationOpId, defaultRemediationJournalDir, findRemediationJournalByOpId, listActiveRemediationOps, listActiveRemediationOpsForContext, readRemediationJournal, sweepExpiredRemediationJournals, writeRemediationJournal, REMEDIATION_JOURNAL_RETENTION_DAYS, captureRemediationForensics, defaultRemediationForensicsDir, applyRetainFlip, composeFlipCapabilities, computeTemplateDigest, deriveRetainFlipTemplate, findMarkedResourcesByOpId, proveFlipMetadataOnly, readRetainFlipState, verifyRetainFlipDiff, FORGET_MARKER_KEY, FORGET_FLIP_SPEC, RECREATE_MARKER_KEY, assessForgetResumability, completeForgetAfterConverge, completeForgetAfterDeploy, formatRecreateInFlightCures, partitionPreFlightByRemediation, runForgetSurgery, synthTemplateDeclaresResource, runRecreateSurgery, snapshotPolicyForType, SNAPSHOT_CAPABLE_RESOURCE_TYPES, runRecreatePreFlight, deriveRemovalTemplate, findRemovalDeletionFailures, findResourcesPresent, proveRemovalTargetsOnly, advertisableDriftVerbs, buildDriftRepairTicket, runDriftRepairGate, formatPinOutcomeDetail, pinProbeCoverage, renderPinReportLines, runPinRemediation, composePostFailureRepairOffer, formatDriftRepairOffer, DriftRepairAvailableError, checkDeployPathStackAvailability, isDeployPathBlockingStatus, StackUnavailableError, assertLeaseBeforeStack, LeaseDeniedError } from "./orchestration/index.js";
-export type { RemediationJournalContext, RemediationJournalOptions, CaptureRemediationForensicsParams, ForensicsCaptureOptions, RemediationForensicsBundle, ApplyRetainFlipOutcome, ApplyRetainFlipParams, DeriveRetainFlipParams, FlipDeletionPolicy, FlipProofResult, FlipSpec, RetainFlipDerivation, RetainFlipState, RecreateOrchestrationOptions, RecreateSurgeryParams, RecreateSurgeryReport, RecreatePreFlightStack, RunRecreatePreFlightParams, CoRemovedResource, ProveRemovalTargetsOnlyParams, RemovalDeletionFailure, RemovalDerivation, RemovalProofResult, StrippedExport, CompleteForgetAfterDeployParams, CompleteForgetOutcome, CompleteForgetParams, ForeignMarkerOperation, ForgetOrchestrationOptions, ForgetResumeAssessment, ForgetResumeSource, ForgetSurgeryParams, ForgetSurgeryReport, PreFlightRemediationDeps, PreFlightRemediationPartition, DriftRepairGateOutcome, RunDriftRepairGateParams, ComposePostFailureRepairOfferParams, PinnedProperty, PinProbeCoverage, PinRemediationReport, PinReportOnlyReason, PinResourceOutcome, PinTarget, RunPinRemediationParams } from "./orchestration/index.js";
+export { archiveCompletedRemediationJournal, computeRemediationOpId, defaultRemediationJournalDir, findRemediationJournalByOpId, listActiveRemediationOps, listActiveRemediationOpsForContext, readRemediationJournal, sweepExpiredRemediationJournals, writeRemediationJournal, REMEDIATION_JOURNAL_RETENTION_DAYS, captureRemediationForensics, defaultRemediationForensicsDir, applyRetainFlip, composeFlipCapabilities, computeTemplateDigest, deriveRetainFlipTemplate, findMarkedResourcesByOpId, proveFlipMetadataOnly, readRetainFlipState, verifyRetainFlipDiff, FORGET_MARKER_KEY, FORGET_FLIP_SPEC, RECREATE_MARKER_KEY, assessForgetResumability, completeForgetAfterConverge, completeForgetAfterDeploy, formatRecreateInFlightCures, partitionPreFlightByRemediation, runForgetSurgery, synthTemplateDeclaresResource, runRecreateSurgery, snapshotPolicyForType, SNAPSHOT_CAPABLE_RESOURCE_TYPES, runRecreatePreFlight, deriveRemovalTemplate, findRemovalDeletionFailures, findResourcesPresent, proveRemovalTargetsOnly, advertisableDriftVerbs, buildDriftRepairTicket, runDriftRepairGate, formatPinOutcomeDetail, pinProbeCoverage, renderPinReportLines, runPinRemediation, captureLegacySurfaces, decodeLegacyAnchor, runIdentitySurfaceGate, collectIdentityPinCandidates, degradedIdentityPinOutcomes, renderIdentityPinReportLines, runIdentityPinMigration, composePostFailureRepairOffer, formatDriftRepairOffer, DriftRepairAvailableError, checkDeployPathStackAvailability, isDeployPathBlockingStatus, StackUnavailableError, assertLeaseBeforeStack, LeaseDeniedError } from "./orchestration/index.js";
+export type { RemediationJournalContext, RemediationJournalOptions, CaptureRemediationForensicsParams, ForensicsCaptureOptions, RemediationForensicsBundle, ApplyRetainFlipOutcome, ApplyRetainFlipParams, DeriveRetainFlipParams, FlipDeletionPolicy, FlipProofResult, FlipSpec, RetainFlipDerivation, RetainFlipState, RecreateOrchestrationOptions, RecreateSurgeryParams, RecreateSurgeryReport, RecreatePreFlightStack, RunRecreatePreFlightParams, CoRemovedResource, ProveRemovalTargetsOnlyParams, RemovalDeletionFailure, RemovalDerivation, RemovalProofResult, StrippedExport, CompleteForgetAfterDeployParams, CompleteForgetOutcome, CompleteForgetParams, ForeignMarkerOperation, ForgetOrchestrationOptions, ForgetResumeAssessment, ForgetResumeSource, ForgetSurgeryParams, ForgetSurgeryReport, PreFlightRemediationDeps, PreFlightRemediationPartition, DriftRepairGateOutcome, RunDriftRepairGateParams, ComposePostFailureRepairOfferParams, PinnedProperty, PinProbeCoverage, PinRemediationReport, PinReportOnlyReason, PinResourceOutcome, PinTarget, RunPinRemediationParams, CapturedLegacySurfaces, IdentitySurfaceGateParams, IdentitySurfaceGateReport, PinnableRenamePair, IdentityPinCandidate, IdentityPinReport, IdentityPinSlotOutcome, IdentityPinVerifiedSlot, LiveTemplateLookup, RunIdentityPinMigrationParams } from "./orchestration/index.js";
 export { unlockBucket, unlockQueue } from "./orchestration/index.js";
 export type { UnlockBucketInput, UnlockBucketReport, UnlockQueueInput, UnlockQueueReport } from "./orchestration/index.js";
 export { triageBucketPolicy, isEnforceSslStatement, toResourcePolicyStatements, restoreBucketPolicy, synthesiseEnforceSslDocument, ensureEnforceSsl, restoreAndReconcileQuarantinedBucket } from "./orchestration/index.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as i,DEPLOYMENT_EVENT_TYPES as a,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as E,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as c,DEPLOYMENT_ERROR_MESSAGE_MAX as S,CASCADE_PHASES as l,CASCADE_ACCOUNT_STATUSES as A,clampDeploymentEventStrings as R,truncateUtf16Safe as T}from"./types/index.js";import{DeployEventSchema as p,StepProgressSchema as m,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as g,DEPLOY_EVENT_NAME_MAX as L,DEPLOY_EVENT_MESSAGE_MAX as I,DEPLOY_EVENT_STATUS_REASON_MAX as y,DEPLOY_EVENT_ERROR_MESSAGE_MAX as h,DEPLOY_EVENT_TRAIL_DETAIL_MAX as M,DEPLOY_EVENT_OUTPUT_MAX as x,DEPLOY_EVENT_ARN_MAX as v,DEPLOY_EVENT_URL_MAX as U,STEP_COMPLETE_STATUSES as F,LOG_LEVELS as k,STACK_CLEANUP_PHASES as b,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as Q,ALL_PROGRESS_KINDS as j,createDeployEmitter as W,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ie,probeAccountStackExists as ae}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as Ee}from"./aws/index.js";import{ensureOrganisationExists as Se,describeOrganisation as le,enablePolicyTypes as Ae,enableServiceAccess as Re,SERVICE_PRINCIPALS as Te,enableRamSharing as _e,activateTrustedAccess as pe,enableIpamDelegatedAdmin as me,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as ge,checkIdentityCentreStatus as Le,snapshotIdentityCentre as Ie,composeSdkAbortSignal as ye,extractErrorName as he,isAborted as Me,DEFAULT_MAX_PAGES as xe,IDENTITY_STORE_PAGE_SIZE as ve,drainPages as Ue,isOULeaf as Fe,registerSecurityDelegates as ke,SECURITY_SERVICE_PRINCIPALS as be,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as Qe,REMEDIATION_VERB_GLOSS as je,DestructionFindingSchema as We,DestructionTicketResourceSchema as Ze,DestructionTicketSchema as qe,DestructionConsentSchema as ze,DestructionOutcomeSchema as $e,DESTRUCTION_FINDINGS as er,CONSENT_VERDICTS as rr,TICKET_VERDICT_SOURCES as tr,TicketVerdictSourceSchema as or}from"./types/index.js";import{DRIFT_VERDICTS as ar,DriftVerdictSchema as nr,DriftSuspectSchema as sr,DriftFindingSchema as Er,DriftJournalRecordSchema as cr,verbsForDriftVerdict as Sr}from"./types/index.js";import{REMEDIATION_PHASES as Ar,RemediationPhaseSchema as Rr,RemediationTargetSchema as Tr,RemediationFlipProofSchema as _r,RemediationJournalRecordSchema as pr,RemediationVerbWithSurgerySchema as mr,remediationPhaseRank as dr,remediationPlaceholderPhysicalId as ur,isRemediationPlaceholderPhysicalId as Dr}from"./types/index.js";import{ProgressReporter as Or,APPLICATION_STACKS as fr,ORGANISATION_TYPES as Cr,APPLICATION_DEPLOY_ORDER as Nr,APPLICATION_DESTROY_ORDER as gr,OPENNEXT_DEPLOY_ORDER as Lr,OPENNEXT_DESTROY_ORDER as Ir,PARALLEL_DEPLOY_GROUPS as yr,PARALLEL_DESTROY_GROUPS as hr,OPENNEXT_PARALLEL_GROUPS as Mr,PARALLEL_OPERATION_TYPES as xr,isApplicationOperation as vr,isOrganisationOperation as Ur,getParallelDeployGroups as Fr,getParallelDestroyGroups as kr,getApplicationDeployOrder as br,getApplicationDestroyOrder as Yr,getApplicationStackName as Vr,getOrganisationStackName as Gr,isApplicationStack as Br,isQuarantineDetail as Kr,isRetainedBucketsDetail as Xr,getApplicationStepName as Hr,getApplicationStepId as wr,toPascalCase as Jr,isOpenNextPattern as Qr,OPENNEXT_PATTERNS as jr,STACK_NOT_FOUND_PATTERN as Wr,STACK_FAILED_STATE_PATTERN as Zr,CDK_NO_STACKS_MATCH as qr,INFRASTRUCTURE_FILENAME as zr,ApplicationError as $r,wrapApplicationError as et,stubCallerIdentity as rt}from"./types/index.js";import{deriveResourcesFromManifestStacks as ot}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as at,readStateFile as nt,writeStateFile as st,createEmptyState as Et,deleteStateFile as ct,updateTemplateHash as St,getStateFilePath as lt,regionSuffix as At}from"./types/config/FjallState.js";import{readDomainState as Tt,writeDomainState as _t,recordDomainDeployState as pt,deleteDomainState as mt,hashDomainDirectory as dt,LEGACY_DOMAIN_STATE_FILENAME as ut}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Pt}from"./aws/index.js";import{CdkService as ft,CdkArgumentBuilder as Ct,CdkProcessManager as Nt,ensureDependencyIntegrity as gt,clearDependencyIntegrityCache as Lt,DEPENDENCY_SYNC_TIMEOUT_MS as It,CdkEventMonitor as yt,startStackMonitoring as ht,DEFAULT_DEPLOY_TIMEOUT_MS as Mt,isCdkError as xt,formatInfrastructureError as vt,getStructuralHint as Ut,getSourceContext as Ft,hasCdkDifferences as kt,parseDiffOutput as bt,CloudFormationService as Yt,CloudFormationError as Vt,EcsService as Gt,EcsError as Bt,EcsServiceResolver as Kt,TemplateHashService as Xt,TemplateHashError as Ht,CdkContextBuilder as wt,emitProgress as Jt,PROGRESS_MESSAGES as Qt,parseBuildPhase as jt,buildStepContextBuildConfig as Wt,convertCloudFormationOutputsToRecord as Zt,ApplicationStackService as qt}from"./services/index.js";import{CdkError as $t}from"./types/errors/index.js";import{BaseServiceError as ro,ValidationError as to,AuthError as oo,AwsError as io,DeploymentError as ao,NetworkError as no,FileSystemError as so,ConfigError as Eo,toServiceError as co}from"./types/errors/index.js";import{filterDangerousEnvVars as lo,maskSensitiveOutput as Ao,parseShellArgs as Ro,sleep as To}from"@fjall/util";import{artefactOutputKey as po,DeployModeSchema as mo,ServiceArtefactSchema as uo,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as Oo}from"./util/dockerfileDetection.js";import{sleepAbortable as Co}from"./util/sleepAbortable.js";import{createSequencedCallbacks as go}from"./util/sequencedCallbacks.js";import{fileExists as Io}from"@fjall/util/fsHelpers";import{success as ho,failure as Mo,isSuccess as xo,isFailure as vo}from"@fjall/generator";import{deploy as Fo}from"./orchestration/index.js";import{destroy as bo}from"./orchestration/index.js";import{restart as Vo,probeSecretsDrift as Go,computeSecretsDrift as Bo,deriveStaleParameters as Ko,extractConsumedSsmParameters as Xo}from"./orchestration/index.js";import{partitionAccounts as wo}from"./orchestration/index.js";import{buildRegionList as Qo,buildAccountRegionPairs as jo,cascadeHomeRegion as Wo,cascadeOperationKey as Zo}from"./orchestration/index.js";import{projectScalarSummary as zo,projectAccountRows as $o}from"./orchestration/index.js";import{reconcileProviderAccounts as ri,mergeReconciledProviderAccounts as ti}from"./orchestration/index.js";import{decideNextTransition as ii,reconcileTrailMigration as ai,decommissionMemberTrailStorage as ni,ORG_TRAIL_BUCKET_OUTPUT_KEY as si,TRAIL_BUCKET_OUTPUT_KEY as Ei,TRAIL_KEY_ARN_OUTPUT_KEY as ci}from"./orchestration/index.js";import{classifyDriftFailure as li,fetchLastOperationEvents as Ai,DriftProbe as Ri,clearDriftSuspects as Ti,defaultDriftJournalDir as _i,readDriftSuspects as pi,recordDriftSuspects as mi,detectStackDrift as di,runDriftPreFlight as ui,formatDriftPreFlightBlock as Di,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Pi,DRIFT_PREFLIGHT_BUDGET_MS as Oi,runRoute53RecordPreflight as fi}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ni,computeRemediationOpId as gi,defaultRemediationJournalDir as Li,findRemediationJournalByOpId as Ii,listActiveRemediationOps as yi,listActiveRemediationOpsForContext as hi,readRemediationJournal as Mi,sweepExpiredRemediationJournals as xi,writeRemediationJournal as vi,REMEDIATION_JOURNAL_RETENTION_DAYS as Ui,captureRemediationForensics as Fi,defaultRemediationForensicsDir as ki,applyRetainFlip as bi,composeFlipCapabilities as Yi,computeTemplateDigest as Vi,deriveRetainFlipTemplate as Gi,findMarkedResourcesByOpId as Bi,proveFlipMetadataOnly as Ki,readRetainFlipState as Xi,verifyRetainFlipDiff as Hi,FORGET_MARKER_KEY as wi,FORGET_FLIP_SPEC as Ji,RECREATE_MARKER_KEY as Qi,assessForgetResumability as ji,completeForgetAfterConverge as Wi,completeForgetAfterDeploy as Zi,formatRecreateInFlightCures as qi,partitionPreFlightByRemediation as zi,runForgetSurgery as $i,synthTemplateDeclaresResource as ea,runRecreateSurgery as ra,snapshotPolicyForType as ta,SNAPSHOT_CAPABLE_RESOURCE_TYPES as oa,runRecreatePreFlight as ia,deriveRemovalTemplate as aa,findRemovalDeletionFailures as na,findResourcesPresent as sa,proveRemovalTargetsOnly as Ea,advertisableDriftVerbs as ca,buildDriftRepairTicket as Sa,runDriftRepairGate as la,formatPinOutcomeDetail as Aa,pinProbeCoverage as Ra,renderPinReportLines as Ta,runPinRemediation as _a,composePostFailureRepairOffer as pa,formatDriftRepairOffer as ma,DriftRepairAvailableError as da,checkDeployPathStackAvailability as ua,isDeployPathBlockingStatus as Da,StackUnavailableError as Pa,assertLeaseBeforeStack as Oa,LeaseDeniedError as fa}from"./orchestration/index.js";import{unlockBucket as Na,unlockQueue as ga}from"./orchestration/index.js";import{triageBucketPolicy as Ia,isEnforceSslStatement as ya,toResourcePolicyStatements as ha,restoreBucketPolicy as Ma,synthesiseEnforceSslDocument as xa,ensureEnforceSsl as va,restoreAndReconcileQuarantinedBucket as Ua}from"./orchestration/index.js";import{verifyOrgTrailDelivery as ka}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as Ya,isRootTaskPolicyArn as Va,ROOT_TASK_POLICY_ARNS as Ga,MAX_ROOT_SESSION_SECONDS as Ba}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as Xa,flattenAccountsToEnvironments as Ha,extractAllAccountNames as wa,accountsConfigToOUTree as Ja,isStringArray as Qa,isAccountsConfig as ja,isOuOnlyAccountBucket as Wa,OU_ONLY_ACCOUNT_BUCKETS as Za}from"./orchestration/index.js";import{runOpenNextBuild as za}from"./orchestration/index.js";import{runOrganisationSetup as en,ORG_SETUP_PHASES as rn}from"./orchestration/index.js";import{DOMAIN_DELEGATION_ERROR_TYPES as on,DomainDelegationError as an,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as nn,PUBLIC_DNS_QUERY_TIMEOUT_MS as sn,createPublicResolvers as En,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as cn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Sn,waitForNsPropagation as ln,ACM_CAA_ISSUERS as An,runCaaPreflight as Rn,deployDelegatedDomain as Tn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as _n,templateOwnsDelegationRecord as pn,deleteChildNsFromParent as mn,nsDelegationPhysicalName as dn,runDelegatedDomainDestroy as un}from"./orchestration/index.js";import{classifyZoneRecords as Pn,buildSatelliteRecordIndex as On,createSystemDnsNameProbe as fn,systemDnsNameProbe as Cn,normaliseRecordName as Nn,isRoute53NameServer as gn,isDelegatedToRoute53 as Ln}from"./orchestration/index.js";import{resolveBuildSecrets as yn,resolveSecretRefValue as hn,resolveBuildSecretSessionProvider as Mn,sourcedRefsFromBuildArgs as xn,resolveBuildArgs as vn,buildBuildSecretSessionPolicy as Un,buildDeploySessionPolicy as Fn,partitionForRegion as kn,validateBuildGroup as bn}from"./orchestration/index.js";import{FrameworkRegistry as Vn}from"./orchestration/index.js";import{openNextBuilder as Bn,staticSiteBuilder as Kn,dockerBuilder as Xn}from"./orchestration/index.js";import{StepRegistry as wn,getDestroyStepId as Jn}from"./steps/index.js";import{buildDeployPlan as jn,computeDeployPlan as Wn,computeAssemblyDigest as Zn,digestHead as qn,classifyImpact as zn,derivePropertyChanges as $n,isDataLoss as es,isStatefulResourceType as rs,renderPlanSummary as ts,renderPlanLines as os,toWirePlanChanges as is,signApprovalToken as as,verifyApprovalToken as ns,DEFAULT_APPROVAL_TTL_MS as ss,APPROVAL_TOKEN_PATTERN as Es,runApprovalGate as cs,approvalRefusalReason as Ss}from"./orchestration/index.js";import{runDestructionGate as As,buildDestructionTicket as Rs,evaluateDestructionConsents as Ts,computeTicketDigest as _s,legalRemediationVerbs as ps,executableRemediationVerbs as ms,advertisableRemediationVerbs as ds,renderDestructionTicketLines as us,renderConsentVerdictLines as Ds,loadDeployPlan as Ps,createMemoisedPlanLoader as Os}from"./orchestration/index.js";export{An as ACM_CAA_ISSUERS,j as ALL_PROGRESS_KINDS,Nr as APPLICATION_DEPLOY_ORDER,gr as APPLICATION_DESTROY_ORDER,fr as APPLICATION_STACKS,Q as APPROVAL_DECISIONS,J as APPROVAL_KINDS,Es as APPROVAL_TOKEN_PATTERN,$r as ApplicationError,qt as ApplicationStackService,oo as AuthError,io as AwsError,K as BUILDERS,ro as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,A as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,l as CASCADE_PHASES,qr as CDK_NO_STACKS_MATCH,rr as CONSENT_VERDICTS,_n as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Ct as CdkArgumentBuilder,wt as CdkContextBuilder,$t as CdkError,yt as CdkEventMonitor,Nt as CdkProcessManager,ft as CdkService,P as ChangeCountsSchema,Vt as CloudFormationError,Pt as CloudFormationEventMonitor,Yt as CloudFormationService,Eo as ConfigError,ss as DEFAULT_APPROVAL_TTL_MS,Mt as DEFAULT_DEPLOY_TIMEOUT_MS,xe as DEFAULT_MAX_PAGES,nn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,It as DEPENDENCY_SYNC_TIMEOUT_MS,S as DEPLOYMENT_ERROR_MESSAGE_MAX,E as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,c as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,a as DEPLOYMENT_EVENT_TYPES,t as DEPLOY_CORE_VERSION_GLOBAL,v as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,h as DEPLOY_EVENT_ERROR_MESSAGE_MAX,g as DEPLOY_EVENT_ID_MAX,I as DEPLOY_EVENT_MESSAGE_MAX,L as DEPLOY_EVENT_NAME_MAX,x as DEPLOY_EVENT_OUTPUT_MAX,y as DEPLOY_EVENT_STATUS_REASON_MAX,M as DEPLOY_EVENT_TRAIL_DETAIL_MAX,U as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,er as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,on as DOMAIN_DELEGATION_ERROR_TYPES,Oi as DRIFT_PREFLIGHT_BUDGET_MS,Pi as DRIFT_PREFLIGHT_TRIGGER_STATUSES,ar as DRIFT_VERDICTS,p as DeployEventSchema,mo as DeployModeSchema,d as DeployResourceSchema,ao as DeploymentError,i as DeploymentEventSchema,ze as DestructionConsentSchema,We as DestructionFindingSchema,$e as DestructionOutcomeSchema,Ze as DestructionTicketResourceSchema,qe as DestructionTicketSchema,an as DomainDelegationError,Er as DriftFindingSchema,cr as DriftJournalRecordSchema,Ri as DriftProbe,da as DriftRepairAvailableError,sr as DriftSuspectSchema,nr as DriftVerdictSchema,Bt as EcsError,Gt as EcsService,Kt as EcsServiceResolver,Ji as FORGET_FLIP_SPEC,wi as FORGET_MARKER_KEY,so as FileSystemError,at as FjallStateFileSchema,Vn as FrameworkRegistry,ve as IDENTITY_STORE_PAGE_SIZE,zr as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,ut as LEGACY_DOMAIN_STATE_FILENAME,k as LOG_LEVELS,fa as LeaseDeniedError,Ba as MAX_ROOT_SESSION_SECONDS,Sn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,cn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,no as NetworkError,Lr as OPENNEXT_DEPLOY_ORDER,Ir as OPENNEXT_DESTROY_ORDER,Mr as OPENNEXT_PARALLEL_GROUPS,jr as OPENNEXT_PATTERNS,Cr as ORGANISATION_TYPES,rn as ORG_SETUP_PHASES,si as ORG_TRAIL_BUCKET_OUTPUT_KEY,Za as OU_ONLY_ACCOUNT_BUCKETS,yr as PARALLEL_DEPLOY_GROUPS,hr as PARALLEL_DESTROY_GROUPS,xr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,Qt as PROGRESS_MESSAGES,sn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,Or as ProgressReporter,Qi as RECREATE_MARKER_KEY,Ui as REMEDIATION_JOURNAL_RETENTION_DAYS,Ar as REMEDIATION_PHASES,je as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,Ga as ROOT_TASK_POLICY_ARNS,_r as RemediationFlipProofSchema,pr as RemediationJournalRecordSchema,Rr as RemediationPhaseSchema,Tr as RemediationTargetSchema,Qe as RemediationVerbSchema,mr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,be as SECURITY_SERVICE_PRINCIPALS,Te as SERVICE_PRINCIPALS,oa as SNAPSHOT_CAPABLE_RESOURCE_TYPES,b as STACK_CLEANUP_PHASES,Zr as STACK_FAILED_STATE_PATTERN,Wr as STACK_NOT_FOUND_PATTERN,F as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,uo as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,Pa as StackUnavailableError,m as StepProgressSchema,wn as StepRegistry,tr as TICKET_VERDICT_SOURCES,Ei as TRAIL_BUCKET_OUTPUT_KEY,ci as TRAIL_KEY_ARN_OUTPUT_KEY,Ht as TemplateHashError,Xt as TemplateHashService,or as TicketVerdictSourceSchema,to as ValidationError,Ja as accountsConfigToOUTree,ge as activateCostAllocationTags,pe as activateTrustedAccess,ca as advertisableDriftVerbs,ds as advertisableRemediationVerbs,bi as applyRetainFlip,Ss as approvalRefusalReason,Ni as archiveCompletedRemediationJournal,po as artefactOutputKey,Oa as assertLeaseBeforeStack,ji as assessForgetResumability,Ya as assumeRootForTask,jo as buildAccountRegionPairs,Ce as buildAccountToOUMap,Un as buildBuildSecretSessionPolicy,jn as buildDeployPlan,Fn as buildDeploySessionPolicy,Rs as buildDestructionTicket,Sa as buildDriftRepairTicket,Qo as buildRegionList,On as buildSatelliteRecordIndex,Wt as buildStepContextBuildConfig,ie as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Fi as captureRemediationForensics,Wo as cascadeHomeRegion,Zo as cascadeOperationKey,ua as checkDeployPathStackAvailability,Le as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,R as clampDeploymentEventStrings,li as classifyDriftFailure,zn as classifyImpact,Pn as classifyZoneRecords,Lt as clearDependencyIntegrityCache,Ti as clearDriftSuspects,Wi as completeForgetAfterConverge,Zi as completeForgetAfterDeploy,Yi as composeFlipCapabilities,pa as composePostFailureRepairOffer,ye as composeSdkAbortSignal,Zn as computeAssemblyDigest,Wn as computeDeployPlan,gi as computeRemediationOpId,Bo as computeSecretsDrift,Vi as computeTemplateDigest,_s as computeTicketDigest,Zt as convertCloudFormationOutputsToRecord,Pe as createAccount,W as createDeployEmitter,Et as createEmptyState,Os as createMemoisedPlanLoader,En as createPublicResolvers,go as createSequencedCallbacks,fn as createSystemDnsNameProbe,ii as decideNextTransition,ni as decommissionMemberTrailStorage,_i as defaultDriftJournalDir,ki as defaultRemediationForensicsDir,Li as defaultRemediationJournalDir,mn as deleteChildNsFromParent,mt as deleteDomainState,ct as deleteStateFile,Fo as deploy,Tn as deployDelegatedDomain,$n as derivePropertyChanges,aa as deriveRemovalTemplate,ot as deriveResourcesFromManifestStacks,Gi as deriveRetainFlipTemplate,Ko as deriveStaleParameters,le as describeOrganisation,te as describeTargetReadinessReason,bo as destroy,di as detectStackDrift,qn as digestHead,Xn as dockerBuilder,Ue as drainPages,Jt as emitProgress,Ye as enableCentralisedRootAccess,me as enableIpamDelegatedAdmin,Ae as enablePolicyTypes,_e as enableRamSharing,Re as enableServiceAccess,gt as ensureDependencyIntegrity,va as ensureEnforceSsl,Se as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Ts as evaluateDestructionConsents,ms as executableRemediationVerbs,wa as extractAllAccountNames,Xo as extractConsumedSsmParameters,he as extractErrorName,Mo as failure,Ai as fetchLastOperationEvents,Io as fileExists,lo as filterDangerousEnvVars,De as findAccount,Ne as findDevelopmentOuId,Bi as findMarkedResourcesByOpId,Ii as findRemediationJournalByOpId,na as findRemovalDeletionFailures,sa as findResourcesPresent,Ha as flattenAccountsToEnvironments,Di as formatDriftPreFlightBlock,ma as formatDriftRepairOffer,vt as formatInfrastructureError,Aa as formatPinOutcomeDetail,qi as formatRecreateInFlightCures,br as getApplicationDeployOrder,Yr as getApplicationDestroyOrder,Vr as getApplicationStackName,wr as getApplicationStepId,Hr as getApplicationStepName,Jn as getDestroyStepId,Gr as getOrganisationStackName,Fr as getParallelDeployGroups,kr as getParallelDestroyGroups,Ft as getSourceContext,lt as getStateFilePath,Ut as getStructuralHint,kt as hasCdkDifferences,Oo as hasDockerfile,dt as hashDomainDirectory,Me as isAborted,ja as isAccountsConfig,vr as isApplicationOperation,Br as isApplicationStack,xt as isCdkError,es as isDataLoss,Ln as isDelegatedToRoute53,Da as isDeployPathBlockingStatus,ya as isEnforceSslStatement,vo as isFailure,Fe as isOULeaf,Qr as isOpenNextPattern,Ur as isOrganisationOperation,Wa as isOuOnlyAccountBucket,Kr as isQuarantineDetail,Dr as isRemediationPlaceholderPhysicalId,Xr as isRetainedBucketsDetail,Va as isRootTaskPolicyArn,gn as isRoute53NameServer,rs as isStatefulResourceType,Qa as isStringArray,xo as isSuccess,ps as legalRemediationVerbs,ue as listAccounts,yi as listActiveRemediationOps,hi as listActiveRemediationOpsForContext,Ps as loadDeployPlan,Ao as maskSensitiveOutput,ti as mergeReconciledProviderAccounts,Nn as normaliseRecordName,dn as nsDelegationPhysicalName,Bn as openNextBuilder,Xa as parseAccountsConfiguration,jt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,bt as parseDiffOutput,Ro as parseShellArgs,wo as partitionAccounts,kn as partitionForRegion,zi as partitionPreFlightByRemediation,Ra as pinProbeCoverage,fe as placeAccountsInOUs,ae as probeAccountStackExists,Go as probeSecretsDrift,$o as projectAccountRows,zo as projectScalarSummary,Ki as proveFlipMetadataOnly,Ea as proveRemovalTargetsOnly,Tt as readDomainState,pi as readDriftSuspects,Mi as readRemediationJournal,Xi as readRetainFlipState,nt as readStateFile,ri as reconcileProviderAccounts,ai as reconcileTrailMigration,pt as recordDomainDeployState,mi as recordDriftSuspects,Ee as regionDisabledMessage,At as regionSuffix,ke as registerSecurityDelegates,dr as remediationPhaseRank,ur as remediationPlaceholderPhysicalId,Ds as renderConsentVerdictLines,us as renderDestructionTicketLines,Ta as renderPinReportLines,os as renderPlanLines,ts as renderPlanSummary,vn as resolveBuildArgs,Mn as resolveBuildSecretSessionProvider,yn as resolveBuildSecrets,hn as resolveSecretRefValue,Vo as restart,Ua as restoreAndReconcileQuarantinedBucket,Ma as restoreBucketPolicy,cs as runApprovalGate,Rn as runCaaPreflight,un as runDelegatedDomainDestroy,As as runDestructionGate,ui as runDriftPreFlight,la as runDriftRepairGate,$i as runForgetSurgery,za as runOpenNextBuild,en as runOrganisationSetup,_a as runPinRemediation,ia as runRecreatePreFlight,ra as runRecreateSurgery,fi as runRoute53RecordPreflight,as as signApprovalToken,To as sleep,Co as sleepAbortable,Ie as snapshotIdentityCentre,ta as snapshotPolicyForType,xn as sourcedRefsFromBuildArgs,ht as startStackMonitoring,Kn as staticSiteBuilder,rt as stubCallerIdentity,ho as success,xi as sweepExpiredRemediationJournals,ea as synthTemplateDeclaresResource,xa as synthesiseEnforceSslDocument,Cn as systemDnsNameProbe,pn as templateOwnsDelegationRecord,Jr as toPascalCase,ha as toResourcePolicyStatements,co as toServiceError,is as toWirePlanChanges,Ia as triageBucketPolicy,T as truncateUtf16Safe,Na as unlockBucket,ga as unlockQueue,de as updateBackupGlobalSettings,St as updateTemplateHash,bn as validateBuildGroup,Sr as verbsForDriftVerdict,ns as verifyApprovalToken,ka as verifyOrgTrailDelivery,Hi as verifyRetainFlipDiff,ln as waitForNsPropagation,et as wrapApplicationError,_t as writeDomainState,vi as writeRemediationJournal,st as writeStateFile};
+import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as i,DEPLOYMENT_EVENT_TYPES as a,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as E,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as c,DEPLOYMENT_ERROR_MESSAGE_MAX as S,CASCADE_PHASES as l,CASCADE_ACCOUNT_STATUSES as T,clampDeploymentEventStrings as _,truncateUtf16Safe as A}from"./types/index.js";import{DeployEventSchema as p,StepProgressSchema as m,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as P,ChangeCountsSchema as D,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as L,DEPLOY_EVENT_NAME_MAX as g,DEPLOY_EVENT_MESSAGE_MAX as I,DEPLOY_EVENT_STATUS_REASON_MAX as y,DEPLOY_EVENT_ERROR_MESSAGE_MAX as h,DEPLOY_EVENT_TRAIL_DETAIL_MAX as M,DEPLOY_EVENT_OUTPUT_MAX as x,DEPLOY_EVENT_ARN_MAX as v,DEPLOY_EVENT_URL_MAX as U,STEP_COMPLETE_STATUSES as F,LOG_LEVELS as b,STACK_CLEANUP_PHASES as k,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as Q,ALL_PROGRESS_KINDS as j,createDeployEmitter as W,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ie,probeAccountStackExists as ae}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as Ee}from"./aws/index.js";import{ensureOrganisationExists as Se,describeOrganisation as le,enablePolicyTypes as Te,enableServiceAccess as _e,SERVICE_PRINCIPALS as Ae,enableRamSharing as Re,activateTrustedAccess as pe,enableIpamDelegatedAdmin as me,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as Pe,createAccount as De,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as Le,checkIdentityCentreStatus as ge,snapshotIdentityCentre as Ie,composeSdkAbortSignal as ye,extractErrorName as he,isAborted as Me,DEFAULT_MAX_PAGES as xe,IDENTITY_STORE_PAGE_SIZE as ve,drainPages as Ue,isOULeaf as Fe,registerSecurityDelegates as be,SECURITY_SERVICE_PRINCIPALS as ke,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as Qe,REMEDIATION_VERB_GLOSS as je,IDENTITY_PIN_SLOT_SWAP_GLOSS as We,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ir}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as Er,DriftFindingSchema as cr,DriftJournalRecordSchema as Sr,verbsForDriftVerdict as lr}from"./types/index.js";import{REMEDIATION_PHASES as _r,RemediationPhaseSchema as Ar,RemediationTargetSchema as Rr,RemediationFlipProofSchema as pr,RemediationJournalRecordSchema as mr,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Pr,isRemediationPlaceholderPhysicalId as Dr}from"./types/index.js";import{ProgressReporter as fr,APPLICATION_STACKS as Cr,ORGANISATION_TYPES as Nr,APPLICATION_DEPLOY_ORDER as Lr,APPLICATION_DESTROY_ORDER as gr,OPENNEXT_DEPLOY_ORDER as Ir,OPENNEXT_DESTROY_ORDER as yr,PARALLEL_DEPLOY_GROUPS as hr,PARALLEL_DESTROY_GROUPS as Mr,OPENNEXT_PARALLEL_GROUPS as xr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Ur,isOrganisationOperation as Fr,getParallelDeployGroups as br,getParallelDestroyGroups as kr,getApplicationDeployOrder as Yr,getApplicationDestroyOrder as Vr,getApplicationStackName as Gr,getOrganisationStackName as Br,isApplicationStack as Kr,isQuarantineDetail as Xr,isRetainedBucketsDetail as Hr,getApplicationStepName as wr,getApplicationStepId as Jr,toPascalCase as Qr,isOpenNextPattern as jr,OPENNEXT_PATTERNS as Wr,STACK_NOT_FOUND_PATTERN as Zr,STACK_FAILED_STATE_PATTERN as qr,CDK_NO_STACKS_MATCH as zr,INFRASTRUCTURE_FILENAME as $r,ApplicationError as et,wrapApplicationError as rt,stubCallerIdentity as tt}from"./types/index.js";import{deriveResourcesFromManifestStacks as it}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as nt,readStateFile as st,writeStateFile as Et,createEmptyState as ct,deleteStateFile as St,updateTemplateHash as lt,getStateFilePath as Tt,regionSuffix as _t}from"./types/config/FjallState.js";import{readDomainState as Rt,writeDomainState as pt,recordDomainDeployState as mt,deleteDomainState as dt,hashDomainDirectory as ut,LEGACY_DOMAIN_STATE_FILENAME as Pt}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Ot}from"./aws/index.js";import{CdkService as Ct,CdkArgumentBuilder as Nt,CdkProcessManager as Lt,ensureDependencyIntegrity as gt,clearDependencyIntegrityCache as It,DEPENDENCY_SYNC_TIMEOUT_MS as yt,CdkEventMonitor as ht,startStackMonitoring as Mt,DEFAULT_DEPLOY_TIMEOUT_MS as xt,isCdkError as vt,formatInfrastructureError as Ut,getStructuralHint as Ft,getSourceContext as bt,hasCdkDifferences as kt,parseDiffOutput as Yt,CloudFormationService as Vt,CloudFormationError as Gt,EcsService as Bt,EcsError as Kt,EcsServiceResolver as Xt,TemplateHashService as Ht,TemplateHashError as wt,CdkContextBuilder as Jt,emitProgress as Qt,PROGRESS_MESSAGES as jt,parseBuildPhase as Wt,buildStepContextBuildConfig as Zt,convertCloudFormationOutputsToRecord as qt,ApplicationStackService as zt}from"./services/index.js";import{CdkError as eo}from"./types/errors/index.js";import{BaseServiceError as to,ValidationError as oo,AuthError as io,AwsError as ao,DeploymentError as no,NetworkError as so,FileSystemError as Eo,ConfigError as co,toServiceError as So}from"./types/errors/index.js";import{filterDangerousEnvVars as To,maskSensitiveOutput as _o,parseShellArgs as Ao,sleep as Ro}from"@fjall/util";import{artefactOutputKey as mo,DeployModeSchema as uo,ServiceArtefactSchema as Po,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as fo}from"./util/dockerfileDetection.js";import{sleepAbortable as No}from"./util/sleepAbortable.js";import{createSequencedCallbacks as go}from"./util/sequencedCallbacks.js";import{fileExists as yo}from"@fjall/util/fsHelpers";import{success as Mo,failure as xo,isSuccess as vo,isFailure as Uo}from"@fjall/generator";import{deploy as bo}from"./orchestration/index.js";import{destroy as Yo}from"./orchestration/index.js";import{buildParamsContext as Go}from"./orchestration/contextHelpers.js";import{restart as Ko,probeSecretsDrift as Xo,computeSecretsDrift as Ho,deriveStaleParameters as wo,extractConsumedSsmParameters as Jo}from"./orchestration/index.js";import{partitionAccounts as jo}from"./orchestration/index.js";import{buildRegionList as Zo,buildAccountRegionPairs as qo,cascadeHomeRegion as zo,cascadeOperationKey as $o}from"./orchestration/index.js";import{projectScalarSummary as ri,projectAccountRows as ti}from"./orchestration/index.js";import{reconcileProviderAccounts as ii,mergeReconciledProviderAccounts as ai}from"./orchestration/index.js";import{decideNextTransition as si,reconcileTrailMigration as Ei,decommissionMemberTrailStorage as ci,ORG_TRAIL_BUCKET_OUTPUT_KEY as Si,TRAIL_BUCKET_OUTPUT_KEY as li,TRAIL_KEY_ARN_OUTPUT_KEY as Ti}from"./orchestration/index.js";import{classifyDriftFailure as Ai,fetchLastOperationEvents as Ri,DriftProbe as pi,clearDriftSuspects as mi,defaultDriftJournalDir as di,readDriftSuspects as ui,recordDriftSuspects as Pi,detectStackDrift as Di,runDriftPreFlight as Oi,formatDriftPreFlightBlock as fi,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Ci,DRIFT_PREFLIGHT_BUDGET_MS as Ni,runRoute53RecordPreflight as Li}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ii,computeRemediationOpId as yi,defaultRemediationJournalDir as hi,findRemediationJournalByOpId as Mi,listActiveRemediationOps as xi,listActiveRemediationOpsForContext as vi,readRemediationJournal as Ui,sweepExpiredRemediationJournals as Fi,writeRemediationJournal as bi,REMEDIATION_JOURNAL_RETENTION_DAYS as ki,captureRemediationForensics as Yi,defaultRemediationForensicsDir as Vi,applyRetainFlip as Gi,composeFlipCapabilities as Bi,computeTemplateDigest as Ki,deriveRetainFlipTemplate as Xi,findMarkedResourcesByOpId as Hi,proveFlipMetadataOnly as wi,readRetainFlipState as Ji,verifyRetainFlipDiff as Qi,FORGET_MARKER_KEY as ji,FORGET_FLIP_SPEC as Wi,RECREATE_MARKER_KEY as Zi,assessForgetResumability as qi,completeForgetAfterConverge as zi,completeForgetAfterDeploy as $i,formatRecreateInFlightCures as ea,partitionPreFlightByRemediation as ra,runForgetSurgery as ta,synthTemplateDeclaresResource as oa,runRecreateSurgery as ia,snapshotPolicyForType as aa,SNAPSHOT_CAPABLE_RESOURCE_TYPES as na,runRecreatePreFlight as sa,deriveRemovalTemplate as Ea,findRemovalDeletionFailures as ca,findResourcesPresent as Sa,proveRemovalTargetsOnly as la,advertisableDriftVerbs as Ta,buildDriftRepairTicket as _a,runDriftRepairGate as Aa,formatPinOutcomeDetail as Ra,pinProbeCoverage as pa,renderPinReportLines as ma,runPinRemediation as da,captureLegacySurfaces as ua,decodeLegacyAnchor as Pa,runIdentitySurfaceGate as Da,collectIdentityPinCandidates as Oa,degradedIdentityPinOutcomes as fa,renderIdentityPinReportLines as Ca,runIdentityPinMigration as Na,composePostFailureRepairOffer as La,formatDriftRepairOffer as ga,DriftRepairAvailableError as Ia,checkDeployPathStackAvailability as ya,isDeployPathBlockingStatus as ha,StackUnavailableError as Ma,assertLeaseBeforeStack as xa,LeaseDeniedError as va}from"./orchestration/index.js";import{unlockBucket as Fa,unlockQueue as ba}from"./orchestration/index.js";import{triageBucketPolicy as Ya,isEnforceSslStatement as Va,toResourcePolicyStatements as Ga,restoreBucketPolicy as Ba,synthesiseEnforceSslDocument as Ka,ensureEnforceSsl as Xa,restoreAndReconcileQuarantinedBucket as Ha}from"./orchestration/index.js";import{verifyOrgTrailDelivery as Ja}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as ja,isRootTaskPolicyArn as Wa,ROOT_TASK_POLICY_ARNS as Za,MAX_ROOT_SESSION_SECONDS as qa}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as $a,flattenAccountsToEnvironments as en,extractAllAccountNames as rn,accountsConfigToOUTree as tn,isStringArray as on,isAccountsConfig as an,isOuOnlyAccountBucket as nn,OU_ONLY_ACCOUNT_BUCKETS as sn}from"./orchestration/index.js";import{runOpenNextBuild as cn}from"./orchestration/index.js";import{runOrganisationSetup as ln,ORG_SETUP_PHASES as Tn}from"./orchestration/index.js";import{DOMAIN_DELEGATION_ERROR_TYPES as An,DomainDelegationError as Rn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as pn,PUBLIC_DNS_QUERY_TIMEOUT_MS as mn,createPublicResolvers as dn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as un,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Pn,waitForNsPropagation as Dn,ACM_CAA_ISSUERS as On,runCaaPreflight as fn,deployDelegatedDomain as Cn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as Nn,templateOwnsDelegationRecord as Ln,deleteChildNsFromParent as gn,nsDelegationPhysicalName as In,runDelegatedDomainDestroy as yn}from"./orchestration/index.js";import{classifyZoneRecords as Mn,buildSatelliteRecordIndex as xn,createSystemDnsNameProbe as vn,systemDnsNameProbe as Un,normaliseRecordName as Fn,isRoute53NameServer as bn,isDelegatedToRoute53 as kn}from"./orchestration/index.js";import{resolveBuildSecrets as Vn,resolveSecretRefValue as Gn,resolveBuildSecretSessionProvider as Bn,sourcedRefsFromBuildArgs as Kn,resolveBuildArgs as Xn,buildBuildSecretSessionPolicy as Hn,buildDeploySessionPolicy as wn,partitionForRegion as Jn,validateBuildGroup as Qn}from"./orchestration/index.js";import{FrameworkRegistry as Wn}from"./orchestration/index.js";import{openNextBuilder as qn,staticSiteBuilder as zn,dockerBuilder as $n}from"./orchestration/index.js";import{StepRegistry as rs,getDestroyStepId as ts}from"./steps/index.js";import{buildDeployPlan as is,computeDeployPlan as as,computeAssemblyDigest as ns,digestHead as ss,classifyImpact as Es,derivePropertyChanges as cs,isDataLoss as Ss,isStatefulResourceType as ls,renderPlanSummary as Ts,renderPlanLines as _s,toWirePlanChanges as As,signApprovalToken as Rs,verifyApprovalToken as ps,DEFAULT_APPROVAL_TTL_MS as ms,APPROVAL_TOKEN_PATTERN as ds,runApprovalGate as us,approvalRefusalReason as Ps}from"./orchestration/index.js";import{runDestructionGate as Os,buildDestructionTicket as fs,evaluateDestructionConsents as Cs,computeTicketDigest as Ns,legalRemediationVerbs as Ls,executableRemediationVerbs as gs,advertisableRemediationVerbs as Is,renderDestructionTicketLines as ys,renderConsentVerdictLines as hs,loadDeployPlan as Ms,createMemoisedPlanLoader as xs}from"./orchestration/index.js";export{On as ACM_CAA_ISSUERS,j as ALL_PROGRESS_KINDS,Lr as APPLICATION_DEPLOY_ORDER,gr as APPLICATION_DESTROY_ORDER,Cr as APPLICATION_STACKS,Q as APPROVAL_DECISIONS,J as APPROVAL_KINDS,ds as APPROVAL_TOKEN_PATTERN,et as ApplicationError,zt as ApplicationStackService,io as AuthError,ao as AwsError,K as BUILDERS,to as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,T as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,l as CASCADE_PHASES,zr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,Nn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Nt as CdkArgumentBuilder,Jt as CdkContextBuilder,eo as CdkError,ht as CdkEventMonitor,Lt as CdkProcessManager,Ct as CdkService,D as ChangeCountsSchema,Gt as CloudFormationError,Ot as CloudFormationEventMonitor,Vt as CloudFormationService,co as ConfigError,ms as DEFAULT_APPROVAL_TTL_MS,xt as DEFAULT_DEPLOY_TIMEOUT_MS,xe as DEFAULT_MAX_PAGES,pn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,yt as DEPENDENCY_SYNC_TIMEOUT_MS,S as DEPLOYMENT_ERROR_MESSAGE_MAX,E as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,c as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,a as DEPLOYMENT_EVENT_TYPES,t as DEPLOY_CORE_VERSION_GLOBAL,v as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,h as DEPLOY_EVENT_ERROR_MESSAGE_MAX,L as DEPLOY_EVENT_ID_MAX,I as DEPLOY_EVENT_MESSAGE_MAX,g as DEPLOY_EVENT_NAME_MAX,x as DEPLOY_EVENT_OUTPUT_MAX,y as DEPLOY_EVENT_STATUS_REASON_MAX,M as DEPLOY_EVENT_TRAIL_DETAIL_MAX,U as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,An as DOMAIN_DELEGATION_ERROR_TYPES,Ni as DRIFT_PREFLIGHT_BUDGET_MS,Ci as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,p as DeployEventSchema,uo as DeployModeSchema,d as DeployResourceSchema,no as DeploymentError,i as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,Rn as DomainDelegationError,cr as DriftFindingSchema,Sr as DriftJournalRecordSchema,pi as DriftProbe,Ia as DriftRepairAvailableError,Er as DriftSuspectSchema,sr as DriftVerdictSchema,Kt as EcsError,Bt as EcsService,Xt as EcsServiceResolver,Wi as FORGET_FLIP_SPEC,ji as FORGET_MARKER_KEY,Eo as FileSystemError,nt as FjallStateFileSchema,Wn as FrameworkRegistry,We as IDENTITY_PIN_SLOT_SWAP_GLOSS,ve as IDENTITY_STORE_PAGE_SIZE,$r as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,Pt as LEGACY_DOMAIN_STATE_FILENAME,b as LOG_LEVELS,va as LeaseDeniedError,qa as MAX_ROOT_SESSION_SECONDS,Pn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,un as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,so as NetworkError,Ir as OPENNEXT_DEPLOY_ORDER,yr as OPENNEXT_DESTROY_ORDER,xr as OPENNEXT_PARALLEL_GROUPS,Wr as OPENNEXT_PATTERNS,Nr as ORGANISATION_TYPES,Tn as ORG_SETUP_PHASES,Si as ORG_TRAIL_BUCKET_OUTPUT_KEY,sn as OU_ONLY_ACCOUNT_BUCKETS,hr as PARALLEL_DEPLOY_GROUPS,Mr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,jt as PROGRESS_MESSAGES,mn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,P as PlanPropertyChangeSchema,fr as ProgressReporter,Zi as RECREATE_MARKER_KEY,ki as REMEDIATION_JOURNAL_RETENTION_DAYS,_r as REMEDIATION_PHASES,je as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,Za as ROOT_TASK_POLICY_ARNS,pr as RemediationFlipProofSchema,mr as RemediationJournalRecordSchema,Ar as RemediationPhaseSchema,Rr as RemediationTargetSchema,Qe as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,ke as SECURITY_SERVICE_PRINCIPALS,Ae as SERVICE_PRINCIPALS,na as SNAPSHOT_CAPABLE_RESOURCE_TYPES,k as STACK_CLEANUP_PHASES,qr as STACK_FAILED_STATE_PATTERN,Zr as STACK_NOT_FOUND_PATTERN,F as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,Po as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,Ma as StackUnavailableError,m as StepProgressSchema,rs as StepRegistry,or as TICKET_VERDICT_SOURCES,li as TRAIL_BUCKET_OUTPUT_KEY,Ti as TRAIL_KEY_ARN_OUTPUT_KEY,wt as TemplateHashError,Ht as TemplateHashService,ir as TicketVerdictSourceSchema,oo as ValidationError,tn as accountsConfigToOUTree,Le as activateCostAllocationTags,pe as activateTrustedAccess,Ta as advertisableDriftVerbs,Is as advertisableRemediationVerbs,Gi as applyRetainFlip,Ps as approvalRefusalReason,Ii as archiveCompletedRemediationJournal,mo as artefactOutputKey,xa as assertLeaseBeforeStack,qi as assessForgetResumability,ja as assumeRootForTask,qo as buildAccountRegionPairs,Ce as buildAccountToOUMap,Hn as buildBuildSecretSessionPolicy,is as buildDeployPlan,wn as buildDeploySessionPolicy,fs as buildDestructionTicket,_a as buildDriftRepairTicket,Go as buildParamsContext,Zo as buildRegionList,xn as buildSatelliteRecordIndex,Zt as buildStepContextBuildConfig,ie as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,ua as captureLegacySurfaces,Yi as captureRemediationForensics,zo as cascadeHomeRegion,$o as cascadeOperationKey,ya as checkDeployPathStackAvailability,ge as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,_ as clampDeploymentEventStrings,Ai as classifyDriftFailure,Es as classifyImpact,Mn as classifyZoneRecords,It as clearDependencyIntegrityCache,mi as clearDriftSuspects,Oa as collectIdentityPinCandidates,zi as completeForgetAfterConverge,$i as completeForgetAfterDeploy,Bi as composeFlipCapabilities,La as composePostFailureRepairOffer,ye as composeSdkAbortSignal,ns as computeAssemblyDigest,as as computeDeployPlan,yi as computeRemediationOpId,Ho as computeSecretsDrift,Ki as computeTemplateDigest,Ns as computeTicketDigest,qt as convertCloudFormationOutputsToRecord,De as createAccount,W as createDeployEmitter,ct as createEmptyState,xs as createMemoisedPlanLoader,dn as createPublicResolvers,go as createSequencedCallbacks,vn as createSystemDnsNameProbe,si as decideNextTransition,Pa as decodeLegacyAnchor,ci as decommissionMemberTrailStorage,di as defaultDriftJournalDir,Vi as defaultRemediationForensicsDir,hi as defaultRemediationJournalDir,fa as degradedIdentityPinOutcomes,gn as deleteChildNsFromParent,dt as deleteDomainState,St as deleteStateFile,bo as deploy,Cn as deployDelegatedDomain,cs as derivePropertyChanges,Ea as deriveRemovalTemplate,it as deriveResourcesFromManifestStacks,Xi as deriveRetainFlipTemplate,wo as deriveStaleParameters,le as describeOrganisation,te as describeTargetReadinessReason,Yo as destroy,Di as detectStackDrift,ss as digestHead,$n as dockerBuilder,Ue as drainPages,Qt as emitProgress,Ye as enableCentralisedRootAccess,me as enableIpamDelegatedAdmin,Te as enablePolicyTypes,Re as enableRamSharing,_e as enableServiceAccess,gt as ensureDependencyIntegrity,Xa as ensureEnforceSsl,Se as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Cs as evaluateDestructionConsents,gs as executableRemediationVerbs,rn as extractAllAccountNames,Jo as extractConsumedSsmParameters,he as extractErrorName,xo as failure,Ri as fetchLastOperationEvents,yo as fileExists,To as filterDangerousEnvVars,Pe as findAccount,Ne as findDevelopmentOuId,Hi as findMarkedResourcesByOpId,Mi as findRemediationJournalByOpId,ca as findRemovalDeletionFailures,Sa as findResourcesPresent,en as flattenAccountsToEnvironments,fi as formatDriftPreFlightBlock,ga as formatDriftRepairOffer,Ut as formatInfrastructureError,Ra as formatPinOutcomeDetail,ea as formatRecreateInFlightCures,Yr as getApplicationDeployOrder,Vr as getApplicationDestroyOrder,Gr as getApplicationStackName,Jr as getApplicationStepId,wr as getApplicationStepName,ts as getDestroyStepId,Br as getOrganisationStackName,br as getParallelDeployGroups,kr as getParallelDestroyGroups,bt as getSourceContext,Tt as getStateFilePath,Ft as getStructuralHint,kt as hasCdkDifferences,fo as hasDockerfile,ut as hashDomainDirectory,Me as isAborted,an as isAccountsConfig,Ur as isApplicationOperation,Kr as isApplicationStack,vt as isCdkError,Ss as isDataLoss,kn as isDelegatedToRoute53,ha as isDeployPathBlockingStatus,Va as isEnforceSslStatement,Uo as isFailure,Fe as isOULeaf,jr as isOpenNextPattern,Fr as isOrganisationOperation,nn as isOuOnlyAccountBucket,Xr as isQuarantineDetail,Dr as isRemediationPlaceholderPhysicalId,Hr as isRetainedBucketsDetail,Wa as isRootTaskPolicyArn,bn as isRoute53NameServer,ls as isStatefulResourceType,on as isStringArray,vo as isSuccess,Ls as legalRemediationVerbs,ue as listAccounts,xi as listActiveRemediationOps,vi as listActiveRemediationOpsForContext,Ms as loadDeployPlan,_o as maskSensitiveOutput,ai as mergeReconciledProviderAccounts,Fn as normaliseRecordName,In as nsDelegationPhysicalName,qn as openNextBuilder,$a as parseAccountsConfiguration,Wt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,Yt as parseDiffOutput,Ao as parseShellArgs,jo as partitionAccounts,Jn as partitionForRegion,ra as partitionPreFlightByRemediation,pa as pinProbeCoverage,fe as placeAccountsInOUs,ae as probeAccountStackExists,Xo as probeSecretsDrift,ti as projectAccountRows,ri as projectScalarSummary,wi as proveFlipMetadataOnly,la as proveRemovalTargetsOnly,Rt as readDomainState,ui as readDriftSuspects,Ui as readRemediationJournal,Ji as readRetainFlipState,st as readStateFile,ii as reconcileProviderAccounts,Ei as reconcileTrailMigration,mt as recordDomainDeployState,Pi as recordDriftSuspects,Ee as regionDisabledMessage,_t as regionSuffix,be as registerSecurityDelegates,ur as remediationPhaseRank,Pr as remediationPlaceholderPhysicalId,hs as renderConsentVerdictLines,ys as renderDestructionTicketLines,Ca as renderIdentityPinReportLines,ma as renderPinReportLines,_s as renderPlanLines,Ts as renderPlanSummary,Xn as resolveBuildArgs,Bn as resolveBuildSecretSessionProvider,Vn as resolveBuildSecrets,Gn as resolveSecretRefValue,Ko as restart,Ha as restoreAndReconcileQuarantinedBucket,Ba as restoreBucketPolicy,us as runApprovalGate,fn as runCaaPreflight,yn as runDelegatedDomainDestroy,Os as runDestructionGate,Oi as runDriftPreFlight,Aa as runDriftRepairGate,ta as runForgetSurgery,Na as runIdentityPinMigration,Da as runIdentitySurfaceGate,cn as runOpenNextBuild,ln as runOrganisationSetup,da as runPinRemediation,sa as runRecreatePreFlight,ia as runRecreateSurgery,Li as runRoute53RecordPreflight,Rs as signApprovalToken,Ro as sleep,No as sleepAbortable,Ie as snapshotIdentityCentre,aa as snapshotPolicyForType,Kn as sourcedRefsFromBuildArgs,Mt as startStackMonitoring,zn as staticSiteBuilder,tt as stubCallerIdentity,Mo as success,Fi as sweepExpiredRemediationJournals,oa as synthTemplateDeclaresResource,Ka as synthesiseEnforceSslDocument,Un as systemDnsNameProbe,Ln as templateOwnsDelegationRecord,Qr as toPascalCase,Ga as toResourcePolicyStatements,So as toServiceError,As as toWirePlanChanges,Ya as triageBucketPolicy,A as truncateUtf16Safe,Fa as unlockBucket,ba as unlockQueue,de as updateBackupGlobalSettings,lt as updateTemplateHash,Qn as validateBuildGroup,lr as verbsForDriftVerdict,ps as verifyApprovalToken,Ja as verifyOrgTrailDelivery,Qi as verifyRetainFlipDiff,Dn as waitForNsPropagation,rt as wrapApplicationError,pt as writeDomainState,bi as writeRemediationJournal,Et as writeStateFile};

package/dist/src/orchestration/application/applicationDeploy.js

@@ -1 +1 @@
-var ve=Object.defineProperty;var v=(e,a)=>ve(e,"name",{value:a,configurable:!0});import{join as ue}from"path";import{CloudFormationClient as Pe}from"@aws-sdk/client-cloudformation";import{EC2Client as Re}from"@aws-sdk/client-ec2";import{success as C,failure as c}from"@fjall/generator";import{logger as $}from"@fjall/util/logger";import{ImageTagSchema as Ce,getErrorMessage as ge,imageTagParameterName as Ie,maskSensitiveOutput as S}from"@fjall/util";import{parseDockerDeclarationsFromManifest as Oe}from"@fjall/util/manifest";import{stubCallerIdentity as Ae}from"../../types/deployment/index.js";import{getApplicationDeployOrder as Le,getApplicationStackName as I,getApplicationStepName as pe,getApplicationStepId as fe,APPLICATION_STACKS as R}from"../../types/operations.js";import{CdkContextBuilder as Be}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as Me,bootstrapOrFail as Fe}from"../contextHelpers.js";import{buildBootstrapTagsIfResolved as $e}from"../bootstrapTags.js";import{hasOrganisationTierAccount as xe}from"../../aws/organisations/accountGlobals.js";import{runDetectionPipeline as je}from"./detectionPipeline.js";import{assertEngineCompatibleWithAssembly as Ge}from"./engineCompat.js";import{STEP_IDS as _,STEP_NAMES as He}from"../../types/stepDefinitions.js";import{StepRegistry as Ue}from"../../steps/stepRegistry.js";import{checkTargetReadiness as _e}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as We}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as Ke}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as me,runDockerBuild as qe}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as Ve,getStackNamesToDeploy as ze,deployParallelPhase as Je,deployStackSequential as Ye,runDockerPreCompute as Qe,runLambdaVersionPublish as Xe,createBuildCallbacks as Ze,willRunDockerBuild as et}from"./applicationDeployHelpers.js";import{verifyAssemblyIntegrity as ke}from"./assemblyIntegrity.js";import{captureDatabaseConnectionOutputs as tt,captureServiceTaskDefinitions as rt,reconcileDatabaseEndpointChange as at}from"./databaseEndpointReconcile.js";import{deployCodeOnly as nt}from"./codeOnlyDeploy.js";import{checkDeployPathStackAvailability as he}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as W}from"./leaseGate.js";import{collectFullDeployArtefacts as ot}from"./artefactCollection.js";import{CfnRegistryService as it}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as st}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as ct}from"./approvalGate.js";import{buildDestructionTicket as lt,runDestructionGate as dt}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as ut,signApprovalToken as gt}from"./plan/approvalToken.js";import{computeAssemblyDigest as pt}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as ft}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as mt}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as kt}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as ye}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as ht,runPinRemediation as yt}from"../remediation/pinRemediation.js";import{runRecreatePreFlight as St}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as bt}from"../remediation/recreateResource.js";const x="applicationDeploy";function wt(e){const a=Object.entries(e);if(a.length===0)return;const n={};for(const[t,i]of a){const b=Ie(t);n[b]=i}return n}v(wt,"buildCdkImageTagParameters");function Tt(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return c(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return c(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return c(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return c(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return c(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const a=Object.entries(e.serviceImageTags);if(a.length===0)return c(new Error("serviceImageTags must name at least one service"));for(const[n,t]of a){const i=Ce.safeParse(t);if(!i.success)return c(new Error(`serviceImageTags.${n} is not a valid image tag: ${i.error.message}`))}}return C(void 0)}v(Tt,"validateRollbackOptions");function Se(e,a,n){if(e.onStackTargets===void 0||n.length===0)return;const t=a.awsProvider.getAccountId(),i=a.awsProvider.getRegion();e.onStackTargets(n.map(b=>({stackName:b,...t!==""?{accountId:t}:{},...i!==""?{region:i}:{}})))}v(Se,"emitStackTargets");async function ur(e,a,n){const{callbacks:t,options:i}=e,b=Date.now(),j=i?.mode??(i?.imageTag||i?.serviceImageTags?"rollback":i?.deployOnly?"code-only":"full");if(j==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),c(r)}const Y=Tt(i);if(!Y.success){const r=S(Y.error.message),o=new Error(r);return t.onError?.(o),c(o)}const G=Be.buildDeploymentContext({deployType:"application",target:n.appName,path:n.path,region:a.awsProvider.getRegion(),callerIdentity:Ae(a.awsProvider.getAccountId()),...Me({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc}),...e.managedDomainBindings!==void 0?{managedDomainBindings:e.managedDomainBindings}:{}},{verbose:i?.verbose,infraOnly:i?.infraOnly},e.orgConfig),E=a.frameworkRegistry.resolve({appPath:n.path});let Q;const L=j==="rollback";if(E&&!L){Q=E.builder.plan({appPath:n.path},E.detection);const r=Ze(t),o=await E.builder.build(n.path,Q,r,{skipBuild:i?.skipBuild,infraOnly:i?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!o.success){const s=new Error(S(o.error.message));return t.onError?.(s),c(s)}}if(j==="code-only"||L){t.onLog?.(L?i?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(i.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${i?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=ue(n.path,"cdk.out"),o=Ge({cdkOutPath:r,onWarning:v(f=>t.onLog?.(f,"warn"),"onWarning")});if(!o.success){const f=new Error(S(o.error.message));return t.onError?.(f),c(f)}const s=Oe(r),p=s.declaresBuild,l=E?.detection.hasDockerfile===!0,u=p||l;$.debug(x,"Deploy-only branch entered",{mode:j,imageTag:i?.imageTag,serviceImageTags:i?.serviceImageTags,appName:n.appName,appPath:n.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:E?.builder.name,hasDockerfileFromManifest:p,hasDockerfileFromDisk:l,hasDockerfile:u,manifestDockerServiceCount:s.ecsServices.length,manifestDockerPaths:s.ecsServices.map(f=>f.docker.path),manifestLambdaDockerEntryCount:s.lambdaEntries.length}),!p&&!l&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const m=await he([I(n.appName,R.COMPUTE)],a.cfnService,e.abortSignal);if(!m.success)return t.onError?.(m.error),c(m.error);Se(t,a,[I(n.appName,R.COMPUTE)]);let d={},h;if(!L&&e.dockerProvider!==void 0&&u){$.debug(x,"Running Docker build before code-only deploy",{source:p?"manifest":"disk"});const f=await qe(e,a,n,t);if(!f.success)return c(f.error);d=f.data.contentHashTagsByService,h=f.data}else $.debug(x,"Skipping Docker build",{reason:L?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const k=await W(e.assertLeaseForStack,I(n.appName,R.COMPUTE),e.abortSignal);return k!==void 0?(t.onError?.(k),c(k)):nt(e,a,n,d,h)}t.onLog?.("Analysing infrastructure\u2026","info");const H=await je(n,a,G,t,e.abortSignal);if(!H.success){const r=new Error(S(H.error.message),{cause:H.error});return t.onError?.(r),c(r)}const g=H.data;try{await t.onDetectionComplete?.({...g,builderName:E?.builder.name??"unknown"})}catch(r){const o=new Error(S(ge(r)),{cause:r});return t.onError?.(o),c(o)}const be={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:i?.infraOnly??!1,hasDockerfile:g.hasDockerfile,pattern:g.pattern,resources:g.resources,...E&&{builderName:E.builder.name}},X=Ue.getSteps(be),Z=X.findIndex(r=>r.id===_.TARGET_READINESS),ee=await Ke(t,{stepId:_.TARGET_READINESS,stepName:He.TARGET_READINESS,...Z>=0&&{stepIndex:Z,totalSteps:X.length}},async()=>{if(i?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=a.awsProvider.getAccountId(),o=e.orgConfig?.providerAccounts.find(u=>u.id===r)?.name,s=a.awsProvider.getCredentials(),p=We(e.orgConfig),l=await _e({cloudFormation:a.awsProvider.getClient(Pe),ec2:new Re({region:p,...s!==void 0&&{credentials:s}})},{id:r,...o!==void 0&&{name:o}},a.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return l.success?l.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(S(l.data.advisory))}:{kind:"error",error:new Error(S(l.error.message),{cause:l.error})}},e.abortSignal);if(!ee.success)return ee;const N=Le({pattern:g.pattern,resources:g.resources}),O=N.length,te=g.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE)&&i?.infraOnly!==!0;if(!g.hasDifferences&&!i?.force&&!te){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(i?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=g.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE);for(let s=0;s<N.length;s++){const p=N[s];r&&p===R.COMPUTE&&(t.onStepStart?.(_.DOCKER_OPERATIONS,me),t.onStepComplete?.(_.DOCKER_OPERATIONS,me,"skipped"));const l=fe(p,"deploy"),u=pe(p,"deploy");t.onStepStart?.(l,u,s,O),t.onStepComplete?.(l,u,"skipped",s,O)}const o=await a.stackService.resolveWebsiteUrl(n.appName);return C({target:n.appName,deploymentType:"application",outputs:o?{websiteUrl:o}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-b})}const A=ue(n.path,"cdk.out"),w=ze({deployOrder:N,stackChanges:g.stackChanges,appName:n.appName,force:i?.force===!0,computeBuildPossible:te});Se(t,a,[...w]);const K=await he([...w],a.cfnService,e.abortSignal);if(!K.success)return t.onError?.(K.error),c(K.error);const re={stacksToDeploy:[...w],imageBuild:et({stackNamesToDeploy:w,appName:n.appName,hasDockerProvider:e.dockerProvider!==void 0,hasDockerfile:g.hasDockerfile})},ae=pt(g.currentHashes,re),q=ft({cfnService:a.cfnService,cdkOutPath:A,changedStacks:[...w],assemblyDigest:ae,registry:new it(a.awsProvider),changeSetProbe:new st(a.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),V=await mt(a.awsProvider,{stackNames:[...w],cdkOutPath:A,cfnService:a.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(V.kind==="blocked"){const r=new Error(V.message);return t.onError?.(r),c(r)}const ne=V.verifiedAbsentByNecessity??[],U=e.approvalGate!==void 0||i?.approvalToken!==void 0&&i.approvalToken!==""||i?.planOnly===!0;if(U){const r=await ct({approvalGate:e.approvalGate,options:i??{},target:n.appName,cdkOutPath:A,detection:{stackChanges:g.stackChanges,currentHashes:g.currentHashes},scope:re,cfnService:a.cfnService,loadPlan:q,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const o=r.data;if(o.kind==="rejected")return t.onLog?.(`Deploy rejected: ${S(o.reason)}`,"warn"),C({target:n.appName,deploymentType:"application",rejected:!0,artefacts:[],...o.planDetail!==void 0?{planDetail:o.planDetail}:{},durationMs:Date.now()-b});if(o.kind==="awaiting"){const s=await q(),p=s.success?lt(s.data,ne):void 0;return C({target:n.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:o.approvalToken,assemblyDigest:o.assemblyDigest,planDetail:o.planDetail,...p!==void 0?{destructionTicket:p}:{},artefacts:[],durationMs:Date.now()-b})}}const D=await dt({loadPlan:q,options:i??{},target:n.appName,callbacks:t,verifiedAbsentByNecessity:ne,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!D.success)return t.onError?.(D.error),c(D.error);if(D.data.kind==="withheld"){const r=U?gt({assemblyDigest:ae,ttlMs:ut}):void 0;return C({target:n.appName,deploymentType:"application",destructionPending:!0,destructionTicket:D.data.ticket,destructionOutcome:D.data.outcome,destructionHaltReasons:D.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-b})}if(D.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:o}=D.data,s=r.resources.filter(l=>o.get(l.physicalName)==="pin");if(s.length>0){t.onLog?.(`Pin remediation for ${n.appName}: probing live value(s) for ${s.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied`,"warn");const l=await yt(a.awsProvider,{targets:s.map(u=>({stack:u.stack,logicalId:u.logicalId,resourceType:u.resourceType,physicalName:u.physicalName,offendingProperties:u.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const u of ht(l))t.onLog?.(u,"warn");return s.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),C({target:n.appName,deploymentType:"application",pinPending:!0,pinReport:l,pinDeferredConsents:r.resources.length-s.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-b})}const p=r.resources.filter(l=>l.finding==="pinned-name-replacement"&&o.get(l.physicalName)==="recreate");if(p.length>0){const l=new Map;for(const d of p){const h=l.get(d.stack)??[];h.push(d),l.set(d.stack,h)}const u=await St(a.awsProvider,{stacks:[...l].map(([d,h])=>({stackName:d,targets:h.map(k=>({logicalId:k.logicalId,resourceType:k.resourceType,physicalId:k.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!u.success){const d=new Error(S(u.error.message),{cause:u.error});return t.onError?.(d),c(d)}const m=[];for(const[d,h]of l){const k=await W(e.assertLeaseForStack,d,e.abortSignal,"destroy");if(k!==void 0)return m.length>0&&t.onLog?.(`Surgery already completed on ${m.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(k),c(k);const f=h.map(y=>y.physicalName);t.onLog?.(`Recreate remediation for ${n.appName}: orchestrating the pinned-name replacement of ${f.join(", ")} on ${d}`,"warn");const F=await bt(a.awsProvider,{stackName:d,targets:h.map(y=>({logicalId:y.logicalId,resourceType:y.resourceType,physicalId:y.physicalName})),appName:n.appName,consentedPhysicalNames:f,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:h.map(y=>y.logicalId),onProgress:v(y=>t.onLog?.(y,"info"),"onProgress"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!F.success){const y=m.length>0?` Surgery already completed on ${m.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",T=new Error(S(`${F.error.message}${y}`));return t.onError?.(T),c(T)}m.push(`${d} (${f.join(", ")})`)}}}const we=e.orgConfig!==void 0&&!xe(e.orgConfig.providerAccounts),Te=$e({account:e.orgConfig?.providerAccounts.find(r=>r.id===a.awsProvider.getAccountId()),estate:we?"solo":"org"}),oe=await Fe(a,G,t,Te);if(!oe.success)return oe;const ie=I(n.appName,R.DATABASE),z=w.has(ie),Ee=z?await tt(a.cfnService,n.appName,e.abortSignal):void 0,Ne=z?await rt(a.ecsResolver,a.ecsService,n.appName,e.abortSignal):void 0,B={},M=new Map;let se,ce={};const P=v(async()=>{!z||!M.has(ie)||await at({appName:n.appName,connectionOutputsBefore:Ee,serviceTaskDefinitionsBefore:Ne,services:{cfnService:a.cfnService,ecsService:a.ecsService,ecsResolver:a.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let r=0;r<N.length;r++){const o=N[r],s=I(n.appName,o),p=fe(o,"deploy"),l=pe(o,"deploy");if(!w.has(s)){t.onStepStart?.(p,l,r,O),t.onLog?.(`Skipping ${o} \u2014 no changes detected`,"info"),t.onStepComplete?.(p,l,"skipped",r,O);continue}const u=await W(e.assertLeaseForStack,s,e.abortSignal);if(u!==void 0)return await P(),t.onError?.(u),c(u);const m=Ve(N,r,n.appName,w);if(m.length>=2){const T=await ke({hashService:a.hashService,cdkOutPath:A,stackNames:m.map(J=>I(n.appName,J)),detectionHashes:g.currentHashes,approvalGated:U});if(!T.success)return await P(),t.onError?.(T.error),c(T.error);const de=await Je(m,n,a,G,t,r,O,g,B,M);if(!de.success)return await P(),c(await ye(a.awsProvider,{stackNames:m.map(J=>I(n.appName,J)),appName:n.appName,originalError:de.error,cfnService:a.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=m.length-1;continue}const d=await Qe(o,e,a,n,t,g.hasDockerfile);if(d!==null&&!d.success)return await P(),c(d.error);d!==null&&d.success&&(se=d.data);const h=d!==null&&d.success?d.data.contentHashTagsByService:{},k=wt(h);if(d!==null){const T=await W(e.assertLeaseForStack,s,e.abortSignal);if(T!==void 0)return await P(),t.onError?.(T),c(T)}const f=await ke({hashService:a.hashService,cdkOutPath:A,stackNames:[s],detectionHashes:g.currentHashes,approvalGated:U});if(!f.success)return await P(),t.onError?.(f.error),c(f.error);const F=await Ye(o,a,G,t,r,O,B,k!==void 0||e.abortSignal!==void 0?{...k!==void 0?{parameters:k}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!F.success)return await P(),c(await ye(a.awsProvider,{stackNames:[s],appName:n.appName,originalError:F.error,cfnService:a.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));o===R.COMPUTE&&(ce=await Xe(n,a,t,h,e.abortSignal));const y=g.currentHashes.get(s);y&&M.set(s,y)}if(await P(),M.size>0){const r=await a.hashService.updateStateAfterDeploy(n.path,M);if(!r.success){const o=S(r.error.message);$.debug(x,"Failed to update state file",{error:o}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${o}`,"warn")}}const le=await a.stackService.resolveWebsiteUrl(n.appName);le&&(B.websiteUrl=le);const De=await ot(a,n.appName,se,t,A,ce,e.abortSignal);return await kt(a.awsProvider,{stackNames:[...w],appName:n.appName,onLog:v((r,o)=>t.onLog?.(r,o),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{$.debug(x,"Forget completion sweep failed",{error:S(ge(r))})}),C({target:n.appName,deploymentType:"application",outputs:Object.keys(B).length>0?B:void 0,artefacts:De,durationMs:Date.now()-b})}v(ur,"deployApplication");export{ur as deployApplication,Se as emitStackTargets};
+var De=Object.defineProperty;var D=(e,n)=>De(e,"name",{value:n,configurable:!0});import{join as ge}from"path";import{CloudFormationClient as Re}from"@aws-sdk/client-cloudformation";import{EC2Client as Ce}from"@aws-sdk/client-ec2";import{success as I,failure as u}from"@fjall/generator";import{logger as F}from"@fjall/util/logger";import{ImageTagSchema as Ie,getErrorMessage as Y,imageTagParameterName as Oe,maskSensitiveOutput as S}from"@fjall/util";import{parseDockerDeclarationsFromManifest as Ae}from"@fjall/util/manifest";import{stubCallerIdentity as Le}from"../../types/deployment/index.js";import{getApplicationDeployOrder as Be,getApplicationStackName as O,getApplicationStepName as fe,getApplicationStepId as pe,APPLICATION_STACKS as C}from"../../types/operations.js";import{CdkContextBuilder as Me}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as $e,buildCapacityIdentityContext as xe,bootstrapOrFail as Fe}from"../contextHelpers.js";import{buildBootstrapTagsIfResolved as je}from"../bootstrapTags.js";import{hasOrganisationTierAccount as Ge}from"../../aws/organisations/accountGlobals.js";import{runDetectionPipeline as He}from"./detectionPipeline.js";import{assertCapacityPinsSupportedByAssembly as Ue,assertEngineCompatibleWithAssembly as _e}from"./engineCompat.js";import{STEP_IDS as _,STEP_NAMES as We}from"../../types/stepDefinitions.js";import{StepRegistry as Ke}from"../../steps/stepRegistry.js";import{checkTargetReadiness as qe}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as Ve}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as ze}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as me,runDockerBuild as Je}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as Ye,getStackNamesToDeploy as Qe,deployParallelPhase as Xe,deployStackSequential as Ze,runDockerPreCompute as et,runLambdaVersionPublish as tt,createBuildCallbacks as rt,willRunDockerBuild as nt}from"./applicationDeployHelpers.js";import{verifyAssemblyIntegrity as ye}from"./assemblyIntegrity.js";import{captureDatabaseConnectionOutputs as at,captureServiceTaskDefinitions as ot,reconcileDatabaseEndpointChange as it}from"./databaseEndpointReconcile.js";import{deployCodeOnly as st}from"./codeOnlyDeploy.js";import{checkDeployPathStackAvailability as ke}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as W}from"./leaseGate.js";import{collectFullDeployArtefacts as ct}from"./artefactCollection.js";import{CfnRegistryService as lt}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as dt}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as ut}from"./approvalGate.js";import{buildDestructionTicket as gt,runDestructionGate as ft}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as pt,signApprovalToken as mt}from"./plan/approvalToken.js";import{computeAssemblyDigest as yt}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as kt}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as ht}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as St}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as he}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as bt,runPinRemediation as wt}from"../remediation/pinRemediation.js";import{degradedIdentityPinOutcomes as Se,renderIdentityPinReportLines as Tt}from"../remediation/migrateIdentity.js";import{runRecreatePreFlight as Et}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as Pt}from"../remediation/recreateResource.js";const j="applicationDeploy";function Nt(e){const n=Object.entries(e);if(n.length===0)return;const a={};for(const[t,i]of n){const w=Oe(t);a[w]=i}return a}D(Nt,"buildCdkImageTagParameters");function vt(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return u(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return u(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return u(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return u(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return u(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const n=Object.entries(e.serviceImageTags);if(n.length===0)return u(new Error("serviceImageTags must name at least one service"));for(const[a,t]of n){const i=Ie.safeParse(t);if(!i.success)return u(new Error(`serviceImageTags.${a} is not a valid image tag: ${i.error.message}`))}}return I(void 0)}D(vt,"validateRollbackOptions");function be(e,n,a){if(e.onStackTargets===void 0||a.length===0)return;const t=n.awsProvider.getAccountId(),i=n.awsProvider.getRegion();e.onStackTargets(a.map(w=>({stackName:w,...t!==""?{accountId:t}:{},...i!==""?{region:i}:{}})))}D(be,"emitStackTargets");async function yr(e,n,a){const{callbacks:t,options:i}=e,w=Date.now(),G=i?.mode??(i?.imageTag||i?.serviceImageTags?"rollback":i?.deployOnly?"code-only":"full");if(G==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),u(r)}const Q=vt(i);if(!Q.success){const r=S(Q.error.message),o=new Error(r);return t.onError?.(o),u(o)}const B=Me.buildDeploymentContext({deployType:"application",target:a.appName,path:a.path,region:n.awsProvider.getRegion(),callerIdentity:Le(n.awsProvider.getAccountId()),...$e({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc}),...e.managedDomainBindings!==void 0?{managedDomainBindings:e.managedDomainBindings}:{},...xe(e)},{verbose:i?.verbose,infraOnly:i?.infraOnly},e.orgConfig),P=n.frameworkRegistry.resolve({appPath:a.path});let X;const M=G==="rollback";if(P&&!M){X=P.builder.plan({appPath:a.path},P.detection);const r=rt(t),o=await P.builder.build(a.path,X,r,{skipBuild:i?.skipBuild,infraOnly:i?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!o.success){const c=new Error(S(o.error.message));return t.onError?.(c),u(c)}}if(G==="code-only"||M){t.onLog?.(M?i?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(i.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${i?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=ge(a.path,"cdk.out"),o=_e({cdkOutPath:r,onWarning:D(f=>t.onLog?.(f,"warn"),"onWarning")});if(!o.success){const f=new Error(S(o.error.message));return t.onError?.(f),u(f)}const c=Ue({cdkOutPath:r,capacityIdentityWire:B.capacityIdentity,appName:a.appName});if(!c.success){const f=new Error(S(c.error.message));return t.onError?.(f),u(f)}const m=Ae(r),l=m.declaresBuild,y=P?.detection.hasDockerfile===!0,g=l||y;F.debug(j,"Deploy-only branch entered",{mode:G,imageTag:i?.imageTag,serviceImageTags:i?.serviceImageTags,appName:a.appName,appPath:a.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:P?.builder.name,hasDockerfileFromManifest:l,hasDockerfileFromDisk:y,hasDockerfile:g,manifestDockerServiceCount:m.ecsServices.length,manifestDockerPaths:m.ecsServices.map(f=>f.docker.path),manifestLambdaDockerEntryCount:m.lambdaEntries.length}),!l&&!y&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const s=await ke([O(a.appName,C.COMPUTE)],n.cfnService,e.abortSignal);if(!s.success)return t.onError?.(s.error),u(s.error);be(t,n,[O(a.appName,C.COMPUTE)]);let d={},k;if(!M&&e.dockerProvider!==void 0&&g){F.debug(j,"Running Docker build before code-only deploy",{source:l?"manifest":"disk"});const f=await Je(e,n,a,t);if(!f.success)return u(f.error);d=f.data.contentHashTagsByService,k=f.data}else F.debug(j,"Skipping Docker build",{reason:M?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const b=await W(e.assertLeaseForStack,O(a.appName,C.COMPUTE),e.abortSignal);return b!==void 0?(t.onError?.(b),u(b)):st(e,n,a,d,k)}t.onLog?.("Analysing infrastructure\u2026","info");const H=await He(a,n,B,t,e.abortSignal);if(!H.success){const r=new Error(S(H.error.message),{cause:H.error});return t.onError?.(r),u(r)}const p=H.data;try{await t.onDetectionComplete?.({...p,builderName:P?.builder.name??"unknown"})}catch(r){const o=new Error(S(Y(r)),{cause:r});return t.onError?.(o),u(o)}const we={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:i?.infraOnly??!1,hasDockerfile:p.hasDockerfile,pattern:p.pattern,resources:p.resources,...P&&{builderName:P.builder.name}},Z=Ke.getSteps(we),ee=Z.findIndex(r=>r.id===_.TARGET_READINESS),te=await ze(t,{stepId:_.TARGET_READINESS,stepName:We.TARGET_READINESS,...ee>=0&&{stepIndex:ee,totalSteps:Z.length}},async()=>{if(i?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=n.awsProvider.getAccountId(),o=e.orgConfig?.providerAccounts.find(y=>y.id===r)?.name,c=n.awsProvider.getCredentials(),m=Ve(e.orgConfig),l=await qe({cloudFormation:n.awsProvider.getClient(Re),ec2:new Ce({region:m,...c!==void 0&&{credentials:c}})},{id:r,...o!==void 0&&{name:o}},n.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return l.success?l.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(S(l.data.advisory))}:{kind:"error",error:new Error(S(l.error.message),{cause:l.error})}},e.abortSignal);if(!te.success)return te;const N=Be({pattern:p.pattern,resources:p.resources}),A=N.length,re=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(C.COMPUTE)&&i?.infraOnly!==!0;if(!p.hasDifferences&&!i?.force&&!re){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(i?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(C.COMPUTE);for(let c=0;c<N.length;c++){const m=N[c];r&&m===C.COMPUTE&&(t.onStepStart?.(_.DOCKER_OPERATIONS,me),t.onStepComplete?.(_.DOCKER_OPERATIONS,me,"skipped"));const l=pe(m,"deploy"),y=fe(m,"deploy");t.onStepStart?.(l,y,c,A),t.onStepComplete?.(l,y,"skipped",c,A)}const o=await n.stackService.resolveWebsiteUrl(a.appName);return I({target:a.appName,deploymentType:"application",outputs:o?{websiteUrl:o}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-w})}const L=ge(a.path,"cdk.out"),T=Qe({deployOrder:N,stackChanges:p.stackChanges,appName:a.appName,force:i?.force===!0,computeBuildPossible:re});be(t,n,[...T]);const K=await ke([...T],n.cfnService,e.abortSignal);if(!K.success)return t.onError?.(K.error),u(K.error);const ne={stacksToDeploy:[...T],imageBuild:nt({stackNamesToDeploy:T,appName:a.appName,hasDockerProvider:e.dockerProvider!==void 0,hasDockerfile:p.hasDockerfile})},ae=yt(p.currentHashes,ne),q=kt({cfnService:n.cfnService,cdkOutPath:L,changedStacks:[...T],assemblyDigest:ae,registry:new lt(n.awsProvider),changeSetProbe:new dt(n.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),V=await ht(n.awsProvider,{stackNames:[...T],cdkOutPath:L,cfnService:n.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(V.kind==="blocked"){const r=new Error(V.message);return t.onError?.(r),u(r)}const oe=V.verifiedAbsentByNecessity??[],U=e.approvalGate!==void 0||i?.approvalToken!==void 0&&i.approvalToken!==""||i?.planOnly===!0;if(U){const r=await ut({approvalGate:e.approvalGate,options:i??{},target:a.appName,cdkOutPath:L,detection:{stackChanges:p.stackChanges,currentHashes:p.currentHashes},scope:ne,cfnService:n.cfnService,loadPlan:q,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const o=r.data;if(o.kind==="rejected")return t.onLog?.(`Deploy rejected: ${S(o.reason)}`,"warn"),I({target:a.appName,deploymentType:"application",rejected:!0,artefacts:[],...o.planDetail!==void 0?{planDetail:o.planDetail}:{},durationMs:Date.now()-w});if(o.kind==="awaiting"){const c=await q(),m=c.success?gt(c.data,oe):void 0;return I({target:a.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:o.approvalToken,assemblyDigest:o.assemblyDigest,planDetail:o.planDetail,...m!==void 0?{destructionTicket:m}:{},artefacts:[],durationMs:Date.now()-w})}}const v=await ft({loadPlan:q,options:i??{},target:a.appName,callbacks:t,verifiedAbsentByNecessity:oe,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!v.success)return t.onError?.(v.error),u(v.error);if(v.data.kind==="withheld"){const r=U?mt({assemblyDigest:ae,ttlMs:pt}):void 0;return I({target:a.appName,deploymentType:"application",destructionPending:!0,destructionTicket:v.data.ticket,destructionOutcome:v.data.outcome,destructionHaltReasons:v.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-w})}if(v.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:o}=v.data,c=r.resources.filter(l=>o.get(l.physicalName)==="pin");if(c.length>0){const l=c.filter(d=>d.finding==="rename-detected"),y=c.filter(d=>d.finding!=="rename-detected");t.onLog?.(`Pin remediation for ${a.appName}: ${c.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied to AWS`,"warn");let g;if(l.length>0){if(e.identityPinRunner!==void 0)try{g=await e.identityPinRunner(l,e.abortSignal)}catch(d){g={outcomes:Se(l,"unknown",`identity-pin runner failed: ${S(Y(d))} \u2014 fix the cause, then run 'fjall migrate identity'`),verified:[],clean:!1}}else g={outcomes:Se(l,"unknown","this surface cannot run the identity-pin migration \u2014 run 'fjall migrate identity' to pin and validate this slot"),verified:[],clean:!1};for(const d of Tt(g))t.onLog?.(d,"warn")}let s;if(y.length>0){s=await wt(n.awsProvider,{targets:y.map(d=>({stack:d.stack,logicalId:d.logicalId,resourceType:d.resourceType,physicalName:d.physicalName,offendingProperties:d.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const d of bt(s))t.onLog?.(d,"warn")}return c.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),I({target:a.appName,deploymentType:"application",pinPending:!0,...s!==void 0?{pinReport:s}:{},...g!==void 0?{identityPinReport:g}:{},pinDeferredConsents:r.resources.length-c.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-w})}const m=r.resources.filter(l=>l.finding==="pinned-name-replacement"&&o.get(l.physicalName)==="recreate");if(m.length>0){const l=new Map;for(const s of m){const d=l.get(s.stack)??[];d.push(s),l.set(s.stack,d)}const y=await Et(n.awsProvider,{stacks:[...l].map(([s,d])=>({stackName:s,targets:d.map(k=>({logicalId:k.logicalId,resourceType:k.resourceType,physicalId:k.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!y.success){const s=new Error(S(y.error.message),{cause:y.error});return t.onError?.(s),u(s)}const g=[];for(const[s,d]of l){const k=await W(e.assertLeaseForStack,s,e.abortSignal,"destroy");if(k!==void 0)return g.length>0&&t.onLog?.(`Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(k),u(k);const b=d.map(h=>h.physicalName);t.onLog?.(`Recreate remediation for ${a.appName}: orchestrating the pinned-name replacement of ${b.join(", ")} on ${s}`,"warn");const f=await Pt(n.awsProvider,{stackName:s,targets:d.map(h=>({logicalId:h.logicalId,resourceType:h.resourceType,physicalId:h.physicalName})),appName:a.appName,consentedPhysicalNames:b,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:d.map(h=>h.logicalId),onProgress:D(h=>t.onLog?.(h,"info"),"onProgress"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!f.success){const h=g.length>0?` Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",E=new Error(S(`${f.error.message}${h}`));return t.onError?.(E),u(E)}g.push(`${s} (${b.join(", ")})`)}}}const Te=e.orgConfig!==void 0&&!Ge(e.orgConfig.providerAccounts),Ee=je({account:e.orgConfig?.providerAccounts.find(r=>r.id===n.awsProvider.getAccountId()),estate:Te?"solo":"org"}),ie=await Fe(n,B,t,Ee);if(!ie.success)return ie;const se=O(a.appName,C.DATABASE),z=T.has(se),Pe=z?await at(n.cfnService,a.appName,e.abortSignal):void 0,Ne=z?await ot(n.ecsResolver,n.ecsService,a.appName,e.abortSignal):void 0,$={},x=new Map;let ce,le={};const R=D(async()=>{!z||!x.has(se)||await it({appName:a.appName,connectionOutputsBefore:Pe,serviceTaskDefinitionsBefore:Ne,services:{cfnService:n.cfnService,ecsService:n.ecsService,ecsResolver:n.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let r=0;r<N.length;r++){const o=N[r],c=O(a.appName,o),m=pe(o,"deploy"),l=fe(o,"deploy");if(!T.has(c)){t.onStepStart?.(m,l,r,A),t.onLog?.(`Skipping ${o} \u2014 no changes detected`,"info"),t.onStepComplete?.(m,l,"skipped",r,A);continue}const y=await W(e.assertLeaseForStack,c,e.abortSignal);if(y!==void 0)return await R(),t.onError?.(y),u(y);const g=Ye(N,r,a.appName,T);if(g.length>=2){const E=await ye({hashService:n.hashService,cdkOutPath:L,stackNames:g.map(J=>O(a.appName,J)),detectionHashes:p.currentHashes,approvalGated:U});if(!E.success)return await R(),t.onError?.(E.error),u(E.error);const ue=await Xe(g,a,n,B,t,r,A,p,$,x);if(!ue.success)return await R(),u(await he(n.awsProvider,{stackNames:g.map(J=>O(a.appName,J)),appName:a.appName,originalError:ue.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=g.length-1;continue}const s=await et(o,e,n,a,t,p.hasDockerfile);if(s!==null&&!s.success)return await R(),u(s.error);s!==null&&s.success&&(ce=s.data);const d=s!==null&&s.success?s.data.contentHashTagsByService:{},k=Nt(d);if(s!==null){const E=await W(e.assertLeaseForStack,c,e.abortSignal);if(E!==void 0)return await R(),t.onError?.(E),u(E)}const b=await ye({hashService:n.hashService,cdkOutPath:L,stackNames:[c],detectionHashes:p.currentHashes,approvalGated:U});if(!b.success)return await R(),t.onError?.(b.error),u(b.error);const f=await Ze(o,n,B,t,r,A,$,k!==void 0||e.abortSignal!==void 0?{...k!==void 0?{parameters:k}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!f.success)return await R(),u(await he(n.awsProvider,{stackNames:[c],appName:a.appName,originalError:f.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));o===C.COMPUTE&&(le=await tt(a,n,t,d,e.abortSignal));const h=p.currentHashes.get(c);h&&x.set(c,h)}if(await R(),x.size>0){const r=await n.hashService.updateStateAfterDeploy(a.path,x);if(!r.success){const o=S(r.error.message);F.debug(j,"Failed to update state file",{error:o}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${o}`,"warn")}}const de=await n.stackService.resolveWebsiteUrl(a.appName);de&&($.websiteUrl=de);const ve=await ct(n,a.appName,ce,t,L,le,e.abortSignal);return await St(n.awsProvider,{stackNames:[...T],appName:a.appName,onLog:D((r,o)=>t.onLog?.(r,o),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{F.debug(j,"Forget completion sweep failed",{error:S(Y(r))})}),I({target:a.appName,deploymentType:"application",outputs:Object.keys($).length>0?$:void 0,artefacts:ve,durationMs:Date.now()-w})}D(yr,"deployApplication");export{yr as deployApplication,be as emitStackTargets};

package/dist/src/orchestration/application/destructionGate.d.ts

@@ -50,7 +50,7 @@ export declare function executableRemediationVerbs(finding: DestructionFinding):
  * interactive ceremony's verb menu, the agent ticket blocks and the shared
  * ticket-row renderer below.
  */
-export declare function advertisableRemediationVerbs(resource: Pick<DestructionTicketResource, "verbs" | "finding" | "resourceType" | "offendingProperties">): RemediationVerb[];
+export declare function advertisableRemediationVerbs(resource: Pick<DestructionTicketResource, "verbs" | "finding" | "resourceType" | "offendingProperties" | "pinSlotHint">): RemediationVerb[];
 /**
  * `hash(assemblyDigest + canonical resource set)` — the TOCTOU binding for
  * consents minted before apply time. Rows are keyed and sorted so the digest

package/dist/src/orchestration/application/destructionGate.js

@@ -1,5 +1,5 @@
-var N=Object.defineProperty;var d=(e,i)=>N(e,"name",{value:i,configurable:!0});import{createHash as D}from"node:crypto";import{success as m,failure as x}from"@fjall/generator";import{maskSensitiveOutput as C}from"@fjall/util";import{remediationPlaceholderPhysicalId as L}from"../../types/remediation.js";import{pinProbeCoverage as v}from"../remediation/pinRemediation.js";const b={"replacement-required":["abort","pin","recreate"],"pinned-name-replacement":["abort","pin","recreate"],"data-loss-delete":["abort","forget","recreate"],"resource-deleted":["abort","repair","forget","recreate"],"stack-deleted":["abort","repair","recreate"],"rename-detected":["abort","pin","recreate"],"rename-ambiguous":["abort","recreate"]};function G(e){return b[e]}d(G,"legalRemediationVerbs");const h={"replacement-required":["pin","recreate"],"pinned-name-replacement":["pin","recreate"],"data-loss-delete":["recreate"],"resource-deleted":["forget"],"stack-deleted":[],"rename-detected":[],"rename-ambiguous":[]};function P(e){return h[e]}d(P,"executableRemediationVerbs");function y(e){const i=P(e.finding);return e.verbs.filter(t=>t==="abort"||i.includes(t)&&(t!=="pin"||v(e.resourceType,e.offendingProperties).covered))}d(y,"advertisableRemediationVerbs");function R(e){if(e.action==="replace")return e.pinnedPhysicalName!==void 0?"pinned-name-replacement":e.dataLoss?"replacement-required":void 0;if(e.action==="delete"&&e.dataLoss&&!e.retained)return"data-loss-delete"}d(R,"findingForChange");function T(e,i,t){if(i==="data-loss-delete")return"removed from the synthesised template \u2014 CloudFormation will delete the live resource and its data";const o=t.length>0?`${t.join(", ")} forces replacement`:"replacement required (no property-level detail available)",n=e.replacementMode==="may"||e.replacementMode==="conditional"?" (conditional verdict \u2014 worst-cased towards ceremony)":"";return i==="pinned-name-replacement"?`${o}${n}; CloudFormation refuses in-stack replacement of custom-named resources`:`${o}${n}`}d(T,"causeForChange");function E(e,i){const t=D("sha256");t.update(e),t.update(`
-`);const o=i.map(n=>`${n.stack}|${n.logicalId}|${n.resourceType}|${n.physicalName}|${n.finding}`).sort();for(const n of o)t.update(n),t.update(`
-`);return t.digest("hex")}d(E,"computeTicketDigest");function M(e,i){const t=new Set((i??[]).map(n=>`${n.stackName}
-${n.logicalId}`)),o=[];for(const n of e.changes){if(n.action==="delete"&&t.has(`${n.stack}
-${n.address}`))continue;const s=R(n);if(s===void 0)continue;const a=n.propertyChanges.filter(l=>l.forcesReplacement).map(l=>l.path);o.push({stack:n.stack,logicalId:n.address,resourceType:n.resourceType,physicalName:n.pinnedPhysicalName??L(n.stack,n.address),finding:s,cause:T(n,s,a),offendingProperties:a,verdictSource:n.verdictSource??"cdk-spec (unverified)",dataLossRisk:n.dataLoss,verbs:[...b[s]]})}if(o.length!==0)return{ticketDigest:E(e.assemblyDigest,o),resources:o}}d(M,"buildDestructionTicket");function $(e){const{ticket:i,consents:t,consentDigest:o}=e,n=o!==void 0&&o!==i.ticketDigest,s=new Map(i.resources.map(r=>[r.physicalName,r])),a=t.map(r=>{const p=s.get(r.physicalName);return p===void 0?{physicalName:r.physicalName,verb:r.verb,verdict:"unmatched",detail:"no pending destructive resource has this exact name"}:p.verbs.includes(r.verb)?{physicalName:r.physicalName,verb:r.verb,verdict:"matched"}:{physicalName:r.physicalName,verb:r.verb,verdict:"wrong-verb",detail:`legal verbs for ${p.finding}: ${y(p).join(", ")}`}}),l=new Set(a.filter(r=>r.verdict==="matched").map(r=>r.physicalName)),f=i.resources.map(r=>r.physicalName).filter(r=>!l.has(r)),g=!n&&f.length===0&&a.length>0&&a.every(r=>r.verdict==="matched");return{rows:a,uncovered:f,digestMismatch:n,satisfied:g,...n&&o!==void 0?{suppliedDigest:o,currentDigest:i.ticketDigest}:{}}}d($,"evaluateDestructionConsents");function S(e){const i=[];for(const t of e.resources){const o=t.dataLossRisk?" (data loss)":"";i.push(`! ${t.finding}  ${t.resourceType}  ${t.stack}/${t.logicalId}${o}`),i.push(`    physical name: ${t.physicalName}`),i.push(`    cause: ${t.cause}`),i.push(`    legal verbs: ${y(t).join(" | ")}`)}return i}d(S,"renderDestructionTicketLines");function j(e){const i=[];if(e.digestMismatch){const t=e.suppliedDigest!==void 0&&e.currentDigest!==void 0?` (consents were minted against '${e.suppliedDigest}'; the pending destructive changes now digest to '${e.currentDigest}')`:"";i.push(`consent digest mismatch: the plan changed since consent was given \u2014 re-review and consent again${t}`)}if(e.rows.length>0){i.push("consent verdicts:");for(const t of e.rows){const o=t.detail!==void 0?` \u2014 ${t.detail}`:"";i.push(`  ${t.physicalName}=${t.verb}  ${t.verdict}${o}`)}}if(e.uncovered.length>0){i.push("awaiting consent:");for(const t of e.uncovered)i.push(`  ${t}`)}return i}d(j,"renderConsentVerdictLines");function w(e,i){const t=new Map(e.resources.map(n=>[n.physicalName,n])),o=[];for(const n of i){if(n.verdict!=="matched")continue;const s=t.get(n.physicalName);if(s!==void 0){if(n.verb==="abort"){o.push(`${n.physicalName}: aborted by operator consent`);continue}if(!h[s.finding].includes(n.verb)){o.push(`${n.physicalName}: verb '${n.verb}' is accepted vocabulary but not yet executable in this release for ${s.finding} \u2014 executable today: ${h[s.finding].join(", ")||"none (abort only)"}`);continue}if(n.verb==="pin"){const a=v(s.resourceType,s.offendingProperties);a.covered||o.push(`${n.physicalName}: verb 'pin' has no live-value probe for ${a.unsupportedPairs.join(", ")} in this release \u2014 pin cannot capture the live value(s) into the config for this resource. Executable today for ${s.finding}: ${h[s.finding].filter(l=>l!=="pin").join(", ")||"none (abort only)"}`)}}}return o}d(w,"collectExecutionHalts");async function H(e){const i=await e.loadPlan();if(!i.success)return x(new Error(C(`Destruction gate could not compute the deploy plan: ${i.error.message}`)));const t=M(i.data,e.verifiedAbsentByNecessity);if(t===void 0)return m({kind:"clear"});const o=d(c=>{e.callbacks.onLog?.(`Destruction gate: ${t.resources.length} destructive change(s) proceeding under named consent (${c.rows.map(u=>`${u.physicalName}=${u.verb}`).join(", ")})`,"warn");const k=new Map(c.rows.filter(u=>u.verdict==="matched").map(u=>[u.physicalName,u.verb]));return m({kind:"proceed",ticket:t,verbsByPhysicalName:k})},"proceedUnderConsent"),n=e.options.destructionConsents??[];let s=$({ticket:t,consents:n,...e.options.destructionConsentDigest!==void 0?{consentDigest:e.options.destructionConsentDigest}:{}}),a=s.satisfied?w(t,s.rows):[];if(s.satisfied&&a.length===0)return o(s);const l=[];if(e.consentGate!==void 0&&n.length===0&&e.options.destructionConsentDigest===void 0){const c=await e.consentGate.resolve({target:e.target,ticket:t});if(c.kind==="abort")l.push("declined at the interactive destruction ceremony \u2014 nothing was applied");else if(s=$({ticket:t,consents:c.consents,consentDigest:c.ticketDigest}),a=s.satisfied?w(t,s.rows):[],s.satisfied&&a.length===0)return o(s)}const f=[...l,...a],g=s.satisfied&&s.rows.some(c=>c.verdict==="matched"&&c.verb==="abort"),r=l.length>0||g?"declined":a.length>0?"consent-not-executable":s.rows.length>0||s.digestMismatch?"consents-invalid":"awaiting-consent",p={"awaiting-consent":`Destructive changes for ${e.target} require named consent \u2014 deploy withheld, nothing was applied`,declined:`Deployment of ${e.target} declined \u2014 the destructive changes were not consented; nothing was applied`,"consents-invalid":`Deployment of ${e.target} withheld \u2014 the supplied consents did not match the pending destructive changes; nothing was applied`,"consent-not-executable":`Deployment of ${e.target} withheld \u2014 consent was given, but the consented remediation is not yet executable in this release; nothing was applied`};e.callbacks.onLog?.(p[r],"warn");for(const c of S(t))e.callbacks.onLog?.(c,"warn");for(const c of j(s))e.callbacks.onLog?.(c,"warn");for(const c of f)e.callbacks.onLog?.(c,"warn");return(r==="awaiting-consent"||r==="consents-invalid")&&e.callbacks.onLog?.("Consent with --remediate <physicalName>=<verb> (repeatable; exact, case-sensitive) or --allow-replace <physicalName> for plain replacements. No blanket flag exists: --auto-approve, --skip-confirmation and approval tokens never satisfy this gate.","warn"),m({kind:"withheld",outcome:r,ticket:t,report:s,reasons:f})}d(H,"runDestructionGate");export{y as advertisableRemediationVerbs,M as buildDestructionTicket,w as collectExecutionHalts,E as computeTicketDigest,$ as evaluateDestructionConsents,P as executableRemediationVerbs,G as legalRemediationVerbs,j as renderConsentVerdictLines,S as renderDestructionTicketLines,H as runDestructionGate};
+var N=Object.defineProperty;var d=(e,i)=>N(e,"name",{value:i,configurable:!0});import{createHash as D}from"node:crypto";import{success as g,failure as x}from"@fjall/generator";import{maskSensitiveOutput as C}from"@fjall/util";import{remediationPlaceholderPhysicalId as L}from"../../types/remediation.js";import{pinProbeCoverage as P}from"../remediation/pinRemediation.js";const v={"replacement-required":["abort","pin","recreate"],"pinned-name-replacement":["abort","pin","recreate"],"data-loss-delete":["abort","forget","recreate"],"resource-deleted":["abort","repair","forget","recreate"],"stack-deleted":["abort","repair","recreate"],"rename-detected":["abort","pin","recreate"],"rename-ambiguous":["abort","recreate"]};function G(e){return v[e]}d(G,"legalRemediationVerbs");const h={"replacement-required":["pin","recreate"],"pinned-name-replacement":["pin","recreate"],"data-loss-delete":["recreate"],"resource-deleted":["forget"],"stack-deleted":[],"rename-detected":["pin"],"rename-ambiguous":[]};function S(e){return h[e]}d(S,"executableRemediationVerbs");function b(e){const i=S(e.finding);return e.verbs.filter(n=>n==="abort"||i.includes(n)&&(n!=="pin"||y(e).covered))}d(b,"advertisableRemediationVerbs");function y(e){if(e.finding==="rename-detected")return e.pinSlotHint!==void 0?{covered:!0}:{covered:!1,detail:"no capacity-identity alias names this rename, so the identity-pin remediation cannot derive the {app, slot} to pin \u2014 hand-author the capacityIdentity entry in fjall-config.json and validate it with 'fjall migrate identity'"};const i=P(e.resourceType,e.offendingProperties);return i.covered?{covered:!0}:{covered:!1,detail:`verb 'pin' has no live-value probe for ${i.unsupportedPairs.join(", ")} in this release \u2014 pin cannot capture the live value(s) into the config for this resource`}}d(y,"pinVerbCoverage");function j(e){if(e.renameFinding!==void 0)return e.renameFinding;if(e.action==="replace")return e.pinnedPhysicalName!==void 0?"pinned-name-replacement":e.dataLoss?"replacement-required":void 0;if(e.action==="delete"&&e.dataLoss&&!e.retained)return"data-loss-delete"}d(j,"findingForChange");function R(e,i,n){if(i==="rename-detected"||i==="rename-ambiguous")return e.renameCause??"logical identity rename detected";if(i==="data-loss-delete")return"removed from the synthesised template \u2014 CloudFormation will delete the live resource and its data";const o=n.length>0?`${n.join(", ")} forces replacement`:"replacement required (no property-level detail available)",t=e.replacementMode==="may"||e.replacementMode==="conditional"?" (conditional verdict \u2014 worst-cased towards ceremony)":"";return i==="pinned-name-replacement"?`${o}${t}; CloudFormation refuses in-stack replacement of custom-named resources`:`${o}${t}`}d(R,"causeForChange");function E(e,i){const n=D("sha256");n.update(e),n.update(`
+`);const o=i.map(t=>`${t.stack}|${t.logicalId}|${t.resourceType}|${t.physicalName}|${t.finding}`).sort();for(const t of o)n.update(t),n.update(`
+`);return n.digest("hex")}d(E,"computeTicketDigest");function T(e,i){const n=new Set((i??[]).map(t=>`${t.stackName}
+${t.logicalId}`)),o=[];for(const t of e.changes){if(t.action==="delete"&&n.has(`${t.stack}
+${t.address}`))continue;const s=j(t);if(s===void 0)continue;const r=t.propertyChanges.filter(l=>l.forcesReplacement).map(l=>l.path);o.push({stack:t.stack,logicalId:t.address,resourceType:t.resourceType,physicalName:t.renamePhysicalId??t.pinnedPhysicalName??L(t.stack,t.address),finding:s,cause:R(t,s,r),offendingProperties:r,verdictSource:t.verdictSource??"cdk-spec (unverified)",dataLossRisk:t.dataLoss,verbs:[...v[s]],...t.renameSlotHint!==void 0?{pinSlotHint:t.renameSlotHint}:{}})}if(o.length!==0)return{ticketDigest:E(e.assemblyDigest,o),resources:o}}d(T,"buildDestructionTicket");function $(e){const{ticket:i,consents:n,consentDigest:o}=e,t=o!==void 0&&o!==i.ticketDigest,s=new Map(i.resources.map(a=>[a.physicalName,a])),r=n.map(a=>{const p=s.get(a.physicalName);return p===void 0?{physicalName:a.physicalName,verb:a.verb,verdict:"unmatched",detail:"no pending destructive resource has this exact name"}:p.verbs.includes(a.verb)?{physicalName:a.physicalName,verb:a.verb,verdict:"matched"}:{physicalName:a.physicalName,verb:a.verb,verdict:"wrong-verb",detail:`legal verbs for ${p.finding}: ${b(p).join(", ")}`}}),l=new Set(r.filter(a=>a.verdict==="matched").map(a=>a.physicalName)),f=i.resources.map(a=>a.physicalName).filter(a=>!l.has(a)),m=!t&&f.length===0&&r.length>0&&r.every(a=>a.verdict==="matched");return{rows:r,uncovered:f,digestMismatch:t,satisfied:m,...t&&o!==void 0?{suppliedDigest:o,currentDigest:i.ticketDigest}:{}}}d($,"evaluateDestructionConsents");function M(e){const i=[];for(const n of e.resources){const o=n.dataLossRisk?" (data loss)":"";i.push(`! ${n.finding}  ${n.resourceType}  ${n.stack}/${n.logicalId}${o}`),i.push(`    physical name: ${n.physicalName}`),i.push(`    cause: ${n.cause}`),i.push(`    legal verbs: ${b(n).join(" | ")}`)}return i}d(M,"renderDestructionTicketLines");function H(e){const i=[];if(e.digestMismatch){const n=e.suppliedDigest!==void 0&&e.currentDigest!==void 0?` (consents were minted against '${e.suppliedDigest}'; the pending destructive changes now digest to '${e.currentDigest}')`:"";i.push(`consent digest mismatch: the plan changed since consent was given \u2014 re-review and consent again${n}`)}if(e.rows.length>0){i.push("consent verdicts:");for(const n of e.rows){const o=n.detail!==void 0?` \u2014 ${n.detail}`:"";i.push(`  ${n.physicalName}=${n.verb}  ${n.verdict}${o}`)}}if(e.uncovered.length>0){i.push("awaiting consent:");for(const n of e.uncovered)i.push(`  ${n}`)}return i}d(H,"renderConsentVerdictLines");function w(e,i){const n=new Map(e.resources.map(t=>[t.physicalName,t])),o=[];for(const t of i){if(t.verdict!=="matched")continue;const s=n.get(t.physicalName);if(s!==void 0){if(t.verb==="abort"){o.push(`${t.physicalName}: aborted by operator consent`);continue}if(!h[s.finding].includes(t.verb)){o.push(`${t.physicalName}: verb '${t.verb}' is accepted vocabulary but not yet executable in this release for ${s.finding} \u2014 executable today: ${h[s.finding].join(", ")||"none (abort only)"}`);continue}if(t.verb==="pin"){const r=y(s);r.covered||o.push(`${t.physicalName}: ${r.detail??"verb 'pin' is not executable for this resource"}. Executable today for ${s.finding}: ${h[s.finding].filter(l=>l!=="pin").join(", ")||"none (abort only)"}`)}}}return o}d(w,"collectExecutionHalts");async function O(e){const i=await e.loadPlan();if(!i.success)return x(new Error(C(`Destruction gate could not compute the deploy plan: ${i.error.message}`)));const n=T(i.data,e.verifiedAbsentByNecessity);if(n===void 0)return g({kind:"clear"});const o=d(c=>{e.callbacks.onLog?.(`Destruction gate: ${n.resources.length} destructive change(s) proceeding under named consent (${c.rows.map(u=>`${u.physicalName}=${u.verb}`).join(", ")})`,"warn");const k=new Map(c.rows.filter(u=>u.verdict==="matched").map(u=>[u.physicalName,u.verb]));return g({kind:"proceed",ticket:n,verbsByPhysicalName:k})},"proceedUnderConsent"),t=e.options.destructionConsents??[];let s=$({ticket:n,consents:t,...e.options.destructionConsentDigest!==void 0?{consentDigest:e.options.destructionConsentDigest}:{}}),r=s.satisfied?w(n,s.rows):[];if(s.satisfied&&r.length===0)return o(s);const l=[];if(e.consentGate!==void 0&&t.length===0&&e.options.destructionConsentDigest===void 0){const c=await e.consentGate.resolve({target:e.target,ticket:n});if(c.kind==="abort")l.push("declined at the interactive destruction ceremony \u2014 nothing was applied");else if(s=$({ticket:n,consents:c.consents,consentDigest:c.ticketDigest}),r=s.satisfied?w(n,s.rows):[],s.satisfied&&r.length===0)return o(s)}const f=[...l,...r],m=s.satisfied&&s.rows.some(c=>c.verdict==="matched"&&c.verb==="abort"),a=l.length>0||m?"declined":r.length>0?"consent-not-executable":s.rows.length>0||s.digestMismatch?"consents-invalid":"awaiting-consent",p={"awaiting-consent":`Destructive changes for ${e.target} require named consent \u2014 deploy withheld, nothing was applied`,declined:`Deployment of ${e.target} declined \u2014 the destructive changes were not consented; nothing was applied`,"consents-invalid":`Deployment of ${e.target} withheld \u2014 the supplied consents did not match the pending destructive changes; nothing was applied`,"consent-not-executable":`Deployment of ${e.target} withheld \u2014 consent was given, but the consented remediation is not yet executable in this release; nothing was applied`};e.callbacks.onLog?.(p[a],"warn");for(const c of M(n))e.callbacks.onLog?.(c,"warn");for(const c of H(s))e.callbacks.onLog?.(c,"warn");for(const c of f)e.callbacks.onLog?.(c,"warn");return(a==="awaiting-consent"||a==="consents-invalid")&&e.callbacks.onLog?.("Consent with --remediate <physicalName>=<verb> (repeatable; exact, case-sensitive) or --allow-replace <physicalName> for plain replacements. No blanket flag exists: --auto-approve, --skip-confirmation and approval tokens never satisfy this gate.","warn"),g({kind:"withheld",outcome:a,ticket:n,report:s,reasons:f})}d(O,"runDestructionGate");export{b as advertisableRemediationVerbs,T as buildDestructionTicket,w as collectExecutionHalts,E as computeTicketDigest,$ as evaluateDestructionConsents,S as executableRemediationVerbs,G as legalRemediationVerbs,H as renderConsentVerdictLines,M as renderDestructionTicketLines,O as runDestructionGate};

package/dist/src/orchestration/application/detectionPipeline.js

@@ -1 +1 @@
-var F=Object.defineProperty;var S=(o,r)=>F(o,"name",{value:r,configurable:!0});import{join as H}from"path";import{success as M,failure as s}from"@fjall/generator";import{logger as O}from"@fjall/util/logger";import{maskSensitiveOutput as n}from"@fjall/util";import{deriveResourcesFromManifestStacks as L}from"../../types/detection/patternDetection.js";import{emitProgress as R,PROGRESS_MESSAGES as E}from"../../services/supporting/helpers.js";import{parseRequiredSecretsFromManifest as q,parseImportedSecretNamesFromManifest as T}from"../manifestSecretParser.js";import{resolveSecretArns as W}from"../secretArnResolver.js";import{isAborted as B}from"../../aws/organisations/types.js";import{parseDockerDeclarationsFromManifest as G}from"@fjall/util/manifest";import{assertEngineCompatibleWithAssembly as K}from"./engineCompat.js";async function b(o,r,h,e,C){e.onDetectionPhaseChange?.("detect","started");const y=r.frameworkRegistry.resolve({appPath:o.path}),w=y?.detection.pattern??null,A=y?.detection.hasDatabase??!1;e.onLog?.(`Pattern detected: ${w??"standard"}`,"info"),e.onDetectionPhaseChange?.("detect","completed");const a=H(o.path,"cdk.out");e.onDetectionPhaseChange?.("synth","started"),R(e,E.SYNTH);const D=await r.cdkService.runCdkSynth(h,t=>e.onCdkOutput?.(t,"synth"));if(!D.success)return s(new Error(n(`CDK synthesis failed: ${D.error}`)));if(e.onDetectionPhaseChange?.("synth","completed"),h.resolvedSecretArns===void 0){const t=T(a);if(t.length>0){e.onLog?.(`Resolving ${t.length} imported secret ARN(s)\u2026`,"info");const i=await W(r.awsProvider,t);if(!i.success)return s(new Error(n(i.error.message)));h.resolvedSecretArns=JSON.stringify(i.data);const g=await r.cdkService.runCdkSynth(h,N=>e.onCdkOutput?.(N,"synth"));if(!g.success)return s(new Error(n(`CDK synthesis failed: ${g.error}`)))}}const P=K({cdkOutPath:a,onWarning:S(t=>e.onLog?.(t,"warn"),"onWarning")});if(!P.success)return s(new Error(n(P.error.message)));const m=q(a);m.length>0&&e.onLog?.(`Found ${m.length} required secret path(s) in manifest`,"info"),e.onDetectionPhaseChange?.("hash","started"),R(e,E.HASH);const d=await r.hashService.getTemplateHashes(a);if(!d.success)return s(new Error(n(`Template hash computation failed: ${d.error.message}`)));const u=d.data,f=await r.hashService.compareWithState(u,o.path);if(!f.success)return s(new Error(n(`Hash comparison failed: ${f.error.message}`)));const c=f.data;e.onDetectionPhaseChange?.("hash","completed");const p=new Map(c.stackChanges);for(const[t,i]of c.stackChanges){if(B(C))break;i||await r.cfnService.stackExists(t,void 0,C)||(O.debug("detectionPipeline","Stale hash detected \u2014 stack missing in CFN",{stackName:t}),p.set(t,!0))}const k=Array.from(u.keys()),l=L(k),v=l.hasCompute&&G(a).declaresBuild,$=Array.from(p.values()).some(Boolean);return e.onLog?.(`Detection complete: ${c.changedCount} changed, ${c.unchangedCount} unchanged`,"info"),M({pattern:w,hasDatabase:A,hasDifferences:$,stackChanges:p,currentHashes:u,resources:l,hasDockerfile:v,requiredSecrets:m})}S(b,"runDetectionPipeline");export{b as runDetectionPipeline};
+var H=Object.defineProperty;var S=(o,r)=>H(o,"name",{value:r,configurable:!0});import{join as M}from"path";import{success as O,failure as s}from"@fjall/generator";import{logger as L}from"@fjall/util/logger";import{maskSensitiveOutput as n}from"@fjall/util";import{deriveResourcesFromManifestStacks as W}from"../../types/detection/patternDetection.js";import{emitProgress as E,PROGRESS_MESSAGES as A}from"../../services/supporting/helpers.js";import{parseRequiredSecretsFromManifest as q,parseImportedSecretNamesFromManifest as B}from"../manifestSecretParser.js";import{resolveSecretArns as I}from"../secretArnResolver.js";import{isAborted as T}from"../../aws/organisations/types.js";import{parseDockerDeclarationsFromManifest as G}from"@fjall/util/manifest";import{assertCapacityPinsSupportedByAssembly as K,assertEngineCompatibleWithAssembly as j}from"./engineCompat.js";async function te(o,r,i,e,y){e.onDetectionPhaseChange?.("detect","started");const C=r.frameworkRegistry.resolve({appPath:o.path}),w=C?.detection.pattern??null,N=C?.detection.hasDatabase??!1;e.onLog?.(`Pattern detected: ${w??"standard"}`,"info"),e.onDetectionPhaseChange?.("detect","completed");const a=M(o.path,"cdk.out");e.onDetectionPhaseChange?.("synth","started"),E(e,A.SYNTH);const l=await r.cdkService.runCdkSynth(i,t=>e.onCdkOutput?.(t,"synth"));if(!l.success)return s(new Error(n(`CDK synthesis failed: ${l.error}`)));if(e.onDetectionPhaseChange?.("synth","completed"),i.resolvedSecretArns===void 0){const t=B(a);if(t.length>0){e.onLog?.(`Resolving ${t.length} imported secret ARN(s)\u2026`,"info");const c=await I(r.awsProvider,t);if(!c.success)return s(new Error(n(c.error.message)));i.resolvedSecretArns=JSON.stringify(c.data);const g=await r.cdkService.runCdkSynth(i,F=>e.onCdkOutput?.(F,"synth"));if(!g.success)return s(new Error(n(`CDK synthesis failed: ${g.error}`)))}}const D=j({cdkOutPath:a,onWarning:S(t=>e.onLog?.(t,"warn"),"onWarning")});if(!D.success)return s(new Error(n(D.error.message)));const P=K({cdkOutPath:a,capacityIdentityWire:i.capacityIdentity,appName:o.appName});if(!P.success)return s(new Error(n(P.error.message)));const m=q(a);m.length>0&&e.onLog?.(`Found ${m.length} required secret path(s) in manifest`,"info"),e.onDetectionPhaseChange?.("hash","started"),E(e,A.HASH);const d=await r.hashService.getTemplateHashes(a);if(!d.success)return s(new Error(n(`Template hash computation failed: ${d.error.message}`)));const u=d.data,p=await r.hashService.compareWithState(u,o.path);if(!p.success)return s(new Error(n(`Hash comparison failed: ${p.error.message}`)));const h=p.data;e.onDetectionPhaseChange?.("hash","completed");const f=new Map(h.stackChanges);for(const[t,c]of h.stackChanges){if(T(y))break;c||await r.cfnService.stackExists(t,void 0,y)||(L.debug("detectionPipeline","Stale hash detected \u2014 stack missing in CFN",{stackName:t}),f.set(t,!0))}const k=Array.from(u.keys()),R=W(k),v=R.hasCompute&&G(a).declaresBuild,$=Array.from(f.values()).some(Boolean);return e.onLog?.(`Detection complete: ${h.changedCount} changed, ${h.unchangedCount} unchanged`,"info"),O({pattern:w,hasDatabase:N,hasDifferences:$,stackChanges:f,currentHashes:u,resources:R,hasDockerfile:v,requiredSecrets:m})}S(te,"runDetectionPipeline");export{te as runDetectionPipeline};