@fjall/deploy-core 8.0.0 → 10.1.1

package/dist/.build-source-hash

@@ -9,12 +9,12 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "7ea3e98f341b69eff0b080c0b37d808ee3944922e33d5f9d86f28b1204e988fb",
+  "hash": "2c11b6ffb0cf61420ceefdf5ed71b69f9a10d2a7d5f745cefd5599b4e056bb79",
   "files": {
     "src/__test-utils__/awsMockHelpers.ts": "fea371c1b1869678",
     "src/__test-utils__/index.ts": "e03cf35821157dc4",
     "src/__test-utils__/lambdaManifestFixture.ts": "fcbe79471c6bc91a",
-    "src/__test-utils__/stackCleanupMock.ts": "bf3d0fc1b8ab5b03",
+    "src/__test-utils__/stackCleanupMock.ts": "279ae989432734b5",
     "src/aws/AwsProvider.ts": "8bbe053f15dfc046",
     "src/aws/SimpleAwsProvider.ts": "41e5a4dee4736249",
     "src/aws/cloudtrail/orgTrailDelivery.ts": "d743cdeb12b335fe",
@@ -52,10 +52,10 @@
     "src/aws/utils/regions.ts": "3a5191f4d2242a60",
     "src/aws/utils/stackStatus.ts": "55fb23ba5514bc13",
     "src/events/index.ts": "e55c022f0d9013e6",
-    "src/index.ts": "138bc00a3dedc54f",
+    "src/index.ts": "28221a2c59ab861d",
     "src/orchestration/activeDeploymentGuard.ts": "e8dde742c00ea728",
-    "src/orchestration/application/applicationDeploy.ts": "04799f21f18d40c8",
-    "src/orchestration/application/applicationDeployHelpers.ts": "a8023472f95d3f05",
+    "src/orchestration/application/applicationDeploy.ts": "867232cbc981906c",
+    "src/orchestration/application/applicationDeployHelpers.ts": "bca833cc04f0b4c5",
     "src/orchestration/application/applicationDestroy.ts": "38b8ecf69c85d884",
     "src/orchestration/application/approvalGate.ts": "e4dee819c94fd15c",
     "src/orchestration/application/artefactCollection.ts": "b77848c922765d30",
@@ -66,12 +66,13 @@
     "src/orchestration/application/buildSecretSession.ts": "b45265140a3a781a",
     "src/orchestration/application/codeOnlyDeploy.ts": "062b0acdad1dcf08",
     "src/orchestration/application/databaseEndpointReconcile.ts": "27b14ee41524c632",
-    "src/orchestration/application/deploySessionPolicy.ts": "3fdd0e349d2144e6",
+    "src/orchestration/application/deploySessionPolicy.ts": "8052c64ce050c2b8",
     "src/orchestration/application/destroyPreFlight.ts": "cc4978dec60b033e",
     "src/orchestration/application/destructionGate.ts": "3b64832555e15887",
     "src/orchestration/application/detectionPipeline.ts": "580a62c8093f96ce",
     "src/orchestration/application/dockerBuildHelper.ts": "e7a7259e987d93be",
     "src/orchestration/application/ecrCacheRepository.ts": "d7a5602ccabde493",
+    "src/orchestration/application/ecsDeploymentTail.ts": "d9ff18631984b2e5",
     "src/orchestration/application/engineCompat.ts": "d3e1cbf906bc785d",
     "src/orchestration/application/lambdaCodeOnlyRollout.ts": "fc347b90ff55c1fd",
     "src/orchestration/application/leaseGate.ts": "26be2e119b32bef4",
@@ -89,6 +90,7 @@
     "src/orchestration/application/plan/renameDetection.ts": "a4a96ad3c175dd5a",
     "src/orchestration/application/plan/renderDeployPlan.ts": "13a01fc9b11e1cf7",
     "src/orchestration/application/plan/types.ts": "45c3bf684cd90f9f",
+    "src/orchestration/application/schemaGateImage.ts": "587a115432c6678e",
     "src/orchestration/application/serviceImageTagsRollback.ts": "55e23a493545511c",
     "src/orchestration/application/taskDefinitionRoll.ts": "d9378c509c7ec287",
     "src/orchestration/application/welcomeImageHelper.ts": "1721ea7edc37a96e",
@@ -99,7 +101,7 @@
     "src/orchestration/builders/openNextBuilder.ts": "7416a37e19380660",
     "src/orchestration/builders/staticSiteBuilder.ts": "a0403be58052310f",
     "src/orchestration/contextHelpers.ts": "b38af2503a974f16",
-    "src/orchestration/deploy.ts": "4f86b86e797bc04f",
+    "src/orchestration/deploy.ts": "5cbdc229366ea1e6",
     "src/orchestration/deployEnvironment.ts": "acfddd575949b7ca",
     "src/orchestration/destroy.ts": "b6da154984e63a8d",
     "src/orchestration/dockerBuildParamsKeys.ts": "ac3d6ecd24d68792",
@@ -115,13 +117,15 @@
     "src/orchestration/domainInterface.ts": "2187279bbd26144d",
     "src/orchestration/drift/classifyDriftFailure.ts": "4426ecc6545b0472",
     "src/orchestration/drift/detectStackDrift.ts": "cc38b12162e08fac",
-    "src/orchestration/drift/driftPreFlight.ts": "287b921160c929f8",
+    "src/orchestration/drift/driftPreFlight.ts": "87c6176636655ad7",
     "src/orchestration/drift/driftProbe.ts": "970ccb185c6efe83",
     "src/orchestration/drift/driftSuspectJournal.ts": "d0189a53a7b7cb7e",
     "src/orchestration/drift/preFlightGate.ts": "8067a3f474fba0b5",
     "src/orchestration/drift/route53Names.ts": "1ac53cc30ac3260e",
     "src/orchestration/drift/route53RecordPreflight.ts": "f4db16a6c0e69ac9",
-    "src/orchestration/index.ts": "e97a95546428a69a",
+    "src/orchestration/failure/classifyFailure.ts": "bfb80731bc7d6b95",
+    "src/orchestration/failure/deploymentFailureAttachment.ts": "358d9e4d88390cfd",
+    "src/orchestration/index.ts": "0b230a38e1ef50d2",
     "src/orchestration/manifestSecretParser.ts": "c5576bd88a3652f8",
     "src/orchestration/organisation/accountsConfig.ts": "a55a3306564e7b2f",
     "src/orchestration/organisation/cascadeDestroyHelpers.ts": "46ca8e144ea76db2",
@@ -130,7 +134,7 @@
     "src/orchestration/organisation/organisationDeploy.ts": "f3fad626230d8a16",
     "src/orchestration/organisation/organisationDestroy.ts": "06076a7e76345854",
     "src/orchestration/organisation/organisationSetup.ts": "3f3415b762a83a47",
-    "src/orchestration/organisation/reconcileProviderAccounts.ts": "84d33f456ec52331",
+    "src/orchestration/organisation/reconcileProviderAccounts.ts": "91920b2ed61dd811",
     "src/orchestration/organisationDeploy/cascadeExecution.ts": "ebc32ef8857d8037",
     "src/orchestration/organisationDeploy/infraSteps.ts": "53880cef5020dd04",
     "src/orchestration/organisationDeploy/orgCascadeDeploy.ts": "97a85277580be283",
@@ -148,18 +152,19 @@
     "src/orchestration/remediation/postFailureRepairOffer.ts": "934b3fbd1c4d34d1",
     "src/orchestration/remediation/recreatePreFlight.ts": "654ef18cabe97777",
     "src/orchestration/remediation/recreateResource.ts": "a9d97c47e0af68a7",
-    "src/orchestration/remediation/remediationJournal.ts": "9c37f66a07ce9912",
+    "src/orchestration/remediation/remediationJournal.ts": "5ebb14e618fde1c1",
     "src/orchestration/remediation/removalUpdate.ts": "805be54eb0ac1623",
-    "src/orchestration/remediation/retainFlip.ts": "8799a03380cb8f45",
+    "src/orchestration/remediation/retainFlip.ts": "80e7b47e87251db5",
     "src/orchestration/resolveOperation.ts": "84a9f425939fad63",
-    "src/orchestration/restart/restartApplication.ts": "08866c681f84c1ed",
+    "src/orchestration/restart/restartApplication.ts": "3320b6aef19da793",
     "src/orchestration/restart/secretsDrift.ts": "53b91db6f8f7f04d",
     "src/orchestration/secretArnResolver.ts": "20041aca6eb7e762",
     "src/orchestration/serviceFactory.ts": "ec35c9eb8015d540",
     "src/orchestration/spawnHelpers.ts": "cbad657ae7039a86",
-    "src/orchestration/stackCleanup.ts": "e6c447375046dcec",
+    "src/orchestration/stackCleanup.ts": "26dfef4375530902",
     "src/orchestration/stackCleanup/bucketOps.ts": "59a3c8349e766947",
     "src/orchestration/stackCleanup/failedStack.ts": "48b700639d8001c7",
+    "src/orchestration/stackCleanup/insightsLogGroups.ts": "6bd85a61d1e9f1ec",
     "src/orchestration/stackCleanup/logging.ts": "dbc9e25542320848",
     "src/orchestration/stackCleanup/messages.ts": "959252d06b1a73a5",
     "src/orchestration/stackCleanup/orphanSweep.ts": "c35d8fe48f564df8",
@@ -172,10 +177,10 @@
     "src/orchestration/unlock/restoreAndReconcileQuarantinedBucket.ts": "c534511ed49952ad",
     "src/orchestration/unlock/restoreBucketPolicy.ts": "f266285ffacf3cf6",
     "src/orchestration/unlock/scpRemediation.ts": "c5d425c850abe455",
-    "src/orchestration/unlock/toResourcePolicyStatements.ts": "ddd15625c785a48d",
+    "src/orchestration/unlock/toResourcePolicyStatements.ts": "b3d91460e2d31457",
     "src/orchestration/unlock/unlockBucket.ts": "d08d7cb6243d7cec",
     "src/orchestration/unlock/unlockQueue.ts": "f7e8eccc258d763d",
-    "src/services/application/ApplicationStackService.ts": "45824be79c1b82aa",
+    "src/services/application/ApplicationStackService.ts": "45f697f7f884af0a",
     "src/services/application/applicationStackHelpers.ts": "04e1758b97ffc5fc",
     "src/services/application/index.ts": "ee810be803dfda9c",
     "src/services/index.ts": "8c441c1b37540650",
@@ -191,7 +196,7 @@
     "src/services/infrastructure/CfnRegistryService.ts": "bd4f57d97982cdda",
     "src/services/infrastructure/CloudFormationService.ts": "82ce03614feae2db",
     "src/services/infrastructure/EcrImageInspectorService.ts": "e784440b5680df74",
-    "src/services/infrastructure/EcsService.ts": "caa79dd5fd7ada9b",
+    "src/services/infrastructure/EcsService.ts": "8a3b6e921bf06c60",
     "src/services/infrastructure/EcsServiceResolver.ts": "4d548cd42e746feb",
     "src/services/infrastructure/ICdkProcessManager.ts": "7e7bfe7dacc999f6",
     "src/services/infrastructure/LambdaService.ts": "5b21e34185e77a4c",
@@ -202,7 +207,7 @@
     "src/services/infrastructure/cfnRegistrySeed.ts": "b1232b66883d6f90",
     "src/services/infrastructure/changeSetProbe.ts": "5f3e100db396cf9b",
     "src/services/infrastructure/constructMapEnrichment.ts": "7400af9bcfaa0da3",
-    "src/services/infrastructure/dependencyIntegrityGate.ts": "c984bb1620f73f38",
+    "src/services/infrastructure/dependencyIntegrityGate.ts": "063a3539a0fa9a86",
     "src/services/infrastructure/index.ts": "c45e43711bf64fa9",
     "src/services/infrastructure/infraTypecheckPreflight.ts": "09e423a8283e3b8b",
     "src/services/infrastructure/transientNetworkRecovery.ts": "264b9a16fea86869",
@@ -217,10 +222,10 @@
     "src/types/application/ApplicationServiceTypes.ts": "e5185e9ef24a1625",
     "src/types/application/index.ts": "c44d78d2209c4b09",
     "src/types/approval.ts": "d5b7741f677d5f21",
-    "src/types/callbackKeys.ts": "37a9c674500db6ce",
-    "src/types/callbacks.ts": "04395c71d2437ef7",
-    "src/types/config/DomainState.ts": "34102eb6d54f46c2",
-    "src/types/config/FjallState.ts": "253221397d892296",
+    "src/types/callbackKeys.ts": "6122dbe3502abd97",
+    "src/types/callbacks.ts": "195275d1eb5dfb5e",
+    "src/types/config/DomainState.ts": "76a076a1735ac6cd",
+    "src/types/config/FjallState.ts": "e586d9c72c177dea",
     "src/types/config/entitlements.ts": "f69ad28847b67e9a",
     "src/types/config/orgConfig.ts": "452866f049cbd71d",
     "src/types/constants.ts": "4d77e1ab4925b9a6",
@@ -243,7 +248,7 @@
     "src/types/errors/CdkError.ts": "6bda32540c93bac9",
     "src/types/errors/ServiceError.ts": "06d269a22c2a05d6",
     "src/types/errors/index.ts": "e3bf5e08988d1182",
-    "src/types/events.ts": "be04dbe61551d76f",
+    "src/types/events.ts": "5f0e756e98914442",
     "src/types/frameworkBuilder.ts": "41198a0b446f60b6",
     "src/types/index.ts": "eb45188ded4c08b4",
     "src/types/operations.ts": "57a6c9e22a3f37ca",
@@ -257,9 +262,9 @@
     "src/util/sleepAbortable.ts": "f9cac3bf8a79a476",
     "src/version.ts": "1811a4475823b27e",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "4b33bf9951961358",
+    "package.json": "4f4fa1478ced177c",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "7cb96ff606aa8fa1b52ebf8be946ab46dd466be575596af0bd00d1ec1bef16c9",
-  "outputFileCount": 483
+  "outputHash": "fe73823703703c13648f60288dcf3b3064f0814b24d460adbaf1188ae62bf266",
+  "outputFileCount": 493
 }

package/dist/.minified

@@ -1 +1 @@
-241 files minified at 2026-08-09T06:27:58.486Z
+246 files minified at 2026-08-11T21:57:14.597Z

package/dist/src/index.d.ts

@@ -54,8 +54,8 @@ export { type Result, success, failure, isSuccess, isFailure } from "@fjall/gene
 export { deploy } from "./orchestration/index.js";
 export { destroy } from "./orchestration/index.js";
 export { buildParamsContext } from "./orchestration/contextHelpers.js";
-export { restart, probeSecretsDrift, computeSecretsDrift, deriveStaleParameters, extractConsumedSsmParameters } from "./orchestration/index.js";
-export type { RestartParams, RestartResult, SecretsDriftProbeParams, ApplicationSecretsDrift, ServiceSecretsDrift, StaleParameter } from "./orchestration/index.js";
+export { restart, probeSecretsDrift, probeServiceDeploymentStatus, computeSecretsDrift, deriveStaleParameters, extractConsumedSsmParameters } from "./orchestration/index.js";
+export type { RestartParams, RestartResult, SecretsDriftProbeParams, ServiceDeploymentStatus, ApplicationServiceStatus, ApplicationSecretsDrift, ServiceSecretsDrift, StaleParameter } from "./orchestration/index.js";
 export { partitionAccounts } from "./orchestration/index.js";
 export { buildRegionList, buildAccountRegionPairs, cascadeHomeRegion, cascadeOperationKey } from "./orchestration/index.js";
 export type { AccountRegionPair } from "./orchestration/index.js";
@@ -96,3 +96,6 @@ export { buildDeployPlan, computeDeployPlan, computeAssemblyDigest, digestHead,
 export type { DeployPlan, DeployPlanResourceChange, StackTemplatePair, CfnTemplateReader, ComputeDeployPlanParams, ComputeDeployPlanStack, ImpactClassification, DeployScope, SignApprovalTokenOptions, SignedApprovalToken, VerifyApprovalTokenOptions, VerifyApprovalTokenResult, RunApprovalGateParams, ApprovalGateOutcome } from "./orchestration/index.js";
 export { runDestructionGate, buildDestructionTicket, evaluateDestructionConsents, computeTicketDigest, legalRemediationVerbs, executableRemediationVerbs, advertisableRemediationVerbs, renderDestructionTicketLines, renderConsentVerdictLines, loadDeployPlan, createMemoisedPlanLoader } from "./orchestration/index.js";
 export type { RunDestructionGateParams, DestructionGateOutcome, EvaluateDestructionConsentsParams, LoadDeployPlanParams, DeployPlanLoader } from "./orchestration/index.js";
+export { DEPLOYMENT_FAILURE_CLASSIFIER_VERSION, classifyDeployFailure, classifyFromEcsCompletion, classifyFromFailureAnalysis, classifyUnclassified } from "./orchestration/failure/classifyFailure.js";
+export type { ClassifyDeployFailureInput, ClassifyUnclassifiedOptions } from "./orchestration/failure/classifyFailure.js";
+export { attachDeploymentFailure, getDeploymentFailure } from "./orchestration/failure/deploymentFailureAttachment.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as i,DEPLOYMENT_EVENT_TYPES as a,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as E,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as c,DEPLOYMENT_ERROR_MESSAGE_MAX as S,CASCADE_PHASES as l,CASCADE_ACCOUNT_STATUSES as T,clampDeploymentEventStrings as _,truncateUtf16Safe as A}from"./types/index.js";import{DeployEventSchema as p,StepProgressSchema as m,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as P,ChangeCountsSchema as D,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as L,DEPLOY_EVENT_NAME_MAX as g,DEPLOY_EVENT_MESSAGE_MAX as I,DEPLOY_EVENT_STATUS_REASON_MAX as y,DEPLOY_EVENT_ERROR_MESSAGE_MAX as h,DEPLOY_EVENT_TRAIL_DETAIL_MAX as M,DEPLOY_EVENT_OUTPUT_MAX as x,DEPLOY_EVENT_ARN_MAX as v,DEPLOY_EVENT_URL_MAX as U,STEP_COMPLETE_STATUSES as F,LOG_LEVELS as b,STACK_CLEANUP_PHASES as k,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as Q,ALL_PROGRESS_KINDS as j,createDeployEmitter as W,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ie,probeAccountStackExists as ae}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as Ee}from"./aws/index.js";import{ensureOrganisationExists as Se,describeOrganisation as le,enablePolicyTypes as Te,enableServiceAccess as _e,SERVICE_PRINCIPALS as Ae,enableRamSharing as Re,activateTrustedAccess as pe,enableIpamDelegatedAdmin as me,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as Pe,createAccount as De,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as Le,checkIdentityCentreStatus as ge,snapshotIdentityCentre as Ie,composeSdkAbortSignal as ye,extractErrorName as he,isAborted as Me,DEFAULT_MAX_PAGES as xe,IDENTITY_STORE_PAGE_SIZE as ve,drainPages as Ue,isOULeaf as Fe,registerSecurityDelegates as be,SECURITY_SERVICE_PRINCIPALS as ke,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as Qe,REMEDIATION_VERB_GLOSS as je,IDENTITY_PIN_SLOT_SWAP_GLOSS as We,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ir}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as Er,DriftFindingSchema as cr,DriftJournalRecordSchema as Sr,verbsForDriftVerdict as lr}from"./types/index.js";import{REMEDIATION_PHASES as _r,RemediationPhaseSchema as Ar,RemediationTargetSchema as Rr,RemediationFlipProofSchema as pr,RemediationJournalRecordSchema as mr,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Pr,isRemediationPlaceholderPhysicalId as Dr}from"./types/index.js";import{ProgressReporter as fr,APPLICATION_STACKS as Cr,ORGANISATION_TYPES as Nr,APPLICATION_DEPLOY_ORDER as Lr,APPLICATION_DESTROY_ORDER as gr,OPENNEXT_DEPLOY_ORDER as Ir,OPENNEXT_DESTROY_ORDER as yr,PARALLEL_DEPLOY_GROUPS as hr,PARALLEL_DESTROY_GROUPS as Mr,OPENNEXT_PARALLEL_GROUPS as xr,PARALLEL_OPERATION_TYPES as vr,isApplicationOperation as Ur,isOrganisationOperation as Fr,getParallelDeployGroups as br,getParallelDestroyGroups as kr,getApplicationDeployOrder as Yr,getApplicationDestroyOrder as Vr,getApplicationStackName as Gr,getOrganisationStackName as Br,isApplicationStack as Kr,isQuarantineDetail as Xr,isRetainedBucketsDetail as Hr,getApplicationStepName as wr,getApplicationStepId as Jr,toPascalCase as Qr,isOpenNextPattern as jr,OPENNEXT_PATTERNS as Wr,STACK_NOT_FOUND_PATTERN as Zr,STACK_FAILED_STATE_PATTERN as qr,CDK_NO_STACKS_MATCH as zr,INFRASTRUCTURE_FILENAME as $r,ApplicationError as et,wrapApplicationError as rt,stubCallerIdentity as tt}from"./types/index.js";import{deriveResourcesFromManifestStacks as it}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as nt,readStateFile as st,writeStateFile as Et,createEmptyState as ct,deleteStateFile as St,updateTemplateHash as lt,getStateFilePath as Tt,regionSuffix as _t}from"./types/config/FjallState.js";import{readDomainState as Rt,writeDomainState as pt,recordDomainDeployState as mt,deleteDomainState as dt,hashDomainDirectory as ut,LEGACY_DOMAIN_STATE_FILENAME as Pt}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Ot}from"./aws/index.js";import{CdkService as Ct,CdkArgumentBuilder as Nt,CdkProcessManager as Lt,ensureDependencyIntegrity as gt,clearDependencyIntegrityCache as It,DEPENDENCY_SYNC_TIMEOUT_MS as yt,CdkEventMonitor as ht,startStackMonitoring as Mt,DEFAULT_DEPLOY_TIMEOUT_MS as xt,isCdkError as vt,formatInfrastructureError as Ut,getStructuralHint as Ft,getSourceContext as bt,hasCdkDifferences as kt,parseDiffOutput as Yt,CloudFormationService as Vt,CloudFormationError as Gt,EcsService as Bt,EcsError as Kt,EcsServiceResolver as Xt,TemplateHashService as Ht,TemplateHashError as wt,CdkContextBuilder as Jt,emitProgress as Qt,PROGRESS_MESSAGES as jt,parseBuildPhase as Wt,buildStepContextBuildConfig as Zt,convertCloudFormationOutputsToRecord as qt,ApplicationStackService as zt}from"./services/index.js";import{CdkError as eo}from"./types/errors/index.js";import{BaseServiceError as to,ValidationError as oo,AuthError as io,AwsError as ao,DeploymentError as no,NetworkError as so,FileSystemError as Eo,ConfigError as co,toServiceError as So}from"./types/errors/index.js";import{filterDangerousEnvVars as To,maskSensitiveOutput as _o,parseShellArgs as Ao,sleep as Ro}from"@fjall/util";import{artefactOutputKey as mo,DeployModeSchema as uo,ServiceArtefactSchema as Po,ServiceArtefactsSchema as Do}from"@fjall/util";import{hasDockerfile as fo}from"./util/dockerfileDetection.js";import{sleepAbortable as No}from"./util/sleepAbortable.js";import{createSequencedCallbacks as go}from"./util/sequencedCallbacks.js";import{fileExists as yo}from"@fjall/util/fsHelpers";import{success as Mo,failure as xo,isSuccess as vo,isFailure as Uo}from"@fjall/generator";import{deploy as bo}from"./orchestration/index.js";import{destroy as Yo}from"./orchestration/index.js";import{buildParamsContext as Go}from"./orchestration/contextHelpers.js";import{restart as Ko,probeSecretsDrift as Xo,computeSecretsDrift as Ho,deriveStaleParameters as wo,extractConsumedSsmParameters as Jo}from"./orchestration/index.js";import{partitionAccounts as jo}from"./orchestration/index.js";import{buildRegionList as Zo,buildAccountRegionPairs as qo,cascadeHomeRegion as zo,cascadeOperationKey as $o}from"./orchestration/index.js";import{projectScalarSummary as ri,projectAccountRows as ti}from"./orchestration/index.js";import{reconcileProviderAccounts as ii,mergeReconciledProviderAccounts as ai}from"./orchestration/index.js";import{decideNextTransition as si,reconcileTrailMigration as Ei,decommissionMemberTrailStorage as ci,ORG_TRAIL_BUCKET_OUTPUT_KEY as Si,TRAIL_BUCKET_OUTPUT_KEY as li,TRAIL_KEY_ARN_OUTPUT_KEY as Ti}from"./orchestration/index.js";import{classifyDriftFailure as Ai,fetchLastOperationEvents as Ri,DriftProbe as pi,clearDriftSuspects as mi,defaultDriftJournalDir as di,readDriftSuspects as ui,recordDriftSuspects as Pi,detectStackDrift as Di,runDriftPreFlight as Oi,formatDriftPreFlightBlock as fi,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Ci,DRIFT_PREFLIGHT_BUDGET_MS as Ni,runRoute53RecordPreflight as Li}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as Ii,computeRemediationOpId as yi,defaultRemediationJournalDir as hi,findRemediationJournalByOpId as Mi,listActiveRemediationOps as xi,listActiveRemediationOpsForContext as vi,readRemediationJournal as Ui,sweepExpiredRemediationJournals as Fi,writeRemediationJournal as bi,REMEDIATION_JOURNAL_RETENTION_DAYS as ki,captureRemediationForensics as Yi,defaultRemediationForensicsDir as Vi,applyRetainFlip as Gi,composeFlipCapabilities as Bi,computeTemplateDigest as Ki,deriveRetainFlipTemplate as Xi,findMarkedResourcesByOpId as Hi,proveFlipMetadataOnly as wi,readRetainFlipState as Ji,verifyRetainFlipDiff as Qi,FORGET_MARKER_KEY as ji,FORGET_FLIP_SPEC as Wi,RECREATE_MARKER_KEY as Zi,assessForgetResumability as qi,completeForgetAfterConverge as zi,completeForgetAfterDeploy as $i,formatRecreateInFlightCures as ea,partitionPreFlightByRemediation as ra,runForgetSurgery as ta,synthTemplateDeclaresResource as oa,runRecreateSurgery as ia,snapshotPolicyForType as aa,SNAPSHOT_CAPABLE_RESOURCE_TYPES as na,runRecreatePreFlight as sa,deriveRemovalTemplate as Ea,findRemovalDeletionFailures as ca,findResourcesPresent as Sa,proveRemovalTargetsOnly as la,advertisableDriftVerbs as Ta,buildDriftRepairTicket as _a,runDriftRepairGate as Aa,formatPinOutcomeDetail as Ra,pinProbeCoverage as pa,renderPinReportLines as ma,runPinRemediation as da,captureLegacySurfaces as ua,decodeLegacyAnchor as Pa,runIdentitySurfaceGate as Da,collectIdentityPinCandidates as Oa,degradedIdentityPinOutcomes as fa,renderIdentityPinReportLines as Ca,runIdentityPinMigration as Na,composePostFailureRepairOffer as La,formatDriftRepairOffer as ga,DriftRepairAvailableError as Ia,checkDeployPathStackAvailability as ya,isDeployPathBlockingStatus as ha,StackUnavailableError as Ma,assertLeaseBeforeStack as xa,LeaseDeniedError as va}from"./orchestration/index.js";import{unlockBucket as Fa,unlockQueue as ba}from"./orchestration/index.js";import{triageBucketPolicy as Ya,isEnforceSslStatement as Va,toResourcePolicyStatements as Ga,restoreBucketPolicy as Ba,synthesiseEnforceSslDocument as Ka,ensureEnforceSsl as Xa,restoreAndReconcileQuarantinedBucket as Ha}from"./orchestration/index.js";import{verifyOrgTrailDelivery as Ja}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as ja,isRootTaskPolicyArn as Wa,ROOT_TASK_POLICY_ARNS as Za,MAX_ROOT_SESSION_SECONDS as qa}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as $a,flattenAccountsToEnvironments as en,extractAllAccountNames as rn,accountsConfigToOUTree as tn,isStringArray as on,isAccountsConfig as an,isOuOnlyAccountBucket as nn,OU_ONLY_ACCOUNT_BUCKETS as sn}from"./orchestration/index.js";import{runOpenNextBuild as cn}from"./orchestration/index.js";import{runOrganisationSetup as ln,ORG_SETUP_PHASES as Tn}from"./orchestration/index.js";import{DOMAIN_DELEGATION_ERROR_TYPES as An,DomainDelegationError as Rn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as pn,PUBLIC_DNS_QUERY_TIMEOUT_MS as mn,createPublicResolvers as dn,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as un,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Pn,waitForNsPropagation as Dn,ACM_CAA_ISSUERS as On,runCaaPreflight as fn,deployDelegatedDomain as Cn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as Nn,templateOwnsDelegationRecord as Ln,deleteChildNsFromParent as gn,nsDelegationPhysicalName as In,runDelegatedDomainDestroy as yn}from"./orchestration/index.js";import{classifyZoneRecords as Mn,buildSatelliteRecordIndex as xn,createSystemDnsNameProbe as vn,systemDnsNameProbe as Un,normaliseRecordName as Fn,isRoute53NameServer as bn,isDelegatedToRoute53 as kn}from"./orchestration/index.js";import{resolveBuildSecrets as Vn,resolveSecretRefValue as Gn,resolveBuildSecretSessionProvider as Bn,sourcedRefsFromBuildArgs as Kn,resolveBuildArgs as Xn,buildBuildSecretSessionPolicy as Hn,buildDeploySessionPolicy as wn,partitionForRegion as Jn,validateBuildGroup as Qn}from"./orchestration/index.js";import{FrameworkRegistry as Wn}from"./orchestration/index.js";import{openNextBuilder as qn,staticSiteBuilder as zn,dockerBuilder as $n}from"./orchestration/index.js";import{StepRegistry as rs,getDestroyStepId as ts}from"./steps/index.js";import{buildDeployPlan as is,computeDeployPlan as as,computeAssemblyDigest as ns,digestHead as ss,classifyImpact as Es,derivePropertyChanges as cs,isDataLoss as Ss,isStatefulResourceType as ls,renderPlanSummary as Ts,renderPlanLines as _s,toWirePlanChanges as As,signApprovalToken as Rs,verifyApprovalToken as ps,DEFAULT_APPROVAL_TTL_MS as ms,APPROVAL_TOKEN_PATTERN as ds,runApprovalGate as us,approvalRefusalReason as Ps}from"./orchestration/index.js";import{runDestructionGate as Os,buildDestructionTicket as fs,evaluateDestructionConsents as Cs,computeTicketDigest as Ns,legalRemediationVerbs as Ls,executableRemediationVerbs as gs,advertisableRemediationVerbs as Is,renderDestructionTicketLines as ys,renderConsentVerdictLines as hs,loadDeployPlan as Ms,createMemoisedPlanLoader as xs}from"./orchestration/index.js";export{On as ACM_CAA_ISSUERS,j as ALL_PROGRESS_KINDS,Lr as APPLICATION_DEPLOY_ORDER,gr as APPLICATION_DESTROY_ORDER,Cr as APPLICATION_STACKS,Q as APPROVAL_DECISIONS,J as APPROVAL_KINDS,ds as APPROVAL_TOKEN_PATTERN,et as ApplicationError,zt as ApplicationStackService,io as AuthError,ao as AwsError,K as BUILDERS,to as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,T as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,l as CASCADE_PHASES,zr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,Nn as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Nt as CdkArgumentBuilder,Jt as CdkContextBuilder,eo as CdkError,ht as CdkEventMonitor,Lt as CdkProcessManager,Ct as CdkService,D as ChangeCountsSchema,Gt as CloudFormationError,Ot as CloudFormationEventMonitor,Vt as CloudFormationService,co as ConfigError,ms as DEFAULT_APPROVAL_TTL_MS,xt as DEFAULT_DEPLOY_TIMEOUT_MS,xe as DEFAULT_MAX_PAGES,pn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,yt as DEPENDENCY_SYNC_TIMEOUT_MS,S as DEPLOYMENT_ERROR_MESSAGE_MAX,E as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,c as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,a as DEPLOYMENT_EVENT_TYPES,t as DEPLOY_CORE_VERSION_GLOBAL,v as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,h as DEPLOY_EVENT_ERROR_MESSAGE_MAX,L as DEPLOY_EVENT_ID_MAX,I as DEPLOY_EVENT_MESSAGE_MAX,g as DEPLOY_EVENT_NAME_MAX,x as DEPLOY_EVENT_OUTPUT_MAX,y as DEPLOY_EVENT_STATUS_REASON_MAX,M as DEPLOY_EVENT_TRAIL_DETAIL_MAX,U as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,An as DOMAIN_DELEGATION_ERROR_TYPES,Ni as DRIFT_PREFLIGHT_BUDGET_MS,Ci as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,p as DeployEventSchema,uo as DeployModeSchema,d as DeployResourceSchema,no as DeploymentError,i as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,Rn as DomainDelegationError,cr as DriftFindingSchema,Sr as DriftJournalRecordSchema,pi as DriftProbe,Ia as DriftRepairAvailableError,Er as DriftSuspectSchema,sr as DriftVerdictSchema,Kt as EcsError,Bt as EcsService,Xt as EcsServiceResolver,Wi as FORGET_FLIP_SPEC,ji as FORGET_MARKER_KEY,Eo as FileSystemError,nt as FjallStateFileSchema,Wn as FrameworkRegistry,We as IDENTITY_PIN_SLOT_SWAP_GLOSS,ve as IDENTITY_STORE_PAGE_SIZE,$r as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,Pt as LEGACY_DOMAIN_STATE_FILENAME,b as LOG_LEVELS,va as LeaseDeniedError,qa as MAX_ROOT_SESSION_SECONDS,Pn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,un as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,so as NetworkError,Ir as OPENNEXT_DEPLOY_ORDER,yr as OPENNEXT_DESTROY_ORDER,xr as OPENNEXT_PARALLEL_GROUPS,Wr as OPENNEXT_PATTERNS,Nr as ORGANISATION_TYPES,Tn as ORG_SETUP_PHASES,Si as ORG_TRAIL_BUCKET_OUTPUT_KEY,sn as OU_ONLY_ACCOUNT_BUCKETS,hr as PARALLEL_DEPLOY_GROUPS,Mr as PARALLEL_DESTROY_GROUPS,vr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,jt as PROGRESS_MESSAGES,mn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,P as PlanPropertyChangeSchema,fr as ProgressReporter,Zi as RECREATE_MARKER_KEY,ki as REMEDIATION_JOURNAL_RETENTION_DAYS,_r as REMEDIATION_PHASES,je as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,Za as ROOT_TASK_POLICY_ARNS,pr as RemediationFlipProofSchema,mr as RemediationJournalRecordSchema,Ar as RemediationPhaseSchema,Rr as RemediationTargetSchema,Qe as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,ke as SECURITY_SERVICE_PRINCIPALS,Ae as SERVICE_PRINCIPALS,na as SNAPSHOT_CAPABLE_RESOURCE_TYPES,k as STACK_CLEANUP_PHASES,qr as STACK_FAILED_STATE_PATTERN,Zr as STACK_NOT_FOUND_PATTERN,F as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,Po as ServiceArtefactSchema,Do as ServiceArtefactsSchema,$ as SimpleAwsProvider,Ma as StackUnavailableError,m as StepProgressSchema,rs as StepRegistry,or as TICKET_VERDICT_SOURCES,li as TRAIL_BUCKET_OUTPUT_KEY,Ti as TRAIL_KEY_ARN_OUTPUT_KEY,wt as TemplateHashError,Ht as TemplateHashService,ir as TicketVerdictSourceSchema,oo as ValidationError,tn as accountsConfigToOUTree,Le as activateCostAllocationTags,pe as activateTrustedAccess,Ta as advertisableDriftVerbs,Is as advertisableRemediationVerbs,Gi as applyRetainFlip,Ps as approvalRefusalReason,Ii as archiveCompletedRemediationJournal,mo as artefactOutputKey,xa as assertLeaseBeforeStack,qi as assessForgetResumability,ja as assumeRootForTask,qo as buildAccountRegionPairs,Ce as buildAccountToOUMap,Hn as buildBuildSecretSessionPolicy,is as buildDeployPlan,wn as buildDeploySessionPolicy,fs as buildDestructionTicket,_a as buildDriftRepairTicket,Go as buildParamsContext,Zo as buildRegionList,xn as buildSatelliteRecordIndex,Zt as buildStepContextBuildConfig,ie as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,ua as captureLegacySurfaces,Yi as captureRemediationForensics,zo as cascadeHomeRegion,$o as cascadeOperationKey,ya as checkDeployPathStackAvailability,ge as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,_ as clampDeploymentEventStrings,Ai as classifyDriftFailure,Es as classifyImpact,Mn as classifyZoneRecords,It as clearDependencyIntegrityCache,mi as clearDriftSuspects,Oa as collectIdentityPinCandidates,zi as completeForgetAfterConverge,$i as completeForgetAfterDeploy,Bi as composeFlipCapabilities,La as composePostFailureRepairOffer,ye as composeSdkAbortSignal,ns as computeAssemblyDigest,as as computeDeployPlan,yi as computeRemediationOpId,Ho as computeSecretsDrift,Ki as computeTemplateDigest,Ns as computeTicketDigest,qt as convertCloudFormationOutputsToRecord,De as createAccount,W as createDeployEmitter,ct as createEmptyState,xs as createMemoisedPlanLoader,dn as createPublicResolvers,go as createSequencedCallbacks,vn as createSystemDnsNameProbe,si as decideNextTransition,Pa as decodeLegacyAnchor,ci as decommissionMemberTrailStorage,di as defaultDriftJournalDir,Vi as defaultRemediationForensicsDir,hi as defaultRemediationJournalDir,fa as degradedIdentityPinOutcomes,gn as deleteChildNsFromParent,dt as deleteDomainState,St as deleteStateFile,bo as deploy,Cn as deployDelegatedDomain,cs as derivePropertyChanges,Ea as deriveRemovalTemplate,it as deriveResourcesFromManifestStacks,Xi as deriveRetainFlipTemplate,wo as deriveStaleParameters,le as describeOrganisation,te as describeTargetReadinessReason,Yo as destroy,Di as detectStackDrift,ss as digestHead,$n as dockerBuilder,Ue as drainPages,Qt as emitProgress,Ye as enableCentralisedRootAccess,me as enableIpamDelegatedAdmin,Te as enablePolicyTypes,Re as enableRamSharing,_e as enableServiceAccess,gt as ensureDependencyIntegrity,Xa as ensureEnforceSsl,Se as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Cs as evaluateDestructionConsents,gs as executableRemediationVerbs,rn as extractAllAccountNames,Jo as extractConsumedSsmParameters,he as extractErrorName,xo as failure,Ri as fetchLastOperationEvents,yo as fileExists,To as filterDangerousEnvVars,Pe as findAccount,Ne as findDevelopmentOuId,Hi as findMarkedResourcesByOpId,Mi as findRemediationJournalByOpId,ca as findRemovalDeletionFailures,Sa as findResourcesPresent,en as flattenAccountsToEnvironments,fi as formatDriftPreFlightBlock,ga as formatDriftRepairOffer,Ut as formatInfrastructureError,Ra as formatPinOutcomeDetail,ea as formatRecreateInFlightCures,Yr as getApplicationDeployOrder,Vr as getApplicationDestroyOrder,Gr as getApplicationStackName,Jr as getApplicationStepId,wr as getApplicationStepName,ts as getDestroyStepId,Br as getOrganisationStackName,br as getParallelDeployGroups,kr as getParallelDestroyGroups,bt as getSourceContext,Tt as getStateFilePath,Ft as getStructuralHint,kt as hasCdkDifferences,fo as hasDockerfile,ut as hashDomainDirectory,Me as isAborted,an as isAccountsConfig,Ur as isApplicationOperation,Kr as isApplicationStack,vt as isCdkError,Ss as isDataLoss,kn as isDelegatedToRoute53,ha as isDeployPathBlockingStatus,Va as isEnforceSslStatement,Uo as isFailure,Fe as isOULeaf,jr as isOpenNextPattern,Fr as isOrganisationOperation,nn as isOuOnlyAccountBucket,Xr as isQuarantineDetail,Dr as isRemediationPlaceholderPhysicalId,Hr as isRetainedBucketsDetail,Wa as isRootTaskPolicyArn,bn as isRoute53NameServer,ls as isStatefulResourceType,on as isStringArray,vo as isSuccess,Ls as legalRemediationVerbs,ue as listAccounts,xi as listActiveRemediationOps,vi as listActiveRemediationOpsForContext,Ms as loadDeployPlan,_o as maskSensitiveOutput,ai as mergeReconciledProviderAccounts,Fn as normaliseRecordName,In as nsDelegationPhysicalName,qn as openNextBuilder,$a as parseAccountsConfiguration,Wt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,Yt as parseDiffOutput,Ao as parseShellArgs,jo as partitionAccounts,Jn as partitionForRegion,ra as partitionPreFlightByRemediation,pa as pinProbeCoverage,fe as placeAccountsInOUs,ae as probeAccountStackExists,Xo as probeSecretsDrift,ti as projectAccountRows,ri as projectScalarSummary,wi as proveFlipMetadataOnly,la as proveRemovalTargetsOnly,Rt as readDomainState,ui as readDriftSuspects,Ui as readRemediationJournal,Ji as readRetainFlipState,st as readStateFile,ii as reconcileProviderAccounts,Ei as reconcileTrailMigration,mt as recordDomainDeployState,Pi as recordDriftSuspects,Ee as regionDisabledMessage,_t as regionSuffix,be as registerSecurityDelegates,ur as remediationPhaseRank,Pr as remediationPlaceholderPhysicalId,hs as renderConsentVerdictLines,ys as renderDestructionTicketLines,Ca as renderIdentityPinReportLines,ma as renderPinReportLines,_s as renderPlanLines,Ts as renderPlanSummary,Xn as resolveBuildArgs,Bn as resolveBuildSecretSessionProvider,Vn as resolveBuildSecrets,Gn as resolveSecretRefValue,Ko as restart,Ha as restoreAndReconcileQuarantinedBucket,Ba as restoreBucketPolicy,us as runApprovalGate,fn as runCaaPreflight,yn as runDelegatedDomainDestroy,Os as runDestructionGate,Oi as runDriftPreFlight,Aa as runDriftRepairGate,ta as runForgetSurgery,Na as runIdentityPinMigration,Da as runIdentitySurfaceGate,cn as runOpenNextBuild,ln as runOrganisationSetup,da as runPinRemediation,sa as runRecreatePreFlight,ia as runRecreateSurgery,Li as runRoute53RecordPreflight,Rs as signApprovalToken,Ro as sleep,No as sleepAbortable,Ie as snapshotIdentityCentre,aa as snapshotPolicyForType,Kn as sourcedRefsFromBuildArgs,Mt as startStackMonitoring,zn as staticSiteBuilder,tt as stubCallerIdentity,Mo as success,Fi as sweepExpiredRemediationJournals,oa as synthTemplateDeclaresResource,Ka as synthesiseEnforceSslDocument,Un as systemDnsNameProbe,Ln as templateOwnsDelegationRecord,Qr as toPascalCase,Ga as toResourcePolicyStatements,So as toServiceError,As as toWirePlanChanges,Ya as triageBucketPolicy,A as truncateUtf16Safe,Fa as unlockBucket,ba as unlockQueue,de as updateBackupGlobalSettings,lt as updateTemplateHash,Qn as validateBuildGroup,lr as verbsForDriftVerdict,ps as verifyApprovalToken,Ja as verifyOrgTrailDelivery,Qi as verifyRetainFlipDiff,Dn as waitForNsPropagation,rt as wrapApplicationError,pt as writeDomainState,bi as writeRemediationJournal,Et as writeStateFile};
+import{DEPLOY_CORE_VERSION_GLOBAL as t}from"./version.js";import{DeploymentEventSchema as i,DEPLOYMENT_EVENT_TYPES as a,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as n,DEPLOYMENT_EVENT_STATUS_REASON_MAX as s,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as E,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as c,DEPLOYMENT_ERROR_MESSAGE_MAX as S,CASCADE_PHASES as l,CASCADE_ACCOUNT_STATUSES as _,clampDeploymentEventStrings as A,truncateUtf16Safe as p}from"./types/index.js";import{DeployEventSchema as T,StepProgressSchema as m,DeployResourceSchema as d,PlanChangeSchema as u,PlanPropertyChangeSchema as D,ChangeCountsSchema as P,DEPLOY_EVENT_CONTRACT as O,DEPLOY_EVENT_CONTRACT_MAJOR as f,DEPLOY_EVENT_CONTRACT_MINOR as C,SUPPORTED_CONTRACT_MARKERS as N,DEPLOY_EVENT_ID_MAX as I,DEPLOY_EVENT_NAME_MAX as L,DEPLOY_EVENT_MESSAGE_MAX as g,DEPLOY_EVENT_STATUS_REASON_MAX as y,DEPLOY_EVENT_ERROR_MESSAGE_MAX as F,DEPLOY_EVENT_TRAIL_DETAIL_MAX as h,DEPLOY_EVENT_OUTPUT_MAX as x,DEPLOY_EVENT_ARN_MAX as M,DEPLOY_EVENT_URL_MAX as U,STEP_COMPLETE_STATUSES as v,LOG_LEVELS as b,STACK_CLEANUP_PHASES as k,CASCADE_ACCOUNT_PHASES as Y,DEPLOY_RESULTS as V,DETECTION_PHASES as G,PHASE_STATUSES as B,BUILDERS as K,CASCADE_OUTCOME_RESULTS as X,PLAN_ACTIONS as H,REPLACEMENT_MODES as w,APPROVAL_KINDS as J,APPROVAL_DECISIONS as Q,ALL_PROGRESS_KINDS as j,createDeployEmitter as W,parseDeployEvent as Z,parseDeployContractVersion as q}from"./types/index.js";import{SimpleAwsProvider as $}from"./aws/index.js";import{checkTargetReadiness as re,describeTargetReadinessReason as te,buildTargetUnreadyAdvisory as oe,buildTargetSetUnreadyAdvisory as ie,probeAccountStackExists as ae}from"./aws/index.js";import{checkRegionEnabled as se,regionDisabledMessage as Ee}from"./aws/index.js";import{ensureOrganisationExists as Se,describeOrganisation as le,enablePolicyTypes as _e,enableServiceAccess as Ae,SERVICE_PRINCIPALS as pe,enableRamSharing as Re,activateTrustedAccess as Te,enableIpamDelegatedAdmin as me,updateBackupGlobalSettings as de,listAccounts as ue,findAccount as De,createAccount as Pe,ensureOrganisationalUnitsExist as Oe,placeAccountsInOUs as fe,buildAccountToOUMap as Ce,findDevelopmentOuId as Ne,activateCostAllocationTags as Ie,checkIdentityCentreStatus as Le,snapshotIdentityCentre as ge,composeSdkAbortSignal as ye,extractErrorName as Fe,isAborted as he,DEFAULT_MAX_PAGES as xe,IDENTITY_STORE_PAGE_SIZE as Me,drainPages as Ue,isOULeaf as ve,registerSecurityDelegates as be,SECURITY_SERVICE_PRINCIPALS as ke,enableCentralisedRootAccess as Ye,ROOT_ACCESS_FEATURES as Ve,RootAccessEnablementError as Ge}from"./aws/index.js";import{STEP_IDS as Ke,STEP_NAMES as Xe,INFRASTRUCTURE_STEP_NAMES as He,INFRA_STEP_NAME as we}from"./types/index.js";import{RemediationVerbSchema as Qe,REMEDIATION_VERB_GLOSS as je,IDENTITY_PIN_SLOT_SWAP_GLOSS as We,DestructionFindingSchema as Ze,DestructionTicketResourceSchema as qe,DestructionTicketSchema as ze,DestructionConsentSchema as $e,DestructionOutcomeSchema as er,DESTRUCTION_FINDINGS as rr,CONSENT_VERDICTS as tr,TICKET_VERDICT_SOURCES as or,TicketVerdictSourceSchema as ir}from"./types/index.js";import{DRIFT_VERDICTS as nr,DriftVerdictSchema as sr,DriftSuspectSchema as Er,DriftFindingSchema as cr,DriftJournalRecordSchema as Sr,verbsForDriftVerdict as lr}from"./types/index.js";import{REMEDIATION_PHASES as Ar,RemediationPhaseSchema as pr,RemediationTargetSchema as Rr,RemediationFlipProofSchema as Tr,RemediationJournalRecordSchema as mr,RemediationVerbWithSurgerySchema as dr,remediationPhaseRank as ur,remediationPlaceholderPhysicalId as Dr,isRemediationPlaceholderPhysicalId as Pr}from"./types/index.js";import{ProgressReporter as fr,APPLICATION_STACKS as Cr,ORGANISATION_TYPES as Nr,APPLICATION_DEPLOY_ORDER as Ir,APPLICATION_DESTROY_ORDER as Lr,OPENNEXT_DEPLOY_ORDER as gr,OPENNEXT_DESTROY_ORDER as yr,PARALLEL_DEPLOY_GROUPS as Fr,PARALLEL_DESTROY_GROUPS as hr,OPENNEXT_PARALLEL_GROUPS as xr,PARALLEL_OPERATION_TYPES as Mr,isApplicationOperation as Ur,isOrganisationOperation as vr,getParallelDeployGroups as br,getParallelDestroyGroups as kr,getApplicationDeployOrder as Yr,getApplicationDestroyOrder as Vr,getApplicationStackName as Gr,getOrganisationStackName as Br,isApplicationStack as Kr,isQuarantineDetail as Xr,isRetainedBucketsDetail as Hr,getApplicationStepName as wr,getApplicationStepId as Jr,toPascalCase as Qr,isOpenNextPattern as jr,OPENNEXT_PATTERNS as Wr,STACK_NOT_FOUND_PATTERN as Zr,STACK_FAILED_STATE_PATTERN as qr,CDK_NO_STACKS_MATCH as zr,INFRASTRUCTURE_FILENAME as $r,ApplicationError as et,wrapApplicationError as rt,stubCallerIdentity as tt}from"./types/index.js";import{deriveResourcesFromManifestStacks as it}from"./types/detection/patternDetection.js";import{FjallStateFileSchema as nt,readStateFile as st,writeStateFile as Et,createEmptyState as ct,deleteStateFile as St,updateTemplateHash as lt,getStateFilePath as _t,regionSuffix as At}from"./types/config/FjallState.js";import{readDomainState as Rt,writeDomainState as Tt,recordDomainDeployState as mt,deleteDomainState as dt,hashDomainDirectory as ut,LEGACY_DOMAIN_STATE_FILENAME as Dt}from"./types/config/DomainState.js";import{CloudFormationEventMonitor as Ot}from"./aws/index.js";import{CdkService as Ct,CdkArgumentBuilder as Nt,CdkProcessManager as It,ensureDependencyIntegrity as Lt,clearDependencyIntegrityCache as gt,DEPENDENCY_SYNC_TIMEOUT_MS as yt,CdkEventMonitor as Ft,startStackMonitoring as ht,DEFAULT_DEPLOY_TIMEOUT_MS as xt,isCdkError as Mt,formatInfrastructureError as Ut,getStructuralHint as vt,getSourceContext as bt,hasCdkDifferences as kt,parseDiffOutput as Yt,CloudFormationService as Vt,CloudFormationError as Gt,EcsService as Bt,EcsError as Kt,EcsServiceResolver as Xt,TemplateHashService as Ht,TemplateHashError as wt,CdkContextBuilder as Jt,emitProgress as Qt,PROGRESS_MESSAGES as jt,parseBuildPhase as Wt,buildStepContextBuildConfig as Zt,convertCloudFormationOutputsToRecord as qt,ApplicationStackService as zt}from"./services/index.js";import{CdkError as eo}from"./types/errors/index.js";import{BaseServiceError as to,ValidationError as oo,AuthError as io,AwsError as ao,DeploymentError as no,NetworkError as so,FileSystemError as Eo,ConfigError as co,toServiceError as So}from"./types/errors/index.js";import{filterDangerousEnvVars as _o,maskSensitiveOutput as Ao,parseShellArgs as po,sleep as Ro}from"@fjall/util";import{artefactOutputKey as mo,DeployModeSchema as uo,ServiceArtefactSchema as Do,ServiceArtefactsSchema as Po}from"@fjall/util";import{hasDockerfile as fo}from"./util/dockerfileDetection.js";import{sleepAbortable as No}from"./util/sleepAbortable.js";import{createSequencedCallbacks as Lo}from"./util/sequencedCallbacks.js";import{fileExists as yo}from"@fjall/util/fsHelpers";import{success as ho,failure as xo,isSuccess as Mo,isFailure as Uo}from"@fjall/generator";import{deploy as bo}from"./orchestration/index.js";import{destroy as Yo}from"./orchestration/index.js";import{buildParamsContext as Go}from"./orchestration/contextHelpers.js";import{restart as Ko,probeSecretsDrift as Xo,probeServiceDeploymentStatus as Ho,computeSecretsDrift as wo,deriveStaleParameters as Jo,extractConsumedSsmParameters as Qo}from"./orchestration/index.js";import{partitionAccounts as Wo}from"./orchestration/index.js";import{buildRegionList as qo,buildAccountRegionPairs as zo,cascadeHomeRegion as $o,cascadeOperationKey as ei}from"./orchestration/index.js";import{projectScalarSummary as ti,projectAccountRows as oi}from"./orchestration/index.js";import{reconcileProviderAccounts as ai,mergeReconciledProviderAccounts as ni}from"./orchestration/index.js";import{decideNextTransition as Ei,reconcileTrailMigration as ci,decommissionMemberTrailStorage as Si,ORG_TRAIL_BUCKET_OUTPUT_KEY as li,TRAIL_BUCKET_OUTPUT_KEY as _i,TRAIL_KEY_ARN_OUTPUT_KEY as Ai}from"./orchestration/index.js";import{classifyDriftFailure as Ri,fetchLastOperationEvents as Ti,DriftProbe as mi,clearDriftSuspects as di,defaultDriftJournalDir as ui,readDriftSuspects as Di,recordDriftSuspects as Pi,detectStackDrift as Oi,runDriftPreFlight as fi,formatDriftPreFlightBlock as Ci,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Ni,DRIFT_PREFLIGHT_BUDGET_MS as Ii,runRoute53RecordPreflight as Li}from"./orchestration/index.js";import{archiveCompletedRemediationJournal as yi,computeRemediationOpId as Fi,defaultRemediationJournalDir as hi,findRemediationJournalByOpId as xi,listActiveRemediationOps as Mi,listActiveRemediationOpsForContext as Ui,readRemediationJournal as vi,sweepExpiredRemediationJournals as bi,writeRemediationJournal as ki,REMEDIATION_JOURNAL_RETENTION_DAYS as Yi,captureRemediationForensics as Vi,defaultRemediationForensicsDir as Gi,applyRetainFlip as Bi,composeFlipCapabilities as Ki,computeTemplateDigest as Xi,deriveRetainFlipTemplate as Hi,findMarkedResourcesByOpId as wi,proveFlipMetadataOnly as Ji,readRetainFlipState as Qi,verifyRetainFlipDiff as ji,FORGET_MARKER_KEY as Wi,FORGET_FLIP_SPEC as Zi,RECREATE_MARKER_KEY as qi,assessForgetResumability as zi,completeForgetAfterConverge as $i,completeForgetAfterDeploy as ea,formatRecreateInFlightCures as ra,partitionPreFlightByRemediation as ta,runForgetSurgery as oa,synthTemplateDeclaresResource as ia,runRecreateSurgery as aa,snapshotPolicyForType as na,SNAPSHOT_CAPABLE_RESOURCE_TYPES as sa,runRecreatePreFlight as Ea,deriveRemovalTemplate as ca,findRemovalDeletionFailures as Sa,findResourcesPresent as la,proveRemovalTargetsOnly as _a,advertisableDriftVerbs as Aa,buildDriftRepairTicket as pa,runDriftRepairGate as Ra,formatPinOutcomeDetail as Ta,pinProbeCoverage as ma,renderPinReportLines as da,runPinRemediation as ua,captureLegacySurfaces as Da,decodeLegacyAnchor as Pa,runIdentitySurfaceGate as Oa,collectIdentityPinCandidates as fa,degradedIdentityPinOutcomes as Ca,renderIdentityPinReportLines as Na,runIdentityPinMigration as Ia,composePostFailureRepairOffer as La,formatDriftRepairOffer as ga,DriftRepairAvailableError as ya,checkDeployPathStackAvailability as Fa,isDeployPathBlockingStatus as ha,StackUnavailableError as xa,assertLeaseBeforeStack as Ma,LeaseDeniedError as Ua}from"./orchestration/index.js";import{unlockBucket as ba,unlockQueue as ka}from"./orchestration/index.js";import{triageBucketPolicy as Va,isEnforceSslStatement as Ga,toResourcePolicyStatements as Ba,restoreBucketPolicy as Ka,synthesiseEnforceSslDocument as Xa,ensureEnforceSsl as Ha,restoreAndReconcileQuarantinedBucket as wa}from"./orchestration/index.js";import{verifyOrgTrailDelivery as Qa}from"./aws/cloudtrail/orgTrailDelivery.js";import{assumeRootForTask as Wa,isRootTaskPolicyArn as Za,ROOT_TASK_POLICY_ARNS as qa,MAX_ROOT_SESSION_SECONDS as za}from"./aws/sts/assumeRoot.js";import{parseAccountsConfiguration as en,flattenAccountsToEnvironments as rn,extractAllAccountNames as tn,accountsConfigToOUTree as on,isStringArray as an,isAccountsConfig as nn,isOuOnlyAccountBucket as sn,OU_ONLY_ACCOUNT_BUCKETS as En}from"./orchestration/index.js";import{runOpenNextBuild as Sn}from"./orchestration/index.js";import{runOrganisationSetup as _n,ORG_SETUP_PHASES as An}from"./orchestration/index.js";import{DOMAIN_DELEGATION_ERROR_TYPES as Rn,DomainDelegationError as Tn,DEFAULT_PUBLIC_RESOLVER_ADDRESSES as mn,PUBLIC_DNS_QUERY_TIMEOUT_MS as dn,createPublicResolvers as un,NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS as Dn,NS_PROPAGATION_DEFAULT_INTERVAL_MS as Pn,waitForNsPropagation as On,ACM_CAA_ISSUERS as fn,runCaaPreflight as Cn,deployDelegatedDomain as Nn,CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE as In,templateOwnsDelegationRecord as Ln,deleteChildNsFromParent as gn,nsDelegationPhysicalName as yn,runDelegatedDomainDestroy as Fn}from"./orchestration/index.js";import{classifyZoneRecords as xn,buildSatelliteRecordIndex as Mn,createSystemDnsNameProbe as Un,systemDnsNameProbe as vn,normaliseRecordName as bn,isRoute53NameServer as kn,isDelegatedToRoute53 as Yn}from"./orchestration/index.js";import{resolveBuildSecrets as Gn,resolveSecretRefValue as Bn,resolveBuildSecretSessionProvider as Kn,sourcedRefsFromBuildArgs as Xn,resolveBuildArgs as Hn,buildBuildSecretSessionPolicy as wn,buildDeploySessionPolicy as Jn,partitionForRegion as Qn,validateBuildGroup as jn}from"./orchestration/index.js";import{FrameworkRegistry as Zn}from"./orchestration/index.js";import{openNextBuilder as zn,staticSiteBuilder as $n,dockerBuilder as es}from"./orchestration/index.js";import{StepRegistry as ts,getDestroyStepId as os}from"./steps/index.js";import{buildDeployPlan as as,computeDeployPlan as ns,computeAssemblyDigest as ss,digestHead as Es,classifyImpact as cs,derivePropertyChanges as Ss,isDataLoss as ls,isStatefulResourceType as _s,renderPlanSummary as As,renderPlanLines as ps,toWirePlanChanges as Rs,signApprovalToken as Ts,verifyApprovalToken as ms,DEFAULT_APPROVAL_TTL_MS as ds,APPROVAL_TOKEN_PATTERN as us,runApprovalGate as Ds,approvalRefusalReason as Ps}from"./orchestration/index.js";import{runDestructionGate as fs,buildDestructionTicket as Cs,evaluateDestructionConsents as Ns,computeTicketDigest as Is,legalRemediationVerbs as Ls,executableRemediationVerbs as gs,advertisableRemediationVerbs as ys,renderDestructionTicketLines as Fs,renderConsentVerdictLines as hs,loadDeployPlan as xs,createMemoisedPlanLoader as Ms}from"./orchestration/index.js";import{DEPLOYMENT_FAILURE_CLASSIFIER_VERSION as vs,classifyDeployFailure as bs,classifyFromEcsCompletion as ks,classifyFromFailureAnalysis as Ys,classifyUnclassified as Vs}from"./orchestration/failure/classifyFailure.js";import{attachDeploymentFailure as Bs,getDeploymentFailure as Ks}from"./orchestration/failure/deploymentFailureAttachment.js";export{fn as ACM_CAA_ISSUERS,j as ALL_PROGRESS_KINDS,Ir as APPLICATION_DEPLOY_ORDER,Lr as APPLICATION_DESTROY_ORDER,Cr as APPLICATION_STACKS,Q as APPROVAL_DECISIONS,J as APPROVAL_KINDS,us as APPROVAL_TOKEN_PATTERN,et as ApplicationError,zt as ApplicationStackService,io as AuthError,ao as AwsError,K as BUILDERS,to as BaseServiceError,Y as CASCADE_ACCOUNT_PHASES,_ as CASCADE_ACCOUNT_STATUSES,X as CASCADE_OUTCOME_RESULTS,l as CASCADE_PHASES,zr as CDK_NO_STACKS_MATCH,tr as CONSENT_VERDICTS,In as CROSS_ACCOUNT_DELEGATION_RESOURCE_TYPE,Nt as CdkArgumentBuilder,Jt as CdkContextBuilder,eo as CdkError,Ft as CdkEventMonitor,It as CdkProcessManager,Ct as CdkService,P as ChangeCountsSchema,Gt as CloudFormationError,Ot as CloudFormationEventMonitor,Vt as CloudFormationService,co as ConfigError,ds as DEFAULT_APPROVAL_TTL_MS,xt as DEFAULT_DEPLOY_TIMEOUT_MS,xe as DEFAULT_MAX_PAGES,mn as DEFAULT_PUBLIC_RESOLVER_ADDRESSES,yt as DEPENDENCY_SYNC_TIMEOUT_MS,S as DEPLOYMENT_ERROR_MESSAGE_MAX,E as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,n as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,s as DEPLOYMENT_EVENT_STATUS_REASON_MAX,c as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,a as DEPLOYMENT_EVENT_TYPES,vs as DEPLOYMENT_FAILURE_CLASSIFIER_VERSION,t as DEPLOY_CORE_VERSION_GLOBAL,M as DEPLOY_EVENT_ARN_MAX,O as DEPLOY_EVENT_CONTRACT,f as DEPLOY_EVENT_CONTRACT_MAJOR,C as DEPLOY_EVENT_CONTRACT_MINOR,F as DEPLOY_EVENT_ERROR_MESSAGE_MAX,I as DEPLOY_EVENT_ID_MAX,g as DEPLOY_EVENT_MESSAGE_MAX,L as DEPLOY_EVENT_NAME_MAX,x as DEPLOY_EVENT_OUTPUT_MAX,y as DEPLOY_EVENT_STATUS_REASON_MAX,h as DEPLOY_EVENT_TRAIL_DETAIL_MAX,U as DEPLOY_EVENT_URL_MAX,V as DEPLOY_RESULTS,rr as DESTRUCTION_FINDINGS,G as DETECTION_PHASES,Rn as DOMAIN_DELEGATION_ERROR_TYPES,Ii as DRIFT_PREFLIGHT_BUDGET_MS,Ni as DRIFT_PREFLIGHT_TRIGGER_STATUSES,nr as DRIFT_VERDICTS,T as DeployEventSchema,uo as DeployModeSchema,d as DeployResourceSchema,no as DeploymentError,i as DeploymentEventSchema,$e as DestructionConsentSchema,Ze as DestructionFindingSchema,er as DestructionOutcomeSchema,qe as DestructionTicketResourceSchema,ze as DestructionTicketSchema,Tn as DomainDelegationError,cr as DriftFindingSchema,Sr as DriftJournalRecordSchema,mi as DriftProbe,ya as DriftRepairAvailableError,Er as DriftSuspectSchema,sr as DriftVerdictSchema,Kt as EcsError,Bt as EcsService,Xt as EcsServiceResolver,Zi as FORGET_FLIP_SPEC,Wi as FORGET_MARKER_KEY,Eo as FileSystemError,nt as FjallStateFileSchema,Zn as FrameworkRegistry,We as IDENTITY_PIN_SLOT_SWAP_GLOSS,Me as IDENTITY_STORE_PAGE_SIZE,$r as INFRASTRUCTURE_FILENAME,He as INFRASTRUCTURE_STEP_NAMES,we as INFRA_STEP_NAME,Dt as LEGACY_DOMAIN_STATE_FILENAME,b as LOG_LEVELS,Ua as LeaseDeniedError,za as MAX_ROOT_SESSION_SECONDS,Pn as NS_PROPAGATION_DEFAULT_INTERVAL_MS,Dn as NS_PROPAGATION_DEFAULT_MAX_ATTEMPTS,so as NetworkError,gr as OPENNEXT_DEPLOY_ORDER,yr as OPENNEXT_DESTROY_ORDER,xr as OPENNEXT_PARALLEL_GROUPS,Wr as OPENNEXT_PATTERNS,Nr as ORGANISATION_TYPES,An as ORG_SETUP_PHASES,li as ORG_TRAIL_BUCKET_OUTPUT_KEY,En as OU_ONLY_ACCOUNT_BUCKETS,Fr as PARALLEL_DEPLOY_GROUPS,hr as PARALLEL_DESTROY_GROUPS,Mr as PARALLEL_OPERATION_TYPES,B as PHASE_STATUSES,H as PLAN_ACTIONS,jt as PROGRESS_MESSAGES,dn as PUBLIC_DNS_QUERY_TIMEOUT_MS,u as PlanChangeSchema,D as PlanPropertyChangeSchema,fr as ProgressReporter,qi as RECREATE_MARKER_KEY,Yi as REMEDIATION_JOURNAL_RETENTION_DAYS,Ar as REMEDIATION_PHASES,je as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,Ve as ROOT_ACCESS_FEATURES,qa as ROOT_TASK_POLICY_ARNS,Tr as RemediationFlipProofSchema,mr as RemediationJournalRecordSchema,pr as RemediationPhaseSchema,Rr as RemediationTargetSchema,Qe as RemediationVerbSchema,dr as RemediationVerbWithSurgerySchema,Ge as RootAccessEnablementError,ke as SECURITY_SERVICE_PRINCIPALS,pe as SERVICE_PRINCIPALS,sa as SNAPSHOT_CAPABLE_RESOURCE_TYPES,k as STACK_CLEANUP_PHASES,qr as STACK_FAILED_STATE_PATTERN,Zr as STACK_NOT_FOUND_PATTERN,v as STEP_COMPLETE_STATUSES,Ke as STEP_IDS,Xe as STEP_NAMES,N as SUPPORTED_CONTRACT_MARKERS,Do as ServiceArtefactSchema,Po as ServiceArtefactsSchema,$ as SimpleAwsProvider,xa as StackUnavailableError,m as StepProgressSchema,ts as StepRegistry,or as TICKET_VERDICT_SOURCES,_i as TRAIL_BUCKET_OUTPUT_KEY,Ai as TRAIL_KEY_ARN_OUTPUT_KEY,wt as TemplateHashError,Ht as TemplateHashService,ir as TicketVerdictSourceSchema,oo as ValidationError,on as accountsConfigToOUTree,Ie as activateCostAllocationTags,Te as activateTrustedAccess,Aa as advertisableDriftVerbs,ys as advertisableRemediationVerbs,Bi as applyRetainFlip,Ps as approvalRefusalReason,yi as archiveCompletedRemediationJournal,mo as artefactOutputKey,Ma as assertLeaseBeforeStack,zi as assessForgetResumability,Wa as assumeRootForTask,Bs as attachDeploymentFailure,zo as buildAccountRegionPairs,Ce as buildAccountToOUMap,wn as buildBuildSecretSessionPolicy,as as buildDeployPlan,Jn as buildDeploySessionPolicy,Cs as buildDestructionTicket,pa as buildDriftRepairTicket,Go as buildParamsContext,qo as buildRegionList,Mn as buildSatelliteRecordIndex,Zt as buildStepContextBuildConfig,ie as buildTargetSetUnreadyAdvisory,oe as buildTargetUnreadyAdvisory,Da as captureLegacySurfaces,Vi as captureRemediationForensics,$o as cascadeHomeRegion,ei as cascadeOperationKey,Fa as checkDeployPathStackAvailability,Le as checkIdentityCentreStatus,se as checkRegionEnabled,re as checkTargetReadiness,A as clampDeploymentEventStrings,bs as classifyDeployFailure,Ri as classifyDriftFailure,ks as classifyFromEcsCompletion,Ys as classifyFromFailureAnalysis,cs as classifyImpact,Vs as classifyUnclassified,xn as classifyZoneRecords,gt as clearDependencyIntegrityCache,di as clearDriftSuspects,fa as collectIdentityPinCandidates,$i as completeForgetAfterConverge,ea as completeForgetAfterDeploy,Ki as composeFlipCapabilities,La as composePostFailureRepairOffer,ye as composeSdkAbortSignal,ss as computeAssemblyDigest,ns as computeDeployPlan,Fi as computeRemediationOpId,wo as computeSecretsDrift,Xi as computeTemplateDigest,Is as computeTicketDigest,qt as convertCloudFormationOutputsToRecord,Pe as createAccount,W as createDeployEmitter,ct as createEmptyState,Ms as createMemoisedPlanLoader,un as createPublicResolvers,Lo as createSequencedCallbacks,Un as createSystemDnsNameProbe,Ei as decideNextTransition,Pa as decodeLegacyAnchor,Si as decommissionMemberTrailStorage,ui as defaultDriftJournalDir,Gi as defaultRemediationForensicsDir,hi as defaultRemediationJournalDir,Ca as degradedIdentityPinOutcomes,gn as deleteChildNsFromParent,dt as deleteDomainState,St as deleteStateFile,bo as deploy,Nn as deployDelegatedDomain,Ss as derivePropertyChanges,ca as deriveRemovalTemplate,it as deriveResourcesFromManifestStacks,Hi as deriveRetainFlipTemplate,Jo as deriveStaleParameters,le as describeOrganisation,te as describeTargetReadinessReason,Yo as destroy,Oi as detectStackDrift,Es as digestHead,es as dockerBuilder,Ue as drainPages,Qt as emitProgress,Ye as enableCentralisedRootAccess,me as enableIpamDelegatedAdmin,_e as enablePolicyTypes,Re as enableRamSharing,Ae as enableServiceAccess,Lt as ensureDependencyIntegrity,Ha as ensureEnforceSsl,Se as ensureOrganisationExists,Oe as ensureOrganisationalUnitsExist,Ns as evaluateDestructionConsents,gs as executableRemediationVerbs,tn as extractAllAccountNames,Qo as extractConsumedSsmParameters,Fe as extractErrorName,xo as failure,Ti as fetchLastOperationEvents,yo as fileExists,_o as filterDangerousEnvVars,De as findAccount,Ne as findDevelopmentOuId,wi as findMarkedResourcesByOpId,xi as findRemediationJournalByOpId,Sa as findRemovalDeletionFailures,la as findResourcesPresent,rn as flattenAccountsToEnvironments,Ci as formatDriftPreFlightBlock,ga as formatDriftRepairOffer,Ut as formatInfrastructureError,Ta as formatPinOutcomeDetail,ra as formatRecreateInFlightCures,Yr as getApplicationDeployOrder,Vr as getApplicationDestroyOrder,Gr as getApplicationStackName,Jr as getApplicationStepId,wr as getApplicationStepName,Ks as getDeploymentFailure,os as getDestroyStepId,Br as getOrganisationStackName,br as getParallelDeployGroups,kr as getParallelDestroyGroups,bt as getSourceContext,_t as getStateFilePath,vt as getStructuralHint,kt as hasCdkDifferences,fo as hasDockerfile,ut as hashDomainDirectory,he as isAborted,nn as isAccountsConfig,Ur as isApplicationOperation,Kr as isApplicationStack,Mt as isCdkError,ls as isDataLoss,Yn as isDelegatedToRoute53,ha as isDeployPathBlockingStatus,Ga as isEnforceSslStatement,Uo as isFailure,ve as isOULeaf,jr as isOpenNextPattern,vr as isOrganisationOperation,sn as isOuOnlyAccountBucket,Xr as isQuarantineDetail,Pr as isRemediationPlaceholderPhysicalId,Hr as isRetainedBucketsDetail,Za as isRootTaskPolicyArn,kn as isRoute53NameServer,_s as isStatefulResourceType,an as isStringArray,Mo as isSuccess,Ls as legalRemediationVerbs,ue as listAccounts,Mi as listActiveRemediationOps,Ui as listActiveRemediationOpsForContext,xs as loadDeployPlan,Ao as maskSensitiveOutput,ni as mergeReconciledProviderAccounts,bn as normaliseRecordName,yn as nsDelegationPhysicalName,zn as openNextBuilder,en as parseAccountsConfiguration,Wt as parseBuildPhase,q as parseDeployContractVersion,Z as parseDeployEvent,Yt as parseDiffOutput,po as parseShellArgs,Wo as partitionAccounts,Qn as partitionForRegion,ta as partitionPreFlightByRemediation,ma as pinProbeCoverage,fe as placeAccountsInOUs,ae as probeAccountStackExists,Xo as probeSecretsDrift,Ho as probeServiceDeploymentStatus,oi as projectAccountRows,ti as projectScalarSummary,Ji as proveFlipMetadataOnly,_a as proveRemovalTargetsOnly,Rt as readDomainState,Di as readDriftSuspects,vi as readRemediationJournal,Qi as readRetainFlipState,st as readStateFile,ai as reconcileProviderAccounts,ci as reconcileTrailMigration,mt as recordDomainDeployState,Pi as recordDriftSuspects,Ee as regionDisabledMessage,At as regionSuffix,be as registerSecurityDelegates,ur as remediationPhaseRank,Dr as remediationPlaceholderPhysicalId,hs as renderConsentVerdictLines,Fs as renderDestructionTicketLines,Na as renderIdentityPinReportLines,da as renderPinReportLines,ps as renderPlanLines,As as renderPlanSummary,Hn as resolveBuildArgs,Kn as resolveBuildSecretSessionProvider,Gn as resolveBuildSecrets,Bn as resolveSecretRefValue,Ko as restart,wa as restoreAndReconcileQuarantinedBucket,Ka as restoreBucketPolicy,Ds as runApprovalGate,Cn as runCaaPreflight,Fn as runDelegatedDomainDestroy,fs as runDestructionGate,fi as runDriftPreFlight,Ra as runDriftRepairGate,oa as runForgetSurgery,Ia as runIdentityPinMigration,Oa as runIdentitySurfaceGate,Sn as runOpenNextBuild,_n as runOrganisationSetup,ua as runPinRemediation,Ea as runRecreatePreFlight,aa as runRecreateSurgery,Li as runRoute53RecordPreflight,Ts as signApprovalToken,Ro as sleep,No as sleepAbortable,ge as snapshotIdentityCentre,na as snapshotPolicyForType,Xn as sourcedRefsFromBuildArgs,ht as startStackMonitoring,$n as staticSiteBuilder,tt as stubCallerIdentity,ho as success,bi as sweepExpiredRemediationJournals,ia as synthTemplateDeclaresResource,Xa as synthesiseEnforceSslDocument,vn as systemDnsNameProbe,Ln as templateOwnsDelegationRecord,Qr as toPascalCase,Ba as toResourcePolicyStatements,So as toServiceError,Rs as toWirePlanChanges,Va as triageBucketPolicy,p as truncateUtf16Safe,ba as unlockBucket,ka as unlockQueue,de as updateBackupGlobalSettings,lt as updateTemplateHash,jn as validateBuildGroup,lr as verbsForDriftVerdict,ms as verifyApprovalToken,Qa as verifyOrgTrailDelivery,ji as verifyRetainFlipDiff,On as waitForNsPropagation,rt as wrapApplicationError,Tt as writeDomainState,ki as writeRemediationJournal,Et as writeStateFile};

package/dist/src/orchestration/application/applicationDeploy.js

@@ -1 +1 @@
-var Re=Object.defineProperty;var D=(e,n)=>Re(e,"name",{value:n,configurable:!0});import{join as fe}from"path";import{CloudFormationClient as Ce}from"@aws-sdk/client-cloudformation";import{EC2Client as Ie}from"@aws-sdk/client-ec2";import{success as I,failure as d}from"@fjall/generator";import{logger as F}from"@fjall/util/logger";import{ImageTagSchema as Oe,getErrorMessage as Q,imageTagParameterName as Ae,maskSensitiveOutput as k}from"@fjall/util";import{parseDockerDeclarationsFromManifest as Le}from"@fjall/util/manifest";import{stubCallerIdentity as Be}from"../../types/deployment/index.js";import{getApplicationDeployOrder as Me,getApplicationStackName as O,getApplicationStepName as pe,getApplicationStepId as me,APPLICATION_STACKS as C}from"../../types/operations.js";import{CdkContextBuilder as $e}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as xe,buildCapacityIdentityContext as Fe,bootstrapOrFail as je}from"../contextHelpers.js";import{resolveDeployEnvironment as Ge}from"../deployEnvironment.js";import{buildBootstrapTagsIfResolved as He}from"../bootstrapTags.js";import{hasOrganisationTierAccount as Ue}from"../../aws/organisations/accountGlobals.js";import{runDetectionPipeline as _e}from"./detectionPipeline.js";import{assertCapacityPinsSupportedByAssembly as We,assertEngineCompatibleWithAssembly as Ke}from"./engineCompat.js";import{STEP_IDS as _,STEP_NAMES as qe}from"../../types/stepDefinitions.js";import{StepRegistry as Ve}from"../../steps/stepRegistry.js";import{checkTargetReadiness as ze}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as Je}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as Ye}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as ye,runDockerBuild as Qe}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as Xe,getStackNamesToDeploy as Ze,deployParallelPhase as et,deployStackSequential as tt,runDockerPreCompute as rt,runLambdaVersionPublish as nt,createBuildCallbacks as ot,willRunDockerBuild as at}from"./applicationDeployHelpers.js";import{verifyAssemblyIntegrity as ke}from"./assemblyIntegrity.js";import{captureDatabaseConnectionOutputs as it,captureServiceTaskDefinitions as st,reconcileDatabaseEndpointChange as ct}from"./databaseEndpointReconcile.js";import{deployCodeOnly as lt}from"./codeOnlyDeploy.js";import{checkDeployPathStackAvailability as he}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as W}from"./leaseGate.js";import{collectFullDeployArtefacts as dt}from"./artefactCollection.js";import{CfnRegistryService as ut}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as gt}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as ft}from"./approvalGate.js";import{buildDestructionTicket as pt,runDestructionGate as mt}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as yt,signApprovalToken as kt}from"./plan/approvalToken.js";import{computeAssemblyDigest as ht}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as St}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as bt}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as wt}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as Se}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as Et,runPinRemediation as Tt}from"../remediation/pinRemediation.js";import{degradedIdentityPinOutcomes as be,renderIdentityPinReportLines as Pt}from"../remediation/migrateIdentity.js";import{runRecreatePreFlight as vt}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as Nt}from"../remediation/recreateResource.js";const j="applicationDeploy";function Dt(e){const n=Object.entries(e);if(n.length===0)return;const o={};for(const[t,i]of n){const w=Ae(t);o[w]=i}return o}D(Dt,"buildCdkImageTagParameters");function Rt(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return d(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return d(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return d(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return d(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return d(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const n=Object.entries(e.serviceImageTags);if(n.length===0)return d(new Error("serviceImageTags must name at least one service"));for(const[o,t]of n){const i=Oe.safeParse(t);if(!i.success)return d(new Error(`serviceImageTags.${o} is not a valid image tag: ${i.error.message}`))}}return I(void 0)}D(Rt,"validateRollbackOptions");function we(e,n,o){if(e.onStackTargets===void 0||o.length===0)return;const t=n.awsProvider.getAccountId(),i=n.awsProvider.getRegion();e.onStackTargets(o.map(w=>({stackName:w,...t!==""?{accountId:t}:{},...i!==""?{region:i}:{}})))}D(we,"emitStackTargets");async function Sr(e,n,o){const{callbacks:t,options:i}=e,w=Date.now(),G=i?.mode??(i?.imageTag||i?.serviceImageTags?"rollback":i?.deployOnly?"code-only":"full");if(G==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),d(r)}const X=Rt(i);if(!X.success){const r=k(X.error.message),a=new Error(r);return t.onError?.(a),d(a)}const K=Ge({orgConfig:e.orgConfig,accountId:n.awsProvider.getAccountId()});if(!K.success){const r=new Error(k(K.error.message));return t.onError?.(r),d(r)}const B=$e.buildDeploymentContext({deployType:"application",target:o.appName,path:o.path,region:n.awsProvider.getRegion(),environment:K.data,callerIdentity:Be(n.awsProvider.getAccountId()),...xe({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc}),...e.managedDomainBindings!==void 0?{managedDomainBindings:e.managedDomainBindings}:{},...Fe(e)},{verbose:i?.verbose,infraOnly:i?.infraOnly},e.orgConfig),P=n.frameworkRegistry.resolve({appPath:o.path});let Z;const M=G==="rollback";if(P&&!M){Z=P.builder.plan({appPath:o.path},P.detection);const r=ot(t),a=await P.builder.build(o.path,Z,r,{skipBuild:i?.skipBuild,infraOnly:i?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!a.success){const c=new Error(k(a.error.message));return t.onError?.(c),d(c)}}if(G==="code-only"||M){t.onLog?.(M?i?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(i.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${i?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=fe(o.path,"cdk.out"),a=Ke({cdkOutPath:r,onWarning:D(f=>t.onLog?.(f,"warn"),"onWarning")});if(!a.success){const f=new Error(k(a.error.message));return t.onError?.(f),d(f)}const c=We({cdkOutPath:r,capacityIdentityWire:B.capacityIdentity,appName:o.appName});if(!c.success){const f=new Error(k(c.error.message));return t.onError?.(f),d(f)}const m=Le(r),l=m.declaresBuild,y=P?.detection.hasDockerfile===!0,g=l||y;F.debug(j,"Deploy-only branch entered",{mode:G,imageTag:i?.imageTag,serviceImageTags:i?.serviceImageTags,appName:o.appName,appPath:o.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:P?.builder.name,hasDockerfileFromManifest:l,hasDockerfileFromDisk:y,hasDockerfile:g,manifestDockerServiceCount:m.ecsServices.length,manifestDockerPaths:m.ecsServices.map(f=>f.docker.path),manifestLambdaDockerEntryCount:m.lambdaEntries.length}),!l&&!y&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const s=await he([O(o.appName,C.COMPUTE)],n.cfnService,e.abortSignal);if(!s.success)return t.onError?.(s.error),d(s.error);we(t,n,[O(o.appName,C.COMPUTE)]);let u={},h;if(!M&&e.dockerProvider!==void 0&&g){F.debug(j,"Running Docker build before code-only deploy",{source:l?"manifest":"disk"});const f=await Qe(e,n,o,t);if(!f.success)return d(f.error);u=f.data.contentHashTagsByService,h=f.data}else F.debug(j,"Skipping Docker build",{reason:M?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const b=await W(e.assertLeaseForStack,O(o.appName,C.COMPUTE),e.abortSignal);return b!==void 0?(t.onError?.(b),d(b)):lt(e,n,o,u,h)}t.onLog?.("Analysing infrastructure\u2026","info");const H=await _e(o,n,B,t,e.abortSignal);if(!H.success){const r=new Error(k(H.error.message),{cause:H.error});return t.onError?.(r),d(r)}const p=H.data;try{await t.onDetectionComplete?.({...p,builderName:P?.builder.name??"unknown"})}catch(r){const a=new Error(k(Q(r)),{cause:r});return t.onError?.(a),d(a)}const Ee={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:i?.infraOnly??!1,hasDockerfile:p.hasDockerfile,pattern:p.pattern,resources:p.resources,...P&&{builderName:P.builder.name}},ee=Ve.getSteps(Ee),te=ee.findIndex(r=>r.id===_.TARGET_READINESS),re=await Ye(t,{stepId:_.TARGET_READINESS,stepName:qe.TARGET_READINESS,...te>=0&&{stepIndex:te,totalSteps:ee.length}},async()=>{if(i?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=n.awsProvider.getAccountId(),a=e.orgConfig?.providerAccounts.find(y=>y.id===r)?.name,c=n.awsProvider.getCredentials(),m=Je(e.orgConfig),l=await ze({cloudFormation:n.awsProvider.getClient(Ce),ec2:new Ie({region:m,...c!==void 0&&{credentials:c}})},{id:r,...a!==void 0&&{name:a}},n.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return l.success?l.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(k(l.data.advisory))}:{kind:"error",error:new Error(k(l.error.message),{cause:l.error})}},e.abortSignal);if(!re.success)return re;const v=Me({pattern:p.pattern,resources:p.resources}),A=v.length,ne=p.hasDockerfile&&e.dockerProvider!==void 0&&v.includes(C.COMPUTE)&&i?.infraOnly!==!0;if(!p.hasDifferences&&!i?.force&&!ne){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(i?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=p.hasDockerfile&&e.dockerProvider!==void 0&&v.includes(C.COMPUTE);for(let c=0;c<v.length;c++){const m=v[c];r&&m===C.COMPUTE&&(t.onStepStart?.(_.DOCKER_OPERATIONS,ye),t.onStepComplete?.(_.DOCKER_OPERATIONS,ye,"skipped"));const l=me(m,"deploy"),y=pe(m,"deploy");t.onStepStart?.(l,y,c,A),t.onStepComplete?.(l,y,"skipped",c,A)}const a=await n.stackService.resolveWebsiteUrl(o.appName);return I({target:o.appName,deploymentType:"application",outputs:a?{websiteUrl:a}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-w})}const L=fe(o.path,"cdk.out"),E=Ze({deployOrder:v,stackChanges:p.stackChanges,appName:o.appName,force:i?.force===!0,computeBuildPossible:ne});we(t,n,[...E]);const q=await he([...E],n.cfnService,e.abortSignal);if(!q.success)return t.onError?.(q.error),d(q.error);const oe={stacksToDeploy:[...E],imageBuild:at({stackNamesToDeploy:E,appName:o.appName,hasDockerProvider:e.dockerProvider!==void 0,hasDockerfile:p.hasDockerfile})},ae=ht(p.currentHashes,oe),V=St({cfnService:n.cfnService,cdkOutPath:L,changedStacks:[...E],assemblyDigest:ae,registry:new ut(n.awsProvider),changeSetProbe:new gt(n.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),z=await bt(n.awsProvider,{stackNames:[...E],cdkOutPath:L,cfnService:n.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(z.kind==="blocked"){const r=new Error(z.message);return t.onError?.(r),d(r)}const ie=z.verifiedAbsentByNecessity??[],U=e.approvalGate!==void 0||i?.approvalToken!==void 0&&i.approvalToken!==""||i?.planOnly===!0;if(U){const r=await ft({approvalGate:e.approvalGate,options:i??{},target:o.appName,cdkOutPath:L,detection:{stackChanges:p.stackChanges,currentHashes:p.currentHashes},scope:oe,cfnService:n.cfnService,loadPlan:V,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const a=r.data;if(a.kind==="rejected")return t.onLog?.(`Deploy rejected: ${k(a.reason)}`,"warn"),I({target:o.appName,deploymentType:"application",rejected:!0,artefacts:[],...a.planDetail!==void 0?{planDetail:a.planDetail}:{},durationMs:Date.now()-w});if(a.kind==="awaiting"){const c=await V(),m=c.success?pt(c.data,ie):void 0;return I({target:o.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:a.approvalToken,assemblyDigest:a.assemblyDigest,planDetail:a.planDetail,...m!==void 0?{destructionTicket:m}:{},artefacts:[],durationMs:Date.now()-w})}}const N=await mt({loadPlan:V,options:i??{},target:o.appName,callbacks:t,verifiedAbsentByNecessity:ie,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!N.success)return t.onError?.(N.error),d(N.error);if(N.data.kind==="withheld"){const r=U?kt({assemblyDigest:ae,ttlMs:yt}):void 0;return I({target:o.appName,deploymentType:"application",destructionPending:!0,destructionTicket:N.data.ticket,destructionOutcome:N.data.outcome,destructionHaltReasons:N.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-w})}if(N.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:a}=N.data,c=r.resources.filter(l=>a.get(l.physicalName)==="pin");if(c.length>0){const l=c.filter(u=>u.finding==="rename-detected"),y=c.filter(u=>u.finding!=="rename-detected");t.onLog?.(`Pin remediation for ${o.appName}: ${c.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied to AWS`,"warn");let g;if(l.length>0){if(e.identityPinRunner!==void 0)try{g=await e.identityPinRunner(l,e.abortSignal)}catch(u){g={outcomes:be(l,"unknown",`identity-pin runner failed: ${k(Q(u))} \u2014 fix the cause, then run 'fjall migrate identity'`),verified:[],clean:!1}}else g={outcomes:be(l,"unknown","this surface cannot run the identity-pin migration \u2014 run 'fjall migrate identity' to pin and validate this slot"),verified:[],clean:!1};for(const u of Pt(g))t.onLog?.(u,"warn")}let s;if(y.length>0){s=await Tt(n.awsProvider,{targets:y.map(u=>({stack:u.stack,logicalId:u.logicalId,resourceType:u.resourceType,physicalName:u.physicalName,offendingProperties:u.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const u of Et(s))t.onLog?.(u,"warn")}return c.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),I({target:o.appName,deploymentType:"application",pinPending:!0,...s!==void 0?{pinReport:s}:{},...g!==void 0?{identityPinReport:g}:{},pinDeferredConsents:r.resources.length-c.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-w})}const m=r.resources.filter(l=>l.finding==="pinned-name-replacement"&&a.get(l.physicalName)==="recreate");if(m.length>0){const l=new Map;for(const s of m){const u=l.get(s.stack)??[];u.push(s),l.set(s.stack,u)}const y=await vt(n.awsProvider,{stacks:[...l].map(([s,u])=>({stackName:s,targets:u.map(h=>({logicalId:h.logicalId,resourceType:h.resourceType,physicalId:h.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!y.success){const s=new Error(k(y.error.message),{cause:y.error});return t.onError?.(s),d(s)}const g=[];for(const[s,u]of l){const h=await W(e.assertLeaseForStack,s,e.abortSignal,"destroy");if(h!==void 0)return g.length>0&&t.onLog?.(`Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(h),d(h);const b=u.map(S=>S.physicalName);t.onLog?.(`Recreate remediation for ${o.appName}: orchestrating the pinned-name replacement of ${b.join(", ")} on ${s}`,"warn");const f=await Nt(n.awsProvider,{stackName:s,targets:u.map(S=>({logicalId:S.logicalId,resourceType:S.resourceType,physicalId:S.physicalName})),appName:o.appName,consentedPhysicalNames:b,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:u.map(S=>S.logicalId),onProgress:D(S=>t.onLog?.(S,"info"),"onProgress"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!f.success){const S=g.length>0?` Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",T=new Error(k(`${f.error.message}${S}`));return t.onError?.(T),d(T)}g.push(`${s} (${b.join(", ")})`)}}}const Te=e.orgConfig!==void 0&&!Ue(e.orgConfig.providerAccounts),Pe=He({account:e.orgConfig?.providerAccounts.find(r=>r.id===n.awsProvider.getAccountId()),estate:Te?"solo":"org"}),se=await je(n,B,t,Pe);if(!se.success)return se;const ce=O(o.appName,C.DATABASE),J=E.has(ce),ve=J?await it(n.cfnService,o.appName,e.abortSignal):void 0,Ne=J?await st(n.ecsResolver,n.ecsService,o.appName,e.abortSignal):void 0,$={},x=new Map;let le,de={};const R=D(async()=>{!J||!x.has(ce)||await ct({appName:o.appName,connectionOutputsBefore:ve,serviceTaskDefinitionsBefore:Ne,services:{cfnService:n.cfnService,ecsService:n.ecsService,ecsResolver:n.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let r=0;r<v.length;r++){const a=v[r],c=O(o.appName,a),m=me(a,"deploy"),l=pe(a,"deploy");if(!E.has(c)){t.onStepStart?.(m,l,r,A),t.onLog?.(`Skipping ${a} \u2014 no changes detected`,"info"),t.onStepComplete?.(m,l,"skipped",r,A);continue}const y=await W(e.assertLeaseForStack,c,e.abortSignal);if(y!==void 0)return await R(),t.onError?.(y),d(y);const g=Xe(v,r,o.appName,E);if(g.length>=2){const T=await ke({hashService:n.hashService,cdkOutPath:L,stackNames:g.map(Y=>O(o.appName,Y)),detectionHashes:p.currentHashes,approvalGated:U});if(!T.success)return await R(),t.onError?.(T.error),d(T.error);const ge=await et(g,o,n,B,t,r,A,p,$,x);if(!ge.success)return await R(),d(await Se(n.awsProvider,{stackNames:g.map(Y=>O(o.appName,Y)),appName:o.appName,originalError:ge.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=g.length-1;continue}const s=await rt(a,e,n,o,t,p.hasDockerfile);if(s!==null&&!s.success)return await R(),d(s.error);s!==null&&s.success&&(le=s.data);const u=s!==null&&s.success?s.data.contentHashTagsByService:{},h=Dt(u);if(s!==null){const T=await W(e.assertLeaseForStack,c,e.abortSignal);if(T!==void 0)return await R(),t.onError?.(T),d(T)}const b=await ke({hashService:n.hashService,cdkOutPath:L,stackNames:[c],detectionHashes:p.currentHashes,approvalGated:U});if(!b.success)return await R(),t.onError?.(b.error),d(b.error);const f=await tt(a,n,B,t,r,A,$,h!==void 0||e.abortSignal!==void 0?{...h!==void 0?{parameters:h}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!f.success)return await R(),d(await Se(n.awsProvider,{stackNames:[c],appName:o.appName,originalError:f.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));a===C.COMPUTE&&(de=await nt(o,n,t,u,e.abortSignal));const S=p.currentHashes.get(c);S&&x.set(c,S)}if(await R(),x.size>0){const r=await n.hashService.updateStateAfterDeploy(o.path,x);if(!r.success){const a=k(r.error.message);F.debug(j,"Failed to update state file",{error:a}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${a}`,"warn")}}const ue=await n.stackService.resolveWebsiteUrl(o.appName);ue&&($.websiteUrl=ue);const De=await dt(n,o.appName,le,t,L,de,e.abortSignal);return await wt(n.awsProvider,{stackNames:[...E],appName:o.appName,onLog:D((r,a)=>t.onLog?.(r,a),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{F.debug(j,"Forget completion sweep failed",{error:k(Q(r))})}),I({target:o.appName,deploymentType:"application",outputs:Object.keys($).length>0?$:void 0,artefacts:De,durationMs:Date.now()-w})}D(Sr,"deployApplication");export{Sr as deployApplication,we as emitStackTargets};
+var Re=Object.defineProperty;var P=(e,n)=>Re(e,"name",{value:n,configurable:!0});import{join as fe}from"path";import{CloudFormationClient as Ie}from"@aws-sdk/client-cloudformation";import{EC2Client as Ce}from"@aws-sdk/client-ec2";import{success as A,failure as l}from"@fjall/generator";import{logger as F}from"@fjall/util/logger";import{ImageTagSchema as Oe,getErrorMessage as Q,imageTagParameterName as Ae,maskSensitiveOutput as h}from"@fjall/util";import{parseDockerDeclarationsFromManifest as Le}from"@fjall/util/manifest";import{stubCallerIdentity as Be}from"../../types/deployment/index.js";import{getApplicationDeployOrder as Me,getApplicationStackName as C,getApplicationStepName as pe,getApplicationStepId as me,APPLICATION_STACKS as R}from"../../types/operations.js";import{CdkContextBuilder as $e}from"../../services/supporting/CdkContextBuilder.js";import{buildParamsContext as xe,buildCapacityIdentityContext as Fe,bootstrapOrFail as je}from"../contextHelpers.js";import{resolveDeployEnvironment as Ge}from"../deployEnvironment.js";import{buildBootstrapTagsIfResolved as He}from"../bootstrapTags.js";import{hasOrganisationTierAccount as Ue}from"../../aws/organisations/accountGlobals.js";import{runDetectionPipeline as _e}from"./detectionPipeline.js";import{assertCapacityPinsSupportedByAssembly as We,assertEngineCompatibleWithAssembly as Ke}from"./engineCompat.js";import{STEP_IDS as _,STEP_NAMES as qe}from"../../types/stepDefinitions.js";import{StepRegistry as Ve}from"../../steps/stepRegistry.js";import{checkTargetReadiness as ze}from"../../aws/targetReadiness.js";import{cascadeHomeRegion as Je}from"../organisation/cascadeHelpers.js";import{withStepLifecycle as Ye}from"../stepLifecycle.js";import{DOCKER_BUILD_STEP_NAME as ye,runDockerBuild as Qe}from"./dockerBuildHelper.js";import{getParallelPhase2Stacks as Xe,getStackNamesToDeploy as Ze,deployParallelPhase as et,deployStackSequential as tt,runDockerPreCompute as rt,runLambdaVersionPublish as nt,createBuildCallbacks as ot,willRunDockerBuild as at}from"./applicationDeployHelpers.js";import{verifyAssemblyIntegrity as he}from"./assemblyIntegrity.js";import{captureDatabaseConnectionOutputs as it,captureServiceTaskDefinitions as st,reconcileDatabaseEndpointChange as ct}from"./databaseEndpointReconcile.js";import{deployCodeOnly as lt}from"./codeOnlyDeploy.js";import{ensureSchemaGateImage as dt}from"./schemaGateImage.js";import{checkDeployPathStackAvailability as ke}from"../activeDeploymentGuard.js";import{assertLeaseBeforeStack as W}from"./leaseGate.js";import{collectFullDeployArtefacts as ut}from"./artefactCollection.js";import{CfnRegistryService as gt}from"../../services/infrastructure/CfnRegistryService.js";import{ChangeSetProbe as ft}from"../../services/infrastructure/changeSetProbe.js";import{runApprovalGate as pt}from"./approvalGate.js";import{buildDestructionTicket as mt,runDestructionGate as yt}from"./destructionGate.js";import{DESTRUCTION_RESUME_TTL_MS as ht,signApprovalToken as kt}from"./plan/approvalToken.js";import{computeAssemblyDigest as St}from"./plan/assemblyDigest.js";import{createMemoisedPlanLoader as bt}from"./plan/loadDeployPlan.js";import{runDriftPreFlightGate as wt}from"../drift/preFlightGate.js";import{completeForgetAfterDeploy as Et}from"../remediation/forgetResource.js";import{composePostFailureRepairOffer as Se}from"../remediation/postFailureRepairOffer.js";import{renderPinReportLines as Tt,runPinRemediation as Pt}from"../remediation/pinRemediation.js";import{degradedIdentityPinOutcomes as be,renderIdentityPinReportLines as vt}from"../remediation/migrateIdentity.js";import{runRecreatePreFlight as Nt}from"../remediation/recreatePreFlight.js";import{runRecreateSurgery as Dt}from"../remediation/recreateResource.js";const j="applicationDeploy";function Rt(e){const n=Object.entries(e);if(n.length===0)return;const o={};for(const[t,s]of n){const E=Ae(t);o[E]=s}return o}P(Rt,"buildCdkImageTagParameters");function It(e){if(e?.mode!==void 0&&e.mode!=="rollback"){if(e.imageTag)return l(new Error(`--image-tag requires rollback mode (explicit mode '${e.mode}' was supplied alongside an image tag)`));if(e.serviceImageTags)return l(new Error(`serviceImageTags requires rollback mode (explicit mode '${e.mode}' was supplied alongside serviceImageTags)`))}if(e?.mode==="rollback"){if(e.imageTag&&e.serviceImageTags)return l(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!e.imageTag&&!e.serviceImageTags)return l(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(e?.serviceImageTags!==void 0){if(e.serviceName)return l(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));const n=Object.entries(e.serviceImageTags);if(n.length===0)return l(new Error("serviceImageTags must name at least one service"));for(const[o,t]of n){const s=Oe.safeParse(t);if(!s.success)return l(new Error(`serviceImageTags.${o} is not a valid image tag: ${s.error.message}`))}}return A(void 0)}P(It,"validateRollbackOptions");function we(e,n,o){if(e.onStackTargets===void 0||o.length===0)return;const t=n.awsProvider.getAccountId(),s=n.awsProvider.getRegion();e.onStackTargets(o.map(E=>({stackName:E,...t!==""?{accountId:t}:{},...s!==""?{region:s}:{}})))}P(we,"emitStackTargets");async function wr(e,n,o){const{callbacks:t,options:s}=e,E=Date.now(),G=s?.mode??(s?.imageTag||s?.serviceImageTags?"rollback":s?.deployOnly?"code-only":"full");if(G==="restart"){const r=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return t.onError?.(r),l(r)}const X=It(s);if(!X.success){const r=h(X.error.message),a=new Error(r);return t.onError?.(a),l(a)}const K=Ge({orgConfig:e.orgConfig,accountId:n.awsProvider.getAccountId()});if(!K.success){const r=new Error(h(K.error.message));return t.onError?.(r),l(r)}const B=$e.buildDeploymentContext({deployType:"application",target:o.appName,path:o.path,region:n.awsProvider.getRegion(),environment:K.data,callerIdentity:Be(n.awsProvider.getAccountId()),...xe({orgConfig:e.orgConfig,identity:e.identity,skipOidc:e.options?.skipOidc}),...e.managedDomainBindings!==void 0?{managedDomainBindings:e.managedDomainBindings}:{},...Fe(e)},{verbose:s?.verbose,infraOnly:s?.infraOnly},e.orgConfig),v=n.frameworkRegistry.resolve({appPath:o.path});let Z;const M=G==="rollback";if(v&&!M){Z=v.builder.plan({appPath:o.path},v.detection);const r=ot(t),a=await v.builder.build(o.path,Z,r,{skipBuild:s?.skipBuild,infraOnly:s?.infraOnly,...e.abortSignal!==void 0&&{abortSignal:e.abortSignal}});if(!a.success){const i=new Error(h(a.error.message));return t.onError?.(i),l(i)}}if(G==="code-only"||M){t.onLog?.(M?s?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(s.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${s?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");const r=fe(o.path,"cdk.out"),a=Ke({cdkOutPath:r,onWarning:P(f=>t.onLog?.(f,"warn"),"onWarning")});if(!a.success){const f=new Error(h(a.error.message));return t.onError?.(f),l(f)}const i=We({cdkOutPath:r,capacityIdentityWire:B.capacityIdentity,appName:o.appName});if(!i.success){const f=new Error(h(i.error.message));return t.onError?.(f),l(f)}const m=Le(r),d=m.declaresBuild,y=v?.detection.hasDockerfile===!0,g=d||y;F.debug(j,"Deploy-only branch entered",{mode:G,imageTag:s?.imageTag,serviceImageTags:s?.serviceImageTags,appName:o.appName,appPath:o.path,cdkOutPath:r,dockerProviderAvailable:e.dockerProvider!==void 0,builderName:v?.builder.name,hasDockerfileFromManifest:d,hasDockerfileFromDisk:y,hasDockerfile:g,manifestDockerServiceCount:m.ecsServices.length,manifestDockerPaths:m.ecsServices.map(f=>f.docker.path),manifestLambdaDockerEntryCount:m.lambdaEntries.length}),!d&&!y&&t.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");const c=await ke([C(o.appName,R.COMPUTE)],n.cfnService,e.abortSignal);if(!c.success)return t.onError?.(c.error),l(c.error);we(t,n,[C(o.appName,R.COMPUTE)]);let u={},k;if(!M&&e.dockerProvider!==void 0&&g){F.debug(j,"Running Docker build before code-only deploy",{source:d?"manifest":"disk"});const f=await Qe(e,n,o,t);if(!f.success)return l(f.error);u=f.data.contentHashTagsByService,k=f.data}else F.debug(j,"Skipping Docker build",{reason:M?"rollback":e.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});const w=await W(e.assertLeaseForStack,C(o.appName,R.COMPUTE),e.abortSignal);return w!==void 0?(t.onError?.(w),l(w)):lt(e,n,o,u,k)}t.onLog?.("Analysing infrastructure\u2026","info");const H=await _e(o,n,B,t,e.abortSignal);if(!H.success){const r=new Error(h(H.error.message),{cause:H.error});return t.onError?.(r),l(r)}const p=H.data;try{await t.onDetectionComplete?.({...p,builderName:v?.builder.name??"unknown"})}catch(r){const a=new Error(h(Q(r)),{cause:r});return t.onError?.(a),l(a)}const Ee={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:s?.infraOnly??!1,hasDockerfile:p.hasDockerfile,pattern:p.pattern,resources:p.resources,...v&&{builderName:v.builder.name}},ee=Ve.getSteps(Ee),te=ee.findIndex(r=>r.id===_.TARGET_READINESS),re=await Ye(t,{stepId:_.TARGET_READINESS,stepName:qe.TARGET_READINESS,...te>=0&&{stepIndex:te,totalSteps:ee.length}},async()=>{if(s?.skipReadinessCheck)return t.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};const r=n.awsProvider.getAccountId(),a=e.orgConfig?.providerAccounts.find(y=>y.id===r)?.name,i=n.awsProvider.getCredentials(),m=Je(e.orgConfig),d=await ze({cloudFormation:n.awsProvider.getClient(Ie),ec2:new Ce({region:m,...i!==void 0&&{credentials:i}})},{id:r,...a!==void 0&&{name:a}},n.awsProvider.getRegion(),e.orgConfig,e.abortSignal);return d.success?d.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(h(d.data.advisory))}:{kind:"error",error:new Error(h(d.error.message),{cause:d.error})}},e.abortSignal);if(!re.success)return re;const N=Me({pattern:p.pattern,resources:p.resources}),L=N.length,ne=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE)&&s?.infraOnly!==!0;if(!p.hasDifferences&&!s?.force&&!ne){t.onLog?.("No infrastructure changes detected","info"),t.onLog?.(s?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");const r=p.hasDockerfile&&e.dockerProvider!==void 0&&N.includes(R.COMPUTE);for(let i=0;i<N.length;i++){const m=N[i];r&&m===R.COMPUTE&&(t.onStepStart?.(_.DOCKER_OPERATIONS,ye),t.onStepComplete?.(_.DOCKER_OPERATIONS,ye,"skipped"));const d=me(m,"deploy"),y=pe(m,"deploy");t.onStepStart?.(d,y,i,L),t.onStepComplete?.(d,y,"skipped",i,L)}const a=await n.stackService.resolveWebsiteUrl(o.appName);return A({target:o.appName,deploymentType:"application",outputs:a?{websiteUrl:a}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-E})}const O=fe(o.path,"cdk.out"),b=Ze({deployOrder:N,stackChanges:p.stackChanges,appName:o.appName,force:s?.force===!0,computeBuildPossible:ne});we(t,n,[...b]);const q=await ke([...b],n.cfnService,e.abortSignal);if(!q.success)return t.onError?.(q.error),l(q.error);const oe={stacksToDeploy:[...b],imageBuild:at({stackNamesToDeploy:b,appName:o.appName,hasDockerProvider:e.dockerProvider!==void 0,hasDockerfile:p.hasDockerfile})},ae=St(p.currentHashes,oe),V=bt({cfnService:n.cfnService,cdkOutPath:O,changedStacks:[...b],assemblyDigest:ae,registry:new gt(n.awsProvider),changeSetProbe:new ft(n.awsProvider),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}),z=await wt(n.awsProvider,{stackNames:[...b],cdkOutPath:O,cfnService:n.cfnService,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(z.kind==="blocked"){const r=new Error(z.message);return t.onError?.(r),l(r)}const ie=z.verifiedAbsentByNecessity??[],U=e.approvalGate!==void 0||s?.approvalToken!==void 0&&s.approvalToken!==""||s?.planOnly===!0;if(U){const r=await pt({approvalGate:e.approvalGate,options:s??{},target:o.appName,cdkOutPath:O,detection:{stackChanges:p.stackChanges,currentHashes:p.currentHashes},scope:oe,cfnService:n.cfnService,loadPlan:V,callbacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return r;const a=r.data;if(a.kind==="rejected")return t.onLog?.(`Deploy rejected: ${h(a.reason)}`,"warn"),A({target:o.appName,deploymentType:"application",rejected:!0,artefacts:[],...a.planDetail!==void 0?{planDetail:a.planDetail}:{},durationMs:Date.now()-E});if(a.kind==="awaiting"){const i=await V(),m=i.success?mt(i.data,ie):void 0;return A({target:o.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:a.approvalToken,assemblyDigest:a.assemblyDigest,planDetail:a.planDetail,...m!==void 0?{destructionTicket:m}:{},artefacts:[],durationMs:Date.now()-E})}}const D=await yt({loadPlan:V,options:s??{},target:o.appName,callbacks:t,verifiedAbsentByNecessity:ie,...e.destructionConsentGate!==void 0?{consentGate:e.destructionConsentGate}:{}});if(!D.success)return t.onError?.(D.error),l(D.error);if(D.data.kind==="withheld"){const r=U?kt({assemblyDigest:ae,ttlMs:ht}):void 0;return A({target:o.appName,deploymentType:"application",destructionPending:!0,destructionTicket:D.data.ticket,destructionOutcome:D.data.outcome,destructionHaltReasons:D.data.reasons,...r!==void 0?{destructionResumeToken:r.token,destructionResumeExpiresAt:r.expiresAt}:{},artefacts:[],durationMs:Date.now()-E})}if(b.has(C(o.appName,R.COMPUTE))){const r=await dt({awsProvider:n.awsProvider,cdkOutPath:O,onLog:P((a,i)=>t.onLog?.(a,i),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!r.success)return t.onError?.(r.error),l(r.error)}if(D.data.kind==="proceed"){const{ticket:r,verbsByPhysicalName:a}=D.data,i=r.resources.filter(d=>a.get(d.physicalName)==="pin");if(i.length>0){const d=i.filter(u=>u.finding==="rename-detected"),y=i.filter(u=>u.finding!=="rename-detected");t.onLog?.(`Pin remediation for ${o.appName}: ${i.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied to AWS`,"warn");let g;if(d.length>0){if(e.identityPinRunner!==void 0)try{g=await e.identityPinRunner(d,e.abortSignal)}catch(u){g={outcomes:be(d,"unknown",`identity-pin runner failed: ${h(Q(u))} \u2014 fix the cause, then run 'fjall migrate identity'`),verified:[],clean:!1}}else g={outcomes:be(d,"unknown","this surface cannot run the identity-pin migration \u2014 run 'fjall migrate identity' to pin and validate this slot"),verified:[],clean:!1};for(const u of vt(g))t.onLog?.(u,"warn")}let c;if(y.length>0){c=await Pt(n.awsProvider,{targets:y.map(u=>({stack:u.stack,logicalId:u.logicalId,resourceType:u.resourceType,physicalName:u.physicalName,offendingProperties:u.offendingProperties})),...e.infrastructureSource!==void 0?{infrastructureContent:e.infrastructureSource.content,infrastructureFilePath:e.infrastructureSource.filePath}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});for(const u of Tt(c))t.onLog?.(u,"warn")}return i.length<r.resources.length&&t.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),A({target:o.appName,deploymentType:"application",pinPending:!0,...c!==void 0?{pinReport:c}:{},...g!==void 0?{identityPinReport:g}:{},pinDeferredConsents:r.resources.length-i.length,destructionTicket:r,artefacts:[],durationMs:Date.now()-E})}const m=r.resources.filter(d=>d.finding==="pinned-name-replacement"&&a.get(d.physicalName)==="recreate");if(m.length>0){const d=new Map;for(const c of m){const u=d.get(c.stack)??[];u.push(c),d.set(c.stack,u)}const y=await Nt(n.awsProvider,{stacks:[...d].map(([c,u])=>({stackName:c,targets:u.map(k=>({logicalId:k.logicalId,resourceType:k.resourceType,physicalId:k.physicalName}))})),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!y.success){const c=new Error(h(y.error.message),{cause:y.error});return t.onError?.(c),l(c)}const g=[];for(const[c,u]of d){const k=await W(e.assertLeaseForStack,c,e.abortSignal,"destroy");if(k!==void 0)return g.length>0&&t.onLog?.(`Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),t.onError?.(k),l(k);const w=u.map(S=>S.physicalName);t.onLog?.(`Recreate remediation for ${o.appName}: orchestrating the pinned-name replacement of ${w.join(", ")} on ${c}`,"warn");const f=await Dt(n.awsProvider,{stackName:c,targets:u.map(S=>({logicalId:S.logicalId,resourceType:S.resourceType,physicalId:S.physicalName})),appName:o.appName,consentedPhysicalNames:w,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:u.map(S=>S.logicalId),onProgress:P(S=>t.onLog?.(S,"info"),"onProgress"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(!f.success){const S=g.length>0?` Surgery already completed on ${g.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",T=new Error(h(`${f.error.message}${S}`));return t.onError?.(T),l(T)}g.push(`${c} (${w.join(", ")})`)}}}const Te=e.orgConfig!==void 0&&!Ue(e.orgConfig.providerAccounts),Pe=He({account:e.orgConfig?.providerAccounts.find(r=>r.id===n.awsProvider.getAccountId()),estate:Te?"solo":"org"}),se=await je(n,B,t,Pe);if(!se.success)return se;const ce=C(o.appName,R.DATABASE),J=b.has(ce),ve=J?await it(n.cfnService,o.appName,e.abortSignal):void 0,Ne=J?await st(n.ecsResolver,n.ecsService,o.appName,e.abortSignal):void 0,$={},x=new Map;let le,de={};const I=P(async()=>{!J||!x.has(ce)||await ct({appName:o.appName,connectionOutputsBefore:ve,serviceTaskDefinitionsBefore:Ne,services:{cfnService:n.cfnService,ecsService:n.ecsService,ecsResolver:n.ecsResolver},callbacks:t,...e.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:e.confirmDatabaseEndpointRestart}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let r=0;r<N.length;r++){const a=N[r],i=C(o.appName,a),m=me(a,"deploy"),d=pe(a,"deploy");if(!b.has(i)){t.onStepStart?.(m,d,r,L),t.onLog?.(`Skipping ${a} \u2014 no changes detected`,"info"),t.onStepComplete?.(m,d,"skipped",r,L);continue}const y=await W(e.assertLeaseForStack,i,e.abortSignal);if(y!==void 0)return await I(),t.onError?.(y),l(y);const g=Xe(N,r,o.appName,b);if(g.length>=2){const T=await he({hashService:n.hashService,cdkOutPath:O,stackNames:g.map(Y=>C(o.appName,Y)),detectionHashes:p.currentHashes,approvalGated:U});if(!T.success)return await I(),t.onError?.(T.error),l(T.error);const ge=await et(g,o,n,B,t,r,L,p,$,x);if(!ge.success)return await I(),l(await Se(n.awsProvider,{stackNames:g.map(Y=>C(o.appName,Y)),appName:o.appName,originalError:ge.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));r+=g.length-1;continue}const c=await rt(a,e,n,o,t,p.hasDockerfile);if(c!==null&&!c.success)return await I(),l(c.error);c!==null&&c.success&&(le=c.data);const u=c!==null&&c.success?c.data.contentHashTagsByService:{},k=Rt(u);if(c!==null){const T=await W(e.assertLeaseForStack,i,e.abortSignal);if(T!==void 0)return await I(),t.onError?.(T),l(T)}const w=await he({hashService:n.hashService,cdkOutPath:O,stackNames:[i],detectionHashes:p.currentHashes,approvalGated:U});if(!w.success)return await I(),t.onError?.(w.error),l(w.error);const f=await tt(a,n,B,t,r,L,$,k!==void 0||e.abortSignal!==void 0?{...k!==void 0?{parameters:k}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}:void 0);if(!f.success)return await I(),l(await Se(n.awsProvider,{stackNames:[i],appName:o.appName,originalError:f.error,cfnService:n.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));a===R.COMPUTE&&(de=await nt(o,n,t,u,e.abortSignal));const S=p.currentHashes.get(i);S&&x.set(i,S)}if(await I(),x.size>0){const r=await n.hashService.updateStateAfterDeploy(o.path,x);if(!r.success){const a=h(r.error.message);F.debug(j,"Failed to update state file",{error:a}),t.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${a}`,"warn")}}const ue=await n.stackService.resolveWebsiteUrl(o.appName);ue&&($.websiteUrl=ue);const De=await ut(n,o.appName,le,t,O,de,e.abortSignal);return await Et(n.awsProvider,{stackNames:[...b],appName:o.appName,onLog:P((r,a)=>t.onLog?.(r,a),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(r=>{F.debug(j,"Forget completion sweep failed",{error:h(Q(r))})}),A({target:o.appName,deploymentType:"application",outputs:Object.keys($).length>0?$:void 0,artefacts:De,durationMs:Date.now()-E})}P(wr,"deployApplication");export{wr as deployApplication,we as emitStackTargets};

package/dist/src/orchestration/application/applicationDeployHelpers.js

@@ -1,4 +1,4 @@
-var B=Object.defineProperty;var a=(e,r)=>B(e,"name",{value:r,configurable:!0});import{join as T}from"node:path";import{success as N,failure as S}from"@fjall/generator";import{maskSensitiveOutput as w}from"@fjall/util";import{parseLambdaDockerEntriesFromManifest as D}from"@fjall/util/manifest";import{isAborted as L}from"../../aws/organisations/types.js";import{APPLICATION_STACKS as k,getApplicationStackName as P,getApplicationStepName as E,getApplicationStepId as b,PARALLEL_DEPLOY_GROUPS as R}from"../../types/operations.js";import{emitProgress as $}from"../../services/supporting/helpers.js";import{forwardOutput as x,forwardResourceProgress as j}from"../contextHelpers.js";import{emptyBuildProducts as v,runDockerBuild as I}from"./dockerBuildHelper.js";import{runWelcomeImageSetup as _}from"./welcomeImageHelper.js";import{withStepLifecycle as U}from"../stepLifecycle.js";function X(e){const r=new Set;for(const s of e.deployOrder){const i=P(e.appName,s),o=e.stackChanges.get(i)??!0,u=s===k.COMPUTE&&e.computeBuildPossible;(o||e.force||u)&&r.add(i)}return r}a(X,"getStackNamesToDeploy");function Z(e){return e.stackNamesToDeploy.has(P(e.appName,k.COMPUTE))&&e.hasDockerProvider&&e.hasDockerfile}a(Z,"willRunDockerBuild");function ee(e,r,s,i){const o=new Set(R.PHASE_2.stacks),u=[];for(let n=r;n<e.length&&o.has(e[n]);n++)u.push(e[n]);if(u.length<2)return[];const l=u.filter(n=>i.has(P(s,n)));return l.length>=2?l:[]}a(ee,"getParallelPhase2Stacks");async function te(e,r,s,i,o,u,l,n,m,p){for(let t=0;t<e.length;t++){const c=e[t],f=b(c,"deploy"),g=E(c,"deploy");o.onStepStart?.(f,g,u+t,l)}$(o,"Deploying infrastructure in parallel\u2026"),o.onParallelPhaseStart?.(e,"Storage and database resources (parallel)");const d=await s.stackService.deployStacksInParallel(e,i,{onOutput:x(o),onResourceProgress:a((t,c)=>{o.onResourceProgress?.(t),c&&o.onParallelStackResourceProgress?.(c,t)},"onResourceProgress"),onStackComplete:a((t,c,f,g)=>{const y=b(t,"deploy"),O=E(t,"deploy"),A=u+e.indexOf(t),C=L(s.abortSignal);o.onStepComplete?.(y,O,c?"completed":C?"cancelled":"error",A,l),!c&&g&&!C&&o.onError?.(new Error(w(g.message)))},"onStackComplete")});if(!d.success)return o.onParallelPhaseComplete?.([]),S(d.error);const h=d.data.filter(t=>!t.success);if(o.onParallelPhaseComplete?.(d.data.map(t=>({stack:t.stack,success:t.success,error:t.error}))),h.length>0){const t=h.map(f=>f.stack).join(", "),c=h.map(f=>`${f.stack}: ${w(f.error?.message??"Unknown error")}`).join(`
-`);return S(new Error(`Failed to deploy stacks: ${t}
+var B=Object.defineProperty;var c=(e,r)=>B(e,"name",{value:r,configurable:!0});import{join as O}from"node:path";import{success as E,failure as P}from"@fjall/generator";import{getErrorMessage as R,maskSensitiveOutput as y}from"@fjall/util";import{parseLambdaDockerEntriesFromManifest as $}from"@fjall/util/manifest";import{isAborted as L}from"../../aws/organisations/types.js";import{APPLICATION_STACKS as b,getApplicationStackName as w,getApplicationStepName as N,getApplicationStepId as C,PARALLEL_DEPLOY_GROUPS as v}from"../../types/operations.js";import{emitProgress as T}from"../../services/supporting/helpers.js";import{forwardOutput as x,forwardResourceProgress as j}from"../contextHelpers.js";import{createEcsDeploymentTail as I}from"./ecsDeploymentTail.js";import{emptyBuildProducts as _,runDockerBuild as M}from"./dockerBuildHelper.js";import{runWelcomeImageSetup as U}from"./welcomeImageHelper.js";import{withStepLifecycle as F}from"../stepLifecycle.js";function te(e){const r=new Set;for(const i of e.deployOrder){const s=w(e.appName,i),n=e.stackChanges.get(s)??!0,l=i===b.COMPUTE&&e.computeBuildPossible;(n||e.force||l)&&r.add(s)}return r}c(te,"getStackNamesToDeploy");function re(e){return e.stackNamesToDeploy.has(w(e.appName,b.COMPUTE))&&e.hasDockerProvider&&e.hasDockerfile}c(re,"willRunDockerBuild");function oe(e,r,i,s){const n=new Set(v.PHASE_2.stacks),l=[];for(let o=r;o<e.length&&n.has(e[o]);o++)l.push(e[o]);if(l.length<2)return[];const f=l.filter(o=>s.has(w(i,o)));return f.length>=2?f:[]}c(oe,"getParallelPhase2Stacks");async function ne(e,r,i,s,n,l,f,o,g,m){for(let t=0;t<e.length;t++){const u=e[t],a=C(u,"deploy"),p=N(u,"deploy");n.onStepStart?.(a,p,l+t,f)}T(n,"Deploying infrastructure in parallel\u2026"),n.onParallelPhaseStart?.(e,"Storage and database resources (parallel)");const d=await i.stackService.deployStacksInParallel(e,s,{onOutput:x(n),onResourceProgress:c((t,u)=>{n.onResourceProgress?.(t),u&&n.onParallelStackResourceProgress?.(u,t)},"onResourceProgress"),onStackComplete:c((t,u,a,p)=>{const h=C(t,"deploy"),A=N(t,"deploy"),D=l+e.indexOf(t),k=L(i.abortSignal);n.onStepComplete?.(h,A,u?"completed":k?"cancelled":"error",D,f),!u&&p&&!k&&n.onError?.(new Error(y(p.message)))},"onStackComplete")});if(!d.success)return n.onParallelPhaseComplete?.([]),P(d.error);const S=d.data.filter(t=>!t.success);if(n.onParallelPhaseComplete?.(d.data.map(t=>({stack:t.stack,success:t.success,error:t.error}))),S.length>0){const t=S.map(a=>a.stack).join(", "),u=S.map(a=>`${a.stack}: ${y(a.error?.message??"Unknown error")}`).join(`
+`);return P(new Error(`Failed to deploy stacks: ${t}
 
-${c}`))}for(const t of d.data){if(t.success&&t.outputs)for(const[g,y]of Object.entries(t.outputs))m[g]=String(y);const c=P(r.appName,t.stack),f=n.currentHashes.get(c);f&&p.set(c,f)}return N(void 0)}a(te,"deployParallelPhase");async function re(e,r,s,i,o,u,l,n){const m=b(e,"deploy"),p=E(e,"deploy");return U(i,{stepId:m,stepName:p,stepIndex:o,totalSteps:u},async()=>{const d=await r.stackService.deployStack(e,s,{onOutput:x(i),onResourceProgress:j(i)},n?.parameters!==void 0||n?.abortSignal!==void 0?{...n?.parameters!==void 0?{parameters:n.parameters}:{},...n?.abortSignal!==void 0?{abortSignal:n.abortSignal}:{}}:void 0);if(!d.success)return{kind:"error",error:d.error};if(d.data.outputs)for(const[h,t]of Object.entries(d.data.outputs))l[h]=String(t);return{kind:"completed",data:void 0}},r.abortSignal)}a(re,"deployStackSequential");async function oe(e,r,s,i,o,u){if(e!==k.COMPUTE||!r.dockerProvider)return null;if(u){const n=await I(r,s,i,o);return n.success?N(n.data):S(n.error)}const l=await _(r,s,i,o);return l.success?N(v()):S(l.error)}a(oe,"runDockerPreCompute");async function ne(e,r,s,i,o){if(Object.keys(i).length===0)return{};const u=T(e.path,"cdk.out"),n=D(u).filter(p=>i[p.imageKey]!==void 0);if(n.length===0)return{};const m={};for(const p of n){if(L(o)){s.onLog?.(`Skipping the Lambda version publish for '${p.name}' \u2014 the deployment was cancelled. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}const d=await r.lambdaService.publishVersion(p.name,o);if(!d.success){s.onLog?.(`Published image for Lambda '${p.name}', but publishing a new version failed: ${w(d.error.message)}. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}m[p.name]=d.data}return m}a(ne,"runLambdaVersionPublish");function se(e){return{onBuildStart:a(r=>{e.onOpenNextBuildStart?.(),e.onLog?.(`${r} build started`,"info")},"onBuildStart"),onBuildProgress:a((r,s)=>{e.onOpenNextProgress?.(s)},"onBuildProgress"),onBuildComplete:a(r=>{e.onOpenNextBuildComplete?.(),e.onLog?.(`${r} build complete`,"info")},"onBuildComplete"),onBuildError:a((r,s)=>{e.onOpenNextBuildError?.(s)},"onBuildError")}}a(se,"createBuildCallbacks");export{se as createBuildCallbacks,te as deployParallelPhase,re as deployStackSequential,ee as getParallelPhase2Stacks,X as getStackNamesToDeploy,oe as runDockerPreCompute,ne as runLambdaVersionPublish,Z as willRunDockerBuild};
+${u}`))}for(const t of d.data){if(t.success&&t.outputs)for(const[p,h]of Object.entries(t.outputs))g[p]=String(h);const u=w(r.appName,t.stack),a=o.currentHashes.get(u);a&&m.set(u,a)}return E(void 0)}c(ne,"deployParallelPhase");async function ie(e,r,i,s,n,l,f,o){const g=C(e,"deploy"),m=N(e,"deploy");return F(s,{stepId:g,stepName:m,stepIndex:n,totalSteps:l},async()=>{const d=o?.abortSignal??r.abortSignal,S=I({ecsService:r.ecsService,callbacks:s,...d!==void 0&&{abortSignal:d}}),t=j(s);let u=!1;try{const a=await r.stackService.deployStack(e,i,{onOutput:x(s),onResourceProgress:c(p=>{S.observeResourceEvent(p),t(p)},"onResourceProgress")},o?.parameters!==void 0||o?.abortSignal!==void 0?{...o?.parameters!==void 0?{parameters:o.parameters}:{},...o?.abortSignal!==void 0?{abortSignal:o.abortSignal}:{}}:void 0);if(u=a.success,!a.success)return{kind:"error",error:a.error};if(a.data.outputs)for(const[p,h]of Object.entries(a.data.outputs))f[p]=String(h);return{kind:"completed",data:void 0}}finally{await S.finalise({deploySucceeded:u}).catch(a=>{T(s,`ECS deployment tail did not finalise cleanly: ${y(R(a))}`,"warning")})}},r.abortSignal)}c(ie,"deployStackSequential");async function se(e,r,i,s,n,l){if(e!==b.COMPUTE||!r.dockerProvider)return null;if(l){const o=await M(r,i,s,n);return o.success?E(o.data):P(o.error)}const f=await U(r,i,s,n);return f.success?E(_()):P(f.error)}c(se,"runDockerPreCompute");async function ae(e,r,i,s,n){if(Object.keys(s).length===0)return{};const l=O(e.path,"cdk.out"),o=$(l).filter(m=>s[m.imageKey]!==void 0);if(o.length===0)return{};const g={};for(const m of o){if(L(n)){i.onLog?.(`Skipping the Lambda version publish for '${m.name}' \u2014 the deployment was cancelled. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}const d=await r.lambdaService.publishVersion(m.name,n);if(!d.success){i.onLog?.(`Published image for Lambda '${m.name}', but publishing a new version failed: ${y(d.error.message)}. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}g[m.name]=d.data}return g}c(ae,"runLambdaVersionPublish");function ue(e){return{onBuildStart:c(r=>{e.onOpenNextBuildStart?.(),e.onLog?.(`${r} build started`,"info")},"onBuildStart"),onBuildProgress:c((r,i)=>{e.onOpenNextProgress?.(i)},"onBuildProgress"),onBuildComplete:c(r=>{e.onOpenNextBuildComplete?.(),e.onLog?.(`${r} build complete`,"info")},"onBuildComplete"),onBuildError:c((r,i)=>{e.onOpenNextBuildError?.(i)},"onBuildError")}}c(ue,"createBuildCallbacks");export{ue as createBuildCallbacks,ne as deployParallelPhase,ie as deployStackSequential,oe as getParallelPhase2Stacks,te as getStackNamesToDeploy,se as runDockerPreCompute,ae as runLambdaVersionPublish,re as willRunDockerBuild};

package/dist/src/orchestration/application/deploySessionPolicy.js

@@ -1 +1 @@
-var s=Object.defineProperty;var i=(e,o)=>s(e,"name",{value:o,configurable:!0});import{success as m,failure as d}from"@fjall/generator";import{toKebab as u,toPascalCase as f}from"@fjall/util";import{buildCacheRepositoryName as y}from"@fjall/util/docker";import{MAX_INLINE_POLICY_CHARS as n}from"./buildSecretSession.js";const S=["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:CreateChangeSet","cloudformation:ExecuteChangeSet","cloudformation:DeleteChangeSet","cloudformation:CancelUpdateStack","cloudformation:ContinueUpdateRollback","cloudformation:RollbackStack","cloudformation:SetStackPolicy","cloudformation:UpdateTerminationProtection"],$=["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchDeleteImage","ecr:DeleteRepository","ecr:SetRepositoryPolicy","ecr:DeleteRepositoryPolicy"];function A(e){const{region:o,accountId:t,partition:a}=e,l=f(e.appName),c=u(e.appName),p=[{Sid:"FjallDeployInheritAdmin",Effect:"Allow",Action:"*",Resource:"*"},{Sid:"FjallDeployDenyForeignStackMutation",Effect:"Deny",Action:S,NotResource:[`arn:${a}:cloudformation:${o}:${t}:stack/${l}*/*`,`arn:${a}:cloudformation:${o}:${t}:stack/CDKToolkit/*`]},{Sid:"FjallDeployDenyForeignEcrMutation",Effect:"Deny",Action:$,NotResource:[`arn:${a}:ecr:${o}:${t}:repository/${c}`,`arn:${a}:ecr:${o}:${t}:repository/${y(c)}`,`arn:${a}:ecr:${o}:${t}:repository/cdk-*`]}],r=JSON.stringify({Version:"2012-10-17",Statement:p});return r.length>n?d(new Error(`Deploy session policy is ${r.length} chars, exceeding the ${n}-char AWS inline-policy limit.`)):m(r)}i(A,"buildDeploySessionPolicy");export{A as buildDeploySessionPolicy};
+var s=Object.defineProperty;var i=(r,o)=>s(r,"name",{value:o,configurable:!0});import{success as m,failure as d}from"@fjall/generator";import{toKebab as u,toPascalCase as f}from"@fjall/util";import{buildCacheRepositoryName as y}from"@fjall/util/docker";import{SCHEMA_GATE_ECR_REPO_NAME as $}from"@fjall/util/migration";import{MAX_INLINE_POLICY_CHARS as n}from"./buildSecretSession.js";const S=["cloudformation:CreateStack","cloudformation:UpdateStack","cloudformation:DeleteStack","cloudformation:CreateChangeSet","cloudformation:ExecuteChangeSet","cloudformation:DeleteChangeSet","cloudformation:CancelUpdateStack","cloudformation:ContinueUpdateRollback","cloudformation:RollbackStack","cloudformation:SetStackPolicy","cloudformation:UpdateTerminationProtection"],C=["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchDeleteImage","ecr:DeleteRepository","ecr:SetRepositoryPolicy","ecr:DeleteRepositoryPolicy"];function g(r){const{region:o,accountId:e,partition:t}=r,l=f(r.appName),c=u(r.appName),p=[{Sid:"FjallDeployInheritAdmin",Effect:"Allow",Action:"*",Resource:"*"},{Sid:"FjallDeployDenyForeignStackMutation",Effect:"Deny",Action:S,NotResource:[`arn:${t}:cloudformation:${o}:${e}:stack/${l}*/*`,`arn:${t}:cloudformation:${o}:${e}:stack/CDKToolkit/*`]},{Sid:"FjallDeployDenyForeignEcrMutation",Effect:"Deny",Action:C,NotResource:[`arn:${t}:ecr:${o}:${e}:repository/${c}`,`arn:${t}:ecr:${o}:${e}:repository/${y(c)}`,`arn:${t}:ecr:${o}:${e}:repository/cdk-*`,`arn:${t}:ecr:${o}:${e}:repository/${$}`]}],a=JSON.stringify({Version:"2012-10-17",Statement:p});return a.length>n?d(new Error(`Deploy session policy is ${a.length} chars, exceeding the ${n}-char AWS inline-policy limit.`)):m(a)}i(g,"buildDeploySessionPolicy");export{g as buildDeploySessionPolicy};

package/dist/src/orchestration/application/ecsDeploymentTail.d.ts

@@ -0,0 +1,48 @@
+import type { ResourceEvent } from "@fjall/util/aws";
+import type { DeployCallbacks } from "../../types/callbacks.js";
+import type { EcsService } from "../../services/infrastructure/EcsService.js";
+export declare const ECS_TAIL_POLL_INTERVAL_MS = 15000;
+/**
+ * The unstick guidance printed when a stack reaches UPDATE_ROLLBACK_FAILED.
+ * Deliberately generic AWS remediation — deploy-core ships to customers, so
+ * no fjall-internal references belong here.
+ */
+export declare const UPDATE_ROLLBACK_FAILED_RUNBOOK: string;
+export interface EcsDeploymentTail {
+    /** Feed every CFN resource event here; ECS service events start supervision. */
+    observeResourceEvent(event: ResourceEvent): void;
+    /**
+     * Stop polling, take a final snapshot per supervised service, and emit
+     * `onECSComplete`. Never throws; safe to call when nothing was supervised.
+     * Services where no fresh deployment was ever adopted (e.g. a
+     * desiredCount-only update that creates no new deployment) emit nothing.
+     * When the last observation is non-terminal and no final snapshot is
+     * available, `deploySucceeded` decides the verdict — CloudFormation only
+     * reports a successful stack once the service stabilised.
+     */
+    finalise(outcome?: {
+        deploySucceeded?: boolean;
+    }): Promise<void>;
+}
+export interface EcsDeploymentTailDeps {
+    ecsService: EcsService;
+    callbacks: DeployCallbacks;
+    abortSignal?: AbortSignal;
+    /** Test seam — production callers use the default. */
+    pollIntervalMs?: number;
+}
+/**
+ * Observe-only ECS supervision for the full CFN deploy path (the seam the
+ * callback vocabulary at `types/callbacks.ts` reserves as "the future
+ * full-deploy ECS-tail step"). While CloudFormation drives a rolling update,
+ * this tail polls the service's PRIMARY deployment, counts distinct stopped
+ * tasks started by it, and narrates stopped-task forensics (`stoppedReason`,
+ * container exit codes) that are otherwise invisible until someone opens the
+ * console. It never cancels anything — CFN remains the deploy authority.
+ *
+ * Verdict semantics: `onECSComplete.success` reports the SUPERVISED
+ * deployment's outcome. A circuit-breaker or CFN rollback that replaces the
+ * supervised deployment is a failure verdict even though the service ends up
+ * stable on the old revision.
+ */
+export declare function createEcsDeploymentTail(deps: EcsDeploymentTailDeps): EcsDeploymentTail;

package/dist/src/orchestration/application/ecsDeploymentTail.js

@@ -0,0 +1,3 @@
+var B=Object.defineProperty;var d=(o,s)=>B(o,"name",{value:s,configurable:!0});import{logger as u}from"@fjall/util/logger";import{getErrorMessage as I,maskSensitiveOutput as f}from"@fjall/util";import{isAborted as _}from"../../aws/organisations/types.js";import{sleepAbortable as U}from"../../util/sleepAbortable.js";const p="EcsDeploymentTail",z="AWS::ECS::Service",K="AWS::CloudFormation::Stack",G=new Set(["CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS"]),Y=15e3,j=3e4,W=["CloudFormation entered UPDATE_ROLLBACK_FAILED \u2014 the stack is wedged and will refuse further updates until the rollback completes.","To unstick it:","  1. Find the resource(s) that failed to roll back: aws cloudformation describe-stack-events --stack-name <stack> (look for UPDATE_ROLLBACK_FAILED resource events and their status reasons).","  2. Fix the underlying cause if possible (an ECS service that cannot stabilise usually means the previous image cannot boot \u2014 check stopped-task reasons above).","  3. Resume the rollback: aws cloudformation continue-update-rollback --stack-name <stack> [--resources-to-skip <logical-ids>].","  4. Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-update-rollback-failed"].join(`
+`);function Z(o){const{ecsService:s,callbacks:i,abortSignal:c}=o,b=o.pollIntervalMs??Y,S=new Map,h=new AbortController,D=c!==void 0?AbortSignal.any([c,h.signal]):h.signal;let E=!1,N=!1;const C=d(e=>{i.onECSProgress?.(f(e))},"emitProgress"),$=d((e,t)=>t.createdAt!==void 0&&t.createdAt.getTime()>=e.updateStartedAt.getTime()-j,"isFreshDeployment"),O=d(async e=>{const t=await s.describeServices(e.clusterName,[e.serviceArn],D);if(!t.success){u.debug(p,"DescribeServices poll failed (transient, observing)",{serviceArn:e.serviceArn,error:f(t.error.message)});return}const r=t.data[0];if(r===void 0)return;const n=r.deployments?.find(l=>l.status==="PRIMARY");if(n?.id!==void 0&&(e.targetDeploymentId===void 0?$(e,n)&&(e.targetDeploymentId=n.id,e.targetTaskDefinitionArn=n.taskDefinition):n.id!==e.targetDeploymentId&&n.id!==e.replacedByDeploymentId&&(e.replacedByDeploymentId=n.id,C(`${e.serviceName}: ECS replaced the in-flight deployment \u2014 now rolling out ${w(n.taskDefinition)}`)),(n.id===e.targetDeploymentId||n.id===e.replacedByDeploymentId)&&n.rolloutState!==void 0)){const k=`${n.id}:${n.rolloutState}`;if(k!==e.lastNarratedRollout){e.lastNarratedRollout=k;const A=n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""?` (${n.rolloutStateReason})`:"";C(`${e.serviceName}: rollout ${n.rolloutState}${A} \u2014 running ${n.runningCount??0}/${n.desiredCount??0}`),i.onECSUpdate?.(n.rolloutState,e.serviceName)}n.id===e.targetDeploymentId&&(e.lastRolloutState=n.rolloutState,n.rolloutStateReason!==void 0&&n.rolloutStateReason!==""&&(e.lastRolloutReason=n.rolloutStateReason))}if(e.targetDeploymentId===void 0)return;const R=await s.listStoppedTasks(e.clusterName,e.targetDeploymentId,D);if(!R.success){u.debug(p,"ListTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:f(R.error.message)});return}const a=R.data.filter(l=>!e.stoppedTaskArns.has(l));if(a.length===0&&e.pendingForensicArns.size===0)return;for(const l of a)e.stoppedTaskArns.add(l);const y=e.pendingForensicArns.size>0,v=[...e.pendingForensicArns,...a];let m=!1;const T=await s.describeTasks(e.clusterName,v,D);if(T.success)m=y,e.pendingForensicArns.clear(),T.data.length>0&&(e.latestForensic=T.data[T.data.length-1]);else{for(const l of v)e.pendingForensicArns.add(l);u.debug(p,"DescribeTasks poll failed (transient, observing)",{serviceArn:e.serviceArn,error:f(T.error.message)})}if(a.length===0&&!m)return;const g=e.latestForensic!==void 0?` \u2014 latest: ${F(e.latestForensic)}`:"";C(`${e.serviceName}: ${e.stoppedTaskArns.size} task(s) from the new revision stopped since the update began${g}`)},"pollOnce"),P=d(async e=>{for(;!E&&!_(D);){try{await O(e)}catch(t){u.debug(p,"Tail poll threw (transient, observing)",{serviceArn:e.serviceArn,error:f(I(t))})}await U(b,D)}},"runTailLoop"),L=d((e,t)=>{const r=V(e);if(r===void 0){u.debug(p,"Cannot derive cluster from legacy-format service ARN; skipping tail",{serviceArn:e});return}const n={serviceArn:e,clusterName:r.clusterName,serviceName:r.serviceName,startedAtMs:Date.now(),updateStartedAt:t,stoppedTaskArns:new Set,pendingForensicArns:new Set,loop:Promise.resolve()};n.loop=P(n),S.set(e,n),u.debug(p,"ECS deployment tail started",{serviceArn:e,clusterName:r.clusterName})},"startTail");return{observeResourceEvent(e){if(!E){if(e.resourceType===z&&G.has(e.status)&&e.physicalId!==void 0&&e.physicalId!==""&&!S.has(e.physicalId)){L(e.physicalId,e.timestamp);return}e.resourceType===K&&e.status==="UPDATE_ROLLBACK_FAILED"&&!N&&(N=!0,i.onOutput?.(`${W}
+`))}},async finalise(e){if(E)return;E=!0,h.abort();const t=e?.deploySucceeded===!0;await Promise.all([...S.values()].map(async r=>{await r.loop.catch(n=>{u.debug(p,"Tail loop rejected during finalise",{serviceArn:r.serviceArn,error:f(I(n))})}),await M(r,t).catch(n=>{u.debug(p,"Tail completion emission failed",{serviceArn:r.serviceArn,error:f(I(n))})})}))}};async function M(e,t){if(e.targetDeploymentId===void 0){u.debug(p,"No fresh deployment was ever adopted; skipping ECS completion event",{serviceArn:e.serviceArn});return}let r,n,R,a=e.lastRolloutState,y=e.lastRolloutReason;if(!_(c)){const l=await s.describeServices(e.clusterName,[e.serviceArn],c);if(l.success&&l.data[0]!==void 0){const k=l.data[0];r=k.taskDefinition,n=k.runningCount,R=k.desiredCount;const A=k.deployments?.find(x=>x.status==="PRIMARY");A?.id!==void 0&&(A.id===e.targetDeploymentId?A.rolloutState!==void 0&&(a=A.rolloutState,y=A.rolloutStateReason??y):e.replacedByDeploymentId===void 0&&(e.replacedByDeploymentId=A.id))}else l.success||u.debug(p,"Final DescribeServices snapshot failed",{serviceArn:e.serviceArn,error:f(l.error.message)})}const v=e.replacedByDeploymentId!==void 0;let m;v?m=!1:a==="COMPLETED"?m=!0:a==="FAILED"?m=!1:m=t,r!==void 0&&e.targetTaskDefinitionArn!==void 0&&r!==e.targetTaskDefinitionArn&&C(`${e.serviceName}: service settled on ${w(r)}, not the deployment's target ${w(e.targetTaskDefinitionArn)} \u2014 ECS rolled the service back`);const g=[];m||(y!==void 0?g.push(y):v||g.push(`rollout state ${a??"unknown"} when monitoring ended`),v&&g.push("ECS replaced the in-flight deployment before it completed"),e.stoppedTaskArns.size>0&&g.push(`${e.stoppedTaskArns.size} distinct task(s) from the new revision stopped`),e.latestForensic!==void 0&&g.push(`latest: ${F(e.latestForensic)}`)),i.onECSComplete?.({serviceName:e.serviceName,serviceArn:e.serviceArn,success:m,taskDefinitionArn:r??e.targetTaskDefinitionArn??"unknown",durationMs:Date.now()-e.startedAtMs,...g.length>0&&{reason:f(g.join("; "))},...n!==void 0&&{finalRunningCount:n},...R!==void 0&&{finalDesiredCount:R},...a!==void 0&&{rolloutState:a},...v&&{replaced:!0},...e.stoppedTaskArns.size>0&&{stoppedTaskCount:e.stoppedTaskArns.size},...e.latestForensic?.stopCode!==void 0&&{stopCode:e.latestForensic.stopCode},...e.latestForensic?.stoppedReason!==void 0&&{stoppedReason:f(e.latestForensic.stoppedReason)}})}}d(Z,"createEcsDeploymentTail");function V(o){const s=":service/",i=o.indexOf(s);if(i===-1)return;const b=o.slice(i+s.length).split("/");if(b.length<2)return;const S=b[0],h=b[1];if(!(S===void 0||S===""||h===void 0||h===""))return{clusterName:S,serviceName:h}}d(V,"parseServiceArn");function w(o){if(o===void 0)return"unknown revision";const s=o.split("/"),i=s[s.length-1];return i!==void 0&&i!==""?i:o}d(w,"shortTaskDefinition");function F(o){const s=o.containers.filter(c=>c.exitCode!==void 0).map(c=>`${c.name??"container"} exit ${c.exitCode}`).join(", "),i=o.stoppedReason??o.stopCode??"no stopped reason recorded";return s!==""?`${i} (${s})`:i}d(F,"formatForensic");export{Y as ECS_TAIL_POLL_INTERVAL_MS,W as UPDATE_ROLLBACK_FAILED_RUNBOOK,Z as createEcsDeploymentTail};

package/dist/src/orchestration/application/schemaGateImage.d.ts

@@ -0,0 +1,32 @@
+import { type Result } from "@fjall/generator";
+import type { AwsProvider } from "../../aws/AwsProvider.js";
+export interface EnsureSchemaGateImageParams {
+    awsProvider: AwsProvider;
+    /** The synthesised assembly directory containing `fjall-manifest.json`. */
+    cdkOutPath: string;
+    onLog?: (message: string, level: "info" | "warn") => void;
+    abortSignal?: AbortSignal;
+    /** Test seam — production callers omit it (global fetch). */
+    fetchFn?: typeof fetch;
+}
+/**
+ * Ensure every schema-gate image tag the manifest declares exists in the
+ * target account's private ECR (`fjall/schema-gate`) before any task
+ * definition referencing it ships. Tags are recorded only for DEFAULT-image
+ * gates — a BYO `schemaGate.image` records nothing, so its availability stays
+ * the author's responsibility.
+ *
+ * Present tag → no-op (one DescribeImages). Absent → create the repository
+ * if needed (IMMUTABLE — release-pinned tags must never be repointed), then
+ * mirror the tag from the public repository via the OCI distribution API
+ * (anonymous pull) and the ECR SDK (layer upload + PutImage), preserving
+ * digests end-to-end so the multi-arch index survives byte-identical.
+ *
+ * Fail-closed: any failure refuses the deploy BEFORE CloudFormation mutates —
+ * shipping a task definition whose gate image cannot be pulled would stop
+ * every task at provisioning with no CFN-visible cause.
+ *
+ * Failure messages are pre-masked at construction — callers may surface
+ * `error.message` to log/callback sinks without re-masking.
+ */
+export declare function ensureSchemaGateImage(params: EnsureSchemaGateImageParams): Promise<Result<void>>;