fjall 3.11.1 → 3.11.2

package/bin/.bundled

@@ -1,3 +1,3 @@
-bundled at 2026-08-08T02:03:06.097Z
-bundle size: 4475585 bytes
-cli version: 3.11.1
+bundled at 2026-08-08T02:43:05.349Z
+bundle size: 4475670 bytes
+cli version: 3.11.2

package/bin/.metafile.json

@@ -13260,7 +13260,7 @@
       "format": "esm"
     },
     "../../deploy-core/dist/src/orchestration/application/applicationDeployHelpers.js": {
-      "bytes": 4979,
+      "bytes": 5036,
       "imports": [
         {
           "path": "node:path",
@@ -13987,7 +13987,7 @@
       "format": "esm"
     },
     "../../deploy-core/dist/src/orchestration/application/applicationDeploy.js": {
-      "bytes": 19416,
+      "bytes": 19444,
       "imports": [
         {
           "path": "path",
@@ -45574,7 +45574,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 12308267
+      "bytes": 12308464
     },
     "bin/fjall.bundle.js": {
       "imports": [
@@ -52014,7 +52014,7 @@
           "bytesInOutput": 1538
         },
         "../../deploy-core/dist/src/orchestration/application/applicationDeployHelpers.js": {
-          "bytesInOutput": 4091
+          "bytesInOutput": 4148
         },
         "../../deploy-core/dist/src/orchestration/application/assemblyIntegrity.js": {
           "bytesInOutput": 1015
@@ -52083,7 +52083,7 @@
           "bytesInOutput": 10418
         },
         "../../deploy-core/dist/src/orchestration/application/applicationDeploy.js": {
-          "bytesInOutput": 16702
+          "bytesInOutput": 16730
         },
         "../../deploy-core/dist/src/orchestration/organisationDeploy/orgContext.js": {
           "bytesInOutput": 1593
@@ -54921,7 +54921,7 @@
           "bytesInOutput": 493
         }
       },
-      "bytes": 4475585
+      "bytes": 4475670
     }
   }
 }

package/bin/fjall.bundle.js

@@ -8,7 +8,7 @@ const __fjbinDir = __fjdir(__fjfilename);
 process.env.FJALL_ASSETS_DIR = process.env.FJALL_ASSETS_DIR || __fjjoin(__fjbinDir, "assets");
 process.env.FJALL_BUNDLED = "1";
 
-var A9t=Object.create;var I7=Object.defineProperty;var w9t=Object.getOwnPropertyDescriptor;var C9t=Object.getOwnPropertyNames;var x9t=Object.getPrototypeOf,T9t=Object.prototype.hasOwnProperty;var Et=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var w=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Ee=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},qt=(t,e)=>{for(var r in e)I7(t,r,{get:e[r],enumerable:!0})},f9e=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let a of C9t(e))!T9t.call(t,a)&&a!==r&&I7(t,a,{get:()=>e[a],enumerable:!(n=w9t(e,a))||n.enumerable});return t};var Kl=(t,e,r)=>(r=t!=null?A9t(x9t(t)):{},f9e(e||!t||!t.__esModule?I7(r,"default",{value:t,enumerable:!0}):r,t)),Kt=t=>f9e(I7({},"__esModule",{value:!0}),t);var aT,N7=w(()=>{aT={name:"@fjall/cli",version:"3.11.1",description:"Fjall CLI helper",private:!0,type:"module",bin:{fjall:"dist/src/cli.js"},files:["dist/"],scripts:{clean:"rm -rf ./dist ./dist.next ./sourcemaps","clean:node":"rm -rf ./node_modules","copy-files":'DEST="${DEST:-dist}"; find generators -type d -name files | while read dir; do mkdir -p "$DEST/$dir" && cp -R "$dir/"* "$DEST/$dir/"; done && cp -R src/proto "./$DEST/src/proto"',build:"rm -rf ./dist.next ./sourcemaps && npx tsc --outDir dist.next && DEST=dist.next npm run copy-files && node ../scripts/minify-dist.mjs dist.next && chmod +x ./dist.next/src/cli.js && rm -rf ./dist && mv ./dist.next ./dist",watch:"npm run build && npx tsc-watch","watch:only":'npx tsc-watch --onSuccess "npm run copy-files"',"fjall-cli":"node ./dist/src/cli.js",version:"npx tsx scripts/updateTemplateVersions.ts",format:'prettier --write "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',"format:check":'prettier --check "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',lint:"eslint src/ generators/","lint:fix":"eslint src/ generators/ --fix",typecheck:"tsc --noEmit","typecheck:tests":"tsc --noEmit --project tsconfig.test.json","typecheck:scripts":"tsc --noEmit --project tsconfig.scripts.json","typecheck:all":"npm run typecheck && npm run typecheck:tests && npm run typecheck:scripts",test:"vitest run","test:watch":"vitest","test:coverage":"vitest run --coverage","test:integration":"vitest run --config vitest.config.integration.ts","test:integration:watch":"vitest --config vitest.config.integration.ts","test:e2e":"vitest run --config vitest.e2e.config.ts","test:all":"npm run test && npm run test:integration && npm run test:e2e","test:setup":"node scripts/setupTestFixtures.mjs","test:payload-compat":"npx tsx scripts/testPayloadCompatibility.ts","test:payload-compat:e2e":"npx tsx scripts/testPayloadCompatibility.ts --e2e"},engines:{node:">=22.0.0"},author:"",license:"SEE LICENSE IN LICENSE",devDependencies:{"@eslint/js":"^10.0.1","@playwright/test":"^1.59.1","@testing-library/dom":"^10.4.1","@testing-library/react":"^16.3.2","@types/ejs":"^3.1.5","@types/js-yaml":"^4.0.9","@types/mime-types":"^3.0.1","@types/picomatch":"^4.0.3","@types/prompts":"^2.4.9","@types/proper-lockfile":"^4.1.4","@types/react":"^19.2.14","@types/tar-fs":"^2.0.4","@types/tar-stream":"^3.1.4","@typescript-eslint/eslint-plugin":"^8.59.1","@typescript-eslint/parser":"^8.59.1","@vitest/coverage-v8":"^4.1.5",eslint:"^10.2.1","eslint-plugin-fjall":"file:./eslint-rules","ink-testing-library":"^4.0.0",jsdom:"^29.1.0",prettier:"^3.8.3","react-dom":"^19.2.5","tsc-watch":"^7.2.0",tsx:"^4.21.0","typescript-eslint":"^8.59.1",vitest:"4.1.7"},dependencies:{"@aws-sdk/client-acm":"^3.1038.0","@aws-sdk/client-auto-scaling":"^3.1038.0","@aws-sdk/client-backup":"^3.1038.0","@aws-sdk/client-cloudformation":"^3.1038.0","@aws-sdk/client-cost-explorer":"^3.1038.0","@aws-sdk/client-ec2":"^3.1038.0","@aws-sdk/client-ecr":"^3.1038.0","@aws-sdk/client-ecs":"^3.1038.0","@aws-sdk/client-elasticache":"^3.1038.0","@aws-sdk/client-iam":"^3.1038.0","@aws-sdk/client-identitystore":"^3.1038.0","@aws-sdk/client-lambda":"^3.1038.0","@aws-sdk/client-organizations":"^3.1038.0","@aws-sdk/client-ram":"^3.1038.0","@aws-sdk/client-rds":"^3.1038.0","@aws-sdk/client-route-53":"^3.1038.0","@aws-sdk/client-s3":"^3.1038.0","@aws-sdk/client-secrets-manager":"^3.1038.0","@aws-sdk/client-ssm":"^3.1038.0","@aws-sdk/client-sso":"^3.1038.0","@aws-sdk/client-sso-admin":"^3.1038.0","@aws-sdk/client-sso-oidc":"^3.1038.0","@aws-sdk/client-sts":"^3.1038.0","@fjall/deploy-core":"^3.11.0","@fjall/generator":"^3.11.0","@fjall/util":"^3.11.0","@nx/devkit":"^23.0.0","@opennextjs/aws":"^4.0.3","@smithy/node-http-handler":"^4.6.1","@toon-format/toon":"^2.1.0","aws-cdk":"^2.1128.1",axios:"^1.15.2",chalk:"^5.6.2","cli-cursor":"^5.0.0",commander:"^15.0.0",ejs:"^6.0.1",ink:"^7.0.1","js-yaml":"^4.1.1","mime-types":"^3.0.2",open:"^11.0.0",ora:"^9.4.0",picomatch:"^4.0.4",prompts:"^2.4.2","proper-lockfile":"^4.1.2",protobufjs:"^8.0.3",react:"^19.2.5","tar-fs":"^3.1.2",typescript:"^6.0.3","update-check":"^1.5.4",zod:"^4.4.3"}}});function $9t(){let t=new Map;for(let[e,r]of Object.entries(To)){for(let[n,a]of Object.entries(r))To[n]={open:`\x1B[${a[0]}m`,close:`\x1B[${a[1]}m`},r[n]=To[n],t.set(a[0],a[1]);Object.defineProperty(To,e,{value:r,enumerable:!1})}return Object.defineProperty(To,"codes",{value:t,enumerable:!1}),To.color.close="\x1B[39m",To.bgColor.close="\x1B[49m",To.color.ansi=v9e(),To.color.ansi256=S9e(),To.color.ansi16m=b9e(),To.bgColor.ansi=v9e(10),To.bgColor.ansi256=S9e(10),To.bgColor.ansi16m=b9e(10),Object.defineProperties(To,{rgbToAnsi256:{value(e,r,n){return e===r&&r===n?e<8?16:e>248?231:Math.round((e-8)/247*24)+232:16+36*Math.round(e/255*5)+6*Math.round(r/255*5)+Math.round(n/255*5)},enumerable:!1},hexToRgb:{value(e){let r=/[a-f\d]{6}|[a-f\d]{3}/i.exec(e.toString(16));if(!r)return[0,0,0];let[n]=r;n.length===3&&(n=[...n].map(o=>o+o).join(""));let a=Number.parseInt(n,16);return[a>>16&255,a>>8&255,a&255]},enumerable:!1},hexToAnsi256:{value:e=>To.rgbToAnsi256(...To.hexToRgb(e)),enumerable:!1},ansi256ToAnsi:{value(e){if(e<8)return 30+e;if(e<16)return 90+(e-8);let r,n,a;if(e>=232)r=((e-232)*10+8)/255,n=r,a=r;else{e-=16;let i=e%36;r=Math.floor(e/36)/5,n=Math.floor(i/6)/5,a=i%6/5}let o=Math.max(r,n,a)*2;if(o===0)return 30;let s=30+(Math.round(a)<<2|Math.round(n)<<1|Math.round(r));return o===2&&(s+=60),s},enumerable:!1},rgbToAnsi:{value:(e,r,n)=>To.ansi256ToAnsi(To.rgbToAnsi256(e,r,n)),enumerable:!1},hexToAnsi:{value:e=>To.ansi256ToAnsi(To.hexToAnsi256(e)),enumerable:!1}}),To}var v9e,S9e,b9e,To,Hdn,N9t,_9t,qdn,M9t,uh,E9e=w(()=>{v9e=(t=0)=>e=>`\x1B[${e+t}m`,S9e=(t=0)=>e=>`\x1B[${38+t};5;${e}m`,b9e=(t=0)=>(e,r,n)=>`\x1B[${38+t};2;${e};${r};${n}m`,To={modifier:{reset:[0,0],bold:[1,22],dim:[2,22],italic:[3,23],underline:[4,24],overline:[53,55],inverse:[7,27],hidden:[8,28],strikethrough:[9,29]},color:{black:[30,39],red:[31,39],green:[32,39],yellow:[33,39],blue:[34,39],magenta:[35,39],cyan:[36,39],white:[37,39],blackBright:[90,39],gray:[90,39],grey:[90,39],redBright:[91,39],greenBright:[92,39],yellowBright:[93,39],blueBright:[94,39],magentaBright:[95,39],cyanBright:[96,39],whiteBright:[97,39]},bgColor:{bgBlack:[40,49],bgRed:[41,49],bgGreen:[42,49],bgYellow:[43,49],bgBlue:[44,49],bgMagenta:[45,49],bgCyan:[46,49],bgWhite:[47,49],bgBlackBright:[100,49],bgGray:[100,49],bgGrey:[100,49],bgRedBright:[101,49],bgGreenBright:[102,49],bgYellowBright:[103,49],bgBlueBright:[104,49],bgMagentaBright:[105,49],bgCyanBright:[106,49],bgWhiteBright:[107,49]}},Hdn=Object.keys(To.modifier),N9t=Object.keys(To.color),_9t=Object.keys(To.bgColor),qdn=[...N9t,..._9t];M9t=$9t(),uh=M9t});import khe from"node:process";import L9t from"node:os";import A9e from"node:tty";function Dm(t,e=globalThis.Deno?globalThis.Deno.args:khe.argv){let r=t.startsWith("-")?"":t.length===1?"-":"--",n=e.indexOf(r+t),a=e.indexOf("--");return n!==-1&&(a===-1||n<a)}function F9t(){if("FORCE_COLOR"in ko)return ko.FORCE_COLOR==="true"?1:ko.FORCE_COLOR==="false"?0:ko.FORCE_COLOR.length===0?1:Math.min(Number.parseInt(ko.FORCE_COLOR,10),3)}function j9t(t){return t===0?!1:{level:t,hasBasic:!0,has256:t>=2,has16m:t>=3}}function B9t(t,{streamIsTTY:e,sniffFlags:r=!0}={}){let n=F9t();n!==void 0&&(_7=n);let a=r?_7:n;if(a===0)return 0;if(r){if(Dm("color=16m")||Dm("color=full")||Dm("color=truecolor"))return 3;if(Dm("color=256"))return 2}if("TF_BUILD"in ko&&"AGENT_NAME"in ko)return 1;if(t&&!e&&a===void 0)return 0;let o=a||0;if(ko.TERM==="dumb")return o;if(khe.platform==="win32"){let s=L9t.release().split(".");return Number(s[0])>=10&&Number(s[2])>=10586?Number(s[2])>=14931?3:2:1}if("CI"in ko)return["GITHUB_ACTIONS","GITEA_ACTIONS","CIRCLECI"].some(s=>s in ko)?3:["TRAVIS","APPVEYOR","GITLAB_CI","BUILDKITE","DRONE"].some(s=>s in ko)||ko.CI_NAME==="codeship"?1:o;if("TEAMCITY_VERSION"in ko)return/^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(ko.TEAMCITY_VERSION)?1:0;if(ko.COLORTERM==="truecolor"||ko.TERM==="xterm-kitty"||ko.TERM==="xterm-ghostty"||ko.TERM==="wezterm")return 3;if("TERM_PROGRAM"in ko){let s=Number.parseInt((ko.TERM_PROGRAM_VERSION||"").split(".")[0],10);switch(ko.TERM_PROGRAM){case"iTerm.app":return s>=3?3:2;case"Apple_Terminal":return 2}}return/-256(color)?$/i.test(ko.TERM)?2:/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(ko.TERM)||"COLORTERM"in ko?1:o}function w9e(t,e={}){let r=B9t(t,{streamIsTTY:t&&t.isTTY,...e});return j9t(r)}var ko,_7,U9t,C9e,x9e=w(()=>{({env:ko}=khe);Dm("no-color")||Dm("no-colors")||Dm("color=false")||Dm("color=never")?_7=0:(Dm("color")||Dm("colors")||Dm("color=true")||Dm("color=always"))&&(_7=1);U9t={stdout:w9e({isTTY:A9e.isatty(1)}),stderr:w9e({isTTY:A9e.isatty(2)})},C9e=U9t});function T9e(t,e,r){let n=t.indexOf(e);if(n===-1)return t;let a=e.length,o=0,s="";do s+=t.slice(o,n)+e+r,o=n+a,n=t.indexOf(e,o);while(n!==-1);return s+=t.slice(o),s}function k9e(t,e,r,n){let a=0,o="";do{let s=t[n-1]==="\r";o+=t.slice(a,s?n-1:n)+e+(s?`\r
+var A9t=Object.create;var I7=Object.defineProperty;var w9t=Object.getOwnPropertyDescriptor;var C9t=Object.getOwnPropertyNames;var x9t=Object.getPrototypeOf,T9t=Object.prototype.hasOwnProperty;var Et=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var w=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Ee=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},qt=(t,e)=>{for(var r in e)I7(t,r,{get:e[r],enumerable:!0})},f9e=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let a of C9t(e))!T9t.call(t,a)&&a!==r&&I7(t,a,{get:()=>e[a],enumerable:!(n=w9t(e,a))||n.enumerable});return t};var Kl=(t,e,r)=>(r=t!=null?A9t(x9t(t)):{},f9e(e||!t||!t.__esModule?I7(r,"default",{value:t,enumerable:!0}):r,t)),Kt=t=>f9e(I7({},"__esModule",{value:!0}),t);var aT,N7=w(()=>{aT={name:"@fjall/cli",version:"3.11.2",description:"Fjall CLI helper",private:!0,type:"module",bin:{fjall:"dist/src/cli.js"},files:["dist/"],scripts:{clean:"rm -rf ./dist ./dist.next ./sourcemaps","clean:node":"rm -rf ./node_modules","copy-files":'DEST="${DEST:-dist}"; find generators -type d -name files | while read dir; do mkdir -p "$DEST/$dir" && cp -R "$dir/"* "$DEST/$dir/"; done && cp -R src/proto "./$DEST/src/proto"',build:"rm -rf ./dist.next ./sourcemaps && npx tsc --outDir dist.next && DEST=dist.next npm run copy-files && node ../scripts/minify-dist.mjs dist.next && chmod +x ./dist.next/src/cli.js && rm -rf ./dist && mv ./dist.next ./dist",watch:"npm run build && npx tsc-watch","watch:only":'npx tsc-watch --onSuccess "npm run copy-files"',"fjall-cli":"node ./dist/src/cli.js",version:"npx tsx scripts/updateTemplateVersions.ts",format:'prettier --write "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',"format:check":'prettier --check "src/**/*.{ts,tsx,js,jsx,json}" "generators/**/*.{ts,tsx,js,jsx,json}"',lint:"eslint src/ generators/","lint:fix":"eslint src/ generators/ --fix",typecheck:"tsc --noEmit","typecheck:tests":"tsc --noEmit --project tsconfig.test.json","typecheck:scripts":"tsc --noEmit --project tsconfig.scripts.json","typecheck:all":"npm run typecheck && npm run typecheck:tests && npm run typecheck:scripts",test:"vitest run","test:watch":"vitest","test:coverage":"vitest run --coverage","test:integration":"vitest run --config vitest.config.integration.ts","test:integration:watch":"vitest --config vitest.config.integration.ts","test:e2e":"vitest run --config vitest.e2e.config.ts","test:all":"npm run test && npm run test:integration && npm run test:e2e","test:setup":"node scripts/setupTestFixtures.mjs","test:payload-compat":"npx tsx scripts/testPayloadCompatibility.ts","test:payload-compat:e2e":"npx tsx scripts/testPayloadCompatibility.ts --e2e"},engines:{node:">=22.0.0"},author:"",license:"SEE LICENSE IN LICENSE",devDependencies:{"@eslint/js":"^10.0.1","@playwright/test":"^1.59.1","@testing-library/dom":"^10.4.1","@testing-library/react":"^16.3.2","@types/ejs":"^3.1.5","@types/js-yaml":"^4.0.9","@types/mime-types":"^3.0.1","@types/picomatch":"^4.0.3","@types/prompts":"^2.4.9","@types/proper-lockfile":"^4.1.4","@types/react":"^19.2.14","@types/tar-fs":"^2.0.4","@types/tar-stream":"^3.1.4","@typescript-eslint/eslint-plugin":"^8.59.1","@typescript-eslint/parser":"^8.59.1","@vitest/coverage-v8":"^4.1.5",eslint:"^10.2.1","eslint-plugin-fjall":"file:./eslint-rules","ink-testing-library":"^4.0.0",jsdom:"^29.1.0",prettier:"^3.8.3","react-dom":"^19.2.5","tsc-watch":"^7.2.0",tsx:"^4.21.0","typescript-eslint":"^8.59.1",vitest:"4.1.7"},dependencies:{"@aws-sdk/client-acm":"^3.1038.0","@aws-sdk/client-auto-scaling":"^3.1038.0","@aws-sdk/client-backup":"^3.1038.0","@aws-sdk/client-cloudformation":"^3.1038.0","@aws-sdk/client-cost-explorer":"^3.1038.0","@aws-sdk/client-ec2":"^3.1038.0","@aws-sdk/client-ecr":"^3.1038.0","@aws-sdk/client-ecs":"^3.1038.0","@aws-sdk/client-elasticache":"^3.1038.0","@aws-sdk/client-iam":"^3.1038.0","@aws-sdk/client-identitystore":"^3.1038.0","@aws-sdk/client-lambda":"^3.1038.0","@aws-sdk/client-organizations":"^3.1038.0","@aws-sdk/client-ram":"^3.1038.0","@aws-sdk/client-rds":"^3.1038.0","@aws-sdk/client-route-53":"^3.1038.0","@aws-sdk/client-s3":"^3.1038.0","@aws-sdk/client-secrets-manager":"^3.1038.0","@aws-sdk/client-ssm":"^3.1038.0","@aws-sdk/client-sso":"^3.1038.0","@aws-sdk/client-sso-admin":"^3.1038.0","@aws-sdk/client-sso-oidc":"^3.1038.0","@aws-sdk/client-sts":"^3.1038.0","@fjall/deploy-core":"^3.11.0","@fjall/generator":"^3.11.0","@fjall/util":"^3.11.0","@nx/devkit":"^23.0.0","@opennextjs/aws":"^4.0.3","@smithy/node-http-handler":"^4.6.1","@toon-format/toon":"^2.1.0","aws-cdk":"^2.1128.1",axios:"^1.15.2",chalk:"^5.6.2","cli-cursor":"^5.0.0",commander:"^15.0.0",ejs:"^6.0.1",ink:"^7.0.1","js-yaml":"^4.1.1","mime-types":"^3.0.2",open:"^11.0.0",ora:"^9.4.0",picomatch:"^4.0.4",prompts:"^2.4.2","proper-lockfile":"^4.1.2",protobufjs:"^8.0.3",react:"^19.2.5","tar-fs":"^3.1.2",typescript:"^6.0.3","update-check":"^1.5.4",zod:"^4.4.3"}}});function $9t(){let t=new Map;for(let[e,r]of Object.entries(To)){for(let[n,a]of Object.entries(r))To[n]={open:`\x1B[${a[0]}m`,close:`\x1B[${a[1]}m`},r[n]=To[n],t.set(a[0],a[1]);Object.defineProperty(To,e,{value:r,enumerable:!1})}return Object.defineProperty(To,"codes",{value:t,enumerable:!1}),To.color.close="\x1B[39m",To.bgColor.close="\x1B[49m",To.color.ansi=v9e(),To.color.ansi256=S9e(),To.color.ansi16m=b9e(),To.bgColor.ansi=v9e(10),To.bgColor.ansi256=S9e(10),To.bgColor.ansi16m=b9e(10),Object.defineProperties(To,{rgbToAnsi256:{value(e,r,n){return e===r&&r===n?e<8?16:e>248?231:Math.round((e-8)/247*24)+232:16+36*Math.round(e/255*5)+6*Math.round(r/255*5)+Math.round(n/255*5)},enumerable:!1},hexToRgb:{value(e){let r=/[a-f\d]{6}|[a-f\d]{3}/i.exec(e.toString(16));if(!r)return[0,0,0];let[n]=r;n.length===3&&(n=[...n].map(o=>o+o).join(""));let a=Number.parseInt(n,16);return[a>>16&255,a>>8&255,a&255]},enumerable:!1},hexToAnsi256:{value:e=>To.rgbToAnsi256(...To.hexToRgb(e)),enumerable:!1},ansi256ToAnsi:{value(e){if(e<8)return 30+e;if(e<16)return 90+(e-8);let r,n,a;if(e>=232)r=((e-232)*10+8)/255,n=r,a=r;else{e-=16;let i=e%36;r=Math.floor(e/36)/5,n=Math.floor(i/6)/5,a=i%6/5}let o=Math.max(r,n,a)*2;if(o===0)return 30;let s=30+(Math.round(a)<<2|Math.round(n)<<1|Math.round(r));return o===2&&(s+=60),s},enumerable:!1},rgbToAnsi:{value:(e,r,n)=>To.ansi256ToAnsi(To.rgbToAnsi256(e,r,n)),enumerable:!1},hexToAnsi:{value:e=>To.ansi256ToAnsi(To.hexToAnsi256(e)),enumerable:!1}}),To}var v9e,S9e,b9e,To,Hdn,N9t,_9t,qdn,M9t,uh,E9e=w(()=>{v9e=(t=0)=>e=>`\x1B[${e+t}m`,S9e=(t=0)=>e=>`\x1B[${38+t};5;${e}m`,b9e=(t=0)=>(e,r,n)=>`\x1B[${38+t};2;${e};${r};${n}m`,To={modifier:{reset:[0,0],bold:[1,22],dim:[2,22],italic:[3,23],underline:[4,24],overline:[53,55],inverse:[7,27],hidden:[8,28],strikethrough:[9,29]},color:{black:[30,39],red:[31,39],green:[32,39],yellow:[33,39],blue:[34,39],magenta:[35,39],cyan:[36,39],white:[37,39],blackBright:[90,39],gray:[90,39],grey:[90,39],redBright:[91,39],greenBright:[92,39],yellowBright:[93,39],blueBright:[94,39],magentaBright:[95,39],cyanBright:[96,39],whiteBright:[97,39]},bgColor:{bgBlack:[40,49],bgRed:[41,49],bgGreen:[42,49],bgYellow:[43,49],bgBlue:[44,49],bgMagenta:[45,49],bgCyan:[46,49],bgWhite:[47,49],bgBlackBright:[100,49],bgGray:[100,49],bgGrey:[100,49],bgRedBright:[101,49],bgGreenBright:[102,49],bgYellowBright:[103,49],bgBlueBright:[104,49],bgMagentaBright:[105,49],bgCyanBright:[106,49],bgWhiteBright:[107,49]}},Hdn=Object.keys(To.modifier),N9t=Object.keys(To.color),_9t=Object.keys(To.bgColor),qdn=[...N9t,..._9t];M9t=$9t(),uh=M9t});import khe from"node:process";import L9t from"node:os";import A9e from"node:tty";function Dm(t,e=globalThis.Deno?globalThis.Deno.args:khe.argv){let r=t.startsWith("-")?"":t.length===1?"-":"--",n=e.indexOf(r+t),a=e.indexOf("--");return n!==-1&&(a===-1||n<a)}function F9t(){if("FORCE_COLOR"in ko)return ko.FORCE_COLOR==="true"?1:ko.FORCE_COLOR==="false"?0:ko.FORCE_COLOR.length===0?1:Math.min(Number.parseInt(ko.FORCE_COLOR,10),3)}function j9t(t){return t===0?!1:{level:t,hasBasic:!0,has256:t>=2,has16m:t>=3}}function B9t(t,{streamIsTTY:e,sniffFlags:r=!0}={}){let n=F9t();n!==void 0&&(_7=n);let a=r?_7:n;if(a===0)return 0;if(r){if(Dm("color=16m")||Dm("color=full")||Dm("color=truecolor"))return 3;if(Dm("color=256"))return 2}if("TF_BUILD"in ko&&"AGENT_NAME"in ko)return 1;if(t&&!e&&a===void 0)return 0;let o=a||0;if(ko.TERM==="dumb")return o;if(khe.platform==="win32"){let s=L9t.release().split(".");return Number(s[0])>=10&&Number(s[2])>=10586?Number(s[2])>=14931?3:2:1}if("CI"in ko)return["GITHUB_ACTIONS","GITEA_ACTIONS","CIRCLECI"].some(s=>s in ko)?3:["TRAVIS","APPVEYOR","GITLAB_CI","BUILDKITE","DRONE"].some(s=>s in ko)||ko.CI_NAME==="codeship"?1:o;if("TEAMCITY_VERSION"in ko)return/^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(ko.TEAMCITY_VERSION)?1:0;if(ko.COLORTERM==="truecolor"||ko.TERM==="xterm-kitty"||ko.TERM==="xterm-ghostty"||ko.TERM==="wezterm")return 3;if("TERM_PROGRAM"in ko){let s=Number.parseInt((ko.TERM_PROGRAM_VERSION||"").split(".")[0],10);switch(ko.TERM_PROGRAM){case"iTerm.app":return s>=3?3:2;case"Apple_Terminal":return 2}}return/-256(color)?$/i.test(ko.TERM)?2:/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(ko.TERM)||"COLORTERM"in ko?1:o}function w9e(t,e={}){let r=B9t(t,{streamIsTTY:t&&t.isTTY,...e});return j9t(r)}var ko,_7,U9t,C9e,x9e=w(()=>{({env:ko}=khe);Dm("no-color")||Dm("no-colors")||Dm("color=false")||Dm("color=never")?_7=0:(Dm("color")||Dm("colors")||Dm("color=true")||Dm("color=always"))&&(_7=1);U9t={stdout:w9e({isTTY:A9e.isatty(1)}),stderr:w9e({isTTY:A9e.isatty(2)})},C9e=U9t});function T9e(t,e,r){let n=t.indexOf(e);if(n===-1)return t;let a=e.length,o=0,s="";do s+=t.slice(o,n)+e+r,o=n+a,n=t.indexOf(e,o);while(n!==-1);return s+=t.slice(o),s}function k9e(t,e,r,n){let a=0,o="";do{let s=t[n-1]==="\r";o+=t.slice(a,s?n-1:n)+e+(s?`\r
 `:`
 `)+r,a=n+1,n=t.indexOf(`
 `,a)}while(n!==-1);return o+=t.slice(a),o}var P9e=w(()=>{});function x2(t){return z9t(t)}var I9e,R9e,Phe,SO,C2,D9e,bO,V9t,z9t,Ihe,G9t,W9t,Rhe,$7,H9t,q9t,npn,K,$n=w(()=>{E9e();x9e();P9e();({stdout:I9e,stderr:R9e}=C9e),Phe=Symbol("GENERATOR"),SO=Symbol("STYLER"),C2=Symbol("IS_EMPTY"),D9e=["ansi","ansi","ansi256","ansi16m"],bO=Object.create(null),V9t=(t,e={})=>{if(e.level&&!(Number.isInteger(e.level)&&e.level>=0&&e.level<=3))throw new Error("The `level` option should be an integer from 0 to 3");let r=I9e?I9e.level:0;t.level=e.level===void 0?r:e.level},z9t=t=>{let e=(...r)=>r.join(" ");return V9t(e,t),Object.setPrototypeOf(e,x2.prototype),e};Object.setPrototypeOf(x2.prototype,Function.prototype);for(let[t,e]of Object.entries(uh))bO[t]={get(){let r=$7(this,Rhe(e.open,e.close,this[SO]),this[C2]);return Object.defineProperty(this,t,{value:r}),r}};bO.visible={get(){let t=$7(this,this[SO],!0);return Object.defineProperty(this,"visible",{value:t}),t}};Ihe=(t,e,r,...n)=>t==="rgb"?e==="ansi16m"?uh[r].ansi16m(...n):e==="ansi256"?uh[r].ansi256(uh.rgbToAnsi256(...n)):uh[r].ansi(uh.rgbToAnsi(...n)):t==="hex"?Ihe("rgb",e,r,...uh.hexToRgb(...n)):uh[r][t](...n),G9t=["rgb","hex","ansi256"];for(let t of G9t){bO[t]={get(){let{level:r}=this;return function(...n){let a=Rhe(Ihe(t,D9e[r],"color",...n),uh.color.close,this[SO]);return $7(this,a,this[C2])}}};let e="bg"+t[0].toUpperCase()+t.slice(1);bO[e]={get(){let{level:r}=this;return function(...n){let a=Rhe(Ihe(t,D9e[r],"bgColor",...n),uh.bgColor.close,this[SO]);return $7(this,a,this[C2])}}}}W9t=Object.defineProperties(()=>{},{...bO,level:{enumerable:!0,get(){return this[Phe].level},set(t){this[Phe].level=t}}}),Rhe=(t,e,r)=>{let n,a;return r===void 0?(n=t,a=e):(n=r.openAll+t,a=e+r.closeAll),{open:t,close:e,openAll:n,closeAll:a,parent:r}},$7=(t,e,r)=>{let n=(...a)=>H9t(n,a.length===1?""+a[0]:a.join(" "));return Object.setPrototypeOf(n,W9t),n[Phe]=t,n[SO]=e,n[C2]=r,n},H9t=(t,e)=>{if(t.level<=0||!e)return t[C2]?"":e;let r=t[SO];if(r===void 0)return e;let{openAll:n,closeAll:a}=r;if(e.includes("\x1B"))for(;r!==void 0;)e=T9e(e,r.close,r.open),r=r.parent;let o=e.indexOf(`
@@ -662,10 +662,10 @@ ${c.join(`
 `),r.update(n);return r.digest("hex").slice(0,16)}function KG(t){return`${IEt(t.verb)} operation ${t.opId} already completed`}function YG(t){return`Archived completed ${t.verb} operation ${t.opId} from a previous incarnation \u2014 starting a fresh operation`}function IEt(t){return t.charAt(0).toUpperCase()+t.slice(1)}function Pae(t,e,r,n,a){for(let[o,s,i]of[["accountId",e,xae],["region",r,xae],["stackName",n,xae],["opId",a,ONe]])if(!i.test(s))return y(new Error(`Refusing remediation journal path: unsafe ${o} segment "${S(s)}"`));return E(dC(t,e,r,n,`${a}.json`))}async function pC(t,e){let r=e?.journalDir??lv(),n=Pae(r,t.accountId,t.region,t.stackName,t.opId);if(!n.success)return n;try{await JPr(PEt(n.data),{recursive:!0});let a=`${n.data}.tmp-${process.pid}`;return await XPr(a,JSON.stringify(t,null,2),"utf8"),await TEt(a,n.data),E(n.data)}catch(a){return y(new Error(`Failed to write remediation journal for ${t.stackName}/${t.opId}: ${S(T(a))}`))}}async function mC(t,e,r,n,a){let o=a?.journalDir??lv(),s=Pae(o,t,e,r,n);if(!s.success)return null;let i;try{i=await kae(s.data,"utf8")}catch{return null}return ZG(i,`${r}/${n}`)}function ZG(t,e){let r;try{r=JSON.parse(t)}catch(a){return z.warn(cv,"Corrupt remediation journal ignored",{label:e,error:S(T(a))}),null}let n=KQ.safeParse(r);return n.success?n.data:(z.warn(cv,"Schema-drifted remediation journal ignored",{label:e,error:S(n.error.message)}),null)}async function IP(t,e){let r=e?.journalDir??lv(),n=Pae(r,t.accountId,t.region,t.stackName,t.opId);if(!n.success)return n;let a=(t.completedAt??t.updatedAt).replace(/[^0-9A-Za-z.-]/g,""),o=n.data.replace(/\.json$/,`.done-${a}.json`);try{return await TEt(n.data,o),E(o)}catch(s){return y(new Error(`Failed to archive the completed remediation journal for ${t.stackName}/${t.opId}: ${S(T(s))}`))}}async function nM(t,e,r){if(!ONe.test(t))return E(null);let n=r?.journalDir??lv(),a;try{a=await Iae(n,3)}catch{return E(null)}let o=[];for(let i of a.filter(c=>c.endsWith(`/${t}.json`))){let c;try{c=await kae(i,"utf8")}catch{continue}let l=ZG(c,t);l!==null&&o.push(l)}if(o.length===0)return E(null);if(o.length===1)return E(o[0]??null);let s=o.find(i=>i.accountId===e?.accountId&&i.region===e?.region);return s!==void 0?E(s):y(new Error(`Remediation operation ${t} exists in more than one context: ${o.map(i=>`${i.accountId}/${i.region}`).join(", ")}${e!==void 0?` \u2014 none matches the current credentials (${e.accountId}/${e.region}). Switch to the matching account/region and re-run 'fjall drift resume ${t}'.`:"."}`))}async function Iu(t,e,r,n){let a=n?.journalDir??lv(),o=dC(a,t,e,r);if(!xae.test(r))return[];let s;try{s=await Tae(o)}catch{return[]}let i=[];for(let c of s){if(!c.endsWith(".json"))continue;let l;try{l=await kae(dC(o,c),"utf8")}catch{continue}let u=ZG(l,`${r}/${c}`);u!==null&&u.phase!=="done"&&i.push(u)}return i}async function JG(t,e,r){let n=r?.journalDir??lv(),a;try{a=await Tae(dC(n,t,e))}catch{return[]}let o=[];for(let s of a)o.push(...await Iu(t,e,s,r));return o}async function RP(t,e=()=>new Date){let r=t?.journalDir??lv(),n=e().getTime()-DNe*24*60*60*1e3,a;try{a=await Iae(r,3)}catch{return}for(let o of a){let s;try{s=await kae(o,"utf8")}catch{continue}let i=ZG(s,o);if(i===null||i.phase!=="done")continue;let c=Date.parse(i.completedAt??i.updatedAt);if(Number.isNaN(c)||c>=n)continue;let l=!0;await RNe(o,{force:!0}).catch(u=>{l=!1,z.debug(cv,"Failed to sweep expired remediation journal",{file:o,error:S(T(u))})}),!(!l||i.forensicsPath===void 0)&&await REt(i.forensicsPath,i.opId)}}async function REt(t,e){let r=PEt(t),n=xEt(t)===e;if(!ONe.test(e)||!n&&xEt(r)!==e){z.debug(cv,"Kept forensics bundle \u2014 unexpected path shape",{forensicsPath:t});return}if(n){await DEt(t);return}let a=!0;await RNe(t,{recursive:!0,force:!0}).catch(o=>{a=!1,z.warn(cv,"Failed to sweep the expired journal's forensics",{forensicsPath:t,error:S(T(o))})}),a&&await kEt(r).catch(o=>{z.debug(cv,"Kept forensics opId directory",{opDir:r,error:S(T(o))})})}async function DEt(t){let e;try{e=await Tae(t,{withFileTypes:!0})}catch(n){z.warn(cv,"Failed to sweep the expired journal's forensics",{forensicsPath:t,error:S(T(n))});return}let r=!1;for(let n of e){if(!n.isFile()){r=!0;continue}await RNe(dC(t,n.name),{force:!0}).catch(a=>{r=!0,z.warn(cv,"Failed to sweep the expired journal's forensics",{forensicsPath:dC(t,n.name),error:S(T(a))})})}if(r){z.debug(cv,"Kept flat forensics directory \u2014 nested bundles live",{forensicsPath:t});return}await kEt(t).catch(n=>{z.debug(cv,"Kept forensics opId directory",{forensicsPath:t,error:S(T(n))})})}async function Iae(t,e){let r=await Tae(t,{withFileTypes:!0}),n=[];for(let a of r){let o=dC(t,a.name);a.isFile()&&a.name.endsWith(".json")?n.push(o):a.isDirectory()&&e>0&&n.push(...await Iae(o,e-1).catch(()=>[]))}return n}var YPr,$c,cv,DNe,xae,ONe,XG=w(()=>{"use strict";Ce();$();Ct();ww();YPr=Object.defineProperty,$c=(t,e)=>YPr(t,"name",{value:e,configurable:!0}),cv="RemediationJournal",DNe=90;$c(lv,"defaultRemediationJournalDir");$c(uv,"computeRemediationOpId");$c(KG,"formatCompletedOperationNotice");$c(YG,"formatArchivedOperationNotice");$c(IEt,"capitaliseVerb");xae=/^[A-Za-z0-9][A-Za-z0-9-]*$/,ONe=/^[a-f0-9]{8,64}$/;$c(Pae,"journalPath");$c(pC,"writeRemediationJournal");$c(mC,"readRemediationJournal");$c(ZG,"parseJournal");$c(IP,"archiveCompletedRemediationJournal");$c(nM,"findRemediationJournalByOpId");$c(Iu,"listActiveRemediationOps");$c(JG,"listActiveRemediationOpsForContext");$c(RP,"sweepExpiredRemediationJournals");$c(REt,"sweepForensicsBundle");$c(DEt,"sweepFlatBundleFiles");$c(Iae,"listFilesRecursive")});import{readFile as tIr}from"node:fs/promises";import{join as rIr}from"node:path";import{CloudFormationClient as nIr,DescribeStacksCommand as aIr,GetTemplateCommand as oIr}from"@aws-sdk/client-cloudformation";async function Bd(t,e,r){let n=t.getClient(nIr);try{let a=await n.send(new oIr({StackName:e,TemplateStage:"Original"}),{abortSignal:ee(r)});if(a.TemplateBody===void 0||a.TemplateBody==="")return y(new Error(`GetTemplate returned an empty template body for ${e}`));let o=(await n.send(new aIr({StackName:e}),{abortSignal:ee(r)})).Stacks?.[0];return E({templateBody:a.TemplateBody,capabilities:o?.Capabilities??[],parameterKeys:(o?.Parameters??[]).flatMap(s=>s.ParameterKey!==void 0?[s.ParameterKey]:[])})}catch(a){return y(new Error(`Could not read the live state of ${e}: ${S(T(a))}`))}}function Ud(t){let e=`'fjall deploy${t!==void 0?` ${t}`:""}'`;return`Two cures terminate it: re-apply the replacement-requiring configuration change and re-run ${e}, re-consenting when prompted \u2014 the recreate completes; or remove the resource from the fjall config and run ${e} \u2014 the operation closes as removed.`}async function QG(t,e,r){let n=e.targets.map(l=>l.logicalId),a=uv(e.stackName,n),o=await mC(t.getAccountId(),t.getRegion(),e.stackName,a,r?.journal);if(o!==null&&o.verb!=="forget"&&o.phase!=="done")return y(new Error(`Forget operation ${a} on ${e.stackName} collides with an in-flight '${o.verb}' operation covering the same resources \u2014 that surgery resumes only through its deploy. ${Ud(o.appName)} Nothing was mutated.`));if(o!==null&&o.phase!=="done")return E({opId:a,alreadyConsented:!0,source:"journal",journal:o,foreignMarkers:[]});let s=await Bd(t,e.stackName,e.abortSignal);if(!s.success)return s;let i=Pu(s.data.templateBody,n,e.stackName);if(!i.success)return i;let c=i.data.markerOpIds.filter(l=>l!==a).map(l=>{let u=Jb(s.data.templateBody,l,e.stackName),d=u.success?u.data:[];return{opId:l,markedLogicalIds:d,markedResourceTypes:TNe(s.data.templateBody,d,e.stackName)}});return i.data.markerOpIds.includes(a)?E({opId:a,alreadyConsented:!0,source:"marker",foreignMarkers:c}):E({opId:a,alreadyConsented:!1,source:"none",foreignMarkers:c})}function NNe(t,e,r,n,a){let o=n.filter(c=>c!==r);if(o.length===0)return E(void 0);let s=o.map(c=>{let l=Jb(t,c,e);return`${c} covers ${l.success&&l.data.length>0?l.data.join(", "):"(could not recover its target set)"}`}),i=a?`resume this operation with 'fjall drift resume ${r}'`:"re-run 'fjall drift repair' to restart this operation";return y(new Error(`Forget operation ${r} on ${e} found target resources already carrying a ${cC} marker from a different operation \u2014 its journal may live on another machine, and completing this operation over it would strand that surgery. Marked resources recovered from the live template: ${s.join("; ")}. Complete the foreign operation first \u2014 on the machine that holds its journal, run 'fjall drift resume ${o.join("' / 'fjall drift resume ")}' (or 'fjall drift repair' there if it is journal-less); once it converges, ${i}. Nothing was mutated.`))}async function Rae(t,e,r,n,a){let o=r.targets.map(p=>p.logicalId),s=Pu(e,o,r.stackName);if(!s.success)return s;if(kc(r.phase)<kc("flip-applied"))return E({absent:s.data.absentTargets,retained:[]});let i=Jb(e,r.opId,r.stackName,r.verb==="recreate"?Xh:cC);if(!i.success)return i;let c=new Set(i.data),l=new Set(s.data.absentTargets),u=r.targets.filter(p=>!l.has(p.logicalId)&&!c.has(p.logicalId));if(u.length===0)return E({absent:s.data.absentTargets,retained:[]});let d=await _Ne(t,r,u,n,a);return E({absent:s.data.absentTargets,retained:u.map(p=>p.logicalId).filter(p=>d.has(p))})}async function _Ne(t,e,r,n,a){let o=r.map(i=>({stackName:e.stackName,logicalId:i.logicalId,resourceType:i.resourceType,...Ay(i,e.stackName)?{}:{physicalId:i.physicalId},failedStatus:e.verb==="recreate"?"RECREATE_CLOSURE_CHECK":"FORGET_CLOSURE_CHECK",statusReason:`Presence verification at ${e.verb} closure`})),s=await new Tu(t,a?.probe).probeSuspects({stackName:e.stackName,suspects:o,...n!==void 0?{abortSignal:n}:{}});return s.success?new Set(s.data.filter(i=>i.verdict==="present"&&i.probeMethod!==dae).map(i=>i.logicalId)):(z.debug(Dae,"Closure probe failed \u2014 failing closed (not retained)",{stackName:e.stackName,opId:e.opId,error:s.error.message}),new Set)}async function DP(t,e,r){let{stackName:n,targets:a,onProgress:o,abortSignal:s}=e;if(a.length===0)return y(new Error("Forget surgery requires at least one target"));let i=r?.now??(()=>new Date),c=t.getAccountId(),l=t.getRegion(),u=a.map(M=>M.logicalId),d=uv(n,u),p=await mC(c,l,n,d,r?.journal);if(p!==null&&p.verb!=="forget"&&p.phase!=="done")return y(new Error(`Forget surgery ${d} on ${n} collides with an in-flight '${p.verb}' operation covering the same resources \u2014 that surgery resumes only through its deploy. ${Ud(p.appName)} Nothing was mutated.`));if(p!==null&&p.phase==="done"){if(e.doneJournalPolicy!=="archive-and-restart")return o?.(KG(p)),E({opId:d,phase:"done",convergePending:!1,...p.forensicsPath!==void 0?{forensicsPath:p.forensicsPath}:{},journal:p});let M=await IP(p,r?.journal);if(!M.success)return M;o?.(YG(p)),p=null}let m=ml(async M=>{let B=await pC(M,r?.journal);return B.success?E(M):y(B.error)},"persistJournal"),f;if(p===null){let M=await Bd(t,n,s);if(!M.success)return M;let B=Pu(M.data.templateBody,u,n);if(!B.success)return B;let j=NNe(M.data.templateBody,n,d,B.data.markerOpIds,!1);if(!j.success)return j;if(B.data.markerOpIds.includes(d)){o?.(`Recognised in-flight forget markers on ${n} \u2014 resuming from the fjall:forget marker`);let U=i().toISOString(),G=await m({version:1,opId:d,verb:"forget",accountId:c,region:l,stackName:n,...e.appName!==void 0?{appName:e.appName}:{},targets:[...a],phase:B.data.allFlipped?"flip-applied":"captured",createdAt:U,updatedAt:U});if(!G.success)return G;p=G.data,f=M.data}else{o?.(`Capturing forensics for ${n} (${d})`);let U=await EP(t,{stackName:n,opId:d,findings:e.findings??[],...s!==void 0?{abortSignal:s}:{}},r?.forensics);if(!U.success)return U;let G=i().toISOString(),V=await m({version:1,opId:d,verb:"forget",accountId:c,region:l,stackName:n,...e.appName!==void 0?{appName:e.appName}:{},targets:[...a],phase:"captured",createdAt:G,updatedAt:G,forensicsPath:U.data.forensicsPath,...e.consentedPhysicalNames!==void 0?{consentedPhysicalNames:[...e.consentedPhysicalNames]}:{}});if(!V.success)return V;p=V.data,f={templateBody:U.data.liveTemplateBody,capabilities:U.data.capabilities,parameterKeys:U.data.parameterKeys}}}if(f===void 0){let M=await Bd(t,n,s);if(!M.success)return M;f=M.data}let g=f.templateBody,v=Pu(g,u,n);if(!v.success)return v;let b=NNe(g,n,d,v.data.markerOpIds,!0);if(!b.success)return b;let A=p.phase,C=await Rae(t,g,p,s,r);if(!C.success)return C;let x=new Set(C.data.retained),k=v.data.policyPendingTargets.filter(M=>!x.has(M)),I=[],R=!1;if(k.length>0){let M=PNe(g,k,n);if(!M.success)return M;if(M.data.length>0){let L=k.length>1;return y(new Error(`Forget surgery cannot proceed on ${n}: ${k.join(", ")} must have DeletionPolicy changed to Retain before removal, but other resources in the stack still reference the deleted resource${L?"s":""} (${M.data.join(", ")}) \u2014 CloudFormation re-resolves references to a deleted resource during any update that modifies it, so the policy change cannot be applied. Either restore the deleted resource${L?"s":""} out-of-band and re-run 'fjall drift detect' (the finding clears; this operation record then idles until the 90-day retention sweep), or remove the target and every referencing resource from the stack in one manual template update \u2014 they cannot outlive it. This shape is a recorded fjall limitation (drift-remediation ADR, 2026-07-12). Nothing was mutated.`))}let B=u.filter(L=>!x.has(L)),j=INe(g,k,B,n);if(!j.success)return j;let U=j.data;if(U.length>0){let L=new Set(U.flatMap(ae=>ae.deadReferences)),H=await _Ne(t,p,p.targets.filter(ae=>L.has(ae.logicalId)),s,r);H.size>0&&(U=U.map(ae=>({...ae,deadReferences:ae.deadReferences.filter(ne=>!H.has(ne))})).filter(ae=>ae.deadReferences.length>0))}if(U.length>0){let L=[];for(let H of U){let ae=p.targets.find(Z=>Z.logicalId===H.pendingTarget);if(ae===void 0||Ay(ae,n)){L.push(`${H.pendingTarget} (no probeable physical id on this operation)`);continue}let ne=await pae(t,{resourceType:ae.resourceType,physicalId:ae.physicalId,...s!==void 0?{abortSignal:s}:{}});ne.verdict==="confirmed-deleted"?I.push(H.pendingTarget):L.push(`${H.pendingTarget} (${ne.verdict}: ${ne.detail})`)}if(L.length>0){let H=U.map(Z=>`${Z.pendingTarget} itself references the deleted ${Z.deadReferences.join(", ")}`).join("; "),ae=new Set(U.flatMap(Z=>Z.deadReferences)).size>1,ne=U.length>1;return y(new Error(`Forget surgery cannot proceed on ${n}: ${U.map(Z=>Z.pendingTarget).join(", ")} must have DeletionPolicy changed to Retain before removal, but ${H} \u2014 CloudFormation resolves a modified resource's own references at execution time, and a reference to a deleted resource cannot resolve, so the policy change cannot be applied. fjall proceeds without the policy change only when the referencing target is verified deleted against its owning service (the converge's removal is then a physical no-op), and verification did not confirm deletion for ${L.join("; ")}. Either restore the referenced resource${ae?"s":""} out-of-band and resume this operation (the policy change can then apply), or remove the referencing target${ne?"s":""} and every reference to ${ne?"them":"it"} (including stack Outputs) from the stack in one manual template update \u2014 CloudFormation deletes template-removed resources from its stored state, so removing an already-deleted resource succeeds where modifying it cannot. The unverified-absence shape is a recorded fjall limitation (drift-remediation ADR, 2026-07-12). Nothing was mutated.`))}o?.(`${I.join(", ")} cannot carry the Retain flip (${U.map(H=>`${H.pendingTarget} references the deleted ${H.deadReferences.join(", ")}`).join("; ")}) but ${I.length===1?"is":"are"} verified deleted against the owning service \u2014 proceeding without the flip: the converge's removal of an already-deleted resource is a physical no-op (flipless by necessity)`)}let G=new Set(I),V=k.filter(L=>!G.has(L));if(V.length>0){R=!0,p.liveTemplateDigest!==void 0&&p.liveTemplateDigest!==Zp(g)&&kc(p.phase)>=kc("flip-verified")&&o?.(`Live template of ${n} changed since the flip was verified \u2014 re-verifying from the current template`),o?.(`Deriving the retain flip for ${n}`);let L=CP({liveTemplateBody:g,stackName:n,targets:V,opId:d,at:i().toISOString()});if(!L.success)return L;let H=xP(g,L.data.flipTemplateBody,V,n);if(!H.success)return H;o?.("Proving the flip is metadata-only (review change set)");let ae=await TP(t,{stackName:n,flipTemplateBody:L.data.flipTemplateBody,targets:V,parameterKeys:f.parameterKeys,...s!==void 0?{abortSignal:s}:{}},r?.flip);if(!ae.success)return ae;let ne=await m({...p,phase:"flip-verified",updatedAt:i().toISOString(),liveTemplateDigest:L.data.liveTemplateDigest,proof:{diffGuardPassed:!0,changeSetMetadataOnly:!0,noChanges:ae.data.noChanges,provenAt:i().toISOString()}});if(!ne.success)return ne;p=ne.data,o?.(`Applying the retain flip to ${n}`);let Z=await lC(t,{stackName:n,flipTemplateBody:L.data.flipTemplateBody,capabilities:f.capabilities,parameterKeys:f.parameterKeys,derivedFromTemplateDigest:L.data.liveTemplateDigest,opId:d,...s!==void 0?{abortSignal:s}:{}},r?.flip);if(!Z.success)return Z;let re=await Bd(t,n,s);if(!re.success)return re;if(g=re.data.templateBody,v=Pu(g,u,n),!v.success)return v;let le=new Set(V),X=v.data.unflippedTargets.filter(ue=>le.has(ue)&&!x.has(ue));if(X.length>0)return y(new Error(`Retain flip on ${n} reported ${Z.data.outcome} but GetTemplate does not show Retain + the fjall:forget marker on ${X.join(", ")} \u2014 aborting to manual repair.`))}}if(kc(p.phase)<kc("flip-applied")){let M=new Set(I),B=v.data.policyPendingTargets.filter(V=>!x.has(V)&&!M.has(V));if(B.length>0)return y(new Error(`Retain flip on ${n} could not be recorded: ${B.join(", ")} do not carry the Retain deletion policies in the live template \u2014 re-run 'fjall drift repair' to re-verify.`));let j=new Set(v.data.absentTargets),U=v.data.unflippedTargets.filter(V=>!j.has(V)&&!x.has(V)&&!M.has(V));U.length>0&&o?.(`${U.join(", ")} already ${U.length===1?"carries":"carry"} DeletionPolicy Retain in the live template \u2014 no stack update needed (flipless fast-path)`);let G=await m({...p,phase:"flip-applied",updatedAt:i().toISOString(),liveTemplateDigest:Zp(g),...U.length>0?{fliplessTargets:U}:{},...I.length>0?{fliplessByNecessity:I}:{}});if(!G.success)return G;p=G.data}let N=!R&&p.phase===A?C:await Rae(t,g,p,s,r);if(!N.success)return N;let _=N.data.retained;if(N.data.absent.length+_.length===u.length){let M=await $Ne(p,_,i,r?.journal,r?.driftJournal);return M.success?(p=M.data,o?.(_.length>0?`Forget operation ${d} complete \u2014 the converge kept ${_.join(", ")} (re-declared in the synthesised template)${N.data.absent.length>0?` and ${n} no longer tracks the remaining targets`:""}`:`Targets are no longer in the ${n} template \u2014 forget operation ${d} complete`),E({opId:d,phase:"done",convergePending:!1,...p.forensicsPath!==void 0?{forensicsPath:p.forensicsPath}:{},journal:p})):M}return o?.(`Retain flip is live on ${n} \u2014 run the converge deploy to complete the forget`),E({opId:d,phase:p.phase,convergePending:!0,...p.forensicsPath!==void 0?{forensicsPath:p.forensicsPath}:{},journal:p})}async function aM(t,e,r){let{journal:n}=e;if(n.phase==="done")return E({status:"done",journal:n});let a=r?.now??(()=>new Date),o=n.targets.map(u=>u.logicalId),s=await Bd(t,n.stackName,e.abortSignal);if(!s.success)return s;let i=await Rae(t,s.data.templateBody,n,e.abortSignal,r);if(!i.success)return i;if(i.data.absent.length+i.data.retained.length!==o.length){let u=new Set([...i.data.absent,...i.data.retained]);return E({status:"converge-pending",journal:n,absent:[...i.data.absent],retained:[...i.data.retained],unverified:o.filter(d=>!u.has(d))})}let c=n.verb==="recreate"&&i.data.absent.length>0?await OEt(t,n,i.data.absent,e.abortSignal):void 0,l=await $Ne(n,i.data.retained,a,r?.journal,r?.driftJournal,c);return l.success?E({status:"done",journal:l.data}):l}async function OEt(t,e,r,n){let a={orphaned:[],unverified:[]};for(let o of r){let s=e.targets.find(c=>c.logicalId===o);if(s===void 0)continue;if(Ay(s,e.stackName)){a.unverified.push(o);continue}let i=await pae(t,{resourceType:s.resourceType,physicalId:s.physicalId,...n!==void 0?{abortSignal:n}:{}});i.verdict==="present"?a.orphaned.push(o):i.verdict==="unconfirmed"&&a.unverified.push(o)}return a}async function $Ne(t,e,r,n,a,o){let s=r().toISOString(),i={...t,phase:"done",updatedAt:s,completedAt:s,...e.length>0?t.verb==="recreate"?{recreatedResources:[...e]}:{retainedByRedeclaration:[...e]}:{},...o!==void 0&&o.orphaned.length>0?{orphanedResources:[...o.orphaned]}:{},...o!==void 0&&o.unverified.length>0?{unverifiedRemovals:[...o.unverified]}:{}},c=await pC(i,n);return c.success?(await NEt(t,a).catch(l=>{z.warn(Dae,"Failed to clear drift suspects after forget",{stackName:t.stackName,opId:t.opId,error:S(T(l))})}),E(i)):y(c.error)}async function NEt(t,e){let r=await bb(t.accountId,t.region,t.stackName,e);if(r===null)return;let n=new Set(t.targets.map(o=>o.logicalId)),a=r.suspects.filter(o=>!n.has(o.logicalId));if(a.length!==r.suspects.length){if(a.length===0){await Mk(t.accountId,t.region,t.stackName,e);return}await Sb({...r,suspects:a},e)}}async function OP(t,e,r){try{let n=await tIr(rIr(t,`${e}.template.json`),"utf8"),a=JSON.parse(n);return typeof a.Resources=="object"&&a.Resources!==null&&Object.hasOwn(a.Resources,r)}catch(n){z.debug(Dae,"Could not read the synthesised template",{stackName:e,error:S(T(n))});return}}async function eW(t,e,r){await RP(r?.journal,r?.now);let n=t.aws.getAccountId(),a=t.aws.getRegion(),o={blocked:[],inProgressOpIds:[],converging:[],flipNotLive:[],flipUnverified:[],stillDeclared:[],recreateConverging:[]},s=new Map,i=new Map;for(let c of e){if(Ae(t.abortSignal)){o.blocked.push(c);continue}let l=s.get(c.stackName);l===void 0&&(l=await Iu(n,a,c.stackName,r?.journal),s.set(c.stackName,l));let u=l.find(f=>f.verb==="forget"&&f.targets.some(g=>g.logicalId===c.logicalId));if(u===void 0){let f=l.find(g=>g.verb==="recreate"&&g.targets.some(v=>v.logicalId===c.logicalId));if(f!==void 0){o.recreateConverging.push({finding:c,opId:f.opId,...f.appName!==void 0?{appName:f.appName}:{}});continue}o.blocked.push(c);continue}if(kc(u.phase)<kc("flip-applied")){o.blocked.push(c),o.inProgressOpIds.includes(u.opId)||o.inProgressOpIds.push(u.opId);continue}let d=i.get(c.stackName);if(d===void 0){let f=await Bd(t.aws,c.stackName,t.abortSignal);f.success?d={templateBody:f.data.templateBody}:(z.debug(Dae,"Could not read the live template for the [G2] partition",{stackName:c.stackName,error:f.error.message}),d={errorMessage:f.error.message}),i.set(c.stackName,d)}if("errorMessage"in d){o.blocked.push(c),o.flipUnverified.push({finding:c,opId:u.opId,message:d.errorMessage});continue}let p=Pu(d.templateBody,[c.logicalId],c.stackName),m=new Set(u.fliplessByNecessity??[]);if(!(p.success&&(p.data.absentTargets.length===1||(p.data.policyPendingTargets.length===0||m.has(c.logicalId))&&p.data.markerOpIds.every(f=>f===u.opId)))){o.blocked.push(c),o.flipNotLive.push({finding:c,opId:u.opId});continue}if(await t.synthDeclaresTarget(c.stackName,c.logicalId)===!0){o.blocked.push(c),o.stillDeclared.push({finding:c,opId:u.opId});continue}o.converging.push({finding:c,opId:u.opId})}return o}async function MNe(t,e,r,n){let a=t.aws.getAccountId(),o=t.aws.getRegion(),s={verifiedAbsent:[],blocked:[]};for(let i of e){let c=await Iu(a,o,i,n?.journal);for(let l of c){if(l.verb!=="forget"||kc(l.phase)<kc("flip-applied"))continue;let u=[];for(let f of l.fliplessByNecessity??[]){let g={stackName:i,logicalId:f,opId:l.opId};if(r.get(i)?.has(f)===!0){s.verifiedAbsent.push(g);continue}if(Ae(t.abortSignal)){s.blocked.push({...g,reason:"absence re-verification aborted before it could run"});continue}if(await t.synthDeclaresTarget(i,f)===!0)continue;let v=l.targets.find(b=>b.logicalId===f);if(v===void 0||Ay(v,i)){s.blocked.push({...g,reason:"no probeable physical id on the covering operation"});continue}u.push({entry:g,target:v})}if(u.length===0)continue;let d=u.map(({entry:f,target:g})=>({stackName:i,logicalId:f.logicalId,resourceType:g.resourceType,physicalId:g.physicalId,failedStatus:"BY_NECESSITY_CONVERGE_CHECK",statusReason:"Absence re-verification before the converge deploy"})),p=await new Tu(t.aws,n?.probe).probeSuspects({stackName:i,suspects:d,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!p.success){for(let{entry:f}of u)s.blocked.push({...f,reason:`absence probe failed: ${p.error.message}`});continue}let m=new Map(p.data.map(f=>[f.logicalId,f]));for(let{entry:f}of u){let g=m.get(f.logicalId);if(g===void 0){s.blocked.push({...f,reason:"absence probe returned no verdict for this target"});continue}if(g.verdict==="confirmed-deleted"||g.verdict==="present"&&g.probeMethod===dae){s.verifiedAbsent.push(f);continue}s.blocked.push({...f,reason:`${g.verdict}: ${g.verdictDetail}`})}}}return s}async function NP(t,e,r){let n=t.getAccountId(),a=t.getRegion(),o=[...e.stackNames];if(e.appName!==void 0){let s=new Set(o),i=await JG(n,a,r?.journal);for(let c of i)c.verb==="recreate"&&c.appName===e.appName&&!s.has(c.stackName)&&(s.add(c.stackName),o.push(c.stackName))}for(let s of o){let i=await Iu(n,a,s,r?.journal);for(let c of i){let l=await aM(t,{journal:c,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}},r);if(!l.success){let u=c.verb==="recreate"?`re-run 'fjall deploy${c.appName!==void 0?` ${c.appName}`:""}' to complete it`:`run 'fjall drift resume ${c.opId}' to complete it`;e.onLog?.(`Could not verify ${c.verb} operation ${c.opId} on ${s} after the deploy: ${S(l.error.message)} \u2014 ${u}`,"warn");continue}if(l.data.status==="done"&&c.verb==="recreate"){let u=l.data.journal,d=u.recreatedResources??[],p=new Set(d),m=new Set(u.orphanedResources??[]),f=new Set(u.unverifiedRemovals??[]),g=u.targets.map(x=>x.logicalId).filter(x=>!p.has(x)),v=g.filter(x=>!m.has(x)&&!f.has(x)),b=[];d.length>0&&b.push(`${d.join(", ")} verified live under the pinned names`),v.length>0&&b.push(`${v.join(", ")} removed instead of re-created (no longer declared)`),e.onLog?.(`Recreate operation ${c.opId} completed${b.length>0?` \u2014 ${b.join("; ")}`:""}`,"info");let A=g.filter(x=>m.has(x));if(A.length>0){let x=A.map(k=>{let I=u.targets.find(R=>R.logicalId===k)?.physicalId;return I!==void 0?`${k} [${I}]`:k}).join(", ");e.onLog?.(`Recreate operation ${c.opId}: ${x} left CloudFormation but the physical resource still exists outside CloudFormation \u2014 the consented deletion did not execute. Delete it via the owning service if it is no longer wanted.`,"warn")}let C=g.filter(x=>f.has(x));C.length>0&&e.onLog?.(`Recreate operation ${c.opId}: ${C.join(", ")} left CloudFormation but the physical deletion could not be verified \u2014 check the owning service before treating it as deleted.`,"warn")}else if(l.data.status==="done"){let u=l.data.journal.retainedByRedeclaration??[],d=new Set(u),p=l.data.journal.targets.map(f=>f.logicalId).filter(f=>!d.has(f)),m=p.length>0?`${s} no longer tracks ${p.join(", ")}${u.length>0?` (${u.join(", ")} retained by re-declaration)`:""}`:`${s} retained ${u.join(", ")} by re-declaration`;e.onLog?.(`Forget operation ${c.opId} completed \u2014 ${m}`,"info")}}}}var eIr,ml,Dae,fC=w(()=>{"use strict";Ce();$();Ct();vt();ww();$G();B1();Sae();qG();XG();VG();eIr=Object.defineProperty,ml=(t,e)=>eIr(t,"name",{value:e,configurable:!0}),Dae="ForgetResource";ml(Bd,"fetchLiveStackState");ml(Ud,"formatRecreateInFlightCures");ml(QG,"assessForgetResumability");ml(NNe,"guardForeignMarkers");ml(Rae,"resolveConvergedTargets");ml(_Ne,"probeClosureCandidates");ml(DP,"runForgetSurgery");ml(aM,"completeForgetAfterConverge");ml(OEt,"probeAbsentClosureTargets");ml($Ne,"finaliseForgetJournal");ml(NEt,"clearForgottenDriftSuspects");ml(OP,"synthTemplateDeclaresResource");ml(eW,"partitionPreFlightByRemediation");ml(MNe,"verifyByNecessityBeforeConverge");ml(NP,"completeForgetAfterDeploy")});function _Et(t){let e=t.map(r=>`  - ${r.stackName} \u203A ${r.logicalId} (operation ${r.opId}): ${r.reason}`);return[`Deploy halted: ${t.length} resource(s) from a forget remediation cannot be safely removed by this deploy.`,...e,"Each was verified deleted when the forget was consented, but carries no Retain policy (the policy change was structurally impossible \u2014 flipless by necessity), so this deploy's removal would issue a real physical delete. fjall therefore re-verifies absence against the owning service at every converge, and could not confirm it here. If the resource was recreated deliberately, keep it by re-declaring it in the fjall configuration (CloudFormation keeps tracking it). If it should still be removed, delete it against the owning service first, then re-run the deploy. Nothing was mutated."].join(`
 `)}async function Xb(t,e){let r=await SP({aws:t,probe:new Tu(t)},{stackNames:e.stackNames,cfnService:e.cfnService,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}).catch(l=>(z.debug("DriftPreFlightGate","Pre-flight probe threw \u2014 failing open",{error:S(T(l))}),null)),{confirmed:n,unconfirmed:a}=r!==null&&r.success?r.data:{confirmed:[],unconfirmed:[]},o={aws:t,synthDeclaresTarget:Oae((l,u)=>OP(e.cdkOutPath,l,u),"synthDeclaresTarget"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}};if(n.length>0){let l=await eW(o,n,e.remediationOptions);for(let{finding:u,opId:d}of l.converging)e.callbacks.onLog?.(`Forget remediation ${d} is mid-surgery for ${u.stackName} \u203A ${u.logicalId} \u2014 this deploy is the converge deploy and will complete it`,"warn");for(let{finding:u,opId:d,appName:p}of l.recreateConverging)e.callbacks.onLog?.(`Recreate remediation ${d} covers ${u.stackName} \u203A ${u.logicalId} \u2014 the physical resource was deleted outside CloudFormation. This deploy re-runs the surgery only if the plan still requires the pinned-name replacement (re-consent when prompted). If the deploy completes without re-creating it, the operation stays open \u2014 ${Ud(p)}`,"warn");if(l.blocked.length>0)return{kind:"blocked",message:LG(l.blocked,l.inProgressOpIds,{flipNotLive:l.flipNotLive,flipUnverified:l.flipUnverified,stillDeclared:l.stillDeclared})}}for(let l of a)e.callbacks.onLog?.(`Possible out-of-band deletion (unconfirmed): ${l.stackName} \u203A ${l.logicalId} \u2014 ${l.verdictDetail}`,"warn");let s=new Map;for(let l of n){let u=s.get(l.stackName)??new Set;u.add(l.logicalId),s.set(l.stackName,u)}let i=await MNe(o,e.stackNames,s,e.remediationOptions);if(i.blocked.length>0)return{kind:"blocked",message:_Et(i.blocked)};let c=await bP(t,{stackNames:e.stackNames,cdkOutPath:e.cdkOutPath,cfnService:e.cfnService,onLog:Oae((l,u)=>e.callbacks.onLog?.(l,u),"onLog"),...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});return c.kind==="blocked"?{kind:"blocked",message:c.message}:{kind:"proceed",...i.verifiedAbsent.length>0?{verifiedAbsentByNecessity:i.verifiedAbsent}:{}}}var sIr,Oae,tW=w(()=>{"use strict";$();Ct();$G();hae();ENe();fC();sIr=Object.defineProperty,Oae=(t,e)=>sIr(t,"name",{value:e,configurable:!0});Oae(_Et,"formatByNecessityBlock");Oae(Xb,"runDriftPreFlightGate")});import{join as $Et}from"path";import{BackupClient as cIr}from"@aws-sdk/client-backup";function Ru(t){let e=t.find(n=>dr(n)==="platform"),r=t.filter(n=>dr(n)==="account");return{platformAccount:e,memberAccounts:r}}function mf(t){let e=t?.primaryRegion??ft,r=t?.secondaryRegions??[],n=new Set([e,...r]),a=t?.disasterRecoveryRegion;return a&&n.add(a),[...n]}function Jp(t){return mf(t)[0]??ft}function hC(t,e){return`${t} (${e})`}function dv(t,e){let r=[];for(let n of e)for(let a of t)r.push({account:a,region:n});return r}async function LNe(t,e,r,n){r.onLog?.(`Verifying cascade role access for ${e.length} account(s)\u2026`,"info");let a=await dh(e,rW,async s=>Ib(t.awsProvider,s.id,s.region??t.awsProvider.getRegion(),`fjall-preflight-${s.name}`,n)),o=[];return a.forEach((s,i)=>{let c=e[i];if(c){if(s.status==="rejected"){o.push({accountId:c.id,accountName:c.name,error:s.reason instanceof Error?s.reason.message:String(s.reason)});return}s.value.success||o.push({accountId:c.id,accountName:c.name,error:s.value.error.message})}}),o.length===0&&r.onLog?.(`Cascade role access verified for ${e.length} account(s)`,"info"),o}async function Nae(t,e,r,n,a,o,s){let i=s?.region??n.region??e.awsProvider.getRegion(),c=hC(n.name,i),l=s?.orgConfig??t.orgConfig,u=s?.ipamPoolId;o.onCascadeAccountStart?.(c,n.id,i,a);let d=await Ib(e.awsProvider,n.id,i,`fjall-cascade-${n.name}`,t.abortSignal);if(!d.success)return o.onCascadeAccountComplete?.(c,!1,S(d.error.message),i),y(new Error(`Failed to assume role for ${n.name}: ${S(d.error.message)}`));let{provider:p,credentials:m}=d.data,f=$Et(t.workingDirectory,"fjall",a==="platform"?Lt.PLATFORM:Lt.ACCOUNT),g=$Et(f,`cdk.out.${n.id}.${hb(i)}`),v=Oc.buildDeploymentContext({deployType:a,target:r.target,path:f,assemblyDir:g,environment:n.environment??void 0,region:i,accountName:n.name,callerIdentity:sl(n.id),ipamPoolId:u,...jp({orgConfig:l,identity:t.identity,skipOidc:t.options?.skipOidc,region:i,primaryRegion:s?.primaryRegion,trailLifecycle:n.trailLifecycle})},{verbose:t.options?.verbose},l);if(Rk(n.environment,l?.disasterRecoveryRegion)){let U=await _V(p.getClient(cIr),t.abortSignal);if(!U.success)return o.onCascadeAccountComplete?.(c,!1,S(U.error.message),i),y(new Error(`Backup vault probe failed for ${n.name}: ${S(U.error.message)}`));v.fjallAdoptBackupVault=U.data}o.onCascadeAccountPhaseChange?.(c,"synth",i);let b=await e.cdkService.runCdkSynth(v,Yi(o),m);if(!b.success)return o.onCascadeAccountComplete?.(c,!1,S(`Synth failed: ${b.error}`),i),y(new Error(`Synth failed for ${n.name}: ${S(b.error)}`));let A=nn(a==="platform"?Lt.PLATFORM:Lt.ACCOUNT),C=gPe(f,n.id,i),x=new rf(p),{changed:k,currentHash:I}=await e.hashService.compareCascadeStack(g,A,C);if(!k&&t.options?.force!==!0&&await x.stackExists(A,void 0,t.abortSignal)){let U=await x.getStackOutputs(A,void 0,t.abortSignal);U.success||z.debug("cascadeHelpers","Failed to read outputs for skipped cascade account (non-critical)",{stackName:A,account:n.name});let G=i$(U);return await s$(v,p,o,t.abortSignal),o.onLog?.(`${n.name}: no infrastructure changes \u2014 skipping deploy`,"info"),o.onCascadeAccountComplete?.(c,!0,void 0,i,G,!0),E({outputs:G,skipped:!0})}let R=await Xb(p,{stackNames:[A],cdkOutPath:g,cfnService:x,callbacks:o,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(R.kind==="blocked")return o.onCascadeAccountComplete?.(c,!1,R.message,i),y(new Error(R.message));let N=await vo(t.assertLeaseForStack,A,t.abortSignal);if(N!==void 0)return o.onCascadeAccountComplete?.(c,!1,N.message,i),y(N);o.onCascadeAccountPhaseChange?.(c,"bootstrap",i);let _=await e.cdkService.runCdkBootstrap(v,Yi(o),m,void 0,Rb({account:n,estate:bu(l?.providerAccounts)?"org":"solo",...s?.orgId!==void 0?{orgId:s.orgId}:{}}));if(!_.success)return o.onCascadeAccountComplete?.(c,!1,S(`Bootstrap failed: ${_.error}`),i),y(new Error(`Bootstrap failed for ${n.name}: ${S(_.error)}`));o.onCascadeAccountPhaseChange?.(c,"deploy",i);let M=await e.cdkService.runCdkDeploy(v,A,Yi(o),U=>o.onCascadeAccountResourceProgress?.(c,U,i),p,m);if(!M.success)return o.onCascadeAccountComplete?.(c,!1,S(M.error),i),y(new Error(S(M.error)));let B=await x.getStackOutputs(A,void 0,t.abortSignal);B.success||z.debug("cascadeHelpers","Failed to read cascade account stack outputs (non-critical)",{stackName:A,account:n.name});let j=i$(B);return await s$(v,p,o,t.abortSignal),I!==void 0&&((await e.hashService.persistCascadeStack(C,A,I)).success||z.debug("cascadeHelpers","Failed to persist cascade hash state (non-critical)",{stackName:A,account:n.name})),o.onCascadeAccountComplete?.(c,!0,void 0,i,j,!1),E({outputs:j,skipped:!1})}async function FNe(t,e,r,n){let a=new Map,o=t.awsProvider.getRegion(),s=await Ib(t.awsProvider,e.id,o,`fjall-ipam-read-${e.name}`,n);if(!s.success)return z.debug("organisationDeploy",`Cannot read Platform outputs: ${s.error.message}`),a;let i=new rf(s.data.provider),c=nn(Lt.PLATFORM),l=await i.getStackOutputs(c);if(!l.success)return z.debug("organisationDeploy",`Failed to read Platform stack outputs: ${l.error.message}`),a;let u=/^IpamPoolId(\d{12})(\w+)$/;for(let d of l.data){let p=d.OutputKey?.match(u);if(p&&d.OutputValue){let m=`${p[1]}-${p[2]}`;a.set(m,d.OutputValue)}}return a.size>0&&r.onLog?.(`Read ${a.size} IPAM pool ID(s) from Platform stack`,"info"),a}function MEt(t,e){let r=t.account!==void 0&&e?.executingAccountId!==void 0&&t.account!==e.executingAccountId,n=t.region!==void 0&&e?.executingRegion!==void 0&&t.region!==e.executingRegion;if(r)return`[${t.name}] skipped: its fjall-config.json entry records account ${t.account} as its home, but this cascade runs in account ${e?.executingAccountId} - deploy it separately with 'fjall domain deploy ${t.name} -t <target in account ${t.account}>' or run the cascade under that account.`;if(n)return`[${t.name}] skipped: its fjall-config.json entry records region ${t.region} as its home, but this cascade runs in region ${e?.executingRegion} - deploy it separately with 'fjall domain deploy ${t.name} --region ${t.region}', or update the entry's "region" key if this move is intentional.`}function LEt(t){let e=new Map;for(let o of t)e.set($r(o.name),o);let r=new Map,n=pf((o,s)=>{let i=r.get(o);if(i!==void 0)return i;if(s.includes(o))return[...s.slice(s.indexOf(o)),o];let c=e.get(o);if(c===void 0)return-1;let l=c.parentDomain!==void 0?$r(c.parentDomain):void 0,u=l===void 0?-1:n(l,[...s,o]);if(Array.isArray(u))return u;let d=u+1;return r.set(o,d),d},"resolveDepth"),a=[];for(let o of t){let s=n($r(o.name),[]);if(Array.isArray(s)){let i=s.map(c=>e.get(c)?.name??c).join(" -> ");return y(new Error(`Delegated domain ordering: fjall-config.json declares a parentDomain cycle (${i}) - no deploy order satisfies it. Nothing was deployed. Cure: correct the "parentDomain" of one entry in that cycle so parents form a chain, then re-run.`))}(a[s]??=[]).push(o)}return E(a.filter(o=>o.length>0))}async function jNe(t,e,r){let n=t.getDomains();if(n.length===0)return{domainsDeployed:0,domainsSkipped:0,errors:[]};e.onCascadePhaseStart?.("domains");let a=[],o=0;for(let p of n){let m=MEt(p,r);if(m!==void 0){o++,e.onProgress?.({type:"warning",message:m});continue}a.push(p)}let s=a.filter(p=>p.type==="apex"),i=a.filter(p=>p.type==="delegated"),c=0,l=[],u=LEt(i);if(!u.success)return l.push(u.error.message),e.onCascadePhaseComplete?.("domains"),{domainsDeployed:c,domainsSkipped:o,errors:l};let d=u.data;for(let p of s){let m=await t.deployDomain(p.name,e);m.success?c++:l.push(`${p.name}: ${m.error.message}`)}for(let p of d){let m=await Promise.allSettled(p.map(f=>{let g=t.delegatedDeployer?.(f.name);return g!==void 0?Zk({deployer:g,callbacks:e,...r?.abortSignal!==void 0?{abortSignal:r.abortSignal}:{},...r?.skipCaaPreflight!==void 0?{skipCaaPreflight:r.skipCaaPreflight}:{}}):t.deployDomain(f.name,e)}));for(let f=0;f<m.length;f++){let g=m[f],v=p[f];if(!(!g||!v))if(g.status==="fulfilled")g.value.success?c++:l.push(`${v.name}: ${g.value.error.message}`);else{let b=g.reason instanceof Error?g.reason.message:String(g.reason);l.push(`${v.name}: ${b}`)}}}return e.onCascadePhaseComplete?.("domains"),{domainsDeployed:c,domainsSkipped:o,errors:l}}var iIr,pf,rW,gC=w(()=>{"use strict";Ce();Ct();$();Oo();Uw();sb();ez();Lw();A1();_d();jy();VIe();lae();tW();$();fz();Nw();bte();_d();iIr=Object.defineProperty,pf=(t,e)=>iIr(t,"name",{value:e,configurable:!0}),rW=4;pf(Ru,"partitionAccounts");pf(mf,"buildRegionList");pf(Jp,"cascadeHomeRegion");pf(hC,"cascadeOperationKey");pf(dv,"buildAccountRegionPairs");pf(LNe,"probeCascadeRoles");pf(Nae,"deployCascadeAccount");pf(FNe,"readPlatformIpamPoolIds");pf(MEt,"foreignDomainSkipReason");pf(LEt,"planDelegatedDomainWaves");pf(jNe,"deployDomains")});async function _P(t,e,r,n){t.onStepStart?.(e.stepId,e.stepName,e.stepIndex,e.totalSteps);let a;try{a=await r()}catch(o){let s=o instanceof Error?o:new Error(String(o));return BNe(t,e,s,n)}return a.kind==="error"?BNe(t,e,a.error,n):(t.onStepComplete?.(e.stepId,e.stepName,a.kind,e.stepIndex,e.totalSteps),E(a.data))}function BNe(t,e,r,n){let a=Ae(n);return t.onStepComplete?.(e.stepId,e.stepName,a?"cancelled":"error",e.stepIndex,e.totalSteps),a||t.onError?.(r),y(r)}var lIr,FEt,_ae=w(()=>{"use strict";Ce();vt();lIr=Object.defineProperty,FEt=(t,e)=>lIr(t,"name",{value:e,configurable:!0});FEt(_P,"withStepLifecycle");FEt(BNe,"emitFailure")});var Xp,$P,oM,UNe,VNe,pv=w(()=>{"use strict";Xp="DockerCli",$P="DockerCli.buildx",oM="0.13.0",UNe="fjall",VNe="docker"});function jEt(t){return pIr.has(t)}var uIr,dIr,zNe,pIr,GNe,mIr,fIr,WNe=w(()=>{"use strict";Ft();uIr=Object.defineProperty,dIr=(t,e)=>uIr(t,"name",{value:e,configurable:!0}),zNe=h.enum(["buildx_unavailable","daemon_unreachable","build_failed","push_failed","pull_failed","tag_failed","inspect_failed","auth_failed","abort","timeout","validation","metadata_missing","metadata_malformed","metadata_missing_digest"]),pIr=new Set(zNe.options);dIr(jEt,"isDockerCliErrorKind");GNe=h.object({contextPath:h.string().min(1),dockerfilePath:h.string().min(1),target:h.string().min(1).optional(),platforms:h.array(h.string().min(1)).min(1),tags:h.array(h.string().min(1)),buildArgs:h.record(h.string(),h.string()),cacheFrom:h.array(h.string().min(1)).optional(),cacheTo:h.array(h.string().min(1)).optional(),secrets:h.array(h.object({id:h.string().min(1),source:h.discriminatedUnion("kind",[h.object({kind:h.literal("file"),path:h.string().min(1)}).strict(),h.object({kind:h.literal("env"),name:h.string().min(1)}).strict()])}).strict()).optional(),provenance:h.boolean(),sbom:h.boolean(),push:h.boolean(),load:h.boolean(),pushByDigest:h.boolean().optional(),imageName:h.string().min(1).optional(),builder:h.string().min(1,"Builder name cannot be empty").optional(),metadataFile:h.string().min(1)}).strict().refine(t=>!(t.platforms.length>1&&t.load),{message:"Multi-arch builds cannot use load:true (Docker limitation); use push:true or omit both for cache-only"}).refine(t=>!(t.push&&t.load),{message:"push and load are mutually exclusive"}).refine(t=>t.pushByDigest!==!0||t.imageName!==void 0,{message:"pushByDigest requires imageName (the registry repo to push to)"}).refine(t=>t.pushByDigest===!0||t.tags.length>=1,{message:"tags must be non-empty unless pushByDigest is set"}),mIr=h.object({digest:h.string(),imageDigests:h.record(h.string(),h.string()),metadata:h.record(h.string(),h.unknown()),platforms:h.array(h.string()),cacheHits:h.number().int().nonnegative(),cacheMisses:h.number().int().nonnegative()}).strict(),fIr=h.object({kind:zNe,message:h.string(),stderrTail:h.array(h.string()).optional(),details:h.unknown().optional()}).strict()});function $ae(t){let e=["buildx","build"];e.push("--builder",t.builder??UNe),e.push("--progress=rawjson"),e.push("--metadata-file",t.metadataFile),e.push("--platform",t.platforms.join(","));for(let r of t.tags)e.push("-t",r);e.push("-f",t.dockerfilePath),t.pushByDigest===!0&&t.imageName!==void 0&&e.push("--output",`type=image,name=${t.imageName},push-by-digest=true,push=true`);for(let[r,n]of Object.entries(t.buildArgs))e.push("--build-arg",`${r}=${n}`);if(t.target!==void 0&&e.push("--target",t.target),t.cacheFrom!==void 0)for(let r of t.cacheFrom)e.push("--cache-from",r);if(t.cacheTo!==void 0)for(let r of t.cacheTo)e.push("--cache-to",r);if(t.secrets!==void 0)for(let r of t.secrets){let n=r.source.kind==="file"?`src=${r.source.path}`:`env=${r.source.name}`;e.push("--secret",`id=${r.id},${n}`)}return e.push(`--provenance=${t.provenance?"true":"false"}`),e.push(`--sbom=${t.sbom?"true":"false"}`),t.pushByDigest!==!0&&(t.push&&e.push("--push"),t.load&&e.push("--load")),e.push(t.contextPath),e}var hIr,gIr,HNe=w(()=>{"use strict";pv();hIr=Object.defineProperty,gIr=(t,e)=>hIr(t,"name",{value:e,configurable:!0});gIr($ae,"buildxArgvBuilder")});function Mae(t){return SIr[t]}var yIr,vIr,SIr,Qb,BEt=w(()=>{"use strict";yIr=Object.defineProperty,vIr=(t,e)=>yIr(t,"name",{value:e,configurable:!0}),SIr={arm64:"linux/arm64",x86_64:"linux/amd64"};vIr(Mae,"dockerPlatformForArchitecture");Qb="arm64"});function qNe(t,e,r){let n=t[e];if(n===void 0)return Ln(r);if(!/^\d+$/.test(n)||parseInt(n,10)<=0)return yt(new Error(`${e} must be a positive integer number of milliseconds (got ${JSON.stringify(n)}) \u2014 fix or unset it (default ${r} ms)`));let a=parseInt(n,10);return a>UEt?yt(new Error(`${e} must be at most ${UEt} ms (got ${a})`)):Ln(a)}function Lae(t){let e=qNe(t,KNe,18e5);if(!e.success)return e;let r=qNe(t,YNe,3e5);return r.success?Ln({compilePhaseTimeoutMs:e.data,publishStallTimeoutMs:r.data}):r}function GEt(t){let e=t.toLowerCase();return e.startsWith("exporting")||e.startsWith("pushing")}function WEt(t){let e=t.toLowerCase();return e.startsWith("pushing")||e.startsWith("writing layer")}function MP(t){let e=["B","kB","MB","GB","TB"],r=t,n=0;for(;r>=1e3&&n<e.length-1;)r/=1e3,n+=1;return`${r.toFixed(r<10&&n>0?1:0)} ${e[n]}`}function ZNe(t){let e=t/6e4;return`${Number.isInteger(e)?e:e.toFixed(1)} minute${e===1?"":"s"}`}function Fae(t){return`docker buildx build exceeded the ${ZNe(t.compilePhaseTimeoutMs)} build budget before the image finished compiling \u2014 nothing was pushed. If this build legitimately needs longer, set ${KNe} to a higher millisecond value.`}function jae(t,e){let r=e!==void 0?`Progress before the stall: ${e}.`:"No upload progress was observed.";return`docker buildx push stalled \u2014 no upload progress for ${ZNe(t.publishStallTimeoutMs)} while pushing the image and exporting the build cache. ${r} The image compiled successfully, so retrying is cheap: layers already pushed are deduplicated by the registry and the build cache is warm. If your connection is slow with long quiet spells, set ${YNe} to a higher millisecond value.`}var bIr,eE,KNe,YNe,UEt,EIr,nW,JNe=w(()=>{"use strict";pv();ob();bIr=Object.defineProperty,eE=(t,e)=>bIr(t,"name",{value:e,configurable:!0}),KNe="FJALL_BUILD_TIMEOUT_MS",YNe="FJALL_PUSH_STALL_TIMEOUT_MS",UEt=2147483647,EIr=2e3;eE(qNe,"parseMsOverride");eE(Lae,"resolveBuildxBudgets");eE(GEt,"isPublishVertexName");eE(WEt,"isTransferStatusName");eE(MP,"formatByteSize");nW=class{static{eE(this,"BuildxBuildMonitor")}budgets;controller=new AbortController;now;compileTimer;stallTimer;lastActivityAt;lastEmitAt;lastEmitMessage;pendingPhaseFlipMessage;publishStartedFlag=!1;disposed=!1;timedOutPhaseValue;statusMemos=new Map;vertexStamps=new Map;transfers=new Map;constructor(e,r){this.budgets=e,this.now=r?.now??Date.now,this.lastActivityAt=this.now(),this.compileTimer=setTimeout(()=>{this.trip("build")},e.compilePhaseTimeoutMs)}get signal(){return this.controller.signal}get timedOutPhase(){return this.timedOutPhaseValue}get publishStarted(){return this.publishStartedFlag}observe(e){if(this.disposed)return;let r=!1,n=!1;for(let a of e.vertexes){let o=`${a.started??""}|${a.completed??""}|${a.error??""}`;this.vertexStamps.get(a.digest)!==o&&(this.vertexStamps.set(a.digest,o),r=!0),a.started!==void 0&&GEt(a.name)&&(n=!0)}for(let a of e.statuses){let o=`${a.vertex}|${a.id}`,s=this.statusMemos.get(o),i={current:a.current,total:a.total,completed:a.completed!==void 0};(s===void 0||s.current!==i.current||s.total!==i.total||s.completed!==i.completed)&&(this.statusMemos.set(o,i),r=!0),WEt(a.name)&&(n=!0,this.transfers.set(o,i))}return(e.logs.length>0||e.warnings.length>0)&&(r=!0),n&&!this.publishStartedFlag&&this.beginPublishPhase(),r&&(this.lastActivityAt=this.now()),this.maybeSyntheticProgress()}progressSummary(){if(this.transfers.size===0)return;let e=this.aggregateTransfers(),r=`${e.completedTransfers}/${e.knownTransfers} layers complete`;if(e.totalBytes>0){let n=Math.min(100,Math.round(e.currentBytes/e.totalBytes*100));return`${MP(e.currentBytes)} of ${MP(e.totalBytes)} pushed (${n}%), ${r}`}return`${MP(e.currentBytes)} pushed, ${r}`}dispose(){this.disposed=!0,this.compileTimer!==void 0&&(clearTimeout(this.compileTimer),this.compileTimer=void 0),this.clearStallTimer()}aggregateTransfers(){let e=0,r=0,n=0;for(let a of this.transfers.values())a.total!==void 0&&a.total>0?(r+=a.total,e+=Math.min(a.current,a.total)):e+=a.current,a.completed&&(n+=1);return{currentBytes:e,totalBytes:r,completedTransfers:n,knownTransfers:this.transfers.size}}maybeSyntheticProgress(){if(this.pendingPhaseFlipMessage!==void 0){let s=this.pendingPhaseFlipMessage;return this.pendingPhaseFlipMessage=void 0,this.lastEmitAt=this.now(),{message:s}}if(!this.publishStartedFlag||this.transfers.size===0)return;let e=this.now();if(this.lastEmitAt!==void 0&&e-this.lastEmitAt<EIr)return;let r=this.aggregateTransfers(),n=`${r.completedTransfers}/${r.knownTransfers} layers`,a,o;if(r.totalBytes>0?(o=Math.min(100,Math.round(r.currentBytes/r.totalBytes*100)),a=`Pushing to registry: ${MP(r.currentBytes)} of ${MP(r.totalBytes)} \u2014 ${n}`):a=`Pushing to registry: ${MP(r.currentBytes)} transferred \u2014 ${n}`,a!==this.lastEmitMessage)return this.lastEmitAt=e,this.lastEmitMessage=a,{message:a,...o!==void 0&&{percentage:o}}}beginPublishPhase(){this.publishStartedFlag=!0,this.compileTimer!==void 0&&(clearTimeout(this.compileTimer),this.compileTimer=void 0),this.lastActivityAt=this.now(),this.armStallTimer(this.budgets.publishStallTimeoutMs),this.pendingPhaseFlipMessage="Image build complete \u2014 pushing image and exporting build cache to the registry\u2026"}armStallTimer(e){this.clearStallTimer(),this.stallTimer=setTimeout(()=>{this.stallTimer=void 0;let r=this.now()-this.lastActivityAt;r>=this.budgets.publishStallTimeoutMs?this.trip("publish"):this.armStallTimer(this.budgets.publishStallTimeoutMs-r)},e)}clearStallTimer(){this.stallTimer!==void 0&&(clearTimeout(this.stallTimer),this.stallTimer=void 0)}trip(e){this.timedOutPhaseValue===void 0&&(this.timedOutPhaseValue=e,this.dispose(),this.controller.abort())}};eE(ZNe,"formatMinutes");eE(Fae,"buildPhaseTimeoutMessage");eE(jae,"publishStallTimeoutMessage")});function yC(t){return Bae.some(e=>t.startsWith(e))}function qEt(t){let e=t.explicitBuildArgs??{},r=new Set([...Object.keys(t.declaredEnv??{}),...t.dotenvKeys??[]]),n=[];for(let a of r)yC(a)&&(Object.prototype.hasOwnProperty.call(e,a)||n.push(a));return n}var AIr,HEt,Bae,XNe=w(()=>{"use strict";AIr=Object.defineProperty,HEt=(t,e)=>AIr(t,"name",{value:e,configurable:!0}),Bae=["VITE_","NEXT_PUBLIC_","PUBLIC_"];HEt(yC,"isPublicBuildVarName");HEt(qEt,"inferPublicBuildArgKeys")});function iM(){let t=new Set;return e=>t.has(e)?!1:(t.add(e),!0)}function cM(t,e){let r=[],n=[];if(t===void 0)return{findings:r,warnings:n};for(let[a,o]of Object.entries(t)){if(typeof o=="object"){if(o.acknowledgePublic===!0)continue;if(o.ssm!==void 0||o.secretsManager!==void 0){r.push({key:a,reason:"sourced-ref",message:`buildArg "${a}" (app "${e}") is sourced from a secret store (SSM/Secrets Manager) but baked via --build-arg \u2014 ${vC}. Move it to docker.buildSecrets (BuildKit --secret mount, never baked), or, if the value is genuinely public-but-sensitive and must ship in the client bundle, set acknowledgePublic: true to bake it deliberately.`});continue}yC(a)||n.push({key:a,message:QNe(a)});continue}if(S(o)!==o){r.push({key:a,reason:"credential-shape",message:e_e(a,e)});continue}yC(a)||n.push({key:a,message:QNe(a)})}return{findings:r,warnings:n}}function QNe(t){return`buildArg "${t}" does not start with a public prefix (${Bae.join(", ")}) and is frozen into the image at build time \u2014 ${vC}. If this value should vary per deploy, use a runtime env var (ECS task environment) instead of baking it.`}function e_e(t,e){return`buildArg "${t}" (app "${e}") has a value that looks like a credential but would be baked via --build-arg \u2014 ${vC}. Move it to docker.buildSecrets (BuildKit --secret mount, never baked). If it is a genuinely public-but-sensitive value, use the object form { ssm/secretsManager/env, acknowledgePublic: true } to bake it deliberately.`}function lM(t){let e=new Set;if(t===void 0)return e;for(let[r,n]of Object.entries(t))typeof n=="object"&&n.acknowledgePublic===!0&&e.add(r);return e}function uM(t,e,r){let n=[];for(let[a,o]of Object.entries(t))r.has(a)||S(o)!==o&&n.push({key:a,reason:"credential-shape",message:e_e(a,e)});return n}var wIr,sM,vC,KEt=w(()=>{"use strict";yp();XNe();wIr=Object.defineProperty,sM=(t,e)=>wIr(t,"name",{value:e,configurable:!0}),vC="baked values are world-readable in `docker history`, image provenance/SBOM, and the `<app>-cache` mode=max ECR cache repo";sM(iM,"createBakeWarningDeduper");sM(cM,"evaluateBakeGuard");sM(QNe,"nonPrefixedWarning");sM(e_e,"credentialShapeMessage");sM(lM,"acknowledgedBuildArgKeys");sM(uM,"evaluateResolvedBuildArgValues")});function Uae(t){let e=t.trim();if(e==="")return null;let r;try{r=JSON.parse(e)}catch{return null}if(r===null||typeof r!="object"||Array.isArray(r))return null;let n=r,a={};for(let[o,s]of Object.entries(n))TIr.has(o)||(a[o]=s);return{...Array.isArray(n.vertexes)&&{vertexes:n.vertexes},...Array.isArray(n.statuses)&&{statuses:n.statuses},...Array.isArray(n.logs)&&{logs:n.logs},...Array.isArray(n.warnings)&&{warnings:n.warnings},extra:a}}var CIr,xIr,TIr,t_e=w(()=>{"use strict";CIr=Object.defineProperty,xIr=(t,e)=>CIr(t,"name",{value:e,configurable:!0}),TIr=new Set(["vertexes","statuses","logs","warnings"]);xIr(Uae,"parseRawjsonLine")});function YEt(t){return typeof t.digest!="string"||t.digest===""||typeof t.name!="string"||t.name===""?null:{digest:t.digest,name:t.name,...typeof t.started=="string"&&{started:t.started},...typeof t.completed=="string"&&{completed:t.completed},...typeof t.cached=="boolean"&&{cached:t.cached},...typeof t.error=="string"&&{error:t.error},...Array.isArray(t.inputs)&&{inputs:t.inputs}}}function ZEt(t){return typeof t.id!="string"||t.id===""||typeof t.vertex!="string"||t.vertex===""||typeof t.name!="string"||typeof t.current!="number"?null:{id:t.id,vertex:t.vertex,name:t.name,current:t.current,...typeof t.total=="number"&&{total:t.total},...typeof t.started=="string"&&{started:t.started},...typeof t.completed=="string"&&{completed:t.completed}}}function JEt(t){if(typeof t.vertex!="string"||t.vertex===""||typeof t.data!="string")return null;let e=t.stream===2?"stderr":"stdout";return{vertex:t.vertex,stream:e,data:t.data,...typeof t.timestamp=="string"&&{timestamp:t.timestamp}}}function XEt(t){return typeof t.vertex!="string"||t.vertex===""||typeof t.short!="string"?null:{vertex:t.vertex,level:typeof t.level=="string"?t.level:"warning",short:t.short}}function Vae(t){let e=[];for(let o of t.vertexes??[]){let s=YEt(o);s!==null&&e.push(s)}let r=[];for(let o of t.statuses??[]){let s=ZEt(o);s!==null&&r.push(s)}let n=[];for(let o of t.logs??[]){let s=JEt(o);s!==null&&n.push(s)}let a=[];for(let o of t.warnings??[]){let s=XEt(o);s!==null&&a.push(s)}return e.length===0&&r.length===0&&n.length===0&&a.length===0?null:{vertexes:e,statuses:r,logs:n,warnings:a}}var kIr,aW,r_e=w(()=>{"use strict";kIr=Object.defineProperty,aW=(t,e)=>kIr(t,"name",{value:e,configurable:!0});aW(YEt,"normaliseVertex");aW(ZEt,"normaliseStatus");aW(JEt,"normaliseLog");aW(XEt,"normaliseWarning");aW(Vae,"rawjsonToVertexEvent")});import{spawnSync as RIr}from"node:child_process";function oW(t,e=process.platform){if(t.pid===void 0)return;if(t.stdout&&t.stdout.destroy(),t.stderr&&t.stderr.destroy(),e==="win32"){RIr("taskkill",["/T","/F","/PID",String(t.pid)],{shell:!1});return}t.kill("SIGTERM");let r=setTimeout(()=>{t.killed||t.kill("SIGKILL")},5e3);t.once("exit",()=>clearTimeout(r))}var PIr,IIr,n_e=w(()=>{"use strict";pv();PIr=Object.defineProperty,IIr=(t,e)=>PIr(t,"name",{value:e,configurable:!0});IIr(oW,"abortChildProcess")});import{rm as OIr}from"node:fs/promises";function a_e(t){return t instanceof Error?t.message:String(t)}async function o_e(t,e,r,n){let a=GNe.safeParse(e);if(!a.success){let m=S(a.error.message);return yt(ir("validation",`Invalid BuildxBuildArgs: ${m}`,{issues:a.error.issues}))}let o=Lae(t.env);if(!o.success)return yt(ir("validation",S(o.error.message)));let s=o.data,i=$ae(a.data),c=0,l=0,u=new Set,d,p;try{let m=new nW(s);d=m,p=a.data.metadataFile;let f=sW(k=>{let I=Uae(k);if(I===null){k.trim()!==""&&t.logger.debug($P,"Skipping malformed rawjson line",{line:S(k)});return}let R=Vae(I);if(R===null)return;let N=m.observe(R);N!==void 0&&r({type:"status",message:mv(N.message),...N.percentage!==void 0&&{percentage:N.percentage}});for(let _ of R.vertexes)_.completed!==void 0&&!u.has(_.digest)&&(u.add(_.digest),_.cached===!0?c++:l++),r({type:"vertex",message:mv(_.name),vertex:_.digest});for(let _ of R.logs)r({type:"log",message:mv(_.data),vertex:_.vertex});for(let _ of R.statuses)r({type:"status",message:mv(`${_.name} ${_.current}`),vertex:_.vertex});for(let _ of R.warnings)r({type:"warning",message:mv(_.short),vertex:_.vertex})},"onStdoutLine"),g=n!==void 0?AbortSignal.any([m.signal,n]):m.signal,v=await dM(t,{args:i,abortSignal:g},f);if(v.spawnError!==void 0)return yt(ir("daemon_unreachable",`Docker CLI is not available: ${v.spawnError}`,{stderrTail:v.stderrTail}));if(v.aborted||v.exitCode===null)return m.timedOutPhase==="build"?yt(ir("timeout",Fae(s),{stderrTail:v.stderrTail})):m.timedOutPhase==="publish"?yt(ir("timeout",jae(s,m.progressSummary()),{stderrTail:v.stderrTail})):yt(ir("abort","docker buildx build was aborted",{stderrTail:v.stderrTail}));if(v.exitCode!==0)return yt(ir("build_failed",`docker buildx build failed (exit ${v.exitCode})`,{stderrTail:v.stderrTail}));let b=await zae(a.data.metadataFile);if(!b.success)return b;let A=b.data,C=A["containerimage.digest"];if(typeof C!="string"||C==="")return yt(ir("metadata_missing_digest","Buildx metadata file does not contain containerimage.digest",{metadataFile:a.data.metadataFile}));let x={};for(let k of a.data.tags)x[k]=C;return Ln({digest:C,imageDigests:x,metadata:A,platforms:a.data.platforms,cacheHits:c,cacheMisses:l})}finally{d!==void 0&&d.dispose(),p!==void 0&&await OIr(p,{force:!0}).catch(m=>{t.logger.warn($P,"Failed to clean up buildx metadata file",{path:p,error:S(a_e(m))})})}}async function s_e(t,e,r,n){if(e.trim()==="")return yt(ir("validation","tagByDigest: sourceImage must be non-empty"));if(!r.startsWith("sha256:"))return yt(ir("validation",`tagByDigest: expected sha256:... digest, got ${r.slice(0,32)}`));if(n.length===0)return yt(ir("validation","tagByDigest: tags must be a non-empty list"));for(let c of n)if(typeof c!="string"||c.trim()==="")return yt(ir("validation","tagByDigest: every tag must be non-empty"));let a=`${e}@${r}`,o=[];for(let c of n)o.push("--tag",c);let s=["buildx","imagetools","create","--prefer-index=false",...o,a],i=await Vd(t,{args:s,timeoutMs:3e4});return i.spawnError!==void 0?yt(Du(i)):i.exitCode===null?yt(ir("abort",`docker buildx imagetools create for ${a} was aborted`,{stderrTail:i.stderrTail})):i.exitCode!==0?yt(ir("tag_failed",`docker buildx imagetools create for ${a} failed (exit ${i.exitCode})`,{stderrTail:i.stderrTail})):Ln(void 0)}async function i_e(t,e){let r=await Vd(t,{args:["buildx","imagetools","inspect",e,"--raw"],timeoutMs:3e4});if(r.spawnError!==void 0)return yt(ir("daemon_unreachable",`Docker CLI is not available: ${r.spawnError}`,{stderrTail:r.stderrTail}));if(r.exitCode===null)return yt(ir("abort",`docker buildx imagetools inspect ${e} was aborted`,{stderrTail:r.stderrTail}));if(r.exitCode!==0)return yt(ir("inspect_failed",`docker buildx imagetools inspect ${e} failed (exit ${r.exitCode})`,{stderrTail:r.stderrTail}));let n,a;try{let o=JSON.parse(r.stdout);typeof o.mediaType=="string"&&(n=o.mediaType),typeof o.digest=="string"&&(a=o.digest)}catch(o){t.logger.debug($P,"imagetools inspect output is not JSON; preserving raw",{error:S(a_e(o))})}return Ln({raw:r.stdout,...n!==void 0&&{mediaType:n},...a!==void 0&&{digest:a}})}var DIr,sW,eAt=w(()=>{"use strict";HNe();WNe();pv();JNe();c_e();t_e();r_e();yp();LP();DIr=Object.defineProperty,sW=(t,e)=>DIr(t,"name",{value:e,configurable:!0});sW(a_e,"getErrorMessage");sW(o_e,"_buildxBuild");sW(s_e,"_tagByDigest");sW(i_e,"_imagetoolsInspect")});function l_e(t){let e=t.startsWith("v")?t.slice(1):t,r=/^(\d+)\.(\d+)\.(\d+)/.exec(e);return r===null?null:[parseInt(r[1]??"0",10),parseInt(r[2]??"0",10),parseInt(r[3]??"0",10)]}function tAt(t,e){for(let r=0;r<3;r++){let n=t[r]??0,a=e[r]??0;if(n!==a)return n-a}return 0}function rAt(t){let e=/github\.com\/docker\/buildx\s+(v?\d+\.\d+\.\d+)/.exec(t);return e!==null&&e[1]!==void 0?e[1]:/(\d+\.\d+\.\d+)/.exec(t)?.[1]??null}async function d_e(t){let e=await Vd(t,{args:["buildx","version"],timeoutMs:3e4});if(e.spawnError!==void 0)return yt(Du(e));if(e.exitCode===null)return yt(ir("abort","docker buildx version was aborted",{stderrTail:e.stderrTail}));if(e.exitCode!==0){let o=await Vd(t,{args:["version","--format","{{.Server.Version}}"],timeoutMs:1e4});return o.spawnError!==void 0?yt(Du(o)):o.exitCode!==0?yt(ir("daemon_unreachable","Docker daemon is not running or not installed",{stderrTail:o.stderrTail})):yt(ir("buildx_unavailable",`Docker Buildx plugin is not installed (need >= ${oM})`,{stderrTail:e.stderrTail}))}let r=rAt(e.stdout);if(r===null)return yt(ir("buildx_unavailable","Could not parse docker buildx version output",{stdout:e.stdout}));let n=l_e(r),a=l_e(oM);return n===null||a===null?yt(ir("buildx_unavailable",`Could not parse buildx version "${r}"`,{stdout:e.stdout})):tAt(n,a)<0?yt(ir("buildx_unavailable",`Docker Buildx ${r} is below the required ${oM} floor`,{observed:r,floor:oM})):(t.logger.debug($P,"buildx available",{version:r}),Ln({version:r}))}async function p_e(t){let e=await Vd(t,{args:["version","--format","json"],timeoutMs:1e4});if(e.spawnError!==void 0)return yt(Du(e));if(e.exitCode===null)return yt(ir("abort","docker version was aborted",{stderrTail:e.stderrTail}));if(e.exitCode!==0)return yt(ir("daemon_unreachable","Docker daemon is not running or not installed",{stderrTail:e.stderrTail}));let r;try{r=JSON.parse(e.stdout)}catch(s){let i=S(s instanceof Error?s.message:String(s));return yt(ir("daemon_unreachable",`docker version output is not valid JSON: ${i}`,{stdout:e.stdout}))}if(r===null||typeof r!="object")return yt(ir("daemon_unreachable","docker version did not return a JSON object"));let n=r,a=n.Server?.Name??"Docker",o=n.Server?.Version??"unknown";return a==="Podman Engine"?yt(ir("buildx_unavailable","Podman is not supported; install Docker Engine 23+ with the buildx plugin")):Ln({serverName:a,serverVersion:o})}async function m_e(t,e){let r=await Vd(t,{args:["buildx","inspect",e],timeoutMs:3e4});if(r.spawnError!==void 0)return yt(Du(r));if(r.exitCode===0){if(/Driver:\s*docker-container/.test(r.stdout))return Ln({created:!1});t.logger.warn(Xp,"Replacing buildx builder with wrong driver",{name:e});let a=await Vd(t,{args:["buildx","rm",e],timeoutMs:3e4});if(a.spawnError!==void 0)return yt(Du(a));if(a.exitCode!==0)return yt(ir("buildx_unavailable",`Failed to remove existing buildx builder ${e}`,{stderrTail:a.stderrTail}))}let n=await Vd(t,{args:["buildx","create","--name",e,"--driver","docker-container","--use"],timeoutMs:3e4});return n.spawnError!==void 0?yt(Du(n)):n.exitCode!==0?yt(ir("buildx_unavailable",`Failed to create buildx builder ${e}`,{stderrTail:n.stderrTail})):Ln({created:!0})}var NIr,pM,nAt=w(()=>{"use strict";yp();pv();LP();NIr=Object.defineProperty,pM=(t,e)=>NIr(t,"name",{value:e,configurable:!0});pM(l_e,"parseSemver");pM(tAt,"compareSemver");pM(rAt,"extractBuildxVersion");pM(d_e,"_assertBuildxAvailable");pM(p_e,"_detectDaemon");pM(m_e,"_ensureBuilder")});import{mkdtemp as $Ir,readFile as MIr,rm as aAt,stat as oAt,symlink as sAt,writeFile as LIr}from"node:fs/promises";import{homedir as FIr,tmpdir as jIr}from"node:os";import{join as tE}from"node:path";function iW(t){return S(t instanceof Error?t.message:String(t))}function iAt(t){let e=t.replace(/^https?:\/\//i,""),r=e.indexOf("/");return r!==-1&&(e=e.slice(0,r)),e}function cAt(t){let e=t.DOCKER_CONFIG;if(e!==void 0&&e!=="")return e;let r=t.HOME!==void 0&&t.HOME!==""?t.HOME:FIr();return tE(r,".docker")}function lAt(t,e){let r=t.BUILDX_CONFIG;return r!==void 0&&r!==""?r:tE(e,"buildx")}async function uAt(t,e){let r;try{r=await MIr(tE(t,"config.json"),"utf8")}catch{return{}}try{let n=JSON.parse(r);return n===null||typeof n!="object"||Array.isArray(n)?{}:n}catch(n){return e.warn(Xp,"Real docker config.json is not valid JSON; using a minimal ephemeral config",{error:iW(n)}),{}}}async function dAt(t,e,r){let n=tE(t,"contexts");try{if(!(await oAt(n)).isDirectory())return}catch{return}try{await sAt(n,tE(e,"contexts"),"dir")}catch(a){r.warn(Xp,"Could not link docker contexts into the ephemeral config; a non-default docker context may not resolve for this build",{error:iW(a)})}}async function pAt(t,e,r){let n=tE(t,"cli-plugins");try{if(!(await oAt(n)).isDirectory())return}catch{return}try{await sAt(n,tE(e,"cli-plugins"),"dir")}catch(a){r.warn(Xp,"Could not link docker cli-plugins into the ephemeral config; `docker buildx` may be unavailable for this build",{error:iW(a)})}}async function Gae(t){let{registry:e,username:r,password:n,baseEnv:a,logger:o}=t,s=iAt(e),i=cAt(a),c=lAt(a,i),l=await uAt(i,o),{credsStore:u,credHelpers:d,auths:p,...m}=l,f={...d??{}};delete f[s];let g=Buffer.from(`${r}:${n}`,"utf8").toString("base64"),v={...p??{},[s]:{auth:g}},b={...m,auths:v,...Object.keys(f).length>0?{credHelpers:f}:{}},A;try{let C=await $Ir(tE(jIr(),"fjall-ecr-auth-"));A=C,await LIr(tE(C,"config.json"),JSON.stringify(b),{mode:384}),await dAt(i,C,o),await pAt(i,C,o),o.debug(Xp,"Established ephemeral ECR credential context",{registry:s,dockerConfig:C,buildxConfig:c});let x=!1;return{env:{DOCKER_CONFIG:C,BUILDX_CONFIG:c},async dispose(){x||(x=!0,await aAt(C,{recursive:!0,force:!0}).catch(k=>{o.warn(Xp,"Failed to remove ephemeral ECR credential dir",{path:C,error:iW(k)})}))}}}catch(C){throw A!==void 0&&await aAt(A,{recursive:!0,force:!0}).catch(()=>{}),C}}var _Ir,SC,f_e=w(()=>{"use strict";yp();pv();_Ir=Object.defineProperty,SC=(t,e)=>_Ir(t,"name",{value:e,configurable:!0});SC(iW,"maskError");SC(iAt,"registryHost");SC(cAt,"resolveRealDockerConfigDir");SC(lAt,"resolveRealBuildxDir");SC(uAt,"readRealConfig");SC(dAt,"linkContextsDir");SC(pAt,"linkCliPluginsDir");SC(Gae,"createEcrAuthSession")});async function h_e(t,e,r){let n=await Vd(t,{args:["tag",e,r],timeoutMs:3e4});return n.spawnError!==void 0?yt(Du(n)):n.exitCode===null?yt(ir("abort",`docker tag ${e} ${r} was aborted`,{stderrTail:n.stderrTail})):n.exitCode!==0?yt(ir("tag_failed",`docker tag ${e} ${r} failed (exit ${n.exitCode})`,{stderrTail:n.stderrTail})):Ln(void 0)}async function g_e(t,e,r){let n,a=await dM(t,{args:["push",e],timeoutMs:3e5},FP(o=>{if(o==="")return;let s;try{s=JSON.parse(o)}catch{t.logger.debug(Xp,"Skipping malformed push progress line",{line:S(o)});return}if(s===null||typeof s!="object")return;let i=s;i.aux?.digest!==void 0&&(n=i.aux.digest),r!==void 0&&i.id!==void 0&&i.status!==void 0&&r({id:i.id,status:mv(i.status),...i.progressDetail?.current!==void 0&&{current:i.progressDetail.current},...i.progressDetail?.total!==void 0&&{total:i.progressDetail.total}})},"onLine"));return a.spawnError!==void 0?yt(Du(a)):a.aborted||a.exitCode===null?yt(ir("abort",`docker push ${e} was aborted`,{stderrTail:a.stderrTail})):a.exitCode!==0?a.stderrTail.join(`
 `).toLowerCase().includes("unauthorized")?yt(ir("auth_failed",`docker push ${e} unauthorized`,{stderrTail:a.stderrTail})):yt(ir("push_failed",`docker push ${e} failed (exit ${a.exitCode})`,{stderrTail:a.stderrTail})):n===void 0?yt(ir("push_failed",`docker push ${e} succeeded but no digest was reported`,{stderrTail:a.stderrTail})):Ln({digest:n})}async function y_e(t,e,r,n){let a=["pull"];r!==void 0&&r!==""&&a.push("--platform",r),a.push(e);let o="",s=await dM(t,{args:a,timeoutMs:3e5},FP(c=>{o+=`${c}
-`,!(n===void 0||c==="")&&n({id:e,status:mv(c)})},"onLine"));if(s.spawnError!==void 0)return yt(Du(s));if(s.aborted||s.exitCode===null)return yt(ir("abort",`docker pull ${e} was aborted`,{stderrTail:s.stderrTail}));if(s.exitCode!==0)return yt(ir("pull_failed",`docker pull ${e} failed (exit ${s.exitCode})`,{stderrTail:s.stderrTail}));let i=/sha256:[0-9a-f]{64}/.exec(o);return Ln({imageId:i?.[0]??e})}async function v_e(t,e){let r=await Vd(t,{args:["image","inspect","--format","{{json .}}",e],timeoutMs:3e4});if(r.spawnError!==void 0)return yt(Du(r));if(r.exitCode===null)return yt(ir("abort",`docker image inspect ${e} was aborted`,{stderrTail:r.stderrTail}));if(r.exitCode!==0)return r.stderr.includes("No such image:")?Ln({exists:!1}):yt(ir("inspect_failed",`docker image inspect ${e} failed (exit ${r.exitCode})`,{stderrTail:r.stderrTail}));let n=/"Id":"(sha256:[0-9a-f]{64})"/.exec(r.stdout);return Ln({exists:!0,...n?.[1]!==void 0&&{digest:n[1]}})}async function S_e(t,e){try{let r=await Gae({registry:e.registry,username:e.username,password:e.password,baseEnv:t.env,logger:t.logger}),n=t.ecrSession;return t.ecrSession=r,n!==void 0&&await n.dispose(),Ln(void 0)}catch(r){return yt(ir("auth_failed",`Failed to configure ECR credentials for ${e.registry}: ${S(r instanceof Error?r.message:String(r))}`))}}var BIr,FP,hAt=w(()=>{"use strict";yp();pv();f_e();LP();BIr=Object.defineProperty,FP=(t,e)=>BIr(t,"name",{value:e,configurable:!0});FP(h_e,"_tag");FP(g_e,"_push");FP(y_e,"_pull");FP(v_e,"_imageInspect");FP(S_e,"_loginEcr")});import{spawn as yAt}from"node:child_process";function vAt(t){let e=S(t);return e.length>2e3?e.slice(0,2e3)+"\u2026":e}function ir(t,e,r){let n,a=r;if(r!==void 0&&Array.isArray(r.stderrTail)&&r.stderrTail.every(o=>typeof o=="string")){n=r.stderrTail.map(vAt);let{stderrTail:o,...s}=r;a=Object.keys(s).length>0?s:void 0}return{kind:t,message:e,...n!==void 0&&{stderrTail:n},...a!==void 0&&{details:a}}}function Du(t){return ir("daemon_unreachable",`Docker CLI is not available: ${t.spawnError??"unknown spawn failure"}`,{stderrTail:t.stderrTail})}function E_e(t,e){if(t==="")return[];let r=t.split(/\r?\n/);for(;r.length>0&&r[r.length-1]==="";)r.pop();return r.slice(-e)}function mv(t){return S(t)}function A_e(t){return t.ecrSession!==void 0?{...t.env,...t.ecrSession.env}:t.env}function Vd(t,e){return new Promise(r=>{let n=!1,a=!1,o=w_e(t.abortSignal,e.timeoutMs,e.abortSignal),s;try{s=yAt(t.dockerBin,e.args,{shell:!1,env:A_e(t)})}catch(u){let d=u instanceof Error?u.message:String(u);r({exitCode:null,stdout:"",stderr:d,stderrTail:[d],aborted:!1,spawnError:d});return}let i="",c="";s.stdout?.on("data",u=>{i+=u.toString()}),s.stderr?.on("data",u=>{c+=u.toString()}),e.stdin!==void 0&&(s.stdin?.on("error",u=>{t.logger.debug(Xp,"stdin write error (typically EPIPE on early child exit)",{error:u.message})}),s.stdin?.write(e.stdin),s.stdin?.end());let l=ff(()=>{n=!0,oW(s)},"onAbort");o!==void 0&&(o.aborted?l():o.addEventListener("abort",l,{once:!0})),s.once("error",u=>{if(a)return;a=!0,o!==void 0&&o.removeEventListener("abort",l);let d=u instanceof Error?u.message:String(u);r({exitCode:null,stdout:i,stderr:d,stderrTail:[d],aborted:n,spawnError:d})}),s.once("close",u=>{a||(a=!0,o!==void 0&&o.removeEventListener("abort",l),r({exitCode:u,stdout:i,stderr:c,stderrTail:E_e(c,50),aborted:n}))})})}function dM(t,e,r,n){return new Promise(a=>{let o=!1,s=!1,i=w_e(t.abortSignal,e.timeoutMs,e.abortSignal),c;try{c=yAt(t.dockerBin,e.args,{shell:!1,env:A_e(t)})}catch(m){let f=m instanceof Error?m.message:String(m);a({exitCode:null,stderrTail:[f],aborted:!1,spawnError:f,child:null});return}let l="",u="",d="";c.stdout?.on("data",m=>{l+=m.toString();let f=l.split(/\r?\n/);l=f.pop()??"";for(let g of f)r(g)}),c.stderr?.on("data",m=>{let f=m.toString();if(u+=f,n!==void 0){d+=f;let g=d.split(/\r?\n/);d=g.pop()??"";for(let v of g)n(v)}});let p=ff(()=>{o=!0,oW(c)},"onAbort");i!==void 0&&(i.aborted?p():i.addEventListener("abort",p,{once:!0})),c.once("error",m=>{if(s)return;s=!0,i!==void 0&&i.removeEventListener("abort",p);let f=m instanceof Error?m.message:String(m);a({exitCode:null,stderrTail:[f],aborted:o,spawnError:f,child:c})}),c.once("close",m=>{s||(s=!0,l!==""&&r(l),n!==void 0&&d!==""&&n(d),i!==void 0&&i.removeEventListener("abort",p),a({exitCode:m,stderrTail:E_e(u,50),aborted:o,child:c}))})})}function w_e(t,e,r){let n=[];if(t!==void 0&&n.push(t),r!==void 0&&n.push(r),e!==void 0&&n.push(AbortSignal.timeout(e)),n.length!==0)return n.length===1?n[0]:AbortSignal.any(n)}var UIr,ff,cW,LP=w(()=>{"use strict";yp();n_e();pv();eAt();nAt();hAt();ob();UIr=Object.defineProperty,ff=(t,e)=>UIr(t,"name",{value:e,configurable:!0}),cW=class{static{ff(this,"DockerCli")}state;constructor(e){let r=e.dockerBin!==void 0&&e.dockerBin!==""?e.dockerBin:VNe,n=yr(e.env??process.env);this.state={logger:e.logger,dockerBin:r,env:n,abortSignal:e.abortSignal,ecrSession:void 0}}async buildxBuild(e,r,n){return o_e(this.state,e,r,n)}async tag(e,r){return h_e(this.state,e,r)}async tagByDigest(e,r,n){return s_e(this.state,e,r,n)}async push(e,r){return g_e(this.state,e,r)}async pull(e,r,n){return y_e(this.state,e,r,n)}async imageInspect(e){return v_e(this.state,e)}async imagetoolsInspect(e){return i_e(this.state,e)}async loginEcr(e){return S_e(this.state,e)}async logoutEcr(){let e=this.state.ecrSession;this.state.ecrSession=void 0,e!==void 0&&await e.dispose()}async withEcrSession(e,r,n){let a=await this.loginEcr(e);if(!a.success)return yt(n(a.error));try{return await r()}finally{await this.logoutEcr().catch(()=>{})}}async ensureBuilder(e){return m_e(this.state,e)}async assertBuildxAvailable(){return d_e(this.state)}async detectDaemon(){return p_e(this.state)}};ff(vAt,"maskAndBoundStderrTailLine");ff(ir,"makeError");ff(Du,"spawnFailureToError");ff(E_e,"tailLines");ff(mv,"maskOutput");ff(A_e,"spawnEnv");ff(Vd,"runDocker");ff(dM,"streamDocker");ff(w_e,"composeAbortSignal")});import{readFile as GIr}from"node:fs/promises";async function zae(t){let e;try{e=await GIr(t,"utf8")}catch(n){if(n?.code==="ENOENT")return yt(ir("metadata_missing",`Buildx metadata file not found at ${t}`,{path:t}));let a=S(n instanceof Error?n.message:String(n));return yt(ir("inspect_failed",`Failed to read buildx metadata file at ${t}: ${a}`,{path:t}))}let r;try{r=JSON.parse(e)}catch(n){let a=S(n instanceof Error?n.message:String(n));return yt(ir("metadata_malformed",`Buildx metadata file at ${t} is not valid JSON: ${a}`,{path:t}))}return r===null||typeof r!="object"||Array.isArray(r)?yt(ir("metadata_malformed",`Buildx metadata file at ${t} is not a JSON object`,{path:t})):Ln(r)}var VIr,zIr,c_e=w(()=>{"use strict";yp();LP();ob();VIr=Object.defineProperty,zIr=(t,e)=>VIr(t,"name",{value:e,configurable:!0});zIr(zae,"parseMetadataFile")});function bAt(t){let e=t.lastIndexOf(":");return e===-1||t.lastIndexOf("/")>e?t:t.slice(e+1)}function EAt(t){let{result:e,primaryTag:r,services:n}=t;if(e.imageDigests[r]===void 0)return yt(ir("metadata_missing_digest",`Buildx result has no digest for primary tag ${r}`,{primaryTag:r,availableTags:Object.keys(e.imageDigests)}));let a=[];if(n!==void 0)for(let o of n){if(e.imageDigests[o.tag]===void 0)return yt(ir("metadata_missing_digest",`Buildx result has no digest for service ${o.name} tag ${o.tag}`,{service:o.name,tag:o.tag,availableTags:Object.keys(e.imageDigests)}));a.push({name:o.name,imageUri:o.tag})}return Ln({imageUri:r,imageTag:bAt(r),...a.length>0&&{services:a}})}var WIr,SAt,AAt=w(()=>{"use strict";LP();ob();WIr=Object.defineProperty,SAt=(t,e)=>WIr(t,"name",{value:e,configurable:!0});SAt(bAt,"extractTagSuffix");SAt(EAt,"projectBuildxResult")});function fv(t){return`${t}-cache`}function Hae(t){let e=t[C_e];return e===void 0?Ln("max"):qIr.has(e)?Ln(e):yt(new Error(`${C_e} must be one of ${x_e.join(", ")} (got ${JSON.stringify(e)}) \u2014 fix or unset it`))}function qae(t){if(t.cacheRepoUri===void 0)return;let e=(t.serviceName??t.appName).toLowerCase(),r=`type=registry,ref=${t.cacheRepoUri}:${e}`;return{cacheFrom:[r],...t.mode!=="off"&&{cacheTo:[`${r},mode=${t.mode}`]}}}function mM(t){return JSON.stringify({rules:[{rulePriority:1,description:`Expire untagged images after ${t} days`,selection:{tagStatus:"untagged",countType:"sinceImagePushed",countUnit:"days",countNumber:t},action:{type:"expire"}}]})}var HIr,Wae,C_e,x_e,qIr,lW,wAt=w(()=>{"use strict";ob();HIr=Object.defineProperty,Wae=(t,e)=>HIr(t,"name",{value:e,configurable:!0});Wae(fv,"buildCacheRepositoryName");C_e="FJALL_BUILD_CACHE_MODE",x_e=["max","min","off"],qIr=new Set(x_e);Wae(Hae,"resolveBuildCacheMode");Wae(qae,"buildRegistryCacheRefs");lW=14;Wae(mM,"untaggedLifecyclePolicyText")});var hv=w(()=>{"use strict";ob();pv();WNe();HNe();BEt();JNe();KEt();XNe();t_e();r_e();c_e();AAt();n_e();LP();f_e();wAt()});import YIr from"os";async function uW(t,e,r={}){let n=t.length,a=new Array(n);if(n===0)return a;let o=Math.max(1,Math.min(e,n)),s=r.abortOnFirstFailure===!0,i=0,c=!1;async function l(){for(;;){if(s&&c||r.abortSignal?.aborted===!0)return;let d=i;if(d>=n)return;i=d+1;let p=t[d];try{let m=await p();a[d]=Ln(m)}catch(m){let f=m instanceof Error?m:new Error(String(m));a[d]=yt(f),s&&(c=!0)}}}Kae(l,"worker");let u=[];for(let d=0;d<o;d++)u.push(l());return await Promise.all(u),a}function xAt(t){let e=YIr.cpus().length;return Math.min(t,Math.max(2,Math.floor(e/2)))}function dW(t){if(t<=0)return 1;let e=process.env.FJALL_BUILD_CONCURRENCY,r=xAt(t);if(e!==void 0&&e!==""){let n=parseInt(e,10);Number.isInteger(n)&&n>0&&(r=n)}return Math.max(1,Math.min(r,t))}var KIr,Kae,T_e=w(()=>{"use strict";ob();KIr=Object.defineProperty,Kae=(t,e)=>KIr(t,"name",{value:e,configurable:!0});Kae(uW,"runWithBoundedConcurrency");Kae(xAt,"defaultBuildConcurrency");Kae(dW,"resolveBuildConcurrency")});function rE(t){return t.startsWith("cn-")?"aws-cn":"aws"}function mW(t,e){let{region:r,accountId:n,partition:a}=t,o=bn(t.appName),s=`arn:${a}:ssm:${r}:${n}:parameter/${o}/*`,i=`arn:${a}:secretsmanager:${r}:${n}:secret:fjall-${o}-*`,c=new Set;for(let d of e){if(d.ssm!==void 0&&d.ssm!==""){let p=d.ssm.startsWith("/")?d.ssm.slice(1):d.ssm;p.startsWith(`${o}/`)||c.add(`arn:${a}:ssm:${r}:${n}:parameter/${p}`)}if(d.secretsManagerArn!==void 0&&d.secretsManagerArn!==""){let p=i.replace(/\*$/,"");d.secretsManagerArn.startsWith(p)||c.add(d.secretsManagerArn)}d.secretsManagerName!==void 0&&d.secretsManagerName!==""&&!d.secretsManagerName.startsWith(`fjall-${o}-`)&&c.add(`arn:${a}:secretsmanager:${r}:${n}:secret:${d.secretsManagerName}-*`)}let l=[{Sid:"FjallBuildSsmRead",Effect:"Allow",Action:["ssm:GetParameter","ssm:GetParameters"],Resource:[s,...[...c].filter(TAt)]},{Sid:"FjallBuildSecretsManagerRead",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:[i,...[...c].filter(kAt)]},{Sid:"FjallBuildKmsDecrypt",Effect:"Allow",Action:["kms:Decrypt"],Resource:"*",Condition:{StringEquals:{"kms:ViaService":[`ssm.${r}.amazonaws.com`,`secretsmanager.${r}.amazonaws.com`]}}}],u=JSON.stringify({Version:"2012-10-17",Statement:l});return u.length>pW?y(new Error(`Build-secret session policy is ${u.length} chars, exceeding the ${pW}-char AWS inline-policy limit. Reduce the number of out-of-prefix secret/parameter references for this build.`)):E(u)}function TAt(t){return t.includes(":ssm:")}function kAt(t){return t.includes(":secretsmanager:")}var ZIr,Yae,pW,fW=w(()=>{"use strict";Ce();$();ZIr=Object.defineProperty,Yae=(t,e)=>ZIr(t,"name",{value:e,configurable:!0}),pW=2048;Yae(rE,"partitionForRegion");Yae(mW,"buildBuildSecretSessionPolicy");Yae(TAt,"isSsmArn");Yae(kAt,"isSecretsArn")});import{mkdtemp as XIr,writeFile as QIr,rm as PAt}from"node:fs/promises";import{tmpdir as eRr}from"node:os";import{join as IAt}from"node:path";import{SecretsManagerClient as tRr,GetSecretValueCommand as rRr}from"@aws-sdk/client-secrets-manager";import{SSMClient as nRr,GetParameterCommand as aRr}from"@aws-sdk/client-ssm";function jP(t){return t===void 0?[]:Object.entries(t).flatMap(([e,r])=>typeof r=="string"||r.env!==void 0?[]:r.ssm!==void 0?[{id:e,ssm:r.ssm}]:r.secretsManager!==void 0?[{id:e,secretsManager:r.secretsManager}]:[])}function DAt(t){return t.flatMap(e=>e.ssm!==void 0?[{ssm:e.ssm}]:e.secretsManager!==void 0?[{...e.secretsManager.name!==void 0&&{secretsManagerName:e.secretsManager.name},...e.secretsManager.arn!==void 0&&{secretsManagerArn:e.secretsManager.arn}}]:[])}async function bC(t,e,r){if(r===void 0||t.assumeScopedBuildSecretSession===void 0)return E(t);let n=mW(r,DAt(e));if(!n.success)return y(n.error);try{let a=await t.assumeScopedBuildSecretSession(n.data,oRr);return E(a)}catch(a){return y(new Error(`Failed to assume scoped build-secret session: ${S(T(a))}`))}}async function BP(t,e,r,n){if(e.length===0)return E({resolved:[],cleanup:hf(()=>Promise.resolve(),"cleanup")});let a=await bC(t,e,n);if(!a.success)return y(a.error);let o=a.data,s;try{let i=await XIr(IAt(eRr(),"fjall-build-secret-"));s=i;let c=hf(()=>PAt(i,{recursive:!0,force:!0}),"cleanup"),l=[];for(let u of e){let d=await k_e(o,u,r);if(!d.success)return await c(),y(d.error);let p=IAt(i,u.id);await QIr(p,d.data,{mode:384}),l.push({id:u.id,source:{kind:"file",path:p}})}return E({resolved:l,cleanup:c})}catch(i){return s!==void 0&&await PAt(s,{recursive:!0,force:!0}).catch(()=>{}),y(new Error(`Failed to resolve build secrets: ${S(T(i))}`))}}async function UP(t,e,r){return k_e(t,e,r)}async function k_e(t,e,r){if(e.ssm!==void 0)return OAt(t,e.ssm,r);if(e.secretsManager!==void 0)return NAt(t,e.id,e.secretsManager,r);if(e.env!==void 0){let n=process.env[e.env];return n===void 0||n===""?y(new Error(`Build secret "${e.id}" reads env var "${e.env}", which is unset or empty.`)):E(n)}return y(new Error(`Build secret "${e.id}" has no resolvable source.`))}async function OAt(t,e,r){let n=t.getClient(nRr);try{let a=(await n.send(new aRr({Name:e,WithDecryption:!0}),{abortSignal:ee(r,RAt)})).Parameter?.Value;return a===void 0||a===""?y(new Error(`SSM parameter "${e}" returned no value.`)):E(a)}catch(a){return y(P_e("SSM parameter",e,a))}}async function NAt(t,e,r,n){let a=r.arn??r.name;if(a===void 0)return y(new Error(`Build secret "${e}" secretsManager has neither name nor arn.`));let o=t.getClient(tRr);try{let s=(await o.send(new rRr({SecretId:a}),{abortSignal:ee(n,RAt)})).SecretString;return s===void 0||s===""?y(new Error(`Secret "${a}" returned no string value.`)):r.field===void 0?E(s):_At(s,r.field,a)}catch(s){return y(P_e("secret",a,s))}}function _At(t,e,r){let n;try{n=JSON.parse(t)}catch{return y(new Error(`Secret "${r}" is not valid JSON; cannot extract field.`))}if(typeof n!="object"||n===null||Array.isArray(n)||!(e in n))return y(new Error(`Secret "${r}" has no field "${e}".`));let a=n[e];return typeof a!="string"||a===""?y(new Error(`Secret "${r}" field "${e}" is empty or not a string.`)):E(a)}function P_e(t,e,r){let n=r instanceof Error?r.name:"";return n==="ResourceNotFoundException"||n==="ParameterNotFound"?new Error(`${t} "${e}" does not exist in this account/region \u2014 create it or fix the reference.`):n==="AccessDeniedException"||n==="AccessDenied"?new Error(`The deploy identity lacks read access to ${t} "${e}" \u2014 grant the build-time read on this reference.`):new Error(`Failed to resolve ${t} "${e}": ${S(T(r))}`)}var JIr,hf,oRr,RAt,I_e=w(()=>{"use strict";Ce();$();vt();fW();JIr=Object.defineProperty,hf=(t,e)=>JIr(t,"name",{value:e,configurable:!0}),oRr="fjall-build-secret-read",RAt=3e4;hf(jP,"sourcedRefsFromBuildArgs");hf(DAt,"toBuildSecretRefs");hf(bC,"resolveBuildSecretSessionProvider");hf(BP,"resolveBuildSecrets");hf(UP,"resolveSecretRefValue");hf(k_e,"resolveOneValue");hf(OAt,"resolveSsm");hf(NAt,"resolveSecretsManager");hf(_At,"extractField");hf(P_e,"toResolveError")});import{readFile as iRr}from"node:fs/promises";import{join as cRr}from"node:path";async function VP(t){let e=t.manifestBuildArgs??{},r=t.flagBuildArgs??{},n,a;try{n=await R_e(t,[".env",".env.production"]),a=t.stage!==void 0&&t.stage!==""?await R_e(t,[`.env.${t.stage}`]):{}}catch(l){return y(new Error(`Failed to read .env build-arg sources: ${S(T(l))}`))}let o=new Set([...Object.keys(e),...Object.keys(r)]),s=[];for(let l of new Set([...Object.keys(a),...Object.keys(n)]))o.has(l)||yC(l)&&s.push(l);let i=new Set([...o,...s]);if(i.size===0)return E({buildArgs:{},inferredDotenvKeys:[]});let c={};for(let l of i){let u=fM(r[l]);if(u!==void 0){c[l]=u;continue}let d=fM(t.shellEnv[l]);if(d!==void 0){c[l]=d;continue}let p=fM(a[l]);if(p!==void 0){c[l]=p;continue}let m=fM(n[l]);if(m!==void 0){c[l]=m;continue}let f=e[l];if(f===void 0)continue;if(typeof f=="string"){let v=fM(f);v!==void 0&&(c[l]=v);continue}if(t.resolveSourcedValue===void 0)return y(new Error(`buildArg "${l}" is sourced from a secret store but no resolver was provided to read it.`));let g=await t.resolveSourcedValue(l,f);if(!g.success)return y(g.error);c[l]=g.data}return E({buildArgs:c,inferredDotenvKeys:s})}function fM(t){return t!==void 0&&t!==""?t:void 0}async function R_e(t,e){let r=[t.serviceDir,...t.appDir?[t.appDir]:[]];for(let n of r)for(let a of e){let o=await $At(cRr(n,a));if(o!==void 0)return MAt(o)}return{}}async function $At(t){try{return await iRr(t,"utf8")}catch{return}}function MAt(t){let e={};for(let r of t.split(/\r?\n/)){let n=r.trim();if(n===""||n.startsWith("#"))continue;let a=n.replace(/^export\s+/,""),o=a.indexOf("=");if(o<=0)continue;let s=a.slice(0,o).trim();if(s==="")continue;let i=a.slice(o+1).trim();i.length>=2&&(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),e[s]=i}return e}var sRr,hW,D_e=w(()=>{"use strict";Ce();$();hv();sRr=Object.defineProperty,hW=(t,e)=>sRr(t,"name",{value:e,configurable:!0});hW(VP,"resolveBuildArgs");hW(fM,"present");hW(R_e,"loadDotenvTier");hW($At,"readEnvFile");hW(MAt,"parseDotenv")});import{existsSync as uRr,statSync as dRr}from"node:fs";function O_e(t){return Zae({buildArgs:t.buildArgs??null,buildSecrets:t.buildSecrets??null})}function Zae(t){return Array.isArray(t)?`[${t.map(Zae).join(",")}]`:t!==null&&typeof t=="object"?`{${Object.keys(t).sort().map(e=>`${JSON.stringify(e)}:${Zae(t[e])}`).join(",")}}`:JSON.stringify(t)}function zP(t){let e=t.buildSecrets??[];for(let o of e)if(!EX.test(o.id))return y(new Error(`Build secret id "${o.id}" for service '${t.serviceName}' contains characters outside the allowed BuildKit set [A-Za-z0-9_.-]; rename it (no comma, '=', or whitespace, which break the buildx --secret argv).`));let r=new Set;for(let o of e){if(r.has(o.id))return y(new Error(`Duplicate build secret id "${o.id}" for service '${t.serviceName}'; each buildSecrets[].id must be unique within a build group (the resolver writes each value to a temp file keyed by id, so a duplicate is silently overwritten).`));r.add(o.id)}let n=t.buildArgs??{};for(let o of Object.keys(n))if(r.has(o))return y(new Error(`buildArg key "${o}" for service '${t.serviceName}' collides with a buildSecrets[].id; a public --build-arg would shadow the secret mount of the same name. Rename one of them.`));if(!uRr(t.buildContext)||!dRr(t.buildContext).isDirectory())return y(new Error(`Build context "${t.buildContext}" for service '${t.serviceName}' is not an existing directory.`));let a=t.members;if(a!==void 0&&a.length>0){let o=O_e({serviceName:t.serviceName,...t.buildArgs!==void 0&&{buildArgs:t.buildArgs},...t.buildSecrets!==void 0&&{buildSecrets:t.buildSecrets}});for(let s of a)if(s.serviceName!==t.serviceName&&O_e(s)!==o)return y(new Error(`Service '${s.serviceName}' shares a build group with leader '${t.serviceName}' but declares different docker buildArgs/buildSecrets. Only the group leader's docker inputs are resolved and built, so '${s.serviceName}' would ship an image built with the leader's inputs, not its own. Give it a distinct Dockerfile path, context, or target so it builds independently, or align its buildArgs/buildSecrets with the leader.`))}return E(void 0)}var lRr,N_e,__e=w(()=>{"use strict";Ce();ZT();lRr=Object.defineProperty,N_e=(t,e)=>lRr(t,"name",{value:e,configurable:!0});N_e(O_e,"canonicaliseInputs");N_e(Zae,"stableStringify");N_e(zP,"validateBuildGroup")});import{ECRClient as fRr,CreateRepositoryCommand as hRr,PutLifecyclePolicyCommand as gRr}from"@aws-sdk/client-ecr";async function $_e(t,e,r){let n=t.getClient(fRr);try{await n.send(new hRr({repositoryName:e,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"MUTABLE"}),{abortSignal:ee(r)}),z.debug(yRr,"Created build-cache repository",{cacheRepositoryName:e})}catch(a){if(Nt(a)!=="RepositoryAlreadyExistsException")return y(new Error(`Could not create build-cache repository '${e}': ${S(T(a))}`))}try{await n.send(new gRr({repositoryName:e,lifecyclePolicyText:mM(lW)}),{abortSignal:ee(r)})}catch(a){return y(new Error(`Could not set lifecycle policy on build-cache repository '${e}': ${S(T(a))}`))}return E(void 0)}var pRr,mRr,yRr,LAt=w(()=>{"use strict";Ce();$();hv();Ct();vt();pRr=Object.defineProperty,mRr=(t,e)=>pRr(t,"name",{value:e,configurable:!0}),yRr="EcrCacheRepository";mRr($_e,"ensureBuildCacheRepository")});import{isAbsolute as FAt,join as L_e,dirname as SRr,resolve as M_e}from"node:path";import{existsSync as F_e}from"node:fs";function jAt(t,e,r){let n=L_e(e,t);if(F_e(n))return{path:n,base:e};if(r!==""&&r!==e){let a=L_e(r,t);if(F_e(a))return{path:a,base:r}}return{path:n,base:e}}function BAt(t,e,r){let n=t.docker.path,a=t.docker.context,o,s;if(FAt(n))o=n,s=e;else{let i=jAt(n,e,r);o=i.path,s=i.base}return{buildContext:a?FAt(a)?M_e(a):M_e(s,a):M_e(SRr(o)),dockerfilePath:o,target:t.docker.target,resolvedViaFallback:s!==e}}function UAt(t){return`${t.buildContext}|${t.dockerfilePath}|${t.target??""}`}function VAt(t,e){return`Dockerfile not found for service '${t}' at ${e}. Checked the synth directory and the working directory. If your Dockerfile lives at the project root with the CDK app in a subdirectory, set an absolute docker.context (the build context must share the Dockerfile's directory).`}function zAt(t){return t.startsWith("cn-")?"amazonaws.com.cn":"amazonaws.com"}function j_e(t,e){return`${t}.dkr.ecr.${e}.${zAt(e)}`}function GP(t,e,r){return`${j_e(t,e)}/${bn(r)}`}function GAt(t,e,r){return`${j_e(t,e)}/${fv(bn(r))}`}function WAt(t,e,r){let n=new Map;for(let a of t){let o=BAt(a,e,r),s=UAt(o),i=n.get(s);i?i.members.push(a):n.set(s,{identity:o,members:[a]})}return Array.from(n.values())}async function HAt(t,e,r,n,a,o){let s=await t.buildAndPush({appName:e.appName,appPath:e.path,region:r,accountId:n,...a!==void 0&&{abortSignal:a}},(i,c,l,u)=>{o.onDockerProgress?.(S(i),c,l,u)});return s.success?E({imageUri:s.data.imageUri,imageTag:s.data.imageTag}):y(s.error)}function hM(){return{contentHashTagsByService:{},imageDigestsByService:{}}}async function qAt(t,e,r,n,a,o,s,i,c,l,u,d,p,m){let f=t.members[0];if(!F_e(t.identity.dockerfilePath))return y(new Error(VAt(f.name,t.identity.dockerfilePath)));t.identity.resolvedViaFallback&&i.onLog?.(`Building service '${f.name}' from ${t.identity.dockerfilePath} (resolved at the project root).`,"info");let g=[...f.docker.buildSecrets??[],...p??[]],v=zP({serviceName:f.name,dockerfilePath:t.identity.dockerfilePath,buildContext:t.identity.buildContext,...t.identity.target!==void 0&&{target:t.identity.target},...f.docker.buildArgs!==void 0&&{buildArgs:f.docker.buildArgs},...g.length>0&&{buildSecrets:g},members:t.members.map(B=>({serviceName:B.name,...B.docker.buildArgs!==void 0&&{buildArgs:B.docker.buildArgs},...B.docker.buildSecrets!==void 0&&{buildSecrets:B.docker.buildSecrets}}))});if(!v.success)return y(v.error);let b=cM(f.docker.buildArgs,bn(r.appName));for(let B of b.warnings){let j=S(B.message);m(j)&&i.onLog?.(j,"warn")}if(b.findings.length>0)return y(new Error(S(b.findings.map(B=>B.message).join(" "))));let A=g,C=jP(f.docker.buildArgs),x={appName:r.appName,region:n,accountId:a,partition:rE(n)},k=await bC(c,[...A,...C],x);if(!k.success)return y(k.error);let I=k.data,R=await VP({manifestBuildArgs:f.docker.buildArgs,serviceDir:t.identity.buildContext,appDir:r.path,...u!==void 0&&{stage:u},shellEnv:process.env,...d!==void 0&&{flagBuildArgs:d},resolveSourcedValue:Qi((B,j)=>UP(I,{id:B,...j},l),"resolveSourcedValue")});if(!R.success)return y(R.error);let N=R.data.buildArgs;for(let B of R.data.inferredDotenvKeys){let j=S(`buildArg "${B}" was auto-declared from a .env file and will be baked into the image \u2014 ${vC}.`);m(j)&&i.onLog?.(j,"warn")}let _=uM(N,bn(r.appName),lM(f.docker.buildArgs));if(_.length>0)return y(new Error(S(_.map(B=>B.message).join(" "))));let M;if(A.length>0){let B=await BP(I,A,l);if(!B.success)return y(B.error);M=B.data}try{if(Ae(l))return y(new Error(`Build of service '${f.name}' was aborted before the docker build started`));let B=t.members.some(V=>V.isLambda===!0),j=new Set(t.members.map(V=>V.architecture).filter(V=>V!==void 0));if(j.size>1)return y(new Error(`Build group for '${f.name}' contains Lambda members targeting different architectures (${Array.from(j).join(", ")}) \u2014 members sharing one Dockerfile/context/target build as a single image and must agree on \`architecture\`. Give the differing Lambda a distinct docker.path/context/target, or align their \`architecture\` props.`));let[U]=j;if(t.members.some(V=>V.isLambda!==!0)&&U!==void 0&&U!==Qb)return y(new Error(`Build group for '${f.name}' declares Lambda architecture '${U}' but also contains ECS service members \u2014 fjall ECS tasks always run on '${Qb}', so an image shared between ECS and Lambda must build for '${Qb}'. Give the Lambda a distinct docker.path/context/target, or align its \`architecture\` prop.`));let G={appName:r.appName,appPath:t.identity.buildContext,region:n,accountId:a,buildContext:t.identity.buildContext,dockerfilePath:t.identity.dockerfilePath,pushByDigest:!0,serviceName:f.name,targetsLambda:B,...U!==void 0&&{platform:Mae(U)},...s!==void 0&&{cacheRepoUri:s},...t.identity.target!==void 0&&{target:t.identity.target},...Object.keys(N).length>0&&{buildArgs:N},...M!==void 0&&{buildSecrets:M.resolved},...l!==void 0&&{abortSignal:l}};return await KAt(t,G,e,o,i)}finally{M!==void 0&&await M.cleanup().catch(()=>i.onLog?.("Build-secret cleanup failed.","warn"))}}async function KAt(t,e,r,n,a){let o=await r.buildAndPush(e,(d,p,m,f)=>{a.onDockerProgress?.(S(d),p,m,f)});if(!o.success)return y(o.error);let s=o.data.imageDigest;if(typeof s!="string"||!s.startsWith("sha256:"))return y(new Error(`Buildx push succeeded but returned an invalid digest: ${S(String(s))}`));let i={},c={},l=[];for(let d of t.members){let p=d.docker.target,m=IT(s,d.name,p);if(!m.success)return y(m.error);let f=m.data,g=d.name;i[g]=f,c[g]=s,l.push(`${n}:${f}`)}let u=await r.tagByDigest({sourceImage:n,digest:s,tags:l});return u.success?E({contentHashTagsByService:i,imageDigestsByService:c}):y(u.error)}function YAt(t,e){let r=new Map(t.map(n=>[n.name,n]));for(let n of e){let a=r.get(n.name);if(a!==void 0&&JSON.stringify(a.docker)!==JSON.stringify(n.docker))throw new Error(`ECS service "${a.name}" and Lambda image key "${n.name}" share one build key but declare different docker configs \u2014 the second build would silently overwrite the first and both would deploy the same image. Rename one of them, or make the docker configs identical to deliberately share the build.`)}}async function yW(t,e,r,n){let a=t.dockerProvider;if(!a)return E(hM());let o=e.awsProvider.getAccountId();if(!o)return n.onLog?.("Skipping Docker build \u2014 account ID not available","warn"),E(hM());let s=e.awsProvider.getRegion(),i=L_e(r.path,"cdk.out"),c;try{let b=Uy(i),A=a$(i);YAt(b,A),c=[...b,...A]}catch(b){let A=new Error(S(T(b)));return n.onError?.(A),y(A)}let l=GP(o,s,r.appName);if(z.debug(gW,"runDockerBuild starting",{appName:r.appName,appPath:r.path,accountId:o,region:s,cdkOutPath:i,manifestServiceCount:c.length,manifestServices:c.map(b=>({name:b.name,path:b.docker.path,context:b.docker.context,target:b.docker.target})),stepId:ve.DOCKER_OPERATIONS,stepName:tg}),n.onStepStart?.(ve.DOCKER_OPERATIONS,tg),c.length===0){n.onLog?.("Initialising ECR repository\u2026","info");let b=await a.initialiseECR({appName:r.appName,region:s,accountId:o});b.success||n.onLog?.(`ECR initialisation failed: ${S(b.error.message)}`,"warn"),n.onLog?.("Building and pushing Docker image\u2026","info");let A=await HAt(a,r,s,o,t.abortSignal,n);if(!A.success){z.debug(gW,"Docker buildAndPush (legacy) failed",{appName:r.appName,error:S(A.error.message)}),n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"error");let C=new Error(S(A.error.message));return n.onError?.(C),y(C)}return n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"completed"),n.onLog?.(`Docker image pushed: ${A.data.imageUri}`,"info"),E(hM())}let u=await a.preflight?.();if(u!==void 0&&!u.success){n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"error");let b=new Error(S(u.error.message));return n.onError?.(b),y(b)}let d=WAt(c,r.path,t.workingDirectory),p=GAt(o,s,r.appName),m=await $_e(e.awsProvider,fv(bn(r.appName)),t.abortSignal);m.success||(p=void 0,n.onLog?.(`Building without registry cache \u2014 ${m.error.message}`,"warn")),n.onLog?.(`Building and pushing ${c.length} service image(s) in ${d.length} group(s)\u2026`,"info");let f=!1;if(a.beginEcrSession!==void 0){let b=await a.beginEcrSession({accountId:o,region:s,...t.abortSignal!==void 0&&{abortSignal:t.abortSignal}});if(!b.success){n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"error");let A=new Error(S(b.error.message));return n.onError?.(A),y(A)}f=!0}let g=new AbortController,v=Qi(()=>g.abort(),"onCallerAbort");t.abortSignal!==void 0&&(t.abortSignal.aborted?g.abort():t.abortSignal.addEventListener("abort",v,{once:!0}));try{let b=Qi(()=>Ae(t.abortSignal)?"the deployment was cancelled":"a sibling group failed","skipCause"),A,C=dW(d.length),x=iM(),k=d.map((_,M)=>async()=>{let B=_.members.map(U=>U.name).join(", ");if(g.signal.aborted)throw new Error(`Build of group ${M+1}/${d.length} (${B}) was not started \u2014 ${b()}`);n.onLog?.(`Building group ${M+1}/${d.length} (${B})\u2026`,"info");let j=await qAt(_,a,r,s,o,l,p,n,e.awsProvider,g.signal,t.options?.environment,t.options?.flagBuildArgs,t.options?.flagBuildSecrets,x);if(!j.success)throw A===void 0&&(A={error:j.error,leader:_.members[0]?.name,members:B}),g.abort(),j.error;return j.data}),I=await uW(k,C,{abortOnFirstFailure:!0,abortSignal:g.signal});if(A===void 0)for(let _=0;_<d.length;_++){let M=I[_];if(!(M!==void 0&&M.success)){A={error:M!==void 0&&!M.success?M.error:new Error(`Build of group ${_+1}/${d.length} never ran \u2014 ${b()}`),leader:d[_].members[0]?.name,members:d[_].members.map(B=>B.name).join(", ")};break}}if(A!==void 0){z.debug(gW,"Docker buildAndPush failed",{appName:r.appName,leader:A.leader,members:A.members,error:S(A.error.message)}),n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"error");let _=new Error(S(A.error.message));return n.onError?.(_),y(_)}let R={},N={};for(let _ of I)if(!(_===void 0||!_.success)){for(let[M,B]of Object.entries(_.data.contentHashTagsByService))R[M]=B;for(let[M,B]of Object.entries(_.data.imageDigestsByService))N[M]=B}return z.debug(gW,"Docker buildAndPush succeeded",{appName:r.appName,services:c.map(_=>_.name),groupCount:d.length,contentHashTags:R}),n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"completed"),n.onLog?.(`Docker images pushed for ${c.length} service(s)`,"info"),E({contentHashTagsByService:R,imageDigestsByService:N,repoUri:l})}finally{t.abortSignal?.removeEventListener("abort",v),f&&a.endEcrSession!==void 0&&await a.endEcrSession().catch(b=>{z.debug(gW,"endEcrSession cleanup failed",{error:S(T(b))})})}}var vRr,Qi,gW,tg,vW=w(()=>{"use strict";Ce();$();hv();T_e();Ct();Vy();Cw();vt();I_e();fW();D_e();__e();LAt();vRr=Object.defineProperty,Qi=(t,e)=>vRr(t,"name",{value:e,configurable:!0}),gW="dockerBuildHelper",tg="Building and pushing Docker image";Qi(jAt,"resolveAgainstBases");Qi(BAt,"resolveBuildIdentity");Qi(UAt,"buildIdentityKey");Qi(VAt,"dockerfileNotFoundMessage");Qi(zAt,"ecrDnsSuffix");Qi(j_e,"ecrRegistryHost");Qi(GP,"ecrRepoUri");Qi(GAt,"ecrCacheRepoUri");Qi(WAt,"groupServicesByIdentity");Qi(HAt,"buildLegacyFallback");Qi(hM,"emptyBuildProducts");Qi(qAt,"buildGroup");Qi(KAt,"buildGroupWithParams");Qi(YAt,"assertNoCrossEntityBuildKeyDivergence");Qi(yW,"runDockerBuild")});async function U_e(t,e,r,n){let a=t.dockerProvider;if(!a)return E(void 0);let o=e.awsProvider.getAccountId();if(!o)return n.onLog?.("Skipping ECR initialisation \u2014 account ID not available","warn"),E(void 0);let s=e.awsProvider.getRegion();n.onStepStart?.(ve.DOCKER_OPERATIONS,"Initialising container repository"),n.onLog?.("Initialising ECR repository with welcome image\u2026","info");let i=await a.initialiseECR({appName:r.appName,region:s,accountId:o});if(i.success||n.onLog?.(S(`ECR initialisation warning: ${i.error.message}`),"warn"),n.onStepComplete?.(ve.DOCKER_OPERATIONS,"Initialising container repository","completed"),a.tagImages){n.onStepStart?.(ve.TAG_ECR_IMAGES,B_e),n.onLog?.("Tagging ECR images for ECS services\u2026","info");let c=ZAt(u=>{n.onLog?.(S(u),"info")},"tagProgress"),l=await a.tagImages({appName:r.appName,appPath:r.path,region:s,accountId:o},c);if(!l.success){let u=new Error(S(l.error.message));return n.onError?.(u),n.onStepComplete?.(ve.TAG_ECR_IMAGES,B_e,"error"),y(u)}n.onLog?.(`Tagged ${l.data.taggedServices.length} service(s): ${l.data.taggedServices.join(", ")}`,"info");for(let u of l.data.taggedServices)n.onStepStart?.(`tag-ecr-images-${u}`,`Tagged ${u}`),n.onStepComplete?.(`tag-ecr-images-${u}`,`Tagged ${u}`,"completed");n.onStepComplete?.(ve.TAG_ECR_IMAGES,B_e,"completed")}return E(void 0)}var bRr,ZAt,B_e,JAt=w(()=>{"use strict";Ce();$();Cw();bRr=Object.defineProperty,ZAt=(t,e)=>bRr(t,"name",{value:e,configurable:!0}),B_e="Tagging container images";ZAt(U_e,"runWelcomeImageSetup")});import{join as ARr}from"node:path";function V_e(t){let e=new Set;for(let r of t.deployOrder){let n=nr(t.appName,r),a=t.stackChanges.get(n)??!0,o=r===Te.COMPUTE&&t.computeBuildPossible;(a||t.force||o)&&e.add(n)}return e}function z_e(t){return t.stackNamesToDeploy.has(nr(t.appName,Te.COMPUTE))&&t.hasDockerProvider&&t.hasDockerfile}function G_e(t,e,r,n){let a=new Set(Th.PHASE_2.stacks),o=[];for(let i=e;i<t.length&&a.has(t[i]);i++)o.push(t[i]);if(o.length<2)return[];let s=o.filter(i=>n.has(nr(r,i)));return s.length>=2?s:[]}async function W_e(t,e,r,n,a,o,s,i,c,l){for(let p=0;p<t.length;p++){let m=t[p],f=Dn(m,"deploy"),g=Rn(m,"deploy");a.onStepStart?.(f,g,o+p,s)}wb(a,"Deploying infrastructure in parallel\u2026"),a.onParallelPhaseStart?.(t,"Storage and database resources (parallel)");let u=await r.stackService.deployStacksInParallel(t,n,{onOutput:Yi(a),onResourceProgress:zd((p,m)=>{a.onResourceProgress?.(p),m&&a.onParallelStackResourceProgress?.(m,p)},"onResourceProgress"),onStackComplete:zd((p,m,f,g)=>{let v=Dn(p,"deploy"),b=Rn(p,"deploy"),A=o+t.indexOf(p),C=Ae(r.abortSignal);a.onStepComplete?.(v,b,m?"completed":C?"cancelled":"error",A,s),!m&&g&&!C&&a.onError?.(new Error(S(g.message)))},"onStackComplete")});if(!u.success)return a.onParallelPhaseComplete?.([]),y(u.error);let d=u.data.filter(p=>!p.success);if(a.onParallelPhaseComplete?.(u.data.map(p=>({stack:p.stack,success:p.success,error:p.error}))),d.length>0){let p=d.map(f=>f.stack).join(", "),m=d.map(f=>`${f.stack}: ${S(f.error?.message??"Unknown error")}`).join(`
+`,!(n===void 0||c==="")&&n({id:e,status:mv(c)})},"onLine"));if(s.spawnError!==void 0)return yt(Du(s));if(s.aborted||s.exitCode===null)return yt(ir("abort",`docker pull ${e} was aborted`,{stderrTail:s.stderrTail}));if(s.exitCode!==0)return yt(ir("pull_failed",`docker pull ${e} failed (exit ${s.exitCode})`,{stderrTail:s.stderrTail}));let i=/sha256:[0-9a-f]{64}/.exec(o);return Ln({imageId:i?.[0]??e})}async function v_e(t,e){let r=await Vd(t,{args:["image","inspect","--format","{{json .}}",e],timeoutMs:3e4});if(r.spawnError!==void 0)return yt(Du(r));if(r.exitCode===null)return yt(ir("abort",`docker image inspect ${e} was aborted`,{stderrTail:r.stderrTail}));if(r.exitCode!==0)return r.stderr.includes("No such image:")?Ln({exists:!1}):yt(ir("inspect_failed",`docker image inspect ${e} failed (exit ${r.exitCode})`,{stderrTail:r.stderrTail}));let n=/"Id":"(sha256:[0-9a-f]{64})"/.exec(r.stdout);return Ln({exists:!0,...n?.[1]!==void 0&&{digest:n[1]}})}async function S_e(t,e){try{let r=await Gae({registry:e.registry,username:e.username,password:e.password,baseEnv:t.env,logger:t.logger}),n=t.ecrSession;return t.ecrSession=r,n!==void 0&&await n.dispose(),Ln(void 0)}catch(r){return yt(ir("auth_failed",`Failed to configure ECR credentials for ${e.registry}: ${S(r instanceof Error?r.message:String(r))}`))}}var BIr,FP,hAt=w(()=>{"use strict";yp();pv();f_e();LP();BIr=Object.defineProperty,FP=(t,e)=>BIr(t,"name",{value:e,configurable:!0});FP(h_e,"_tag");FP(g_e,"_push");FP(y_e,"_pull");FP(v_e,"_imageInspect");FP(S_e,"_loginEcr")});import{spawn as yAt}from"node:child_process";function vAt(t){let e=S(t);return e.length>2e3?e.slice(0,2e3)+"\u2026":e}function ir(t,e,r){let n,a=r;if(r!==void 0&&Array.isArray(r.stderrTail)&&r.stderrTail.every(o=>typeof o=="string")){n=r.stderrTail.map(vAt);let{stderrTail:o,...s}=r;a=Object.keys(s).length>0?s:void 0}return{kind:t,message:e,...n!==void 0&&{stderrTail:n},...a!==void 0&&{details:a}}}function Du(t){return ir("daemon_unreachable",`Docker CLI is not available: ${t.spawnError??"unknown spawn failure"}`,{stderrTail:t.stderrTail})}function E_e(t,e){if(t==="")return[];let r=t.split(/\r?\n/);for(;r.length>0&&r[r.length-1]==="";)r.pop();return r.slice(-e)}function mv(t){return S(t)}function A_e(t){return t.ecrSession!==void 0?{...t.env,...t.ecrSession.env}:t.env}function Vd(t,e){return new Promise(r=>{let n=!1,a=!1,o=w_e(t.abortSignal,e.timeoutMs,e.abortSignal),s;try{s=yAt(t.dockerBin,e.args,{shell:!1,env:A_e(t)})}catch(u){let d=u instanceof Error?u.message:String(u);r({exitCode:null,stdout:"",stderr:d,stderrTail:[d],aborted:!1,spawnError:d});return}let i="",c="";s.stdout?.on("data",u=>{i+=u.toString()}),s.stderr?.on("data",u=>{c+=u.toString()}),e.stdin!==void 0&&(s.stdin?.on("error",u=>{t.logger.debug(Xp,"stdin write error (typically EPIPE on early child exit)",{error:u.message})}),s.stdin?.write(e.stdin),s.stdin?.end());let l=ff(()=>{n=!0,oW(s)},"onAbort");o!==void 0&&(o.aborted?l():o.addEventListener("abort",l,{once:!0})),s.once("error",u=>{if(a)return;a=!0,o!==void 0&&o.removeEventListener("abort",l);let d=u instanceof Error?u.message:String(u);r({exitCode:null,stdout:i,stderr:d,stderrTail:[d],aborted:n,spawnError:d})}),s.once("close",u=>{a||(a=!0,o!==void 0&&o.removeEventListener("abort",l),r({exitCode:u,stdout:i,stderr:c,stderrTail:E_e(c,50),aborted:n}))})})}function dM(t,e,r,n){return new Promise(a=>{let o=!1,s=!1,i=w_e(t.abortSignal,e.timeoutMs,e.abortSignal),c;try{c=yAt(t.dockerBin,e.args,{shell:!1,env:A_e(t)})}catch(m){let f=m instanceof Error?m.message:String(m);a({exitCode:null,stderrTail:[f],aborted:!1,spawnError:f,child:null});return}let l="",u="",d="";c.stdout?.on("data",m=>{l+=m.toString();let f=l.split(/\r?\n/);l=f.pop()??"";for(let g of f)r(g)}),c.stderr?.on("data",m=>{let f=m.toString();if(u+=f,n!==void 0){d+=f;let g=d.split(/\r?\n/);d=g.pop()??"";for(let v of g)n(v)}});let p=ff(()=>{o=!0,oW(c)},"onAbort");i!==void 0&&(i.aborted?p():i.addEventListener("abort",p,{once:!0})),c.once("error",m=>{if(s)return;s=!0,i!==void 0&&i.removeEventListener("abort",p);let f=m instanceof Error?m.message:String(m);a({exitCode:null,stderrTail:[f],aborted:o,spawnError:f,child:c})}),c.once("close",m=>{s||(s=!0,l!==""&&r(l),n!==void 0&&d!==""&&n(d),i!==void 0&&i.removeEventListener("abort",p),a({exitCode:m,stderrTail:E_e(u,50),aborted:o,child:c}))})})}function w_e(t,e,r){let n=[];if(t!==void 0&&n.push(t),r!==void 0&&n.push(r),e!==void 0&&n.push(AbortSignal.timeout(e)),n.length!==0)return n.length===1?n[0]:AbortSignal.any(n)}var UIr,ff,cW,LP=w(()=>{"use strict";yp();n_e();pv();eAt();nAt();hAt();ob();UIr=Object.defineProperty,ff=(t,e)=>UIr(t,"name",{value:e,configurable:!0}),cW=class{static{ff(this,"DockerCli")}state;constructor(e){let r=e.dockerBin!==void 0&&e.dockerBin!==""?e.dockerBin:VNe,n=yr(e.env??process.env);this.state={logger:e.logger,dockerBin:r,env:n,abortSignal:e.abortSignal,ecrSession:void 0}}async buildxBuild(e,r,n){return o_e(this.state,e,r,n)}async tag(e,r){return h_e(this.state,e,r)}async tagByDigest(e,r,n){return s_e(this.state,e,r,n)}async push(e,r){return g_e(this.state,e,r)}async pull(e,r,n){return y_e(this.state,e,r,n)}async imageInspect(e){return v_e(this.state,e)}async imagetoolsInspect(e){return i_e(this.state,e)}async loginEcr(e){return S_e(this.state,e)}async logoutEcr(){let e=this.state.ecrSession;this.state.ecrSession=void 0,e!==void 0&&await e.dispose()}async withEcrSession(e,r,n){let a=await this.loginEcr(e);if(!a.success)return yt(n(a.error));try{return await r()}finally{await this.logoutEcr().catch(()=>{})}}async ensureBuilder(e){return m_e(this.state,e)}async assertBuildxAvailable(){return d_e(this.state)}async detectDaemon(){return p_e(this.state)}};ff(vAt,"maskAndBoundStderrTailLine");ff(ir,"makeError");ff(Du,"spawnFailureToError");ff(E_e,"tailLines");ff(mv,"maskOutput");ff(A_e,"spawnEnv");ff(Vd,"runDocker");ff(dM,"streamDocker");ff(w_e,"composeAbortSignal")});import{readFile as GIr}from"node:fs/promises";async function zae(t){let e;try{e=await GIr(t,"utf8")}catch(n){if(n?.code==="ENOENT")return yt(ir("metadata_missing",`Buildx metadata file not found at ${t}`,{path:t}));let a=S(n instanceof Error?n.message:String(n));return yt(ir("inspect_failed",`Failed to read buildx metadata file at ${t}: ${a}`,{path:t}))}let r;try{r=JSON.parse(e)}catch(n){let a=S(n instanceof Error?n.message:String(n));return yt(ir("metadata_malformed",`Buildx metadata file at ${t} is not valid JSON: ${a}`,{path:t}))}return r===null||typeof r!="object"||Array.isArray(r)?yt(ir("metadata_malformed",`Buildx metadata file at ${t} is not a JSON object`,{path:t})):Ln(r)}var VIr,zIr,c_e=w(()=>{"use strict";yp();LP();ob();VIr=Object.defineProperty,zIr=(t,e)=>VIr(t,"name",{value:e,configurable:!0});zIr(zae,"parseMetadataFile")});function bAt(t){let e=t.lastIndexOf(":");return e===-1||t.lastIndexOf("/")>e?t:t.slice(e+1)}function EAt(t){let{result:e,primaryTag:r,services:n}=t;if(e.imageDigests[r]===void 0)return yt(ir("metadata_missing_digest",`Buildx result has no digest for primary tag ${r}`,{primaryTag:r,availableTags:Object.keys(e.imageDigests)}));let a=[];if(n!==void 0)for(let o of n){if(e.imageDigests[o.tag]===void 0)return yt(ir("metadata_missing_digest",`Buildx result has no digest for service ${o.name} tag ${o.tag}`,{service:o.name,tag:o.tag,availableTags:Object.keys(e.imageDigests)}));a.push({name:o.name,imageUri:o.tag})}return Ln({imageUri:r,imageTag:bAt(r),...a.length>0&&{services:a}})}var WIr,SAt,AAt=w(()=>{"use strict";LP();ob();WIr=Object.defineProperty,SAt=(t,e)=>WIr(t,"name",{value:e,configurable:!0});SAt(bAt,"extractTagSuffix");SAt(EAt,"projectBuildxResult")});function fv(t){return`${t}-cache`}function Hae(t){let e=t[C_e];return e===void 0?Ln("max"):qIr.has(e)?Ln(e):yt(new Error(`${C_e} must be one of ${x_e.join(", ")} (got ${JSON.stringify(e)}) \u2014 fix or unset it`))}function qae(t){if(t.cacheRepoUri===void 0)return;let e=(t.serviceName??t.appName).toLowerCase(),r=`type=registry,ref=${t.cacheRepoUri}:${e}`;return{cacheFrom:[r],...t.mode!=="off"&&{cacheTo:[`${r},mode=${t.mode}`]}}}function mM(t){return JSON.stringify({rules:[{rulePriority:1,description:`Expire untagged images after ${t} days`,selection:{tagStatus:"untagged",countType:"sinceImagePushed",countUnit:"days",countNumber:t},action:{type:"expire"}}]})}var HIr,Wae,C_e,x_e,qIr,lW,wAt=w(()=>{"use strict";ob();HIr=Object.defineProperty,Wae=(t,e)=>HIr(t,"name",{value:e,configurable:!0});Wae(fv,"buildCacheRepositoryName");C_e="FJALL_BUILD_CACHE_MODE",x_e=["max","min","off"],qIr=new Set(x_e);Wae(Hae,"resolveBuildCacheMode");Wae(qae,"buildRegistryCacheRefs");lW=14;Wae(mM,"untaggedLifecyclePolicyText")});var hv=w(()=>{"use strict";ob();pv();WNe();HNe();BEt();JNe();KEt();XNe();t_e();r_e();c_e();AAt();n_e();LP();f_e();wAt()});import YIr from"os";async function uW(t,e,r={}){let n=t.length,a=new Array(n);if(n===0)return a;let o=Math.max(1,Math.min(e,n)),s=r.abortOnFirstFailure===!0,i=0,c=!1;async function l(){for(;;){if(s&&c||r.abortSignal?.aborted===!0)return;let d=i;if(d>=n)return;i=d+1;let p=t[d];try{let m=await p();a[d]=Ln(m)}catch(m){let f=m instanceof Error?m:new Error(String(m));a[d]=yt(f),s&&(c=!0)}}}Kae(l,"worker");let u=[];for(let d=0;d<o;d++)u.push(l());return await Promise.all(u),a}function xAt(t){let e=YIr.cpus().length;return Math.min(t,Math.max(2,Math.floor(e/2)))}function dW(t){if(t<=0)return 1;let e=process.env.FJALL_BUILD_CONCURRENCY,r=xAt(t);if(e!==void 0&&e!==""){let n=parseInt(e,10);Number.isInteger(n)&&n>0&&(r=n)}return Math.max(1,Math.min(r,t))}var KIr,Kae,T_e=w(()=>{"use strict";ob();KIr=Object.defineProperty,Kae=(t,e)=>KIr(t,"name",{value:e,configurable:!0});Kae(uW,"runWithBoundedConcurrency");Kae(xAt,"defaultBuildConcurrency");Kae(dW,"resolveBuildConcurrency")});function rE(t){return t.startsWith("cn-")?"aws-cn":"aws"}function mW(t,e){let{region:r,accountId:n,partition:a}=t,o=bn(t.appName),s=`arn:${a}:ssm:${r}:${n}:parameter/${o}/*`,i=`arn:${a}:secretsmanager:${r}:${n}:secret:fjall-${o}-*`,c=new Set;for(let d of e){if(d.ssm!==void 0&&d.ssm!==""){let p=d.ssm.startsWith("/")?d.ssm.slice(1):d.ssm;p.startsWith(`${o}/`)||c.add(`arn:${a}:ssm:${r}:${n}:parameter/${p}`)}if(d.secretsManagerArn!==void 0&&d.secretsManagerArn!==""){let p=i.replace(/\*$/,"");d.secretsManagerArn.startsWith(p)||c.add(d.secretsManagerArn)}d.secretsManagerName!==void 0&&d.secretsManagerName!==""&&!d.secretsManagerName.startsWith(`fjall-${o}-`)&&c.add(`arn:${a}:secretsmanager:${r}:${n}:secret:${d.secretsManagerName}-*`)}let l=[{Sid:"FjallBuildSsmRead",Effect:"Allow",Action:["ssm:GetParameter","ssm:GetParameters"],Resource:[s,...[...c].filter(TAt)]},{Sid:"FjallBuildSecretsManagerRead",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:[i,...[...c].filter(kAt)]},{Sid:"FjallBuildKmsDecrypt",Effect:"Allow",Action:["kms:Decrypt"],Resource:"*",Condition:{StringEquals:{"kms:ViaService":[`ssm.${r}.amazonaws.com`,`secretsmanager.${r}.amazonaws.com`]}}}],u=JSON.stringify({Version:"2012-10-17",Statement:l});return u.length>pW?y(new Error(`Build-secret session policy is ${u.length} chars, exceeding the ${pW}-char AWS inline-policy limit. Reduce the number of out-of-prefix secret/parameter references for this build.`)):E(u)}function TAt(t){return t.includes(":ssm:")}function kAt(t){return t.includes(":secretsmanager:")}var ZIr,Yae,pW,fW=w(()=>{"use strict";Ce();$();ZIr=Object.defineProperty,Yae=(t,e)=>ZIr(t,"name",{value:e,configurable:!0}),pW=2048;Yae(rE,"partitionForRegion");Yae(mW,"buildBuildSecretSessionPolicy");Yae(TAt,"isSsmArn");Yae(kAt,"isSecretsArn")});import{mkdtemp as XIr,writeFile as QIr,rm as PAt}from"node:fs/promises";import{tmpdir as eRr}from"node:os";import{join as IAt}from"node:path";import{SecretsManagerClient as tRr,GetSecretValueCommand as rRr}from"@aws-sdk/client-secrets-manager";import{SSMClient as nRr,GetParameterCommand as aRr}from"@aws-sdk/client-ssm";function jP(t){return t===void 0?[]:Object.entries(t).flatMap(([e,r])=>typeof r=="string"||r.env!==void 0?[]:r.ssm!==void 0?[{id:e,ssm:r.ssm}]:r.secretsManager!==void 0?[{id:e,secretsManager:r.secretsManager}]:[])}function DAt(t){return t.flatMap(e=>e.ssm!==void 0?[{ssm:e.ssm}]:e.secretsManager!==void 0?[{...e.secretsManager.name!==void 0&&{secretsManagerName:e.secretsManager.name},...e.secretsManager.arn!==void 0&&{secretsManagerArn:e.secretsManager.arn}}]:[])}async function bC(t,e,r){if(r===void 0||t.assumeScopedBuildSecretSession===void 0)return E(t);let n=mW(r,DAt(e));if(!n.success)return y(n.error);try{let a=await t.assumeScopedBuildSecretSession(n.data,oRr);return E(a)}catch(a){return y(new Error(`Failed to assume scoped build-secret session: ${S(T(a))}`))}}async function BP(t,e,r,n){if(e.length===0)return E({resolved:[],cleanup:hf(()=>Promise.resolve(),"cleanup")});let a=await bC(t,e,n);if(!a.success)return y(a.error);let o=a.data,s;try{let i=await XIr(IAt(eRr(),"fjall-build-secret-"));s=i;let c=hf(()=>PAt(i,{recursive:!0,force:!0}),"cleanup"),l=[];for(let u of e){let d=await k_e(o,u,r);if(!d.success)return await c(),y(d.error);let p=IAt(i,u.id);await QIr(p,d.data,{mode:384}),l.push({id:u.id,source:{kind:"file",path:p}})}return E({resolved:l,cleanup:c})}catch(i){return s!==void 0&&await PAt(s,{recursive:!0,force:!0}).catch(()=>{}),y(new Error(`Failed to resolve build secrets: ${S(T(i))}`))}}async function UP(t,e,r){return k_e(t,e,r)}async function k_e(t,e,r){if(e.ssm!==void 0)return OAt(t,e.ssm,r);if(e.secretsManager!==void 0)return NAt(t,e.id,e.secretsManager,r);if(e.env!==void 0){let n=process.env[e.env];return n===void 0||n===""?y(new Error(`Build secret "${e.id}" reads env var "${e.env}", which is unset or empty.`)):E(n)}return y(new Error(`Build secret "${e.id}" has no resolvable source.`))}async function OAt(t,e,r){let n=t.getClient(nRr);try{let a=(await n.send(new aRr({Name:e,WithDecryption:!0}),{abortSignal:ee(r,RAt)})).Parameter?.Value;return a===void 0||a===""?y(new Error(`SSM parameter "${e}" returned no value.`)):E(a)}catch(a){return y(P_e("SSM parameter",e,a))}}async function NAt(t,e,r,n){let a=r.arn??r.name;if(a===void 0)return y(new Error(`Build secret "${e}" secretsManager has neither name nor arn.`));let o=t.getClient(tRr);try{let s=(await o.send(new rRr({SecretId:a}),{abortSignal:ee(n,RAt)})).SecretString;return s===void 0||s===""?y(new Error(`Secret "${a}" returned no string value.`)):r.field===void 0?E(s):_At(s,r.field,a)}catch(s){return y(P_e("secret",a,s))}}function _At(t,e,r){let n;try{n=JSON.parse(t)}catch{return y(new Error(`Secret "${r}" is not valid JSON; cannot extract field.`))}if(typeof n!="object"||n===null||Array.isArray(n)||!(e in n))return y(new Error(`Secret "${r}" has no field "${e}".`));let a=n[e];return typeof a!="string"||a===""?y(new Error(`Secret "${r}" field "${e}" is empty or not a string.`)):E(a)}function P_e(t,e,r){let n=r instanceof Error?r.name:"";return n==="ResourceNotFoundException"||n==="ParameterNotFound"?new Error(`${t} "${e}" does not exist in this account/region \u2014 create it or fix the reference.`):n==="AccessDeniedException"||n==="AccessDenied"?new Error(`The deploy identity lacks read access to ${t} "${e}" \u2014 grant the build-time read on this reference.`):new Error(`Failed to resolve ${t} "${e}": ${S(T(r))}`)}var JIr,hf,oRr,RAt,I_e=w(()=>{"use strict";Ce();$();vt();fW();JIr=Object.defineProperty,hf=(t,e)=>JIr(t,"name",{value:e,configurable:!0}),oRr="fjall-build-secret-read",RAt=3e4;hf(jP,"sourcedRefsFromBuildArgs");hf(DAt,"toBuildSecretRefs");hf(bC,"resolveBuildSecretSessionProvider");hf(BP,"resolveBuildSecrets");hf(UP,"resolveSecretRefValue");hf(k_e,"resolveOneValue");hf(OAt,"resolveSsm");hf(NAt,"resolveSecretsManager");hf(_At,"extractField");hf(P_e,"toResolveError")});import{readFile as iRr}from"node:fs/promises";import{join as cRr}from"node:path";async function VP(t){let e=t.manifestBuildArgs??{},r=t.flagBuildArgs??{},n,a;try{n=await R_e(t,[".env",".env.production"]),a=t.stage!==void 0&&t.stage!==""?await R_e(t,[`.env.${t.stage}`]):{}}catch(l){return y(new Error(`Failed to read .env build-arg sources: ${S(T(l))}`))}let o=new Set([...Object.keys(e),...Object.keys(r)]),s=[];for(let l of new Set([...Object.keys(a),...Object.keys(n)]))o.has(l)||yC(l)&&s.push(l);let i=new Set([...o,...s]);if(i.size===0)return E({buildArgs:{},inferredDotenvKeys:[]});let c={};for(let l of i){let u=fM(r[l]);if(u!==void 0){c[l]=u;continue}let d=fM(t.shellEnv[l]);if(d!==void 0){c[l]=d;continue}let p=fM(a[l]);if(p!==void 0){c[l]=p;continue}let m=fM(n[l]);if(m!==void 0){c[l]=m;continue}let f=e[l];if(f===void 0)continue;if(typeof f=="string"){let v=fM(f);v!==void 0&&(c[l]=v);continue}if(t.resolveSourcedValue===void 0)return y(new Error(`buildArg "${l}" is sourced from a secret store but no resolver was provided to read it.`));let g=await t.resolveSourcedValue(l,f);if(!g.success)return y(g.error);c[l]=g.data}return E({buildArgs:c,inferredDotenvKeys:s})}function fM(t){return t!==void 0&&t!==""?t:void 0}async function R_e(t,e){let r=[t.serviceDir,...t.appDir?[t.appDir]:[]];for(let n of r)for(let a of e){let o=await $At(cRr(n,a));if(o!==void 0)return MAt(o)}return{}}async function $At(t){try{return await iRr(t,"utf8")}catch{return}}function MAt(t){let e={};for(let r of t.split(/\r?\n/)){let n=r.trim();if(n===""||n.startsWith("#"))continue;let a=n.replace(/^export\s+/,""),o=a.indexOf("=");if(o<=0)continue;let s=a.slice(0,o).trim();if(s==="")continue;let i=a.slice(o+1).trim();i.length>=2&&(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),e[s]=i}return e}var sRr,hW,D_e=w(()=>{"use strict";Ce();$();hv();sRr=Object.defineProperty,hW=(t,e)=>sRr(t,"name",{value:e,configurable:!0});hW(VP,"resolveBuildArgs");hW(fM,"present");hW(R_e,"loadDotenvTier");hW($At,"readEnvFile");hW(MAt,"parseDotenv")});import{existsSync as uRr,statSync as dRr}from"node:fs";function O_e(t){return Zae({buildArgs:t.buildArgs??null,buildSecrets:t.buildSecrets??null})}function Zae(t){return Array.isArray(t)?`[${t.map(Zae).join(",")}]`:t!==null&&typeof t=="object"?`{${Object.keys(t).sort().map(e=>`${JSON.stringify(e)}:${Zae(t[e])}`).join(",")}}`:JSON.stringify(t)}function zP(t){let e=t.buildSecrets??[];for(let o of e)if(!EX.test(o.id))return y(new Error(`Build secret id "${o.id}" for service '${t.serviceName}' contains characters outside the allowed BuildKit set [A-Za-z0-9_.-]; rename it (no comma, '=', or whitespace, which break the buildx --secret argv).`));let r=new Set;for(let o of e){if(r.has(o.id))return y(new Error(`Duplicate build secret id "${o.id}" for service '${t.serviceName}'; each buildSecrets[].id must be unique within a build group (the resolver writes each value to a temp file keyed by id, so a duplicate is silently overwritten).`));r.add(o.id)}let n=t.buildArgs??{};for(let o of Object.keys(n))if(r.has(o))return y(new Error(`buildArg key "${o}" for service '${t.serviceName}' collides with a buildSecrets[].id; a public --build-arg would shadow the secret mount of the same name. Rename one of them.`));if(!uRr(t.buildContext)||!dRr(t.buildContext).isDirectory())return y(new Error(`Build context "${t.buildContext}" for service '${t.serviceName}' is not an existing directory.`));let a=t.members;if(a!==void 0&&a.length>0){let o=O_e({serviceName:t.serviceName,...t.buildArgs!==void 0&&{buildArgs:t.buildArgs},...t.buildSecrets!==void 0&&{buildSecrets:t.buildSecrets}});for(let s of a)if(s.serviceName!==t.serviceName&&O_e(s)!==o)return y(new Error(`Service '${s.serviceName}' shares a build group with leader '${t.serviceName}' but declares different docker buildArgs/buildSecrets. Only the group leader's docker inputs are resolved and built, so '${s.serviceName}' would ship an image built with the leader's inputs, not its own. Give it a distinct Dockerfile path, context, or target so it builds independently, or align its buildArgs/buildSecrets with the leader.`))}return E(void 0)}var lRr,N_e,__e=w(()=>{"use strict";Ce();ZT();lRr=Object.defineProperty,N_e=(t,e)=>lRr(t,"name",{value:e,configurable:!0});N_e(O_e,"canonicaliseInputs");N_e(Zae,"stableStringify");N_e(zP,"validateBuildGroup")});import{ECRClient as fRr,CreateRepositoryCommand as hRr,PutLifecyclePolicyCommand as gRr}from"@aws-sdk/client-ecr";async function $_e(t,e,r){let n=t.getClient(fRr);try{await n.send(new hRr({repositoryName:e,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"MUTABLE"}),{abortSignal:ee(r)}),z.debug(yRr,"Created build-cache repository",{cacheRepositoryName:e})}catch(a){if(Nt(a)!=="RepositoryAlreadyExistsException")return y(new Error(`Could not create build-cache repository '${e}': ${S(T(a))}`))}try{await n.send(new gRr({repositoryName:e,lifecyclePolicyText:mM(lW)}),{abortSignal:ee(r)})}catch(a){return y(new Error(`Could not set lifecycle policy on build-cache repository '${e}': ${S(T(a))}`))}return E(void 0)}var pRr,mRr,yRr,LAt=w(()=>{"use strict";Ce();$();hv();Ct();vt();pRr=Object.defineProperty,mRr=(t,e)=>pRr(t,"name",{value:e,configurable:!0}),yRr="EcrCacheRepository";mRr($_e,"ensureBuildCacheRepository")});import{isAbsolute as FAt,join as L_e,dirname as SRr,resolve as M_e}from"node:path";import{existsSync as F_e}from"node:fs";function jAt(t,e,r){let n=L_e(e,t);if(F_e(n))return{path:n,base:e};if(r!==""&&r!==e){let a=L_e(r,t);if(F_e(a))return{path:a,base:r}}return{path:n,base:e}}function BAt(t,e,r){let n=t.docker.path,a=t.docker.context,o,s;if(FAt(n))o=n,s=e;else{let i=jAt(n,e,r);o=i.path,s=i.base}return{buildContext:a?FAt(a)?M_e(a):M_e(s,a):M_e(SRr(o)),dockerfilePath:o,target:t.docker.target,resolvedViaFallback:s!==e}}function UAt(t){return`${t.buildContext}|${t.dockerfilePath}|${t.target??""}`}function VAt(t,e){return`Dockerfile not found for service '${t}' at ${e}. Checked the synth directory and the working directory. If your Dockerfile lives at the project root with the CDK app in a subdirectory, set an absolute docker.context (the build context must share the Dockerfile's directory).`}function zAt(t){return t.startsWith("cn-")?"amazonaws.com.cn":"amazonaws.com"}function j_e(t,e){return`${t}.dkr.ecr.${e}.${zAt(e)}`}function GP(t,e,r){return`${j_e(t,e)}/${bn(r)}`}function GAt(t,e,r){return`${j_e(t,e)}/${fv(bn(r))}`}function WAt(t,e,r){let n=new Map;for(let a of t){let o=BAt(a,e,r),s=UAt(o),i=n.get(s);i?i.members.push(a):n.set(s,{identity:o,members:[a]})}return Array.from(n.values())}async function HAt(t,e,r,n,a,o){let s=await t.buildAndPush({appName:e.appName,appPath:e.path,region:r,accountId:n,...a!==void 0&&{abortSignal:a}},(i,c,l,u)=>{o.onDockerProgress?.(S(i),c,l,u)});return s.success?E({imageUri:s.data.imageUri,imageTag:s.data.imageTag}):y(s.error)}function hM(){return{contentHashTagsByService:{},imageDigestsByService:{}}}async function qAt(t,e,r,n,a,o,s,i,c,l,u,d,p,m){let f=t.members[0];if(!F_e(t.identity.dockerfilePath))return y(new Error(VAt(f.name,t.identity.dockerfilePath)));t.identity.resolvedViaFallback&&i.onLog?.(`Building service '${f.name}' from ${t.identity.dockerfilePath} (resolved at the project root).`,"info");let g=[...f.docker.buildSecrets??[],...p??[]],v=zP({serviceName:f.name,dockerfilePath:t.identity.dockerfilePath,buildContext:t.identity.buildContext,...t.identity.target!==void 0&&{target:t.identity.target},...f.docker.buildArgs!==void 0&&{buildArgs:f.docker.buildArgs},...g.length>0&&{buildSecrets:g},members:t.members.map(B=>({serviceName:B.name,...B.docker.buildArgs!==void 0&&{buildArgs:B.docker.buildArgs},...B.docker.buildSecrets!==void 0&&{buildSecrets:B.docker.buildSecrets}}))});if(!v.success)return y(v.error);let b=cM(f.docker.buildArgs,bn(r.appName));for(let B of b.warnings){let j=S(B.message);m(j)&&i.onLog?.(j,"warn")}if(b.findings.length>0)return y(new Error(S(b.findings.map(B=>B.message).join(" "))));let A=g,C=jP(f.docker.buildArgs),x={appName:r.appName,region:n,accountId:a,partition:rE(n)},k=await bC(c,[...A,...C],x);if(!k.success)return y(k.error);let I=k.data,R=await VP({manifestBuildArgs:f.docker.buildArgs,serviceDir:t.identity.buildContext,appDir:r.path,...u!==void 0&&{stage:u},shellEnv:process.env,...d!==void 0&&{flagBuildArgs:d},resolveSourcedValue:Qi((B,j)=>UP(I,{id:B,...j},l),"resolveSourcedValue")});if(!R.success)return y(R.error);let N=R.data.buildArgs;for(let B of R.data.inferredDotenvKeys){let j=S(`buildArg "${B}" was auto-declared from a .env file and will be baked into the image \u2014 ${vC}.`);m(j)&&i.onLog?.(j,"warn")}let _=uM(N,bn(r.appName),lM(f.docker.buildArgs));if(_.length>0)return y(new Error(S(_.map(B=>B.message).join(" "))));let M;if(A.length>0){let B=await BP(I,A,l);if(!B.success)return y(B.error);M=B.data}try{if(Ae(l))return y(new Error(`Build of service '${f.name}' was aborted before the docker build started`));let B=t.members.some(V=>V.isLambda===!0),j=new Set(t.members.map(V=>V.architecture).filter(V=>V!==void 0));if(j.size>1)return y(new Error(`Build group for '${f.name}' contains Lambda members targeting different architectures (${Array.from(j).join(", ")}) \u2014 members sharing one Dockerfile/context/target build as a single image and must agree on \`architecture\`. Give the differing Lambda a distinct docker.path/context/target, or align their \`architecture\` props.`));let[U]=j;if(t.members.some(V=>V.isLambda!==!0)&&U!==void 0&&U!==Qb)return y(new Error(`Build group for '${f.name}' declares Lambda architecture '${U}' but also contains ECS service members \u2014 fjall ECS tasks always run on '${Qb}', so an image shared between ECS and Lambda must build for '${Qb}'. Give the Lambda a distinct docker.path/context/target, or align its \`architecture\` prop.`));let G={appName:r.appName,appPath:t.identity.buildContext,region:n,accountId:a,buildContext:t.identity.buildContext,dockerfilePath:t.identity.dockerfilePath,pushByDigest:!0,serviceName:f.name,targetsLambda:B,...U!==void 0&&{platform:Mae(U)},...s!==void 0&&{cacheRepoUri:s},...t.identity.target!==void 0&&{target:t.identity.target},...Object.keys(N).length>0&&{buildArgs:N},...M!==void 0&&{buildSecrets:M.resolved},...l!==void 0&&{abortSignal:l}};return await KAt(t,G,e,o,i)}finally{M!==void 0&&await M.cleanup().catch(()=>i.onLog?.("Build-secret cleanup failed.","warn"))}}async function KAt(t,e,r,n,a){let o=await r.buildAndPush(e,(d,p,m,f)=>{a.onDockerProgress?.(S(d),p,m,f)});if(!o.success)return y(o.error);let s=o.data.imageDigest;if(typeof s!="string"||!s.startsWith("sha256:"))return y(new Error(`Buildx push succeeded but returned an invalid digest: ${S(String(s))}`));let i={},c={},l=[];for(let d of t.members){let p=d.docker.target,m=IT(s,d.name,p);if(!m.success)return y(m.error);let f=m.data,g=d.name;i[g]=f,c[g]=s,l.push(`${n}:${f}`)}let u=await r.tagByDigest({sourceImage:n,digest:s,tags:l});return u.success?E({contentHashTagsByService:i,imageDigestsByService:c}):y(u.error)}function YAt(t,e){let r=new Map(t.map(n=>[n.name,n]));for(let n of e){let a=r.get(n.name);if(a!==void 0&&JSON.stringify(a.docker)!==JSON.stringify(n.docker))throw new Error(`ECS service "${a.name}" and Lambda image key "${n.name}" share one build key but declare different docker configs \u2014 the second build would silently overwrite the first and both would deploy the same image. Rename one of them, or make the docker configs identical to deliberately share the build.`)}}async function yW(t,e,r,n){let a=t.dockerProvider;if(!a)return E(hM());let o=e.awsProvider.getAccountId();if(!o)return n.onLog?.("Skipping Docker build \u2014 account ID not available","warn"),E(hM());let s=e.awsProvider.getRegion(),i=L_e(r.path,"cdk.out"),c;try{let b=Uy(i),A=a$(i);YAt(b,A),c=[...b,...A]}catch(b){let A=new Error(S(T(b)));return n.onError?.(A),y(A)}let l=GP(o,s,r.appName);if(z.debug(gW,"runDockerBuild starting",{appName:r.appName,appPath:r.path,accountId:o,region:s,cdkOutPath:i,manifestServiceCount:c.length,manifestServices:c.map(b=>({name:b.name,path:b.docker.path,context:b.docker.context,target:b.docker.target})),stepId:ve.DOCKER_OPERATIONS,stepName:tg}),n.onStepStart?.(ve.DOCKER_OPERATIONS,tg),c.length===0){n.onLog?.("Initialising ECR repository\u2026","info");let b=await a.initialiseECR({appName:r.appName,region:s,accountId:o});b.success||n.onLog?.(`ECR initialisation failed: ${S(b.error.message)}`,"warn"),n.onLog?.("Building and pushing Docker image\u2026","info");let A=await HAt(a,r,s,o,t.abortSignal,n);if(!A.success){z.debug(gW,"Docker buildAndPush (legacy) failed",{appName:r.appName,error:S(A.error.message)}),n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"error");let C=new Error(S(A.error.message));return n.onError?.(C),y(C)}return n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"completed"),n.onLog?.(`Docker image pushed: ${A.data.imageUri}`,"info"),E(hM())}let u=await a.preflight?.();if(u!==void 0&&!u.success){n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"error");let b=new Error(S(u.error.message));return n.onError?.(b),y(b)}let d=WAt(c,r.path,t.workingDirectory),p=GAt(o,s,r.appName),m=await $_e(e.awsProvider,fv(bn(r.appName)),t.abortSignal);m.success||(p=void 0,n.onLog?.(`Building without registry cache \u2014 ${m.error.message}`,"warn")),n.onLog?.(`Building and pushing ${c.length} service image(s) in ${d.length} group(s)\u2026`,"info");let f=!1;if(a.beginEcrSession!==void 0){let b=await a.beginEcrSession({accountId:o,region:s,...t.abortSignal!==void 0&&{abortSignal:t.abortSignal}});if(!b.success){n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"error");let A=new Error(S(b.error.message));return n.onError?.(A),y(A)}f=!0}let g=new AbortController,v=Qi(()=>g.abort(),"onCallerAbort");t.abortSignal!==void 0&&(t.abortSignal.aborted?g.abort():t.abortSignal.addEventListener("abort",v,{once:!0}));try{let b=Qi(()=>Ae(t.abortSignal)?"the deployment was cancelled":"a sibling group failed","skipCause"),A,C=dW(d.length),x=iM(),k=d.map((_,M)=>async()=>{let B=_.members.map(U=>U.name).join(", ");if(g.signal.aborted)throw new Error(`Build of group ${M+1}/${d.length} (${B}) was not started \u2014 ${b()}`);n.onLog?.(`Building group ${M+1}/${d.length} (${B})\u2026`,"info");let j=await qAt(_,a,r,s,o,l,p,n,e.awsProvider,g.signal,t.options?.environment,t.options?.flagBuildArgs,t.options?.flagBuildSecrets,x);if(!j.success)throw A===void 0&&(A={error:j.error,leader:_.members[0]?.name,members:B}),g.abort(),j.error;return j.data}),I=await uW(k,C,{abortOnFirstFailure:!0,abortSignal:g.signal});if(A===void 0)for(let _=0;_<d.length;_++){let M=I[_];if(!(M!==void 0&&M.success)){A={error:M!==void 0&&!M.success?M.error:new Error(`Build of group ${_+1}/${d.length} never ran \u2014 ${b()}`),leader:d[_].members[0]?.name,members:d[_].members.map(B=>B.name).join(", ")};break}}if(A!==void 0){z.debug(gW,"Docker buildAndPush failed",{appName:r.appName,leader:A.leader,members:A.members,error:S(A.error.message)}),n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"error");let _=new Error(S(A.error.message));return n.onError?.(_),y(_)}let R={},N={};for(let _ of I)if(!(_===void 0||!_.success)){for(let[M,B]of Object.entries(_.data.contentHashTagsByService))R[M]=B;for(let[M,B]of Object.entries(_.data.imageDigestsByService))N[M]=B}return z.debug(gW,"Docker buildAndPush succeeded",{appName:r.appName,services:c.map(_=>_.name),groupCount:d.length,contentHashTags:R}),n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"completed"),n.onLog?.(`Docker images pushed for ${c.length} service(s)`,"info"),E({contentHashTagsByService:R,imageDigestsByService:N,repoUri:l})}finally{t.abortSignal?.removeEventListener("abort",v),f&&a.endEcrSession!==void 0&&await a.endEcrSession().catch(b=>{z.debug(gW,"endEcrSession cleanup failed",{error:S(T(b))})})}}var vRr,Qi,gW,tg,vW=w(()=>{"use strict";Ce();$();hv();T_e();Ct();Vy();Cw();vt();I_e();fW();D_e();__e();LAt();vRr=Object.defineProperty,Qi=(t,e)=>vRr(t,"name",{value:e,configurable:!0}),gW="dockerBuildHelper",tg="Building and pushing Docker image";Qi(jAt,"resolveAgainstBases");Qi(BAt,"resolveBuildIdentity");Qi(UAt,"buildIdentityKey");Qi(VAt,"dockerfileNotFoundMessage");Qi(zAt,"ecrDnsSuffix");Qi(j_e,"ecrRegistryHost");Qi(GP,"ecrRepoUri");Qi(GAt,"ecrCacheRepoUri");Qi(WAt,"groupServicesByIdentity");Qi(HAt,"buildLegacyFallback");Qi(hM,"emptyBuildProducts");Qi(qAt,"buildGroup");Qi(KAt,"buildGroupWithParams");Qi(YAt,"assertNoCrossEntityBuildKeyDivergence");Qi(yW,"runDockerBuild")});async function U_e(t,e,r,n){let a=t.dockerProvider;if(!a)return E(void 0);let o=e.awsProvider.getAccountId();if(!o)return n.onLog?.("Skipping ECR initialisation \u2014 account ID not available","warn"),E(void 0);let s=e.awsProvider.getRegion();n.onStepStart?.(ve.DOCKER_OPERATIONS,"Initialising container repository"),n.onLog?.("Initialising ECR repository with welcome image\u2026","info");let i=await a.initialiseECR({appName:r.appName,region:s,accountId:o});if(i.success||n.onLog?.(S(`ECR initialisation warning: ${i.error.message}`),"warn"),n.onStepComplete?.(ve.DOCKER_OPERATIONS,"Initialising container repository","completed"),a.tagImages){n.onStepStart?.(ve.TAG_ECR_IMAGES,B_e),n.onLog?.("Tagging ECR images for ECS services\u2026","info");let c=ZAt(u=>{n.onLog?.(S(u),"info")},"tagProgress"),l=await a.tagImages({appName:r.appName,appPath:r.path,region:s,accountId:o},c);if(!l.success){let u=new Error(S(l.error.message));return n.onError?.(u),n.onStepComplete?.(ve.TAG_ECR_IMAGES,B_e,"error"),y(u)}n.onLog?.(`Tagged ${l.data.taggedServices.length} service(s): ${l.data.taggedServices.join(", ")}`,"info");for(let u of l.data.taggedServices)n.onStepStart?.(`tag-ecr-images-${u}`,`Tagged ${u}`),n.onStepComplete?.(`tag-ecr-images-${u}`,`Tagged ${u}`,"completed");n.onStepComplete?.(ve.TAG_ECR_IMAGES,B_e,"completed")}return E(void 0)}var bRr,ZAt,B_e,JAt=w(()=>{"use strict";Ce();$();Cw();bRr=Object.defineProperty,ZAt=(t,e)=>bRr(t,"name",{value:e,configurable:!0}),B_e="Tagging container images";ZAt(U_e,"runWelcomeImageSetup")});import{join as ARr}from"node:path";function V_e(t){let e=new Set;for(let r of t.deployOrder){let n=nr(t.appName,r),a=t.stackChanges.get(n)??!0,o=r===Te.COMPUTE&&t.computeBuildPossible;(a||t.force||o)&&e.add(n)}return e}function z_e(t){return!t.infraOnly&&t.stackNamesToDeploy.has(nr(t.appName,Te.COMPUTE))&&t.hasDockerProvider&&t.hasDockerfile}function G_e(t,e,r,n){let a=new Set(Th.PHASE_2.stacks),o=[];for(let i=e;i<t.length&&a.has(t[i]);i++)o.push(t[i]);if(o.length<2)return[];let s=o.filter(i=>n.has(nr(r,i)));return s.length>=2?s:[]}async function W_e(t,e,r,n,a,o,s,i,c,l){for(let p=0;p<t.length;p++){let m=t[p],f=Dn(m,"deploy"),g=Rn(m,"deploy");a.onStepStart?.(f,g,o+p,s)}wb(a,"Deploying infrastructure in parallel\u2026"),a.onParallelPhaseStart?.(t,"Storage and database resources (parallel)");let u=await r.stackService.deployStacksInParallel(t,n,{onOutput:Yi(a),onResourceProgress:zd((p,m)=>{a.onResourceProgress?.(p),m&&a.onParallelStackResourceProgress?.(m,p)},"onResourceProgress"),onStackComplete:zd((p,m,f,g)=>{let v=Dn(p,"deploy"),b=Rn(p,"deploy"),A=o+t.indexOf(p),C=Ae(r.abortSignal);a.onStepComplete?.(v,b,m?"completed":C?"cancelled":"error",A,s),!m&&g&&!C&&a.onError?.(new Error(S(g.message)))},"onStackComplete")});if(!u.success)return a.onParallelPhaseComplete?.([]),y(u.error);let d=u.data.filter(p=>!p.success);if(a.onParallelPhaseComplete?.(u.data.map(p=>({stack:p.stack,success:p.success,error:p.error}))),d.length>0){let p=d.map(f=>f.stack).join(", "),m=d.map(f=>`${f.stack}: ${S(f.error?.message??"Unknown error")}`).join(`
 `);return y(new Error(`Failed to deploy stacks: ${p}
 
-${m}`))}for(let p of u.data){if(p.success&&p.outputs)for(let[g,v]of Object.entries(p.outputs))c[g]=String(v);let m=nr(e.appName,p.stack),f=i.currentHashes.get(m);f&&l.set(m,f)}return E(void 0)}async function H_e(t,e,r,n,a,o,s,i){let c=Dn(t,"deploy"),l=Rn(t,"deploy");return _P(n,{stepId:c,stepName:l,stepIndex:a,totalSteps:o},async()=>{let u=await e.stackService.deployStack(t,r,{onOutput:Yi(n),onResourceProgress:Pb(n)},i?.parameters!==void 0||i?.abortSignal!==void 0?{...i?.parameters!==void 0?{parameters:i.parameters}:{},...i?.abortSignal!==void 0?{abortSignal:i.abortSignal}:{}}:void 0);if(!u.success)return{kind:"error",error:u.error};if(u.data.outputs)for(let[d,p]of Object.entries(u.data.outputs))s[d]=String(p);return{kind:"completed",data:void 0}},e.abortSignal)}async function q_e(t,e,r,n,a,o){if(t!==Te.COMPUTE||!e.dockerProvider)return null;if(o){let i=await yW(e,r,n,a);return i.success?E(i.data):y(i.error)}let s=await U_e(e,r,n,a);return s.success?E(hM()):y(s.error)}async function K_e(t,e,r,n,a){if(Object.keys(n).length===0)return{};let o=ARr(t.path,"cdk.out"),s=Od(o).filter(c=>n[c.imageKey]!==void 0);if(s.length===0)return{};let i={};for(let c of s){if(Ae(a)){r.onLog?.(`Skipping the Lambda version publish for '${c.name}' \u2014 the deployment was cancelled. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}let l=await e.lambdaService.publishVersion(c.name,a);if(!l.success){r.onLog?.(`Published image for Lambda '${c.name}', but publishing a new version failed: ${S(l.error.message)}. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}i[c.name]=l.data}return i}function Y_e(t){return{onBuildStart:zd(e=>{t.onOpenNextBuildStart?.(),t.onLog?.(`${e} build started`,"info")},"onBuildStart"),onBuildProgress:zd((e,r)=>{t.onOpenNextProgress?.(r)},"onBuildProgress"),onBuildComplete:zd(e=>{t.onOpenNextBuildComplete?.(),t.onLog?.(`${e} build complete`,"info")},"onBuildComplete"),onBuildError:zd((e,r)=>{t.onOpenNextBuildError?.(r)},"onBuildError")}}var ERr,zd,XAt=w(()=>{"use strict";Ce();$();Vy();vt();Oo();rz();_d();vW();JAt();_ae();ERr=Object.defineProperty,zd=(t,e)=>ERr(t,"name",{value:e,configurable:!0});zd(V_e,"getStackNamesToDeploy");zd(z_e,"willRunDockerBuild");zd(G_e,"getParallelPhase2Stacks");zd(W_e,"deployParallelPhase");zd(H_e,"deployStackSequential");zd(q_e,"runDockerPreCompute");zd(K_e,"runLambdaVersionPublish");zd(Y_e,"createBuildCallbacks")});import{join as CRr}from"node:path";function Z_e(t,e,r,n){return`Assembly integrity check failed for ${t}: ${n} after change detection.${r?" The approved plan no longer matches what would deploy.":""} Another process likely re-synthesised ${e} mid-deploy. Nothing was deployed for this stack \u2014 re-run 'fjall deploy --plan' against the current working tree and approve the new plan.`}async function Jae(t){for(let e of t.stackNames){let r=t.detectionHashes.get(e);if(r===void 0)continue;let n=CRr(t.cdkOutPath,`${e}.template.json`),a=await t.hashService.computeTemplateHash(n);if(!a.success)return y(new Error(Z_e(e,t.cdkOutPath,t.approvalGated,"its synthesised template could no longer be read")));if(a.data!==r)return y(new Error(Z_e(e,t.cdkOutPath,t.approvalGated,"its synthesised template changed")))}return E(void 0)}var wRr,QAt,ewt=w(()=>{"use strict";Ce();wRr=Object.defineProperty,QAt=(t,e)=>wRr(t,"name",{value:e,configurable:!0});QAt(Z_e,"integrityFailureMessage");QAt(Jae,"verifyAssemblyIntegrity")});function gM(t,e){let r=t.toLowerCase(),n=e.toLowerCase();return r===n||r.endsWith(n)}function J_e(t,e){let r=Object.entries(e),n=[],a=[],o=new Set,s=t.map(p=>{let m=Ei(p)??p;return{serviceArn:p,serviceName:m,lowerName:m.toLowerCase()}}),i=new Map,c=new Set;for(let p of s){let m=r.find(([f])=>f.toLowerCase()===p.lowerName);m!==void 0&&(i.set(p.serviceArn,m),c.add(m[0]))}let l=new Map,u=new Map;for(let p of s){if(i.has(p.serviceArn))continue;let m=r.filter(([f])=>!c.has(f)&&gM(p.serviceName,f)).sort(([f],[g])=>g.length-f.length)[0];m!==void 0&&(l.set(p.serviceArn,m),u.set(m[0],(u.get(m[0])??0)+1))}for(let p of s){let m=l.get(p.serviceArn),f=i.get(p.serviceArn)??(m!==void 0&&u.get(m[0])===1?m:void 0);if(f===void 0){a.push(p.serviceName);continue}let[g,v]=f;o.add(g),n.push({serviceArn:p.serviceArn,serviceName:p.serviceName,tag:v,mapKey:g})}let d=r.map(([p])=>p).filter(p=>!o.has(p));return{matched:n,unmatchedLiveServiceNames:a,staleMapKeys:d}}function Xae(t,e,r){let n=t.filter(s=>s.image!==void 0),a=n.map(s=>s.name||"(unnamed)").join(", ")||"none";if(r!==void 0){let s=n.find(i=>(i.name??"").toLowerCase()===r.toLowerCase());return s===void 0?y(new Error(`Container "${r}" not found on ${e}'s task definition. Available: ${a}`)):E({name:s.name??"",image:s.image})}if(n.length===0)return y(new Error(`${e}'s task definition has no container image to retag`));if(n.length===1){let s=n[0];return E({name:s.name??"",image:s.image})}let o=n.filter(s=>(s.portMappings?.length??0)>0);if(o.length===1){let s=o[0];return E({name:s.name??"",image:s.image})}return y(new Error(`${e} has multiple containers (${a}) and no single primary container could be determined \u2014 pass --container-name <name> to target one explicitly.`))}async function nE(t,e,r,n,a){let o=await t.ecsService.describeServices(e,[r],a);if(!o.success)return y(new Error(`Failed to describe service ${n}: ${S(o.error.message)}`));let s=o.data[0];if(!s?.taskDefinition)return y(new Error(`Service ${n} has no task definition`));let i=s.taskDefinition,c=await t.ecsService.getLatestTaskDefinition(i,a);if(!c.success)return y(new Error(`Failed to fetch task definition for ${n}: ${S(c.error.message)}`));let l=c.data;if(!l||!l.containerDefinitions||l.containerDefinitions.length===0)return y(new Error(`Task definition for ${n} has no container definitions`));let u=l.containerDefinitions,d=u.find(m=>m.image)?.image;if(!d)return y(new Error(`Task definition for ${n} has no container image \u2014 cannot derive repository URI`));let p=nf(d);return E({previousTaskDefArn:i,taskDefinition:l,containerDefinitions:u,repoUri:p})}async function X_e(t,e,r,n){let a=new Map;for(let o of r){if(Ae(n))return y(new Error("Pre-flight cancelled. No service was rolled."));let s=await nE(t,e,o.serviceArn,o.serviceName,n);if(!s.success)return y(new Error(`Pre-flight failed resolving the current task definition for ${o.serviceName} (tag ${o.tag}): ${S(s.error.message)}. No service was rolled.`));let i=Xae(s.data.containerDefinitions,o.serviceName);if(!i.success)return y(new Error(`Pre-flight failed selecting a container to retag for ${o.serviceName} (tag ${o.tag}): ${S(i.error.message)}. No service was rolled.`));let c=nf(i.data.image),l=await t.ecrImageInspector.getImageDigest(c,o.tag,n);if(!l.success||l.data===void 0){let u=l.success?"ECR returned no digest for this tag (non-ECR repository, or the image is missing)":S(l.error.message);return y(new Error(`Pre-flight digest resolution failed for ${o.serviceName} (tag ${o.tag}): ${u}. No service was rolled.`))}a.set(o.serviceArn,{taskDefinition:s.data,imageDigest:l.data,containerName:i.data.name,repoUri:c})}return E(a)}var xRr,SW,Qae=w(()=>{"use strict";Ce();$();Ab();vt();Z1();xRr=Object.defineProperty,SW=(t,e)=>xRr(t,"name",{value:e,configurable:!0});SW(gM,"matchesServiceName");SW(J_e,"matchServiceImageTagsToLiveServices");SW(Xae,"selectContainerToRetag");SW(nE,"resolveServiceTaskDefinition");SW(X_e,"preflightResolveServiceImageTagDigests")});async function WP(t,e,r,n){let{clusterArn:a,serviceArn:o,serviceName:s,taskDefinition:i,containerDefinitions:c,previousTaskDefArn:l,imageDigest:u,startedAtMs:d}=e,p=i.family;if(!p)return y(new Error(`Task definition for ${s} has no family`));let m=await t.ecsService.registerTaskDefinition({family:p,taskRoleArn:i.taskRoleArn,executionRoleArn:i.executionRoleArn,networkMode:i.networkMode,containerDefinitions:c,volumes:i.volumes,placementConstraints:i.placementConstraints,requiresCompatibilities:i.requiresCompatibilities,cpu:i.cpu,memory:i.memory,runtimePlatform:i.runtimePlatform,proxyConfiguration:i.proxyConfiguration,inferenceAccelerators:i.inferenceAccelerators,pidMode:i.pidMode,ipcMode:i.ipcMode,ephemeralStorage:i.ephemeralStorage},n);if(!m.success)return y(new Error(`Failed to register task definition for ${s}: ${m.error.message}`));let f=m.data;r.onTaskDefRegistered?.({serviceName:s,taskDefinitionArn:f,previousTaskDefinitionArn:l,revision:twt(f),family:p,...u!==void 0?{imageDigest:u}:{}});let g=await t.ecsService.updateService(a,o,{taskDefinition:f,forceNewDeployment:!0},n);if(!g.success)return y(new Error(`Failed to update service ${s}: ${g.error.message}`));let v=await t.ecsService.pollDeployment({clusterArn:a,serviceArn:o,waitForCompletion:!0,progressCallback:Q_e(C=>{let x=C.latestEvent?` \u2014 ${S(C.latestEvent)}`:"";r.onECSProgress?.(`${s}: ${S(C.message)}${x}`,C.percentComplete)},"progressCallback")}),b=Date.now()-d;if(!v.success){let C=S(v.error.message);return r.onECSComplete?.({serviceName:s,serviceArn:o,success:!1,taskDefinitionArn:f,durationMs:b,reason:C}),y(new Error(`ECS rollout failed for ${s}: ${C}`))}let A=await t.ecsService.getDeploymentStatus(a,o);return r.onECSComplete?.({serviceName:s,serviceArn:o,success:!0,taskDefinitionArn:f,durationMs:b,finalRunningCount:A.success?A.data.runningCount:void 0,finalDesiredCount:A.success?A.data.desiredCount:void 0}),z.debug(kRr,`Rolled ${s} successfully`,{serviceArn:o,newTaskDefArn:f,previousTaskDefArn:l,durationMs:b}),E({newTaskDefArn:f,durationMs:b})}function twt(t){let e=t.lastIndexOf(":");if(e<0)return 0;let r=t.slice(e+1);return/^\d+$/.test(r)?parseInt(r,10):0}var TRr,Q_e,kRr,eoe=w(()=>{"use strict";Ce();Ct();$();TRr=Object.defineProperty,Q_e=(t,e)=>TRr(t,"name",{value:e,configurable:!0}),kRr="taskDefinitionRoll";Q_e(WP,"registerAndRollTaskDefinition");Q_e(twt,"extractRevision")});async function roe(t,e,r){let n=nr(e,Te.DATABASE),a=await t.getStackOutputs(n,void 0,r);if(!a.success){z.debug(toe,"Could not read database stack outputs",{stackName:n,error:S(a.error.message)});return}let o={};for(let s of a.data){let i=s.OutputKey,c=s.OutputValue;i===void 0||c===void 0||IRr.some(l=>i.endsWith(l))&&(o[i]=c)}return o}async function e1e(t,e,r,n){let a=await t.getDeployableClusterAndServices(r,n);if(!a.success){z.debug(toe,"Could not discover services pre-deploy",{appName:r,error:S(a.error.message)});return}let{clusterArn:o,serviceArns:s}=a.data;if(o===void 0||s.length===0)return{};let i=await e.describeServices(o,s,n);if(!i.success){z.debug(toe,"Could not describe services pre-deploy",{appName:r,error:S(i.error.message)});return}let c={};for(let l of i.data)l.serviceArn!==void 0&&l.taskDefinition!==void 0&&(c[l.serviceArn]=l.taskDefinition);return c}function rwt(t,e){return Object.keys(t).filter(r=>e[r]!==void 0&&e[r]!==t[r]).sort()}async function t1e(t){let{appName:e,connectionOutputsBefore:r,services:n,callbacks:a,abortSignal:o}=t,s=`Run \`fjall rollout ${e}\` to restart them manually.`,i=`Could not verify the database endpoint was unchanged by this deploy. If the database was replaced (e.g. restored from a snapshot), run \`fjall rollout ${e}\` so running services reconnect to it.`;if(r===void 0)return a.onLog?.(i,"warn"),{kind:"unverified"};let c=await roe(n.cfnService,e);if(c===void 0)return a.onLog?.(i,"warn"),{kind:"unverified"};let l=rwt(r,c);if(l.length===0)return{kind:"not-needed"};if(a.onLog?.(`Database connection outputs changed this deploy (${l.join(", ")}) \u2014 the database was replaced.`,"info"),Ae(o))return a.onLog?.(`Deploy cancelled before services were restarted onto the new database endpoint. ${s}`,"warn"),{kind:"cancelled"};let u=await n.ecsResolver.getDeployableClusterAndServices(e,o);if(!u.success)return a.onLog?.(`Could not discover this application's ECS services to restart them onto the new database endpoint: ${S(u.error.message)}. ${s}`,"warn"),{kind:"failed"};let{clusterArn:d,serviceArns:p}=u.data;if(d===void 0||p.length===0)return a.onLog?.(`Database connection outputs changed but no running ECS services were found to restart. If this application has running services, run \`fjall rollout ${e}\` so they reconnect to the new database endpoint.`,"warn"),{kind:"not-needed"};let m=t.serviceTaskDefinitionsBefore,f=m!==void 0&&Object.keys(m).length>0,g=[],v=0,b=0,A=bW((x,k)=>{a.onLog?.(`Could not restart ${x} onto the new database endpoint: ${S(k)}. ${s}`,"warn"),b+=1},"warnServiceFailure");for(let x of p){if(Ae(o))return a.onLog?.(`Deploy cancelled before services were restarted onto the new database endpoint. ${s}`,"warn"),{kind:"cancelled"};let k=Ei(x)??x,I=await nE({ecsService:n.ecsService},d,x,k,o);if(!I.success){A(k,I.error.message);continue}let R=m?.[x];if(f&&R===void 0){v+=1;continue}if(R!==void 0&&R!==I.data.previousTaskDefArn){v+=1;continue}g.push({serviceArn:x,serviceName:k,resolved:I.data})}if(g.length===0)return b>0?{kind:"failed"}:(a.onLog?.(`Services were already relaunched during this deploy \u2014 no restart needed. If something other than this deploy relaunched them, run \`fjall rollout ${e}\` to be safe.`,"info"),{kind:"already-current"});if(t.confirmRestart!==void 0){let x={appName:e,changedOutputs:l,serviceCount:g.length},k;try{k=await t.confirmRestart(x)}catch(I){return a.onLog?.(`Restart confirmation failed: ${S(I instanceof Error?I.message:String(I))}. ${s}`,"warn"),{kind:"failed"}}if(!k)return a.onLog?.(`Restart declined \u2014 running containers are still connected to the old database endpoint. ${s}`,"warn"),{kind:"declined"}}a.onLog?.(`Restarting ${g.length} service${g.length===1?"":"s"} so running containers reconnect to the new database\u2026`,"info");let C=[];for(let x of g){if(Ae(o))return a.onLog?.(`Deploy cancelled before all services were restarted onto the new database endpoint. ${s}`,"warn"),{kind:"cancelled"};let k=x.resolved;if(t.confirmRestart!==void 0){let R=await nE({ecsService:n.ecsService},d,x.serviceArn,x.serviceName,o);if(!R.success){A(x.serviceName,R.error.message);continue}if(R.data.previousTaskDefArn!==x.resolved.previousTaskDefArn){a.onLog?.(`${x.serviceName} was relaunched while awaiting confirmation \u2014 skipping its restart.`,"info");continue}k=R.data}let I=await WP({ecsService:n.ecsService},{clusterArn:d,serviceArn:x.serviceArn,serviceName:x.serviceName,taskDefinition:k.taskDefinition,containerDefinitions:k.containerDefinitions,previousTaskDefArn:k.previousTaskDefArn,startedAtMs:Date.now()},a,o);if(!I.success){A(x.serviceName,I.error.message);continue}C.push(x.serviceName)}return C.length>0&&(z.debug(toe,"Restarted services after database replacement",{appName:e,changedOutputs:l,services:C,alreadyRolled:v}),a.onLog?.(`Restarted ${C.length} service${C.length===1?"":"s"} onto the new database endpoint.`,"info")),b>0?{kind:"failed"}:{kind:"reconciled",services:C}}var PRr,bW,toe,IRr,nwt=w(()=>{"use strict";$();Ct();Oo();Ab();vt();Qae();eoe();PRr=Object.defineProperty,bW=(t,e)=>PRr(t,"name",{value:e,configurable:!0}),toe="databaseEndpointReconcile",IRr=["Endpoint","Port"];bW(roe,"captureDatabaseConnectionOutputs");bW(e1e,"captureServiceTaskDefinitions");bW(rwt,"diffConnectionOutputs");bW(t1e,"reconcileDatabaseEndpointChange")});import{join as r1e}from"path";function noe(){return{outputs:{},artefacts:[],failures:[],rolledImageKeys:[]}}function aoe(t,e,r){return Ae(r)?(t.failures.push(`${e}: rollout cancelled before this function was reached`),!0):!1}function awt(t,e,r,n,a,o,s){let i=EC(a),c=`${a}:${n}`;t.outputs[el(e,"ImageTag")]=n,t.outputs[el(e,"ImageUri")]=c,t.outputs[el(e,"ImageDigest")]=o,i!==""&&(t.outputs[el(e,"EcrRepositoryArn")]=i),t.artefacts.push({serviceName:e,imageTag:n,imageUri:c,imageDigest:o,...i!==""?{ecrRepositoryArn:i}:{},functionArn:s.functionArn,publishedVersion:s.version}),t.rolledImageKeys.some(l=>l.serviceName===r)||t.rolledImageKeys.push({serviceName:r,imageTag:n})}async function ooe(t,e,r,n,a,o,s,i){s.onLog?.(`Updating Lambda function ${r.name} to ${o}`,"info");let c=await t.lambdaService.updateFunctionCode(r.name,`${n}@${a}`,i);if(!c.success){e.failures.push(`${r.name}: ${S(c.error.message)}`);return}c.data.unverifiedReason!==void 0&&s.onLog?.(`Updated ${r.name}, but completion of the update could not be verified: ${c.data.unverifiedReason}`,"warn"),awt(e,r.name,r.imageKey,o,n,a,c.data)}function soe(t,e){return t.toLowerCase()===e.toLowerCase()}function n1e(t,e){return e?t.filter(r=>soe(r.name,e)):t}async function a1e(t,e,r,n,a,o,s,i){let c=noe(),l=r1e(e.path,"cdk.out"),u=n1e(Od(l),s);for(let d of u){if(aoe(c,d.name,i))continue;let p=r[d.imageKey],m=n[d.imageKey];p===void 0||m===void 0||await ooe(t,c,d,a,m,p,o,i)}return c}async function o1e(t,e,r,n,a,o,s){let i=noe(),c=r1e(e.path,"cdk.out"),l=n1e(Od(c),o);if(l.length===0)return i;let u=t.awsProvider.getAccountId(),d=t.awsProvider.getRegion(),p=GP(u,d,e.appName);for(let m of l){if(aoe(i,m.name,s))continue;let f=ioe(r,m.imageKey,n),g=await t.ecrImageInspector.getImageDigest(p,f,s);if(!g.success||g.data===void 0){let v=g.success?"not an ECR repository":S(g.error.message);i.failures.push(`${m.name}: image tag '${f}' (rebased from '${r}') could not be resolved to a digest: ${v}`);continue}await ooe(t,i,m,p,g.data,f,a,s)}return i}async function s1e(t,e,r,n){let a=r1e(e.path,"cdk.out"),o=Od(a).map(u=>({entry:u,tag:r[u.name]})).filter(u=>u.tag!==void 0);if(o.length===0)return E({matched:o,digestsByFunctionName:new Map,repoUri:""});let s=t.awsProvider.getAccountId(),i=t.awsProvider.getRegion(),c=GP(s,i,e.appName),l=new Map;for(let{entry:u,tag:d}of o){if(Ae(n))return y(new Error("Pre-flight cancelled. No function was rolled."));let p=await t.ecrImageInspector.getImageDigest(c,d,n);if(!p.success||p.data===void 0){let m=p.success?"not an ECR repository":S(p.error.message);return y(new Error(`Lambda function '${u.name}': image tag '${d}' could not be resolved to a digest: ${m}. No function was rolled.`))}l.set(u.name,p.data)}return E({matched:o,digestsByFunctionName:l,repoUri:c})}async function i1e(t,e,r,n){let a=noe();for(let{entry:o,tag:s}of e.matched){if(aoe(a,o.name,n))continue;let i=e.digestsByFunctionName.get(o.name);i!==void 0&&await ooe(t,a,o,e.repoUri,i,s,r,n)}return a}var RRr,gv,owt=w(()=>{"use strict";Ce();$();Vy();vt();vW();EW();RRr=Object.defineProperty,gv=(t,e)=>RRr(t,"name",{value:e,configurable:!0});gv(noe,"emptyOutcome");gv(aoe,"pushCancelledIfAborted");gv(awt,"recordLambdaRollout");gv(ooe,"rolloutOne");gv(soe,"matchesLambdaFunctionName");gv(n1e,"filterByService");gv(a1e,"rolloutLambdaPrimary");gv(o1e,"rolloutLambdaImageTag");gv(s1e,"preflightLambdaServiceImageTags");gv(i1e,"executeLambdaServiceImageTagsRollout")});import{join as swt}from"path";function iwt(t,e){if(t)return e[t.name]}function cwt(t,e){let r=e.toLowerCase();return t.find(n=>n.name.toLowerCase()===r)??t.find(n=>r.includes(n.name.toLowerCase()))}function ioe(t,e,r){let n=e.toLowerCase(),a=t.toLowerCase(),o=r.map(i=>i.toLowerCase()).filter(i=>i!==""&&a.startsWith(`${i}-`)).sort((i,c)=>c.length-i.length)[0];if(o===void 0||o===n)return t;let s=t.slice(o.length);return`${n}${s}`}function l1e(t,e,r,n,a){n[el(t,"TaskDefinition")]=r.taskDefinitionArn,n[el(t,"PreviousTaskDefinition")]=r.previousTaskDefinitionArn,n[el(t,"ImageTag")]=e,n[el(t,"ImageUri")]=r.imageUri,n[el(t,"EcrRepositoryArn")]=r.ecrRepositoryArn,r.imageDigest!==void 0&&(n[el(t,"ImageDigest")]=r.imageDigest),a.push({serviceName:t,imageTag:e,imageUri:r.imageUri,taskDefinitionArn:r.taskDefinitionArn,previousTaskDefinitionArn:r.previousTaskDefinitionArn,...r.imageDigest!==void 0?{imageDigest:r.imageDigest}:{},...r.ecrRepositoryArn!==""?{ecrRepositoryArn:r.ecrRepositoryArn}:{}})}async function coe(t,e,r,n,a){if(r.length===0)return;let o=nr(e,Te.COMPUTE),s={};for(let{serviceName:c,imageTag:l}of r)s[uT(c)]=l;let i=await t.cfnService.updateStackParameters(o,s,a);if(!i.success){n.onLog?.(`Rollback succeeded but the CloudFormation ImageTag parameter reconcile failed \u2014 the next full deploy may revert this rollback. Reason: ${S(i.error.message)}`,"warn");return}i.data.skippedKeys.length>0&&(n.onLog?.(`Rollback succeeded but ${i.data.skippedKeys.length} ImageTag parameter(s) were not found on stack ${o} (${i.data.skippedKeys.join(", ")}) \u2014 the next full deploy may revert those services`,"warn"),z.debug(AC,"ImageTag reconcile skipped stale parameters",{stackName:o,skippedKeys:i.data.skippedKeys}))}function c1e(t,e,r,n){if(t.kind==="error")return e.failures.length>0?{kind:"error",error:new Error(`${t.error.message}; Lambda rollout failures: ${e.failures.join("; ")}`)}:t;if(e.failures.length>0)return{kind:"error",error:new Error(`Lambda rollout failures: ${e.failures.join("; ")}`)};let a=t.data,o={...a.outputs??{},...e.outputs};return{kind:"completed",data:{target:r.appName,deploymentType:"application",outputs:Object.keys(o).length>0?o:void 0,artefacts:[...a.artefacts,...e.artefacts],durationMs:Date.now()-n}}}async function u1e(t,e,r,n,a){let{callbacks:o,options:s}=t,i=Date.now(),c=Dn(Te.COMPUTE,"deploy"),l=Rn(Te.COMPUTE,"deploy");return _P(o,{stepId:c,stepName:l,stepIndex:ORr,totalSteps:NRr},async()=>{let u=s?.imageTag,d=s?.serviceImageTags;u?o.onLog?.(`Rolling to supplied image tag ${u}`,"info"):d&&o.onLog?.(`Rolling ${Object.keys(d).length} service(s) to their release-recorded image tags`,"info");let p=Uy(swt(r.path,"cdk.out"));z.debug(AC,"Code-only rollout starting",{explicitRollbackTag:u,serviceImageTags:d,workingDirectory:t.workingDirectory,contentHashTagsByService:n,manifestServiceCount:p.length,manifestServices:p.map(L=>({name:L.name,target:L.docker.target}))}),o.onLog?.("Discovering ECS cluster and services\u2026","info");let m=await e.ecsResolver.getDeployableClusterAndServices(r.appName,t.abortSignal);if(!m.success)return z.debug(AC,"ECS discovery failed",{appName:r.appName,error:S(m.error.message)}),{kind:"error",error:m.error};let{clusterArn:f,serviceArns:g}=m.data;z.debug(AC,"ECS discovery complete",{appName:r.appName,clusterArn:f,serviceCount:g.length,serviceArns:g});let v=Od(swt(r.path,"cdk.out")),b=Array.from(new Set(v.map(L=>L.imageKey))),A=f!==void 0&&g.length>0,C=v.length>0;if(!A&&!C){let L=`No deployable ECS services or container-image Lambda functions found for ${r.appName}`;return o.onLog?.(L,"warn"),{kind:"skipped",data:{target:r.appName,deploymentType:"application",durationMs:Date.now()-i,noChanges:!0,artefacts:[]}}}let x=f??"";if(d!==void 0){let L=J_e(A?g:[],d),H=await s1e(e,r,d,t.abortSignal);if(!H.success)return{kind:"error",error:H.error};let ae=new Set(H.data.matched.map(X=>X.entry.name));for(let X of L.unmatchedLiveServiceNames)o.onLog?.(`Service ${X} is not part of this release \u2014 leaving it untouched`,"warn");for(let X of L.staleMapKeys)ae.has(X)||o.onLog?.(`Service ${X} from the release no longer exists in the stack`,"warn");if(L.matched.length===0&&ae.size===0)return{kind:"error",error:new Error("None of the services in serviceImageTags matched a live ECS service or container-image Lambda function in this stack \u2014 nothing to roll")};let ne=L.matched.length>0?await X_e(e,x,L.matched,t.abortSignal):E(new Map);if(!ne.success)return{kind:"error",error:ne.error};let Z=L.matched.length>0?await lwt(e,r,x,L.matched,ne.data,o,t.abortSignal,i):{kind:"completed",data:{target:r.appName,deploymentType:"application",artefacts:[],durationMs:Date.now()-i}},re=await i1e(e,H.data,o,t.abortSignal),le=[...Z.kind==="completed"?Z.data.artefacts.map(X=>({serviceName:X.serviceName,imageTag:X.imageTag})):[],...re.rolledImageKeys];return await coe(e,r.appName,le,o,t.abortSignal),c1e(Z,re,r,i)}let k=s?.serviceName?.toLowerCase(),I=k===""?void 0:k,R=I?g.filter(L=>gM(Ei(L)??"",I)):g;if(I){let L=v.some(H=>soe(H.name,I));if(R.length===0&&!L){let H=[...g.map(ae=>Ei(ae)??"unknown"),...v.map(ae=>ae.name)];return{kind:"error",error:new Error(`Service '${I}' not found. Available: ${H.join(", ")||"none"}`)}}}let N={},_=[],M=[],B=[...g.map(L=>Ei(L)).filter(L=>L!==void 0&&L!==""),...b];for(let L=0;L<R.length;L++){if(Ae(t.abortSignal))return{kind:"error",error:new Error(`Rollout cancelled after ${_.length}/${R.length} services`)};let H=R[L];if(!H)continue;let ae=Ei(H)??`service-${L+1}`,ne=`[${L+1}/${R.length}] ${ae}`,Z=cwt(p,ae),re=iwt(Z,n),le,X;if(u!==void 0)le=ioe(u,ae,B),le!==u?(X=u,o.onLog?.(`Re-based image tag ${u} \u2192 ${le} for ${ae}`,"info")):B.length>1&&!u.toLowerCase().startsWith(`${ae.toLowerCase()}-`)&&o.onLog?.(`Image tag ${u} has no recognised service prefix; applying verbatim to ${ae} \u2014 confirm it points at this service's image`,"warn");else if(re!==void 0)le=re;else{let ce=`No image available to deploy for ${ae}: no content-hash tag was produced this run. Run a full deploy to build the image, or pass --image-tag <tag> to roll a specific existing image.`;o.onLog?.(ce,"warn"),M.push(`${ae}: ${ce}`);continue}z.debug(AC,"Starting service rollout",{serviceName:ae,serviceArn:H,imageTag:le,explicitRollbackTag:u,contentHashTag:re,manifestServiceMatched:Z?.name,dockerTarget:Z?.docker.target,index:L,total:R.length}),o.onECSUpdate?.(`${ne}: rolling out image tag ${le}`,ae);let ue=await d1e(e,x,H,ae,le,o,X,void 0,t.abortSignal,s?.containerName);if(z.debug(AC,"Service rollout completed",{serviceName:ae,success:ue.success,...ue.success?{taskDefinitionArn:ue.data.taskDefinitionArn,imageDigest:ue.data.imageDigest,durationMs:ue.data.durationMs}:{error:S(ue.error.message)}}),!ue.success){M.push(`${ae}: ${S(ue.error.message)}`);continue}l1e(ae,le,ue.data,N,_)}let j=Date.now()-i;if(M.length>0){let L=R.length-M.length,H=R.length,ae=M.length===H?`All ${H} ECS service rollouts failed: ${M.join("; ")}`:`Partial rollout: ${L}/${H} services succeeded. Failures: ${M.join("; ")}`;return{kind:"error",error:new Error(ae)}}let U=_.map(L=>({serviceName:L.serviceName,imageTag:L.imageTag})),G={kind:"completed",data:{target:r.appName,deploymentType:"application",outputs:Object.keys(N).length>0?N:void 0,artefacts:_,durationMs:j}};if(!C)return u!==void 0&&await coe(e,r.appName,U,o,t.abortSignal),G;let V=u!==void 0?await o1e(e,r,u,B,o,I,t.abortSignal):await a1e(e,r,n,a?.imageDigestsByService??{},a?.repoUri??GP(e.awsProvider.getAccountId(),e.awsProvider.getRegion(),r.appName),o,I,t.abortSignal);return u!==void 0&&await coe(e,r.appName,[...U,...V.rolledImageKeys],o,t.abortSignal),c1e(G,V,r,i)},t.abortSignal)}async function lwt(t,e,r,n,a,o,s,i){let c={},l=[],u=[];for(let p=0;p<n.length;p++){if(Ae(s))return{kind:"error",error:new Error(`Rollout cancelled after ${l.length}/${n.length} services`)};let m=n[p];if(!m)continue;let f=`[${p+1}/${n.length}] ${m.serviceName}`,g=a.get(m.serviceArn);if(g===void 0){u.push(`${m.serviceName}: pre-flight digest missing after a successful pre-flight`);continue}z.debug(AC,"Starting service rollout (serviceImageTags)",{serviceName:m.serviceName,serviceArn:m.serviceArn,imageTag:m.tag,mapKey:m.mapKey,index:p,total:n.length}),o.onECSUpdate?.(`${f}: rolling out image tag ${m.tag}`,m.serviceName);let v=await d1e(t,r,m.serviceArn,m.serviceName,m.tag,o,void 0,g,s);if(z.debug(AC,"Service rollout completed (serviceImageTags)",{serviceName:m.serviceName,success:v.success,...v.success?{taskDefinitionArn:v.data.taskDefinitionArn,imageDigest:v.data.imageDigest,durationMs:v.data.durationMs}:{error:S(v.error.message)}}),!v.success){u.push(`${m.serviceName}: ${S(v.error.message)}`);continue}l1e(m.serviceName,m.tag,v.data,c,l)}let d=Date.now()-i;if(u.length>0){let p=n.length-u.length,m=n.length,f=u.length===m?`All ${m} ECS service rollouts failed: ${u.join("; ")}`:`Partial rollout: ${p}/${m} services succeeded. Failures: ${u.join("; ")}`;return{kind:"error",error:new Error(f)}}return{kind:"completed",data:{target:e.appName,deploymentType:"application",outputs:Object.keys(c).length>0?c:void 0,artefacts:l,durationMs:d}}}async function d1e(t,e,r,n,a,o,s,i,c,l){let u=Date.now(),d,p,m,f,g,v;if(i!==void 0)d=i.taskDefinition.previousTaskDefArn,p=i.taskDefinition.taskDefinition,m=i.taskDefinition.containerDefinitions,f=i.repoUri,g=i.imageDigest,v=i.containerName;else{let I=await nE(t,e,r,n,c);if(!I.success)return y(I.error);d=I.data.previousTaskDefArn,p=I.data.taskDefinition,m=I.data.containerDefinitions;let R=Xae(m,n,l);if(!R.success)return y(R.error);v=R.data.name,f=nf(R.data.image);let N=await t.ecrImageInspector.getImageDigest(f,a,c);if(N.success)g=N.data;else{if(s!==void 0)return y(new Error(`Re-based image tag '${a}' (from supplied '${s}') was not found in ECR for ${n}: ${S(N.error.message)}. The supplied tag's build has no image for ${n} \u2014 supply that service's own tag, or pass --service to roll a single service.`));o.onLog?.(`Could not resolve image digest for ${n} (${S(N.error.message)}); falling back to tag pinning`,"warn")}}let b=rg(I=>g!==void 0?`${I}@${g}`:`${I}:${a}`,"buildContainerImage"),A=m.map(I=>!I.image||I.name!==v?I:{...I,image:b(nf(I.image))}),C=await WP(t,{clusterArn:e,serviceArn:r,serviceName:n,taskDefinition:p,containerDefinitions:A,previousTaskDefArn:d,...g!==void 0?{imageDigest:g}:{},startedAtMs:u},o,c);if(!C.success)return y(C.error);let x=`${f}:${a}`,k=EC(f);return E({taskDefinitionArn:C.data.newTaskDefArn,previousTaskDefinitionArn:d,imageUri:x,ecrRepositoryArn:k,imageDigest:g,durationMs:C.data.durationMs})}function EC(t){let e=t.match(/^(\d{12})\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com\/(.+)$/);if(!e)return"";let[,r,n,a]=e;return`arn:aws:ecr:${n}:${r}:repository/${a}`}var DRr,rg,AC,ORr,NRr,EW=w(()=>{"use strict";Ce();Ct();$();Vy();Oo();Ab();vt();Z1();_ae();eoe();vW();Qae();owt();DRr=Object.defineProperty,rg=(t,e)=>DRr(t,"name",{value:e,configurable:!0}),AC="codeOnlyDeploy";rg(iwt,"lookupContentHashTag");rg(cwt,"findManifestServiceForEcsService");rg(ioe,"rebaseRollbackTagForService");ORr=0,NRr=1;rg(l1e,"recordRolloutOutputs");rg(coe,"reconcileImageTagParameters");rg(c1e,"mergeEcsAndLambdaOutcomes");rg(u1e,"deployCodeOnly");rg(lwt,"rollOutServiceImageTagsMap");rg(d1e,"rolloutService");rg(EC,"deriveEcrRepositoryArn")});async function p1e(t,e,r){if(t.length===0)return E(void 0);let n=await Promise.all(t.map(async o=>{let s=await e.getStackStatus(o,void 0,r);return{name:o,result:s}})),a=[];for(let{name:o,result:s}of n){if(!s.success)return y(s.error);let i=s.data;i===null||i.status==="DOES_NOT_EXIST"||q1[i.status]?.safeToRedeploy==="No"&&a.push({name:o,status:i.status})}if(a.length>0){let o=a.map(s=>`  ${s.name}: ${s.status}`).join(`
+${m}`))}for(let p of u.data){if(p.success&&p.outputs)for(let[g,v]of Object.entries(p.outputs))c[g]=String(v);let m=nr(e.appName,p.stack),f=i.currentHashes.get(m);f&&l.set(m,f)}return E(void 0)}async function H_e(t,e,r,n,a,o,s,i){let c=Dn(t,"deploy"),l=Rn(t,"deploy");return _P(n,{stepId:c,stepName:l,stepIndex:a,totalSteps:o},async()=>{let u=await e.stackService.deployStack(t,r,{onOutput:Yi(n),onResourceProgress:Pb(n)},i?.parameters!==void 0||i?.abortSignal!==void 0?{...i?.parameters!==void 0?{parameters:i.parameters}:{},...i?.abortSignal!==void 0?{abortSignal:i.abortSignal}:{}}:void 0);if(!u.success)return{kind:"error",error:u.error};if(u.data.outputs)for(let[d,p]of Object.entries(u.data.outputs))s[d]=String(p);return{kind:"completed",data:void 0}},e.abortSignal)}async function q_e(t,e,r,n,a,o){if(t!==Te.COMPUTE||!e.dockerProvider)return null;if(o&&e.options?.infraOnly!==!0){let i=await yW(e,r,n,a);return i.success?E(i.data):y(i.error)}if(o)return null;let s=await U_e(e,r,n,a);return s.success?E(hM()):y(s.error)}async function K_e(t,e,r,n,a){if(Object.keys(n).length===0)return{};let o=ARr(t.path,"cdk.out"),s=Od(o).filter(c=>n[c.imageKey]!==void 0);if(s.length===0)return{};let i={};for(let c of s){if(Ae(a)){r.onLog?.(`Skipping the Lambda version publish for '${c.name}' \u2014 the deployment was cancelled. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}let l=await e.lambdaService.publishVersion(c.name,a);if(!l.success){r.onLog?.(`Published image for Lambda '${c.name}', but publishing a new version failed: ${S(l.error.message)}. The function's $LATEST code is up to date; only the published-version record is affected.`,"warn");continue}i[c.name]=l.data}return i}function Y_e(t){return{onBuildStart:zd(e=>{t.onOpenNextBuildStart?.(),t.onLog?.(`${e} build started`,"info")},"onBuildStart"),onBuildProgress:zd((e,r)=>{t.onOpenNextProgress?.(r)},"onBuildProgress"),onBuildComplete:zd(e=>{t.onOpenNextBuildComplete?.(),t.onLog?.(`${e} build complete`,"info")},"onBuildComplete"),onBuildError:zd((e,r)=>{t.onOpenNextBuildError?.(r)},"onBuildError")}}var ERr,zd,XAt=w(()=>{"use strict";Ce();$();Vy();vt();Oo();rz();_d();vW();JAt();_ae();ERr=Object.defineProperty,zd=(t,e)=>ERr(t,"name",{value:e,configurable:!0});zd(V_e,"getStackNamesToDeploy");zd(z_e,"willRunDockerBuild");zd(G_e,"getParallelPhase2Stacks");zd(W_e,"deployParallelPhase");zd(H_e,"deployStackSequential");zd(q_e,"runDockerPreCompute");zd(K_e,"runLambdaVersionPublish");zd(Y_e,"createBuildCallbacks")});import{join as CRr}from"node:path";function Z_e(t,e,r,n){return`Assembly integrity check failed for ${t}: ${n} after change detection.${r?" The approved plan no longer matches what would deploy.":""} Another process likely re-synthesised ${e} mid-deploy. Nothing was deployed for this stack \u2014 re-run 'fjall deploy --plan' against the current working tree and approve the new plan.`}async function Jae(t){for(let e of t.stackNames){let r=t.detectionHashes.get(e);if(r===void 0)continue;let n=CRr(t.cdkOutPath,`${e}.template.json`),a=await t.hashService.computeTemplateHash(n);if(!a.success)return y(new Error(Z_e(e,t.cdkOutPath,t.approvalGated,"its synthesised template could no longer be read")));if(a.data!==r)return y(new Error(Z_e(e,t.cdkOutPath,t.approvalGated,"its synthesised template changed")))}return E(void 0)}var wRr,QAt,ewt=w(()=>{"use strict";Ce();wRr=Object.defineProperty,QAt=(t,e)=>wRr(t,"name",{value:e,configurable:!0});QAt(Z_e,"integrityFailureMessage");QAt(Jae,"verifyAssemblyIntegrity")});function gM(t,e){let r=t.toLowerCase(),n=e.toLowerCase();return r===n||r.endsWith(n)}function J_e(t,e){let r=Object.entries(e),n=[],a=[],o=new Set,s=t.map(p=>{let m=Ei(p)??p;return{serviceArn:p,serviceName:m,lowerName:m.toLowerCase()}}),i=new Map,c=new Set;for(let p of s){let m=r.find(([f])=>f.toLowerCase()===p.lowerName);m!==void 0&&(i.set(p.serviceArn,m),c.add(m[0]))}let l=new Map,u=new Map;for(let p of s){if(i.has(p.serviceArn))continue;let m=r.filter(([f])=>!c.has(f)&&gM(p.serviceName,f)).sort(([f],[g])=>g.length-f.length)[0];m!==void 0&&(l.set(p.serviceArn,m),u.set(m[0],(u.get(m[0])??0)+1))}for(let p of s){let m=l.get(p.serviceArn),f=i.get(p.serviceArn)??(m!==void 0&&u.get(m[0])===1?m:void 0);if(f===void 0){a.push(p.serviceName);continue}let[g,v]=f;o.add(g),n.push({serviceArn:p.serviceArn,serviceName:p.serviceName,tag:v,mapKey:g})}let d=r.map(([p])=>p).filter(p=>!o.has(p));return{matched:n,unmatchedLiveServiceNames:a,staleMapKeys:d}}function Xae(t,e,r){let n=t.filter(s=>s.image!==void 0),a=n.map(s=>s.name||"(unnamed)").join(", ")||"none";if(r!==void 0){let s=n.find(i=>(i.name??"").toLowerCase()===r.toLowerCase());return s===void 0?y(new Error(`Container "${r}" not found on ${e}'s task definition. Available: ${a}`)):E({name:s.name??"",image:s.image})}if(n.length===0)return y(new Error(`${e}'s task definition has no container image to retag`));if(n.length===1){let s=n[0];return E({name:s.name??"",image:s.image})}let o=n.filter(s=>(s.portMappings?.length??0)>0);if(o.length===1){let s=o[0];return E({name:s.name??"",image:s.image})}return y(new Error(`${e} has multiple containers (${a}) and no single primary container could be determined \u2014 pass --container-name <name> to target one explicitly.`))}async function nE(t,e,r,n,a){let o=await t.ecsService.describeServices(e,[r],a);if(!o.success)return y(new Error(`Failed to describe service ${n}: ${S(o.error.message)}`));let s=o.data[0];if(!s?.taskDefinition)return y(new Error(`Service ${n} has no task definition`));let i=s.taskDefinition,c=await t.ecsService.getLatestTaskDefinition(i,a);if(!c.success)return y(new Error(`Failed to fetch task definition for ${n}: ${S(c.error.message)}`));let l=c.data;if(!l||!l.containerDefinitions||l.containerDefinitions.length===0)return y(new Error(`Task definition for ${n} has no container definitions`));let u=l.containerDefinitions,d=u.find(m=>m.image)?.image;if(!d)return y(new Error(`Task definition for ${n} has no container image \u2014 cannot derive repository URI`));let p=nf(d);return E({previousTaskDefArn:i,taskDefinition:l,containerDefinitions:u,repoUri:p})}async function X_e(t,e,r,n){let a=new Map;for(let o of r){if(Ae(n))return y(new Error("Pre-flight cancelled. No service was rolled."));let s=await nE(t,e,o.serviceArn,o.serviceName,n);if(!s.success)return y(new Error(`Pre-flight failed resolving the current task definition for ${o.serviceName} (tag ${o.tag}): ${S(s.error.message)}. No service was rolled.`));let i=Xae(s.data.containerDefinitions,o.serviceName);if(!i.success)return y(new Error(`Pre-flight failed selecting a container to retag for ${o.serviceName} (tag ${o.tag}): ${S(i.error.message)}. No service was rolled.`));let c=nf(i.data.image),l=await t.ecrImageInspector.getImageDigest(c,o.tag,n);if(!l.success||l.data===void 0){let u=l.success?"ECR returned no digest for this tag (non-ECR repository, or the image is missing)":S(l.error.message);return y(new Error(`Pre-flight digest resolution failed for ${o.serviceName} (tag ${o.tag}): ${u}. No service was rolled.`))}a.set(o.serviceArn,{taskDefinition:s.data,imageDigest:l.data,containerName:i.data.name,repoUri:c})}return E(a)}var xRr,SW,Qae=w(()=>{"use strict";Ce();$();Ab();vt();Z1();xRr=Object.defineProperty,SW=(t,e)=>xRr(t,"name",{value:e,configurable:!0});SW(gM,"matchesServiceName");SW(J_e,"matchServiceImageTagsToLiveServices");SW(Xae,"selectContainerToRetag");SW(nE,"resolveServiceTaskDefinition");SW(X_e,"preflightResolveServiceImageTagDigests")});async function WP(t,e,r,n){let{clusterArn:a,serviceArn:o,serviceName:s,taskDefinition:i,containerDefinitions:c,previousTaskDefArn:l,imageDigest:u,startedAtMs:d}=e,p=i.family;if(!p)return y(new Error(`Task definition for ${s} has no family`));let m=await t.ecsService.registerTaskDefinition({family:p,taskRoleArn:i.taskRoleArn,executionRoleArn:i.executionRoleArn,networkMode:i.networkMode,containerDefinitions:c,volumes:i.volumes,placementConstraints:i.placementConstraints,requiresCompatibilities:i.requiresCompatibilities,cpu:i.cpu,memory:i.memory,runtimePlatform:i.runtimePlatform,proxyConfiguration:i.proxyConfiguration,inferenceAccelerators:i.inferenceAccelerators,pidMode:i.pidMode,ipcMode:i.ipcMode,ephemeralStorage:i.ephemeralStorage},n);if(!m.success)return y(new Error(`Failed to register task definition for ${s}: ${m.error.message}`));let f=m.data;r.onTaskDefRegistered?.({serviceName:s,taskDefinitionArn:f,previousTaskDefinitionArn:l,revision:twt(f),family:p,...u!==void 0?{imageDigest:u}:{}});let g=await t.ecsService.updateService(a,o,{taskDefinition:f,forceNewDeployment:!0},n);if(!g.success)return y(new Error(`Failed to update service ${s}: ${g.error.message}`));let v=await t.ecsService.pollDeployment({clusterArn:a,serviceArn:o,waitForCompletion:!0,progressCallback:Q_e(C=>{let x=C.latestEvent?` \u2014 ${S(C.latestEvent)}`:"";r.onECSProgress?.(`${s}: ${S(C.message)}${x}`,C.percentComplete)},"progressCallback")}),b=Date.now()-d;if(!v.success){let C=S(v.error.message);return r.onECSComplete?.({serviceName:s,serviceArn:o,success:!1,taskDefinitionArn:f,durationMs:b,reason:C}),y(new Error(`ECS rollout failed for ${s}: ${C}`))}let A=await t.ecsService.getDeploymentStatus(a,o);return r.onECSComplete?.({serviceName:s,serviceArn:o,success:!0,taskDefinitionArn:f,durationMs:b,finalRunningCount:A.success?A.data.runningCount:void 0,finalDesiredCount:A.success?A.data.desiredCount:void 0}),z.debug(kRr,`Rolled ${s} successfully`,{serviceArn:o,newTaskDefArn:f,previousTaskDefArn:l,durationMs:b}),E({newTaskDefArn:f,durationMs:b})}function twt(t){let e=t.lastIndexOf(":");if(e<0)return 0;let r=t.slice(e+1);return/^\d+$/.test(r)?parseInt(r,10):0}var TRr,Q_e,kRr,eoe=w(()=>{"use strict";Ce();Ct();$();TRr=Object.defineProperty,Q_e=(t,e)=>TRr(t,"name",{value:e,configurable:!0}),kRr="taskDefinitionRoll";Q_e(WP,"registerAndRollTaskDefinition");Q_e(twt,"extractRevision")});async function roe(t,e,r){let n=nr(e,Te.DATABASE),a=await t.getStackOutputs(n,void 0,r);if(!a.success){z.debug(toe,"Could not read database stack outputs",{stackName:n,error:S(a.error.message)});return}let o={};for(let s of a.data){let i=s.OutputKey,c=s.OutputValue;i===void 0||c===void 0||IRr.some(l=>i.endsWith(l))&&(o[i]=c)}return o}async function e1e(t,e,r,n){let a=await t.getDeployableClusterAndServices(r,n);if(!a.success){z.debug(toe,"Could not discover services pre-deploy",{appName:r,error:S(a.error.message)});return}let{clusterArn:o,serviceArns:s}=a.data;if(o===void 0||s.length===0)return{};let i=await e.describeServices(o,s,n);if(!i.success){z.debug(toe,"Could not describe services pre-deploy",{appName:r,error:S(i.error.message)});return}let c={};for(let l of i.data)l.serviceArn!==void 0&&l.taskDefinition!==void 0&&(c[l.serviceArn]=l.taskDefinition);return c}function rwt(t,e){return Object.keys(t).filter(r=>e[r]!==void 0&&e[r]!==t[r]).sort()}async function t1e(t){let{appName:e,connectionOutputsBefore:r,services:n,callbacks:a,abortSignal:o}=t,s=`Run \`fjall rollout ${e}\` to restart them manually.`,i=`Could not verify the database endpoint was unchanged by this deploy. If the database was replaced (e.g. restored from a snapshot), run \`fjall rollout ${e}\` so running services reconnect to it.`;if(r===void 0)return a.onLog?.(i,"warn"),{kind:"unverified"};let c=await roe(n.cfnService,e);if(c===void 0)return a.onLog?.(i,"warn"),{kind:"unverified"};let l=rwt(r,c);if(l.length===0)return{kind:"not-needed"};if(a.onLog?.(`Database connection outputs changed this deploy (${l.join(", ")}) \u2014 the database was replaced.`,"info"),Ae(o))return a.onLog?.(`Deploy cancelled before services were restarted onto the new database endpoint. ${s}`,"warn"),{kind:"cancelled"};let u=await n.ecsResolver.getDeployableClusterAndServices(e,o);if(!u.success)return a.onLog?.(`Could not discover this application's ECS services to restart them onto the new database endpoint: ${S(u.error.message)}. ${s}`,"warn"),{kind:"failed"};let{clusterArn:d,serviceArns:p}=u.data;if(d===void 0||p.length===0)return a.onLog?.(`Database connection outputs changed but no running ECS services were found to restart. If this application has running services, run \`fjall rollout ${e}\` so they reconnect to the new database endpoint.`,"warn"),{kind:"not-needed"};let m=t.serviceTaskDefinitionsBefore,f=m!==void 0&&Object.keys(m).length>0,g=[],v=0,b=0,A=bW((x,k)=>{a.onLog?.(`Could not restart ${x} onto the new database endpoint: ${S(k)}. ${s}`,"warn"),b+=1},"warnServiceFailure");for(let x of p){if(Ae(o))return a.onLog?.(`Deploy cancelled before services were restarted onto the new database endpoint. ${s}`,"warn"),{kind:"cancelled"};let k=Ei(x)??x,I=await nE({ecsService:n.ecsService},d,x,k,o);if(!I.success){A(k,I.error.message);continue}let R=m?.[x];if(f&&R===void 0){v+=1;continue}if(R!==void 0&&R!==I.data.previousTaskDefArn){v+=1;continue}g.push({serviceArn:x,serviceName:k,resolved:I.data})}if(g.length===0)return b>0?{kind:"failed"}:(a.onLog?.(`Services were already relaunched during this deploy \u2014 no restart needed. If something other than this deploy relaunched them, run \`fjall rollout ${e}\` to be safe.`,"info"),{kind:"already-current"});if(t.confirmRestart!==void 0){let x={appName:e,changedOutputs:l,serviceCount:g.length},k;try{k=await t.confirmRestart(x)}catch(I){return a.onLog?.(`Restart confirmation failed: ${S(I instanceof Error?I.message:String(I))}. ${s}`,"warn"),{kind:"failed"}}if(!k)return a.onLog?.(`Restart declined \u2014 running containers are still connected to the old database endpoint. ${s}`,"warn"),{kind:"declined"}}a.onLog?.(`Restarting ${g.length} service${g.length===1?"":"s"} so running containers reconnect to the new database\u2026`,"info");let C=[];for(let x of g){if(Ae(o))return a.onLog?.(`Deploy cancelled before all services were restarted onto the new database endpoint. ${s}`,"warn"),{kind:"cancelled"};let k=x.resolved;if(t.confirmRestart!==void 0){let R=await nE({ecsService:n.ecsService},d,x.serviceArn,x.serviceName,o);if(!R.success){A(x.serviceName,R.error.message);continue}if(R.data.previousTaskDefArn!==x.resolved.previousTaskDefArn){a.onLog?.(`${x.serviceName} was relaunched while awaiting confirmation \u2014 skipping its restart.`,"info");continue}k=R.data}let I=await WP({ecsService:n.ecsService},{clusterArn:d,serviceArn:x.serviceArn,serviceName:x.serviceName,taskDefinition:k.taskDefinition,containerDefinitions:k.containerDefinitions,previousTaskDefArn:k.previousTaskDefArn,startedAtMs:Date.now()},a,o);if(!I.success){A(x.serviceName,I.error.message);continue}C.push(x.serviceName)}return C.length>0&&(z.debug(toe,"Restarted services after database replacement",{appName:e,changedOutputs:l,services:C,alreadyRolled:v}),a.onLog?.(`Restarted ${C.length} service${C.length===1?"":"s"} onto the new database endpoint.`,"info")),b>0?{kind:"failed"}:{kind:"reconciled",services:C}}var PRr,bW,toe,IRr,nwt=w(()=>{"use strict";$();Ct();Oo();Ab();vt();Qae();eoe();PRr=Object.defineProperty,bW=(t,e)=>PRr(t,"name",{value:e,configurable:!0}),toe="databaseEndpointReconcile",IRr=["Endpoint","Port"];bW(roe,"captureDatabaseConnectionOutputs");bW(e1e,"captureServiceTaskDefinitions");bW(rwt,"diffConnectionOutputs");bW(t1e,"reconcileDatabaseEndpointChange")});import{join as r1e}from"path";function noe(){return{outputs:{},artefacts:[],failures:[],rolledImageKeys:[]}}function aoe(t,e,r){return Ae(r)?(t.failures.push(`${e}: rollout cancelled before this function was reached`),!0):!1}function awt(t,e,r,n,a,o,s){let i=EC(a),c=`${a}:${n}`;t.outputs[el(e,"ImageTag")]=n,t.outputs[el(e,"ImageUri")]=c,t.outputs[el(e,"ImageDigest")]=o,i!==""&&(t.outputs[el(e,"EcrRepositoryArn")]=i),t.artefacts.push({serviceName:e,imageTag:n,imageUri:c,imageDigest:o,...i!==""?{ecrRepositoryArn:i}:{},functionArn:s.functionArn,publishedVersion:s.version}),t.rolledImageKeys.some(l=>l.serviceName===r)||t.rolledImageKeys.push({serviceName:r,imageTag:n})}async function ooe(t,e,r,n,a,o,s,i){s.onLog?.(`Updating Lambda function ${r.name} to ${o}`,"info");let c=await t.lambdaService.updateFunctionCode(r.name,`${n}@${a}`,i);if(!c.success){e.failures.push(`${r.name}: ${S(c.error.message)}`);return}c.data.unverifiedReason!==void 0&&s.onLog?.(`Updated ${r.name}, but completion of the update could not be verified: ${c.data.unverifiedReason}`,"warn"),awt(e,r.name,r.imageKey,o,n,a,c.data)}function soe(t,e){return t.toLowerCase()===e.toLowerCase()}function n1e(t,e){return e?t.filter(r=>soe(r.name,e)):t}async function a1e(t,e,r,n,a,o,s,i){let c=noe(),l=r1e(e.path,"cdk.out"),u=n1e(Od(l),s);for(let d of u){if(aoe(c,d.name,i))continue;let p=r[d.imageKey],m=n[d.imageKey];p===void 0||m===void 0||await ooe(t,c,d,a,m,p,o,i)}return c}async function o1e(t,e,r,n,a,o,s){let i=noe(),c=r1e(e.path,"cdk.out"),l=n1e(Od(c),o);if(l.length===0)return i;let u=t.awsProvider.getAccountId(),d=t.awsProvider.getRegion(),p=GP(u,d,e.appName);for(let m of l){if(aoe(i,m.name,s))continue;let f=ioe(r,m.imageKey,n),g=await t.ecrImageInspector.getImageDigest(p,f,s);if(!g.success||g.data===void 0){let v=g.success?"not an ECR repository":S(g.error.message);i.failures.push(`${m.name}: image tag '${f}' (rebased from '${r}') could not be resolved to a digest: ${v}`);continue}await ooe(t,i,m,p,g.data,f,a,s)}return i}async function s1e(t,e,r,n){let a=r1e(e.path,"cdk.out"),o=Od(a).map(u=>({entry:u,tag:r[u.name]})).filter(u=>u.tag!==void 0);if(o.length===0)return E({matched:o,digestsByFunctionName:new Map,repoUri:""});let s=t.awsProvider.getAccountId(),i=t.awsProvider.getRegion(),c=GP(s,i,e.appName),l=new Map;for(let{entry:u,tag:d}of o){if(Ae(n))return y(new Error("Pre-flight cancelled. No function was rolled."));let p=await t.ecrImageInspector.getImageDigest(c,d,n);if(!p.success||p.data===void 0){let m=p.success?"not an ECR repository":S(p.error.message);return y(new Error(`Lambda function '${u.name}': image tag '${d}' could not be resolved to a digest: ${m}. No function was rolled.`))}l.set(u.name,p.data)}return E({matched:o,digestsByFunctionName:l,repoUri:c})}async function i1e(t,e,r,n){let a=noe();for(let{entry:o,tag:s}of e.matched){if(aoe(a,o.name,n))continue;let i=e.digestsByFunctionName.get(o.name);i!==void 0&&await ooe(t,a,o,e.repoUri,i,s,r,n)}return a}var RRr,gv,owt=w(()=>{"use strict";Ce();$();Vy();vt();vW();EW();RRr=Object.defineProperty,gv=(t,e)=>RRr(t,"name",{value:e,configurable:!0});gv(noe,"emptyOutcome");gv(aoe,"pushCancelledIfAborted");gv(awt,"recordLambdaRollout");gv(ooe,"rolloutOne");gv(soe,"matchesLambdaFunctionName");gv(n1e,"filterByService");gv(a1e,"rolloutLambdaPrimary");gv(o1e,"rolloutLambdaImageTag");gv(s1e,"preflightLambdaServiceImageTags");gv(i1e,"executeLambdaServiceImageTagsRollout")});import{join as swt}from"path";function iwt(t,e){if(t)return e[t.name]}function cwt(t,e){let r=e.toLowerCase();return t.find(n=>n.name.toLowerCase()===r)??t.find(n=>r.includes(n.name.toLowerCase()))}function ioe(t,e,r){let n=e.toLowerCase(),a=t.toLowerCase(),o=r.map(i=>i.toLowerCase()).filter(i=>i!==""&&a.startsWith(`${i}-`)).sort((i,c)=>c.length-i.length)[0];if(o===void 0||o===n)return t;let s=t.slice(o.length);return`${n}${s}`}function l1e(t,e,r,n,a){n[el(t,"TaskDefinition")]=r.taskDefinitionArn,n[el(t,"PreviousTaskDefinition")]=r.previousTaskDefinitionArn,n[el(t,"ImageTag")]=e,n[el(t,"ImageUri")]=r.imageUri,n[el(t,"EcrRepositoryArn")]=r.ecrRepositoryArn,r.imageDigest!==void 0&&(n[el(t,"ImageDigest")]=r.imageDigest),a.push({serviceName:t,imageTag:e,imageUri:r.imageUri,taskDefinitionArn:r.taskDefinitionArn,previousTaskDefinitionArn:r.previousTaskDefinitionArn,...r.imageDigest!==void 0?{imageDigest:r.imageDigest}:{},...r.ecrRepositoryArn!==""?{ecrRepositoryArn:r.ecrRepositoryArn}:{}})}async function coe(t,e,r,n,a){if(r.length===0)return;let o=nr(e,Te.COMPUTE),s={};for(let{serviceName:c,imageTag:l}of r)s[uT(c)]=l;let i=await t.cfnService.updateStackParameters(o,s,a);if(!i.success){n.onLog?.(`Rollback succeeded but the CloudFormation ImageTag parameter reconcile failed \u2014 the next full deploy may revert this rollback. Reason: ${S(i.error.message)}`,"warn");return}i.data.skippedKeys.length>0&&(n.onLog?.(`Rollback succeeded but ${i.data.skippedKeys.length} ImageTag parameter(s) were not found on stack ${o} (${i.data.skippedKeys.join(", ")}) \u2014 the next full deploy may revert those services`,"warn"),z.debug(AC,"ImageTag reconcile skipped stale parameters",{stackName:o,skippedKeys:i.data.skippedKeys}))}function c1e(t,e,r,n){if(t.kind==="error")return e.failures.length>0?{kind:"error",error:new Error(`${t.error.message}; Lambda rollout failures: ${e.failures.join("; ")}`)}:t;if(e.failures.length>0)return{kind:"error",error:new Error(`Lambda rollout failures: ${e.failures.join("; ")}`)};let a=t.data,o={...a.outputs??{},...e.outputs};return{kind:"completed",data:{target:r.appName,deploymentType:"application",outputs:Object.keys(o).length>0?o:void 0,artefacts:[...a.artefacts,...e.artefacts],durationMs:Date.now()-n}}}async function u1e(t,e,r,n,a){let{callbacks:o,options:s}=t,i=Date.now(),c=Dn(Te.COMPUTE,"deploy"),l=Rn(Te.COMPUTE,"deploy");return _P(o,{stepId:c,stepName:l,stepIndex:ORr,totalSteps:NRr},async()=>{let u=s?.imageTag,d=s?.serviceImageTags;u?o.onLog?.(`Rolling to supplied image tag ${u}`,"info"):d&&o.onLog?.(`Rolling ${Object.keys(d).length} service(s) to their release-recorded image tags`,"info");let p=Uy(swt(r.path,"cdk.out"));z.debug(AC,"Code-only rollout starting",{explicitRollbackTag:u,serviceImageTags:d,workingDirectory:t.workingDirectory,contentHashTagsByService:n,manifestServiceCount:p.length,manifestServices:p.map(L=>({name:L.name,target:L.docker.target}))}),o.onLog?.("Discovering ECS cluster and services\u2026","info");let m=await e.ecsResolver.getDeployableClusterAndServices(r.appName,t.abortSignal);if(!m.success)return z.debug(AC,"ECS discovery failed",{appName:r.appName,error:S(m.error.message)}),{kind:"error",error:m.error};let{clusterArn:f,serviceArns:g}=m.data;z.debug(AC,"ECS discovery complete",{appName:r.appName,clusterArn:f,serviceCount:g.length,serviceArns:g});let v=Od(swt(r.path,"cdk.out")),b=Array.from(new Set(v.map(L=>L.imageKey))),A=f!==void 0&&g.length>0,C=v.length>0;if(!A&&!C){let L=`No deployable ECS services or container-image Lambda functions found for ${r.appName}`;return o.onLog?.(L,"warn"),{kind:"skipped",data:{target:r.appName,deploymentType:"application",durationMs:Date.now()-i,noChanges:!0,artefacts:[]}}}let x=f??"";if(d!==void 0){let L=J_e(A?g:[],d),H=await s1e(e,r,d,t.abortSignal);if(!H.success)return{kind:"error",error:H.error};let ae=new Set(H.data.matched.map(X=>X.entry.name));for(let X of L.unmatchedLiveServiceNames)o.onLog?.(`Service ${X} is not part of this release \u2014 leaving it untouched`,"warn");for(let X of L.staleMapKeys)ae.has(X)||o.onLog?.(`Service ${X} from the release no longer exists in the stack`,"warn");if(L.matched.length===0&&ae.size===0)return{kind:"error",error:new Error("None of the services in serviceImageTags matched a live ECS service or container-image Lambda function in this stack \u2014 nothing to roll")};let ne=L.matched.length>0?await X_e(e,x,L.matched,t.abortSignal):E(new Map);if(!ne.success)return{kind:"error",error:ne.error};let Z=L.matched.length>0?await lwt(e,r,x,L.matched,ne.data,o,t.abortSignal,i):{kind:"completed",data:{target:r.appName,deploymentType:"application",artefacts:[],durationMs:Date.now()-i}},re=await i1e(e,H.data,o,t.abortSignal),le=[...Z.kind==="completed"?Z.data.artefacts.map(X=>({serviceName:X.serviceName,imageTag:X.imageTag})):[],...re.rolledImageKeys];return await coe(e,r.appName,le,o,t.abortSignal),c1e(Z,re,r,i)}let k=s?.serviceName?.toLowerCase(),I=k===""?void 0:k,R=I?g.filter(L=>gM(Ei(L)??"",I)):g;if(I){let L=v.some(H=>soe(H.name,I));if(R.length===0&&!L){let H=[...g.map(ae=>Ei(ae)??"unknown"),...v.map(ae=>ae.name)];return{kind:"error",error:new Error(`Service '${I}' not found. Available: ${H.join(", ")||"none"}`)}}}let N={},_=[],M=[],B=[...g.map(L=>Ei(L)).filter(L=>L!==void 0&&L!==""),...b];for(let L=0;L<R.length;L++){if(Ae(t.abortSignal))return{kind:"error",error:new Error(`Rollout cancelled after ${_.length}/${R.length} services`)};let H=R[L];if(!H)continue;let ae=Ei(H)??`service-${L+1}`,ne=`[${L+1}/${R.length}] ${ae}`,Z=cwt(p,ae),re=iwt(Z,n),le,X;if(u!==void 0)le=ioe(u,ae,B),le!==u?(X=u,o.onLog?.(`Re-based image tag ${u} \u2192 ${le} for ${ae}`,"info")):B.length>1&&!u.toLowerCase().startsWith(`${ae.toLowerCase()}-`)&&o.onLog?.(`Image tag ${u} has no recognised service prefix; applying verbatim to ${ae} \u2014 confirm it points at this service's image`,"warn");else if(re!==void 0)le=re;else{let ce=`No image available to deploy for ${ae}: no content-hash tag was produced this run. Run a full deploy to build the image, or pass --image-tag <tag> to roll a specific existing image.`;o.onLog?.(ce,"warn"),M.push(`${ae}: ${ce}`);continue}z.debug(AC,"Starting service rollout",{serviceName:ae,serviceArn:H,imageTag:le,explicitRollbackTag:u,contentHashTag:re,manifestServiceMatched:Z?.name,dockerTarget:Z?.docker.target,index:L,total:R.length}),o.onECSUpdate?.(`${ne}: rolling out image tag ${le}`,ae);let ue=await d1e(e,x,H,ae,le,o,X,void 0,t.abortSignal,s?.containerName);if(z.debug(AC,"Service rollout completed",{serviceName:ae,success:ue.success,...ue.success?{taskDefinitionArn:ue.data.taskDefinitionArn,imageDigest:ue.data.imageDigest,durationMs:ue.data.durationMs}:{error:S(ue.error.message)}}),!ue.success){M.push(`${ae}: ${S(ue.error.message)}`);continue}l1e(ae,le,ue.data,N,_)}let j=Date.now()-i;if(M.length>0){let L=R.length-M.length,H=R.length,ae=M.length===H?`All ${H} ECS service rollouts failed: ${M.join("; ")}`:`Partial rollout: ${L}/${H} services succeeded. Failures: ${M.join("; ")}`;return{kind:"error",error:new Error(ae)}}let U=_.map(L=>({serviceName:L.serviceName,imageTag:L.imageTag})),G={kind:"completed",data:{target:r.appName,deploymentType:"application",outputs:Object.keys(N).length>0?N:void 0,artefacts:_,durationMs:j}};if(!C)return u!==void 0&&await coe(e,r.appName,U,o,t.abortSignal),G;let V=u!==void 0?await o1e(e,r,u,B,o,I,t.abortSignal):await a1e(e,r,n,a?.imageDigestsByService??{},a?.repoUri??GP(e.awsProvider.getAccountId(),e.awsProvider.getRegion(),r.appName),o,I,t.abortSignal);return u!==void 0&&await coe(e,r.appName,[...U,...V.rolledImageKeys],o,t.abortSignal),c1e(G,V,r,i)},t.abortSignal)}async function lwt(t,e,r,n,a,o,s,i){let c={},l=[],u=[];for(let p=0;p<n.length;p++){if(Ae(s))return{kind:"error",error:new Error(`Rollout cancelled after ${l.length}/${n.length} services`)};let m=n[p];if(!m)continue;let f=`[${p+1}/${n.length}] ${m.serviceName}`,g=a.get(m.serviceArn);if(g===void 0){u.push(`${m.serviceName}: pre-flight digest missing after a successful pre-flight`);continue}z.debug(AC,"Starting service rollout (serviceImageTags)",{serviceName:m.serviceName,serviceArn:m.serviceArn,imageTag:m.tag,mapKey:m.mapKey,index:p,total:n.length}),o.onECSUpdate?.(`${f}: rolling out image tag ${m.tag}`,m.serviceName);let v=await d1e(t,r,m.serviceArn,m.serviceName,m.tag,o,void 0,g,s);if(z.debug(AC,"Service rollout completed (serviceImageTags)",{serviceName:m.serviceName,success:v.success,...v.success?{taskDefinitionArn:v.data.taskDefinitionArn,imageDigest:v.data.imageDigest,durationMs:v.data.durationMs}:{error:S(v.error.message)}}),!v.success){u.push(`${m.serviceName}: ${S(v.error.message)}`);continue}l1e(m.serviceName,m.tag,v.data,c,l)}let d=Date.now()-i;if(u.length>0){let p=n.length-u.length,m=n.length,f=u.length===m?`All ${m} ECS service rollouts failed: ${u.join("; ")}`:`Partial rollout: ${p}/${m} services succeeded. Failures: ${u.join("; ")}`;return{kind:"error",error:new Error(f)}}return{kind:"completed",data:{target:e.appName,deploymentType:"application",outputs:Object.keys(c).length>0?c:void 0,artefacts:l,durationMs:d}}}async function d1e(t,e,r,n,a,o,s,i,c,l){let u=Date.now(),d,p,m,f,g,v;if(i!==void 0)d=i.taskDefinition.previousTaskDefArn,p=i.taskDefinition.taskDefinition,m=i.taskDefinition.containerDefinitions,f=i.repoUri,g=i.imageDigest,v=i.containerName;else{let I=await nE(t,e,r,n,c);if(!I.success)return y(I.error);d=I.data.previousTaskDefArn,p=I.data.taskDefinition,m=I.data.containerDefinitions;let R=Xae(m,n,l);if(!R.success)return y(R.error);v=R.data.name,f=nf(R.data.image);let N=await t.ecrImageInspector.getImageDigest(f,a,c);if(N.success)g=N.data;else{if(s!==void 0)return y(new Error(`Re-based image tag '${a}' (from supplied '${s}') was not found in ECR for ${n}: ${S(N.error.message)}. The supplied tag's build has no image for ${n} \u2014 supply that service's own tag, or pass --service to roll a single service.`));o.onLog?.(`Could not resolve image digest for ${n} (${S(N.error.message)}); falling back to tag pinning`,"warn")}}let b=rg(I=>g!==void 0?`${I}@${g}`:`${I}:${a}`,"buildContainerImage"),A=m.map(I=>!I.image||I.name!==v?I:{...I,image:b(nf(I.image))}),C=await WP(t,{clusterArn:e,serviceArn:r,serviceName:n,taskDefinition:p,containerDefinitions:A,previousTaskDefArn:d,...g!==void 0?{imageDigest:g}:{},startedAtMs:u},o,c);if(!C.success)return y(C.error);let x=`${f}:${a}`,k=EC(f);return E({taskDefinitionArn:C.data.newTaskDefArn,previousTaskDefinitionArn:d,imageUri:x,ecrRepositoryArn:k,imageDigest:g,durationMs:C.data.durationMs})}function EC(t){let e=t.match(/^(\d{12})\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com\/(.+)$/);if(!e)return"";let[,r,n,a]=e;return`arn:aws:ecr:${n}:${r}:repository/${a}`}var DRr,rg,AC,ORr,NRr,EW=w(()=>{"use strict";Ce();Ct();$();Vy();Oo();Ab();vt();Z1();_ae();eoe();vW();Qae();owt();DRr=Object.defineProperty,rg=(t,e)=>DRr(t,"name",{value:e,configurable:!0}),AC="codeOnlyDeploy";rg(iwt,"lookupContentHashTag");rg(cwt,"findManifestServiceForEcsService");rg(ioe,"rebaseRollbackTagForService");ORr=0,NRr=1;rg(l1e,"recordRolloutOutputs");rg(coe,"reconcileImageTagParameters");rg(c1e,"mergeEcsAndLambdaOutcomes");rg(u1e,"deployCodeOnly");rg(lwt,"rollOutServiceImageTagsMap");rg(d1e,"rolloutService");rg(EC,"deriveEcrRepositoryArn")});async function p1e(t,e,r){if(t.length===0)return E(void 0);let n=await Promise.all(t.map(async o=>{let s=await e.getStackStatus(o,void 0,r);return{name:o,result:s}})),a=[];for(let{name:o,result:s}of n){if(!s.success)return y(s.error);let i=s.data;i===null||i.status==="DOES_NOT_EXIST"||q1[i.status]?.safeToRedeploy==="No"&&a.push({name:o,status:i.status})}if(a.length>0){let o=a.map(s=>`  ${s.name}: ${s.status}`).join(`
 `);return y(new Error(`Cannot proceed while stacks are busy:
 ${o}
 
@@ -689,7 +689,7 @@ ${O1e(n,e.appName)}`);let o=n.length>0?`
 
 ${O1e(n,e.appName)}`:"";return new yf(`${e.originalError.message}
 
-${Coe(a,e.appName,e.repairTarget)}${o}`,a)}catch(r){return z.debug(rDr,"Post-failure repair probe threw \u2014 offer skipped",{stackNames:[...e.stackNames],error:S(T(r))}),e.originalError}}async function Mwt(t,e,r){let n=t.getAccountId(),a=t.getRegion(),o=new Map,s=[],i=[];for(let c of e){let l=o.get(c.stackName);l===void 0&&(l=await Iu(n,a,c.stackName,r),o.set(c.stackName,l));let u=l.find(d=>d.verb==="recreate"&&d.targets.some(p=>p.logicalId===c.logicalId));u!==void 0?s.push({finding:c,opId:u.opId,...u.appName!==void 0?{appName:u.appName}:{}}):i.push(c)}return{covered:s,uncovered:i}}var tDr,IW,rDr,yf,xoe=w(()=>{"use strict";$();Ct();$G();hae();fC();XG();tDr=Object.defineProperty,IW=(t,e)=>tDr(t,"name",{value:e,configurable:!0}),rDr="PostFailureRepairOffer",yf=class extends Error{static{IW(this,"DriftRepairAvailableError")}findings;constructor(e,r){super(e),this.name="DriftRepairAvailableError",this.findings=r}};IW(Coe,"formatDriftRepairOffer");IW(O1e,"formatRecreateCoveredNotice");IW(TC,"composePostFailureRepairOffer");IW(Mwt,"partitionByRecreateCoverage")});import{DescribeTableCommand as aDr,DynamoDBClient as oDr}from"@aws-sdk/client-dynamodb";import{DescribeDBClustersCommand as sDr,DescribeDBInstancesCommand as iDr,RDSClient as Lwt}from"@aws-sdk/client-rds";function Toe(t){let e=typeof t=="object"&&t!==null&&"name"in t?String(t.name):"";return/NotFound/i.test(e)}async function Fwt(t,e,r){try{let n=await t.getClient(Lwt).send(new iDr({DBInstanceIdentifier:e}),{abortSignal:ee(r)});return E({blocked:n.DBInstances?.[0]?.DeletionProtection===!0,setting:"DeletionProtection"})}catch(n){return Toe(n)?E({blocked:!1,setting:"DeletionProtection"}):y(new Error(S(T(n))))}}async function jwt(t,e,r){try{let n=await t.getClient(Lwt).send(new sDr({DBClusterIdentifier:e}),{abortSignal:ee(r)});return E({blocked:n.DBClusters?.[0]?.DeletionProtection===!0,setting:"DeletionProtection"})}catch(n){return Toe(n)?E({blocked:!1,setting:"DeletionProtection"}):y(new Error(S(T(n))))}}async function Bwt(t,e,r){try{let n=await t.getClient(oDr).send(new aDr({TableName:e}),{abortSignal:ee(r)});return E({blocked:n.Table?.DeletionProtectionEnabled===!0,setting:"DeletionProtectionEnabled"})}catch(n){return Toe(n)?E({blocked:!1,setting:"DeletionProtectionEnabled"}):y(new Error(S(T(n))))}}var nDr,qP,RW,N1e=w(()=>{"use strict";Ce();$();vt();nDr=Object.defineProperty,qP=(t,e)=>nDr(t,"name",{value:e,configurable:!0});qP(Toe,"isNotFoundError");qP(Fwt,"probeDbInstanceDeletionProtection");qP(jwt,"probeDbClusterDeletionProtection");qP(Bwt,"probeDynamoTableDeletionProtection");RW={"AWS::RDS::DBInstance":{probe:Fwt,method:"rds:DescribeDBInstances",disableCommand:qP(t=>`aws rds modify-db-instance --db-instance-identifier ${t} --no-deletion-protection`,"disableCommand")},"AWS::RDS::DBCluster":{probe:jwt,method:"rds:DescribeDBClusters",disableCommand:qP(t=>`aws rds modify-db-cluster --db-cluster-identifier ${t} --no-deletion-protection`,"disableCommand")},"AWS::DynamoDB::Table":{probe:Bwt,method:"dynamodb:DescribeTable",disableCommand:qP(t=>`aws dynamodb update-table --table-name ${t} --no-deletion-protection-enabled`,"disableCommand")}}});import{CloudFormationClient as lDr,ListImportsCommand as uDr}from"@aws-sdk/client-cloudformation";async function Vwt(t,e,r){let n=t.getClient(lDr),a=[],o;try{do{if(Ae(r))return y(new Error(`aborted while listing imports of export '${e}'`));let s=await n.send(new uDr({ExportName:e,...o!==void 0?{NextToken:o}:{}}),{abortSignal:ee(r)});a.push(...s.Imports??[]),o=s.NextToken}while(o!==void 0);return E(a)}catch(s){return pDr.test(T(s))?E([]):y(new Error(S(T(s))))}}async function DW(t,e){for(let{stackName:r,targets:n}of e.stacks){if(Ae(e.abortSignal))return y(new Error(`Recreate pre-flight aborted before ${r} was checked \u2014 nothing was mutated in this run.`));let a=n.map(c=>c.logicalId),o=await Bd(t,r,e.abortSignal);if(!o.success)return y(new Error(`${o.error.message} Nothing was mutated in this run.`));let s=PP(o.data.templateBody,a,r);if(!s.success)return y(new Error(`${s.error.message} Nothing was mutated in this run.`));let i=new Set(s.data.alreadyAbsent);for(let c of s.data.strippedExports){if(c.exportName===void 0)return y(new Error(`Recreate pre-flight for ${r}: removing ${a.join(", ")} strips output '${c.outputName}' whose Export name is not a literal string, so its cross-stack consumers cannot be verified \u2014 perform the replacement manually. Nothing was mutated in this run.`));let l=await Vwt(t,c.exportName,e.abortSignal);if(!l.success)return y(new Error(`Recreate pre-flight for ${r}: could not verify whether export '${c.exportName}' (output '${c.outputName}') is imported by other stacks: ${l.error.message}. Retry the deploy. Nothing was mutated in this run.`));if(l.data.length>0)return y(new Error(`Recreate pre-flight for ${r}: removing ${a.join(", ")} strips export '${c.exportName}' (output '${c.outputName}'), which is imported by ${l.data.join(", ")} \u2014 CloudFormation refuses to drop an export while imports exist, so the surgery would fail mid-deploy. Redeploy the importing stack(s) without the import first, or perform the replacement manually. Nothing was mutated in this run.`))}for(let c of n){if(i.has(c.logicalId))continue;let l=RW[c.resourceType];if(l===void 0)continue;if(Ay(c,r)){z.debug(dDr,"No live physical id to probe \u2014 skipping",{stackName:r,logicalId:c.logicalId});continue}let u=await l.probe(t,c.physicalId,e.abortSignal);if(!u.success)return y(new Error(`Recreate pre-flight for ${r}: could not verify that ${c.physicalId} (${c.logicalId}) is deletable \u2014 ${l.method} failed: ${u.error.message}. Retry the deploy. Nothing was mutated in this run.`));if(u.data.blocked)return y(new Error(`Recreate pre-flight for ${r}: ${c.physicalId} (${c.logicalId}) has ${u.data.setting} enabled \u2014 CloudFormation cannot delete it, so the pinned-name replacement would fail mid-surgery. Disable it on the live resource (e.g. '${l.disableCommand(c.physicalId)}'), then re-run the deploy. Nothing was mutated in this run.`))}}return E(void 0)}var cDr,Uwt,dDr,pDr,_1e=w(()=>{"use strict";Ce();$();Ct();vt();ww();N1e();fC();qG();cDr=Object.defineProperty,Uwt=(t,e)=>cDr(t,"name",{value:e,configurable:!0}),dDr="RecreatePreFlight",pDr=/is not imported by any stack/i;Uwt(Vwt,"listExportImporters");Uwt(DW,"runRecreatePreFlight")});function koe(t){return M1e.has(t)?"Snapshot":"Delete"}function zwt(t){let e={};for(let r of t)e[r.logicalId]=koe(r.resourceType);return e}function $1e(t,e,r,n){let a=n.filter(s=>s!==r);if(a.length===0)return E(void 0);let o=a.map(s=>{let i=Jb(t,s,e,Xh);return`${s} covers ${i.success&&i.data.length>0?i.data.join(", "):"(could not recover its target set)"}`});return y(new Error(`Recreate operation ${r} on ${e} found target resources already carrying a ${Xh} marker from a different operation \u2014 its journal may live on another machine, and completing this operation over it would strand that surgery. Marked resources recovered from the live template: ${o.join("; ")}. Complete the foreign operation first (re-run its converge deploy on the machine that holds its journal), then re-run this deploy. Nothing was mutated.`))}async function OW(t,e,r){let{stackName:n,targets:a,onProgress:o,abortSignal:s}=e;if(a.length===0)return y(new Error("Recreate surgery requires at least one target"));let i=r?.now??(()=>new Date),c=t.getAccountId(),l=t.getRegion(),u=a.map(M=>M.logicalId),d=uv(n,u),p=zwt(a),m={markerKey:Xh,policyForTarget:KP(M=>p[M]??"Delete","policyForTarget")},f=e.appName!==void 0?`Re-run 'fjall deploy ${e.appName}' to resume the recreate.`:"Re-run the deploy to resume the recreate.",g=KP(M=>M.snapshotPolicies??p,"reportPolicies"),v=await mC(c,l,n,d,r?.journal);if(v!==null&&v.verb!=="recreate"&&v.phase!=="done")return y(new Error(`Recreate operation ${d} on ${n} collides with an in-flight '${v.verb}' operation covering the same resources \u2014 complete it first with 'fjall drift resume ${d}', then re-run this deploy. Nothing was mutated.`));if(v!==null&&v.phase==="removal-applied"){let M=await aM(t,{journal:v,...s!==void 0?{abortSignal:s}:{}},r);if(!M.success)return M;if(v=M.data.journal,M.data.status==="converge-pending"){let B=M.data.unverified,j=(e.plannedReplacementLogicalIds??[]).filter(U=>B.includes(U));if(j.length>0){let U=e.appName!==void 0?`fjall deploy ${e.appName}`:"fjall deploy";return y(new Error(`Recreate operation ${d} on ${n} already applied its removal, but the closure check could not verify ${j.join(", ")} (re-created, removed, or still orphaned) \u2014 and this deploy plans a pinned-name replacement for the same target(s), which CloudFormation would refuse while the name may still be held. Nothing further was mutated. Retry the deploy once AWS settles \u2014 a re-assert or converge still in flight clears on its own. If it persists, verify the resource state in the owning service; the terminating cure is to remove the resource(s) from the fjall config and re-run '${U}' \u2014 the converge clears the unverifiable declaration and the operation closes as removed \u2014 then re-add the configuration to re-create them under their pinned names.`))}return o?.(`Removal already applied on ${n} \u2014 the deploy re-creates any still-missing ${u.join(", ")} under the pinned names; already-present targets close once the post-deploy sweep verifies them`),E({opId:d,phase:v.phase,convergePending:!0,...v.forensicsPath!==void 0?{forensicsPath:v.forensicsPath}:{},snapshotPolicies:g(v),journal:v})}}if(v!==null&&v.phase==="done"){if(e.doneJournalPolicy!=="archive-and-restart")return o?.(KG(v)),E({opId:d,phase:"done",convergePending:!1,...v.forensicsPath!==void 0?{forensicsPath:v.forensicsPath}:{},snapshotPolicies:g(v),journal:v});let M=await IP(v,r?.journal);if(!M.success)return M;o?.(YG(v)),v=null}let b=KP(async M=>{let B=await pC(M,r?.journal);return B.success?E(M):y(B.error)},"persistJournal"),A;if(v===null){let M=await Bd(t,n,s);if(!M.success)return M;let B=Pu(M.data.templateBody,u,n,m);if(!B.success)return B;let j=$1e(M.data.templateBody,n,d,B.data.markerOpIds);if(!j.success)return j;if(B.data.markerOpIds.includes(d)){o?.(`Recognised in-flight recreate markers on ${n} \u2014 resuming from the ${Xh} marker`);let U=i().toISOString(),G=await b({version:1,opId:d,verb:"recreate",accountId:c,region:l,stackName:n,...e.appName!==void 0?{appName:e.appName}:{},targets:[...a],phase:B.data.allFlipped?"flip-applied":"captured",createdAt:U,updatedAt:U,snapshotPolicies:p});if(!G.success)return G;v=G.data,A=M.data}else{o?.(`Capturing forensics for ${n} (${d})`);let U=await EP(t,{stackName:n,opId:d,findings:e.findings??[],...s!==void 0?{abortSignal:s}:{}},r?.forensics);if(!U.success)return U;let G=i().toISOString(),V=await b({version:1,opId:d,verb:"recreate",accountId:c,region:l,stackName:n,...e.appName!==void 0?{appName:e.appName}:{},targets:[...a],phase:"captured",createdAt:G,updatedAt:G,forensicsPath:U.data.forensicsPath,snapshotPolicies:p,...e.consentedPhysicalNames!==void 0?{consentedPhysicalNames:[...e.consentedPhysicalNames]}:{}});if(!V.success)return V;v=V.data,A={templateBody:U.data.liveTemplateBody,capabilities:U.data.capabilities,parameterKeys:U.data.parameterKeys}}}if(A===void 0){let M=await Bd(t,n,s);if(!M.success)return M;A=M.data}let C=A.templateBody,x=Pu(C,u,n,m);if(!x.success)return x;let k=$1e(C,n,d,x.data.markerOpIds);if(!k.success)return k;let I=new Set(x.data.absentTargets),R=u.filter(M=>!I.has(M)),N=[];if(R.length>0){if(x.data.unflippedTargets.filter(L=>R.includes(L)).length>0){o?.(`Deriving the snapshot flip for ${n}`);let L=CP({liveTemplateBody:C,stackName:n,targets:R,opId:d,at:i().toISOString(),spec:m});if(!L.success)return L;let H=xP(C,L.data.flipTemplateBody,R,n,Xh);if(!H.success)return H;o?.("Proving the flip is metadata-only (review change set)");let ae=await TP(t,{stackName:n,flipTemplateBody:L.data.flipTemplateBody,targets:R,parameterKeys:A.parameterKeys,...s!==void 0?{abortSignal:s}:{}},r?.flip);if(!ae.success)return ae;let ne=await b({...v,phase:"flip-verified",updatedAt:i().toISOString(),liveTemplateDigest:L.data.liveTemplateDigest,proof:{diffGuardPassed:!0,changeSetMetadataOnly:!0,noChanges:ae.data.noChanges,provenAt:i().toISOString()}});if(!ne.success)return ne;v=ne.data,o?.(`Applying the snapshot flip to ${n}`);let Z=await lC(t,{stackName:n,flipTemplateBody:L.data.flipTemplateBody,capabilities:A.capabilities,parameterKeys:A.parameterKeys,derivedFromTemplateDigest:L.data.liveTemplateDigest,opId:d,operationLabel:"Snapshot-flip",resumeHint:f,...s!==void 0?{abortSignal:s}:{}},r?.flip);if(!Z.success)return Z;let re=await Bd(t,n,s);if(!re.success)return re;if(C=re.data.templateBody,x=Pu(C,u,n,m),!x.success)return x;let le=new Set(x.data.absentTargets),X=x.data.unflippedTargets.filter(ue=>!le.has(ue));if(X.length>0)return y(new Error(`Snapshot flip on ${n} reported ${Z.data.outcome} but GetTemplate does not show the snapshot policy + the ${Xh} marker on ${X.join(", ")} \u2014 aborting to manual repair.`))}if(v.phase==="captured"||v.phase==="flip-verified"){let L=await b({...v,phase:"flip-applied",updatedAt:i().toISOString(),liveTemplateDigest:Zp(C)});if(!L.success)return L;v=L.data}o?.(`Deriving the surgical removal of ${R.join(", ")} from ${n}`);let M=PP(C,u,n);if(!M.success)return y(new Error(`${M.error.message} The snapshot flip has already been applied on ${n}. ${f}`));N=M.data.coRemoved.map(L=>L.logicalId);let B=[...u,...N];if(M.data.coRemoved.length>0){let L=M.data.coRemoved.map(H=>`${H.logicalId} (${H.resourceType})`).join(", ");o?.(`Co-removing stateless referrer(s) of the recreate target(s): ${L} \u2014 CloudFormation cannot keep a resource that references a deleted one; the deploy re-creates them alongside the targets. No data is lost.`)}o?.("Proving the removal touches only the recreate targets (review change set)");let j=await HG(t,{stackName:n,removalTemplateBody:M.data.removalTemplateBody,targets:B,parameterKeys:A.parameterKeys,...s!==void 0?{abortSignal:s}:{}},r?.flip);if(!j.success)return j;if(!j.data.noChanges){let L=R.map(ae=>`${ae} \u2192 ${p[ae]??"Delete"}`).join(", ");o?.(`Removing ${R.join(", ")}${N.length>0?` (with co-removed ${N.join(", ")})`:""} from ${n} (deletion policies: ${L})`);let H=await lC(t,{stackName:n,flipTemplateBody:M.data.removalTemplateBody,capabilities:A.capabilities,parameterKeys:A.parameterKeys,derivedFromTemplateDigest:M.data.liveTemplateDigest,opId:d,operationLabel:"Recreate-removal",resumeHint:f,...s!==void 0?{abortSignal:s}:{}},{...r?.flip,updateTimeoutMs:r?.flip?.updateTimeoutMs??fDr});if(!H.success)return H}let U=await Bd(t,n,s);if(!U.success)return U;C=U.data.templateBody;let G=GG(C,B,n);if(!G.success)return G;if(G.data.length>0)return y(new Error(`Recreate removal on ${n} completed but GetTemplate still shows ${G.data.join(", ")} \u2014 aborting to manual repair. ${f}`));if(!j.data.noChanges){let L=await WG(t,n,B,s);if(!L.success)return y(new Error(`Recreate removal on ${n} removed ${R.join(", ")} from the template, but the physical deletion outcome could not be verified: ${L.error.message}. ${f}`));if(L.data.length>0){let H=L.data.map(ae=>`${ae.status} for ${ae.logicalId}${ae.statusReason!==void 0?` (${ae.statusReason})`:""}`).join("; ");return y(new Error(`Recreate removal on ${n} removed ${R.join(", ")} from the template, but CloudFormation reported ${H} \u2014 the physical resource(s) still exist outside the stack; a recreate target orphaned this way still holds its pinned name, so the deploy's re-create would collide. Resolve the deletion failure and delete the orphaned resource(s) manually, then re-run the deploy to resume.`))}}let V=R.filter(L=>p[L]==="Snapshot");V.length>0&&o?.(`Final snapshots were requested for ${V.join(", ")} \u2014 locate them in the owning service's console to restore data into the re-created resources`)}let _=await b({...v,phase:"removal-applied",updatedAt:i().toISOString(),liveTemplateDigest:Zp(C),...N.length>0?{coRemovedLogicalIds:N}:{}});return _.success?(v=_.data,o?.(`Surgical removal complete on ${n} \u2014 the deploy now re-creates ${u.join(", ")} under the pinned names`),E({opId:d,phase:v.phase,convergePending:!0,...v.forensicsPath!==void 0?{forensicsPath:v.forensicsPath}:{},snapshotPolicies:g(v),journal:v})):_}var mDr,KP,M1e,fDr,L1e=w(()=>{"use strict";Ce();fC();XG();Sae();VG();qG();mDr=Object.defineProperty,KP=(t,e)=>mDr(t,"name",{value:e,configurable:!0}),M1e=new Set(["AWS::DocDB::DBCluster","AWS::EC2::Volume","AWS::ElastiCache::CacheCluster","AWS::ElastiCache::ReplicationGroup","AWS::Neptune::DBCluster","AWS::RDS::DBCluster","AWS::RDS::DBInstance","AWS::Redshift::Cluster"]);KP(koe,"snapshotPolicyForType");fDr=30*6e4;KP(zwt,"buildSnapshotPolicies");KP($1e,"guardForeignRecreateMarkers");KP(OW,"runRecreateSurgery")});import{join as Gwt}from"path";import{CloudFormationClient as gDr}from"@aws-sdk/client-cloudformation";import{EC2Client as yDr}from"@aws-sdk/client-ec2";function Wwt(t){let e=Object.entries(t);if(e.length===0)return;let r={};for(let[n,a]of e){let o=uT(n);r[o]=a}return r}function Hwt(t){if(t?.mode!==void 0&&t.mode!=="rollback"){if(t.imageTag)return y(new Error(`--image-tag requires rollback mode (explicit mode '${t.mode}' was supplied alongside an image tag)`));if(t.serviceImageTags)return y(new Error(`serviceImageTags requires rollback mode (explicit mode '${t.mode}' was supplied alongside serviceImageTags)`))}if(t?.mode==="rollback"){if(t.imageTag&&t.serviceImageTags)return y(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!t.imageTag&&!t.serviceImageTags)return y(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(t?.containerName!==void 0&&!t.imageTag)return y(new Error("--container-name requires --image-tag \u2014 it targets which container within the service's task definition receives the rolled-back image"));if(t?.serviceImageTags!==void 0){if(t.serviceName)return y(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));let e=Object.entries(t.serviceImageTags);if(e.length===0)return y(new Error("serviceImageTags must name at least one service"));for(let[r,n]of e){let a=ZA.safeParse(n);if(!a.success)return y(new Error(`serviceImageTags.${r} is not a valid image tag: ${a.error.message}`))}}return E(void 0)}function _W(t,e,r){if(t.onStackTargets===void 0||r.length===0)return;let n=e.awsProvider.getAccountId(),a=e.awsProvider.getRegion();t.onStackTargets(r.map(o=>({stackName:o,...n!==""?{accountId:n}:{},...a!==""?{region:a}:{}})))}async function F1e(t,e,r){let{callbacks:n,options:a}=t,o=Date.now(),s=a?.mode??(a?.imageTag||a?.serviceImageTags?"rollback":a?.deployOnly?"code-only":"full");if(s==="restart"){let ie=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return n.onError?.(ie),y(ie)}let i=Hwt(a);if(!i.success){let ie=S(i.error.message),oe=new Error(ie);return n.onError?.(oe),y(oe)}let c=Oc.buildDeploymentContext({deployType:"application",target:r.appName,path:r.path,region:e.awsProvider.getRegion(),callerIdentity:sl(e.awsProvider.getAccountId()),...jp({orgConfig:t.orgConfig,identity:t.identity,skipOidc:t.options?.skipOidc}),...t.managedDomainBindings!==void 0?{managedDomainBindings:t.managedDomainBindings}:{}},{verbose:a?.verbose,infraOnly:a?.infraOnly},t.orgConfig),l=e.frameworkRegistry.resolve({appPath:r.path}),u,d=s==="rollback";if(l&&!d){u=l.builder.plan({appPath:r.path},l.detection);let ie=Y_e(n),oe=await l.builder.build(r.path,u,ie,{skipBuild:a?.skipBuild,infraOnly:a?.infraOnly,...t.abortSignal!==void 0&&{abortSignal:t.abortSignal}});if(!oe.success){let he=new Error(S(oe.error.message));return n.onError?.(he),y(he)}}if(s==="code-only"||d){n.onLog?.(d?a?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(a.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${a?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");let ie=Gwt(r.path,"cdk.out"),oe=o$(ie),he=oe.declaresBuild,Be=l?.detection.hasDockerfile===!0,lt=he||Be;z.debug(NW,"Deploy-only branch entered",{mode:s,imageTag:a?.imageTag,serviceImageTags:a?.serviceImageTags,appName:r.appName,appPath:r.path,cdkOutPath:ie,dockerProviderAvailable:t.dockerProvider!==void 0,builderName:l?.builder.name,hasDockerfileFromManifest:he,hasDockerfileFromDisk:Be,hasDockerfile:lt,manifestDockerServiceCount:oe.ecsServices.length,manifestDockerPaths:oe.ecsServices.map(Vt=>Vt.docker.path),manifestLambdaDockerEntryCount:oe.lambdaEntries.length}),!he&&!Be&&n.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");let Je=await yM([nr(r.appName,Te.COMPUTE)],e.cfnService,t.abortSignal);if(!Je.success)return n.onError?.(Je.error),y(Je.error);_W(n,e,[nr(r.appName,Te.COMPUTE)]);let At={},Xe;if(!d&&t.dockerProvider!==void 0&&lt){z.debug(NW,"Running Docker build before code-only deploy",{source:he?"manifest":"disk"});let Vt=await yW(t,e,r,n);if(!Vt.success)return y(Vt.error);At=Vt.data.contentHashTagsByService,Xe=Vt.data}else z.debug(NW,"Skipping Docker build",{reason:d?"rollback":t.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});let ut=await vo(t.assertLeaseForStack,nr(r.appName,Te.COMPUTE),t.abortSignal);return ut!==void 0?(n.onError?.(ut),y(ut)):u1e(t,e,r,At,Xe)}n.onLog?.("Analysing infrastructure\u2026","info");let p=await kIe(r,e,c,n,t.abortSignal);if(!p.success){let ie=new Error(S(p.error.message),{cause:p.error});return n.onError?.(ie),y(ie)}let m=p.data;try{await n.onDetectionComplete?.({...m,builderName:l?.builder.name??"unknown"})}catch(ie){let oe=new Error(S(T(ie)),{cause:ie});return n.onError?.(oe),y(oe)}let f={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:a?.infraOnly??!1,hasDockerfile:m.hasDockerfile,pattern:m.pattern,resources:m.resources,...l&&{builderName:l.builder.name}},g=Ns.getSteps(f),v=g.findIndex(ie=>ie.id===ve.TARGET_READINESS),b=await _P(n,{stepId:ve.TARGET_READINESS,stepName:Hr.TARGET_READINESS,...v>=0&&{stepIndex:v,totalSteps:g.length}},async()=>{if(a?.skipReadinessCheck)return n.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};let ie=e.awsProvider.getAccountId(),oe=t.orgConfig?.providerAccounts.find(Je=>Je.id===ie)?.name,he=e.awsProvider.getCredentials(),Be=Jp(t.orgConfig),lt=await Ik({cloudFormation:e.awsProvider.getClient(gDr),ec2:new yDr({region:Be,...he!==void 0&&{credentials:he}})},{id:ie,...oe!==void 0&&{name:oe}},e.awsProvider.getRegion(),t.orgConfig,t.abortSignal);return lt.success?lt.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(S(lt.data.advisory))}:{kind:"error",error:new Error(S(lt.error.message),{cause:lt.error})}},t.abortSignal);if(!b.success)return b;let A=Cy({pattern:m.pattern,resources:m.resources}),C=A.length,x=m.hasDockerfile&&t.dockerProvider!==void 0&&A.includes(Te.COMPUTE)&&a?.infraOnly!==!0;if(!m.hasDifferences&&!a?.force&&!x){n.onLog?.("No infrastructure changes detected","info"),n.onLog?.(a?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");let ie=m.hasDockerfile&&t.dockerProvider!==void 0&&A.includes(Te.COMPUTE);for(let he=0;he<A.length;he++){let Be=A[he];ie&&Be===Te.COMPUTE&&(n.onStepStart?.(ve.DOCKER_OPERATIONS,tg),n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"skipped"));let lt=Dn(Be,"deploy"),Je=Rn(Be,"deploy");n.onStepStart?.(lt,Je,he,C),n.onStepComplete?.(lt,Je,"skipped",he,C)}let oe=await e.stackService.resolveWebsiteUrl(r.appName);return E({target:r.appName,deploymentType:"application",outputs:oe?{websiteUrl:oe}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-o})}let k=Gwt(r.path,"cdk.out"),I=V_e({deployOrder:A,stackChanges:m.stackChanges,appName:r.appName,force:a?.force===!0,computeBuildPossible:x});_W(n,e,[...I]);let R=await yM([...I],e.cfnService,t.abortSignal);if(!R.success)return n.onError?.(R.error),y(R.error);let N={stacksToDeploy:[...I],imageBuild:z_e({stackNamesToDeploy:I,appName:r.appName,hasDockerProvider:t.dockerProvider!==void 0,hasDockerfile:m.hasDockerfile})},_=yv(m.currentHashes,N),M=kW({cfnService:e.cfnService,cdkOutPath:k,changedStacks:[...I],assemblyDigest:_,registry:new K1(e.awsProvider),changeSetProbe:new Eae(e.awsProvider),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}),B=await Xb(e.awsProvider,{stackNames:[...I],cdkOutPath:k,cfnService:e.cfnService,callbacks:n,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(B.kind==="blocked"){let ie=new Error(B.message);return n.onError?.(ie),y(ie)}let j=B.verifiedAbsentByNecessity??[],U=t.approvalGate!==void 0||a?.approvalToken!==void 0&&a.approvalToken!==""||a?.planOnly===!0;if(U){let ie=await PW({approvalGate:t.approvalGate,options:a??{},target:r.appName,cdkOutPath:k,detection:{stackChanges:m.stackChanges,currentHashes:m.currentHashes},scope:N,cfnService:e.cfnService,loadPlan:M,callbacks:n,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!ie.success)return ie;let oe=ie.data;if(oe.kind==="rejected")return n.onLog?.(`Deploy rejected: ${S(oe.reason)}`,"warn"),E({target:r.appName,deploymentType:"application",rejected:!0,artefacts:[],...oe.planDetail!==void 0?{planDetail:oe.planDetail}:{},durationMs:Date.now()-o});if(oe.kind==="awaiting"){let he=await M(),Be=he.success?Z$(he.data,j):void 0;return E({target:r.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:oe.approvalToken,assemblyDigest:oe.assemblyDigest,planDetail:oe.planDetail,...Be!==void 0?{destructionTicket:Be}:{},artefacts:[],durationMs:Date.now()-o})}}let G=await IG({loadPlan:M,options:a??{},target:r.appName,callbacks:n,verifiedAbsentByNecessity:j,...t.destructionConsentGate!==void 0?{consentGate:t.destructionConsentGate}:{}});if(!G.success)return n.onError?.(G.error),y(G.error);if(G.data.kind==="withheld"){let ie=U?Sv({assemblyDigest:_,ttlMs:Owt}):void 0;return E({target:r.appName,deploymentType:"application",destructionPending:!0,destructionTicket:G.data.ticket,destructionOutcome:G.data.outcome,destructionHaltReasons:G.data.reasons,...ie!==void 0?{destructionResumeToken:ie.token,destructionResumeExpiresAt:ie.expiresAt}:{},artefacts:[],durationMs:Date.now()-o})}if(G.data.kind==="proceed"){let{ticket:ie,verbsByPhysicalName:oe}=G.data,he=ie.resources.filter(lt=>oe.get(lt.physicalName)==="pin");if(he.length>0){n.onLog?.(`Pin remediation for ${r.appName}: probing live value(s) for ${he.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied`,"warn");let lt=await kG(e.awsProvider,{targets:he.map(Je=>({stack:Je.stack,logicalId:Je.logicalId,resourceType:Je.resourceType,physicalName:Je.physicalName,offendingProperties:Je.offendingProperties})),...t.infrastructureSource!==void 0?{infrastructureContent:t.infrastructureSource.content,infrastructureFilePath:t.infrastructureSource.filePath}:{},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});for(let Je of TG(lt))n.onLog?.(Je,"warn");return he.length<ie.resources.length&&n.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),E({target:r.appName,deploymentType:"application",pinPending:!0,pinReport:lt,pinDeferredConsents:ie.resources.length-he.length,destructionTicket:ie,artefacts:[],durationMs:Date.now()-o})}let Be=ie.resources.filter(lt=>lt.finding==="pinned-name-replacement"&&oe.get(lt.physicalName)==="recreate");if(Be.length>0){let lt=new Map;for(let Xe of Be){let ut=lt.get(Xe.stack)??[];ut.push(Xe),lt.set(Xe.stack,ut)}let Je=await DW(e.awsProvider,{stacks:[...lt].map(([Xe,ut])=>({stackName:Xe,targets:ut.map(Vt=>({logicalId:Vt.logicalId,resourceType:Vt.resourceType,physicalId:Vt.physicalName}))})),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!Je.success){let Xe=new Error(S(Je.error.message),{cause:Je.error});return n.onError?.(Xe),y(Xe)}let At=[];for(let[Xe,ut]of lt){let Vt=await vo(t.assertLeaseForStack,Xe,t.abortSignal,"destroy");if(Vt!==void 0)return At.length>0&&n.onLog?.(`Surgery already completed on ${At.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),n.onError?.(Vt),y(Vt);let tn=ut.map(Qn=>Qn.physicalName);n.onLog?.(`Recreate remediation for ${r.appName}: orchestrating the pinned-name replacement of ${tn.join(", ")} on ${Xe}`,"warn");let da=await OW(e.awsProvider,{stackName:Xe,targets:ut.map(Qn=>({logicalId:Qn.logicalId,resourceType:Qn.resourceType,physicalId:Qn.physicalName})),appName:r.appName,consentedPhysicalNames:tn,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:ut.map(Qn=>Qn.logicalId),onProgress:YP(Qn=>n.onLog?.(Qn,"info"),"onProgress"),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!da.success){let Qn=At.length>0?` Surgery already completed on ${At.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",Dr=new Error(S(`${da.error.message}${Qn}`));return n.onError?.(Dr),y(Dr)}At.push(`${Xe} (${tn.join(", ")})`)}}}let V=t.orgConfig!==void 0&&!bu(t.orgConfig.providerAccounts),L=Rb({account:t.orgConfig?.providerAccounts.find(ie=>ie.id===e.awsProvider.getAccountId()),estate:V?"solo":"org"}),H=await qk(e,c,n,L);if(!H.success)return H;let ae=nr(r.appName,Te.DATABASE),ne=I.has(ae),Z=ne?await roe(e.cfnService,r.appName,t.abortSignal):void 0,re=ne?await e1e(e.ecsResolver,e.ecsService,r.appName,t.abortSignal):void 0,le={},X=new Map,ue,ce={},_e=YP(async()=>{!ne||!X.has(ae)||await t1e({appName:r.appName,connectionOutputsBefore:Z,serviceTaskDefinitionsBefore:re,services:{cfnService:e.cfnService,ecsService:e.ecsService,ecsResolver:e.ecsResolver},callbacks:n,...t.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:t.confirmDatabaseEndpointRestart}:{},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let ie=0;ie<A.length;ie++){let oe=A[ie],he=nr(r.appName,oe),Be=Dn(oe,"deploy"),lt=Rn(oe,"deploy");if(!I.has(he)){n.onStepStart?.(Be,lt,ie,C),n.onLog?.(`Skipping ${oe} \u2014 no changes detected`,"info"),n.onStepComplete?.(Be,lt,"skipped",ie,C);continue}let Je=await vo(t.assertLeaseForStack,he,t.abortSignal);if(Je!==void 0)return await _e(),n.onError?.(Je),y(Je);let At=G_e(A,ie,r.appName,I);if(At.length>=2){let Dr=await Jae({hashService:e.hashService,cdkOutPath:k,stackNames:At.map(vc=>nr(r.appName,vc)),detectionHashes:m.currentHashes,approvalGated:U});if(!Dr.success)return await _e(),n.onError?.(Dr.error),y(Dr.error);let un=await W_e(At,r,e,c,n,ie,C,m,le,X);if(!un.success)return await _e(),y(await TC(e.awsProvider,{stackNames:At.map(vc=>nr(r.appName,vc)),appName:r.appName,originalError:un.error,cfnService:e.cfnService,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}));ie+=At.length-1;continue}let Xe=await q_e(oe,t,e,r,n,m.hasDockerfile);if(Xe!==null&&!Xe.success)return await _e(),y(Xe.error);Xe!==null&&Xe.success&&(ue=Xe.data);let ut=Xe!==null&&Xe.success?Xe.data.contentHashTagsByService:{},Vt=Wwt(ut);if(Xe!==null){let Dr=await vo(t.assertLeaseForStack,he,t.abortSignal);if(Dr!==void 0)return await _e(),n.onError?.(Dr),y(Dr)}let tn=await Jae({hashService:e.hashService,cdkOutPath:k,stackNames:[he],detectionHashes:m.currentHashes,approvalGated:U});if(!tn.success)return await _e(),n.onError?.(tn.error),y(tn.error);let da=await H_e(oe,e,c,n,ie,C,le,Vt!==void 0||t.abortSignal!==void 0?{...Vt!==void 0?{parameters:Vt}:{},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}:void 0);if(!da.success)return await _e(),y(await TC(e.awsProvider,{stackNames:[he],appName:r.appName,originalError:da.error,cfnService:e.cfnService,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}));oe===Te.COMPUTE&&(ce=await K_e(r,e,n,ut,t.abortSignal));let Qn=m.currentHashes.get(he);Qn&&X.set(he,Qn)}if(await _e(),X.size>0){let ie=await e.hashService.updateStateAfterDeploy(r.path,X);if(!ie.success){let oe=S(ie.error.message);z.debug(NW,"Failed to update state file",{error:oe}),n.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${oe}`,"warn")}}let Se=await e.stackService.resolveWebsiteUrl(r.appName);Se&&(le.websiteUrl=Se);let de=await m1e(e,r.appName,ue,n,k,ce,t.abortSignal);return await NP(e.awsProvider,{stackNames:[...I],appName:r.appName,onLog:YP((ie,oe)=>n.onLog?.(ie,oe),"onLog"),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}).catch(ie=>{z.debug(NW,"Forget completion sweep failed",{error:S(T(ie))})}),E({target:r.appName,deploymentType:"application",outputs:Object.keys(le).length>0?le:void 0,artefacts:de,durationMs:Date.now()-o})}var hDr,YP,NW,j1e=w(()=>{"use strict";Ce();Ct();$();Vy();sb();Oo();Uw();_d();fz();Nw();Pmt();Cw();PIe();tte();gC();_ae();vW();XAt();ewt();nwt();EW();uoe();jy();fwt();VPe();Aae();D1e();RG();woe();CW();boe();tW();fC();xoe();tae();_1e();L1e();hDr=Object.defineProperty,YP=(t,e)=>hDr(t,"name",{value:e,configurable:!0}),NW="applicationDeploy";YP(Wwt,"buildCdkImageTagParameters");YP(Hwt,"validateRollbackOptions");YP(_W,"emitStackTargets");YP(F1e,"deployApplication")});import{OrganizationsClient as B1e}from"@aws-sdk/client-organizations";function $W(t,e,r,n,a,o,s,i){let c=e.awsProvider.getRegion();return Oc.buildDeploymentContext({deployType:n,target:r.target,path:r.path,region:c,accountName:o,callerIdentity:sl(e.awsProvider.getAccountId()),orgId:a?.orgId,rootId:a?.rootId,managementAccountId:a?.managementAccountId,devOuId:a?.devOuId,...jp({orgConfig:t.orgConfig,identity:t.identity,skipOidc:EIe(n,t.orgConfig,t.options?.skipOidc,i),...n!=="organisation"?{region:c,primaryRegion:t.orgConfig?.primaryRegion}:{},trailLifecycle:s})},{verbose:t.options?.verbose,infraOnly:t.options?.infraOnly},t.orgConfig)}async function U1e(t,e){let r=t.awsProvider.getClient(B1e),n=await $y(r,e);return n.success?E({orgId:n.data.orgId,rootId:n.data.rootId,managementAccountId:n.data.managementAccountId}):y(n.error)}async function V1e(t,e){let r=t.awsProvider.getClient(B1e),n=await rte(r,e);return n.success?n.data===null?E(void 0):E({orgId:n.data.orgId,managementAccountId:n.data.managementAccountId,...n.data.rootId!==void 0?{rootId:n.data.rootId}:{}}):y(n.error)}async function z1e(t,e){let r=t.awsProvider.getClient(B1e),n=await m1(r,e,{tolerateAccessDenied:!0});if(!(!n.success||n.data===null))return{orgId:n.data.orgId,rootId:n.data.rootId,managementAccountId:n.data.managementAccountId}}var vDr,Poe,G1e=w(()=>{"use strict";Ce();Uw();sb();ate();_d();vDr=Object.defineProperty,Poe=(t,e)=>vDr(t,"name",{value:e,configurable:!0});Poe($W,"buildOrgContext");Poe(U1e,"resolveOrgDetails");Poe(V1e,"resolveOrgDetailsForMemberComponent");Poe(z1e,"resolveOrgDetailsForSolo")});function ZP(t,e){t.onStackTargets===void 0||e.length===0||t.onStackTargets(e)}function aE(t){t.onStepComplete?.(uo.PREPARE.id,uo.PREPARE.name,"error",1,bv)}function Qp(t,e){let r=new Error(S(e));return t.onError?.(r),y(r)}async function CM(t,e,r,n,a){let o=await t.cfnService.getStackOutputs(r,void 0,a);return o.success||e.onLog?.(n,"debug"),i$(o)}var SDr,Ioe,uo,bv,MW=w(()=>{"use strict";Ce();_d();$();Cw();SDr=Object.defineProperty,Ioe=(t,e)=>SDr(t,"name",{value:e,configurable:!0}),uo={CONNECT:{id:ve.CONNECT,name:Pc.CONNECT},PREPARE:{id:ve.PREPARE_ENVIRONMENT,name:Pc.PREPARE},DEPLOY:{id:ve.DEPLOY,name:Pc.DEPLOY},MONITORING:{id:ve.MONITORING,name:Pc.MONITORING},ORG_DEPLOY:{id:ve.ORG_DEPLOY,name:Hr.ORG_DEPLOY},CASCADE_PLATFORM:{id:ve.CASCADE_PLATFORM,name:Hr.CASCADE_PLATFORM},CASCADE_ACCOUNTS:{id:ve.CASCADE_ACCOUNTS,name:Hr.CASCADE_ACCOUNTS}},bv=4;Ioe(ZP,"emitOrgStackTargets");Ioe(aE,"failPrepareStep");Ioe(Qp,"maskAndFail");Ioe(CM,"readStackOutputsBestEffort")});import{join as EDr}from"path";import{BackupClient as ADr}from"@aws-sdk/client-backup";import{IAMClient as wDr}from"@aws-sdk/client-iam";async function Roe(t,e,r,n,a){let{callbacks:o}=t;o.onStepComplete?.(uo.CONNECT.id,uo.CONNECT.name,"completed",0,bv),o.onStepStart?.(uo.PREPARE.id,uo.PREPARE.name,1,bv);let s=e.awsProvider.getRegion(),i=t.orgConfig?.primaryRegion;if(i!==void 0&&Sre(s,i)){let N=await Uke(e.awsProvider.getClient(wDr),t.abortSignal);if(!N.success)return aE(o),Qp(o,N.error.message);if(!N.data)return aE(o),Qp(o,Vke({target:r.target,deployRegion:s,primaryRegion:i,...t.orgConfig!==void 0?{providerAccounts:t.orgConfig.providerAccounts}:{}}))}let c=bu(t.orgConfig?.providerAccounts),l;if(c){let N=await V1e(e,t.abortSignal);if(!N.success)return aE(o),Qp(o,N.error.message);l=N.data}else l=await z1e(e,t.abortSignal);let u=n==="account"?t.orgConfig?.providerAccounts.find(N=>N.id===e.awsProvider.getAccountId()):t.orgConfig?.providerAccounts.find(N=>dr(N)==="platform"),d=n==="account"&&u!==void 0&&dr(u)==="organisation",p=$W(t,e,r,n,l,n==="account"?u?.name??r.target:void 0,u?.trailLifecycle,d),m=t.orgConfig?.disasterRecoveryRegion;if(n==="account"&&m!==void 0&&m!==""&&(u===void 0||Rk(u.environment,m))){let N=await _V(e.awsProvider.getClient(ADr),t.abortSignal);if(!N.success)return aE(o),Qp(o,N.error.message);p.fjallAdoptBackupVault=N.data}o.onLog?.(`Synthesising ${n} infrastructure\u2026`,"info");let f=await Hk(e,p,o,"CDK synthesis failed");if(!f.success)return aE(o),f;let g=nn(r.type),v=e.awsProvider.getAccountId(),b=e.awsProvider.getRegion();ZP(o,[{stackName:g,...v!==""?{accountId:v}:{},...b!==""?{region:b}:{}}]);let A=await Xb(e.awsProvider,{stackNames:[g],cdkOutPath:EDr(r.path,"cdk.out"),cfnService:e.cfnService,callbacks:o,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(A.kind==="blocked")return aE(o),Qp(o,A.message);let C=await qk(e,p,o,Rb({account:u,estate:c?"org":"solo",...l?.orgId!==void 0?{orgId:l.orgId}:{}}));if(!C.success)return aE(o),C;o.onStepComplete?.(uo.PREPARE.id,uo.PREPARE.name,"completed",1,bv);let x=await vo(t.assertLeaseForStack,g,t.abortSignal);if(x!==void 0)return o.onError?.(x),y(x);o.onStepStart?.(uo.DEPLOY.id,uo.DEPLOY.name,2,bv);let k=await e.cdkService.runCdkDeploy(p,g,Yi(o),Pb(o),e.awsProvider);if(!k.success){o.onStepComplete?.(uo.DEPLOY.id,uo.DEPLOY.name,"error",2,bv);let N=await TC(e.awsProvider,{stackNames:[g],repairTarget:`--stack ${g}`,originalError:new Error(S(k.error)),cfnService:e.cfnService,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});return o.onError?.(N),y(N)}o.onStepComplete?.(uo.DEPLOY.id,uo.DEPLOY.name,"completed",2,bv);let I=await CM(e,o,g,"Failed to read stack outputs (non-critical)",t.abortSignal);await s$(p,e.awsProvider,o,t.abortSignal),o.onStepStart?.(uo.MONITORING.id,uo.MONITORING.name,3,bv),o.onStepComplete?.(uo.MONITORING.id,uo.MONITORING.name,"completed",3,bv),await NP(e.awsProvider,{stackNames:[g],onLog:qwt((N,_)=>o.onLog?.(N,_),"onLog"),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}).catch(N=>{z.debug("SingleComponentDeploy","Forget completion sweep failed",{error:S(T(N))})});let R=k.data?.status==="NO_CHANGES"&&t.options?.force!==!0;return E({target:r.target,deploymentType:"organisation",outputs:I,artefacts:[],...R?{noChanges:!0}:{},durationMs:Date.now()-a})}var bDr,qwt,Kwt=w(()=>{"use strict";Ce();Ct();Oo();A1();Nw();_d();$();tW();fC();xoe();G1e();Nw();fz();MW();jy();bDr=Object.defineProperty,qwt=(t,e)=>bDr(t,"name",{value:e,configurable:!0});qwt(Roe,"deploySingleComponent")});function LW(t){return xDr.has(t)}function Doe(t){return Array.isArray(t)&&t.every(e=>typeof e=="string")}function FW(t){return typeof t!="object"||t===null?!1:Object.entries(t).every(([e,r])=>typeof e=="string"&&(typeof r=="string"||Doe(r)||FW(r)))}function kC(t){let e=[];for(let[r,n]of Object.entries(t))if(typeof n=="string")e.push({accountName:n,environment:r});else if(Array.isArray(n))for(let a of n)e.push({accountName:a,environment:r});else typeof n=="object"&&n!==null&&e.push(...kC(n));return e}function Ooe(t){let e=[];for(let r of Object.values(t))typeof r=="string"?e.push(r):Array.isArray(r)?e.push(...r):typeof r=="object"&&r!==null&&e.push(...Ooe(r));return e}function xM(t){let e={};for(let[r,n]of Object.entries(t))typeof n=="string"?e[r]=[n]:Array.isArray(n)?e[r]=[...n]:typeof n=="object"&&n!==null&&(e[r]=xM(n));return e}async function oE(t){try{let e=await import("path"),r=await import("fs"),{pathToFileURL:n}=await import("url"),a=e.join(t,"fjall","organisation",W1e);if(!r.existsSync(a))return E(null);let{tsImport:o}=await import("tsx/esm/api"),s=n(a).href,i=await o(a,s),c=i.default,l=i.ACCOUNTS||c?.ACCOUNTS;return l?FW(l)?E(l):y(new yu("ACCOUNTS configuration has invalid structure","ACCOUNTS",a,{providedValue:l})):y(new yu(`ACCOUNTS constant not found in organisation/${W1e}`,"ACCOUNTS",a,{moduleKeys:Object.keys(i),hasDefault:i.default!==void 0}))}catch(e){let r=S(T(e));return y(new yu(`Failed to import ACCOUNTS from organisation/${W1e}: ${r}`,"ACCOUNTS",void 0,{originalError:e}))}}var CDr,JP,W1e,H1e,xDr,q1e=w(()=>{"use strict";Ce();$();Xm();CDr=Object.defineProperty,JP=(t,e)=>CDr(t,"name",{value:e,configurable:!0}),W1e="infrastructure.ts",H1e=["security","suspended"],xDr=new Set(H1e);JP(LW,"isOuOnlyAccountBucket");JP(Doe,"isStringArray");JP(FW,"isAccountsConfig");JP(kC,"flattenAccountsToEnvironments");JP(Ooe,"extractAllAccountNames");JP(xM,"accountsConfigToOUTree");JP(oE,"parseAccountsConfiguration")});import{OrganizationsClient as kDr}from"@aws-sdk/client-organizations";async function jW(t,e){let r,n=new Promise((p,m)=>{r=setTimeout(()=>m(new Error(`Timed out parsing ACCOUNTS configuration after ${Ywt}ms`)),Ywt)}),a;try{a=await Promise.race([oE(e),n])}catch(p){return y(_r(p))}finally{r!==void 0&&clearTimeout(r)}if(!a.success)return y(new Error(`Failed to parse ACCOUNTS configuration: ${a.error.message}`));if(a.data===null)return y(new Error("ACCOUNTS configuration file not found"));let o=kC(a.data),s=new Map;for(let{accountName:p,environment:m}of o)s.set(p.toLowerCase(),{environment:m,displayName:p});let i;try{i=t.awsProvider.getClient(kDr)}catch(p){return y(_r(p))}let c=await Mp(i);if(!c.success)return y(c.error);let l=new Map;for(let p of c.data){let m=PDr.safeParse(p);m.success&&l.set(m.data.Name.toLowerCase(),{id:m.data.Id,name:m.data.Name})}let u=[],d=[];for(let[p,{environment:m,displayName:f}]of s){let g=l.get(p);if(!g){d.push(f);continue}BS(m)!=="organisation"&&u.push({id:g.id,name:g.name,tier:BS(m),environment:xT(m)})}return E({providerAccounts:u,missingAccountNames:d})}function BW(t,e){let r=new Map;for(let n of t?.providerAccounts??[])r.set(n.id,n);for(let n of e)r.has(n.id)||r.set(n.id,n);return{...t??{},providerAccounts:Array.from(r.values())}}var TDr,Zwt,Ywt,PDr,K1e=w(()=>{"use strict";Ft();Ce();$();ste();q1e();TDr=Object.defineProperty,Zwt=(t,e)=>TDr(t,"name",{value:e,configurable:!0}),Ywt=6e4,PDr=h.object({Id:h.string().min(1),Name:h.string().min(1)});Zwt(jW,"reconcileProviderAccounts");Zwt(BW,"mergeReconciledProviderAccounts")});async function Y1e(t,e){let{callbacks:r}=t,n=t.orgConfig?.providerAccounts??[];if(n.length===0||n.every(s=>dr(s)==="organisation")){let s=await jW(e,t.workingDirectory);if(s.success){let{providerAccounts:i,missingAccountNames:c}=s.data;i.length>0&&(n=BW(t.orgConfig,i).providerAccounts,r.onLog?.(`Reconciled ${i.length} account(s) from AWS Organizations`,"info")),c.length>0&&(r.onCascadeMissingAccounts?.(c),r.onProgress?.({type:"warning",message:S(`Accounts declared in ACCOUNTS but not yet in AWS Organizations (cascade will skip): ${c.join(", ")}`)}))}else r.onProgress?.({type:"warning",message:S(`Could not reconcile accounts from AWS Organizations \u2014 cascade may skip accounts: ${s.error.message}`)})}let a=Jp(t.orgConfig);n=n.map(s=>s.region!==void 0?s:{...s,region:a});let o=t.orgConfig!==void 0?{...t.orgConfig,providerAccounts:n}:n.length>0?{providerAccounts:n}:void 0;return{providerAccounts:n,effectiveOrgConfig:o,defaultRegion:a}}var IDr,RDr,Jwt=w(()=>{"use strict";gC();K1e();$();IDr=Object.defineProperty,RDr=(t,e)=>IDr(t,"name",{value:e,configurable:!0});RDr(Y1e,"resolveCascadeAccounts")});function Ev(t){let e=new Set,r=new Set,n=new Set;for(let l of t.members)l.result==="succeeded"?e.add(l.accountId):l.result==="failed"?r.add(l.accountId):n.add(l.accountId);let a=0;for(let l of n)!e.has(l)&&!r.has(l)&&a++;let{platform:o}=t,s=o!==void 0&&(o.result==="succeeded"||o.result==="skipped"),i=o!==void 0&&o.result==="skipped",c=o!==void 0&&o.result==="failed";return{platformDeployed:s,platformSkipped:i,platformFailed:c,domainsDeployed:t.domainsDeployed,accountsDeployed:e.size,accountsSkipped:a,accountsFailed:r.size,errors:t.errors}}function Z1e(t){return t==="failed"?{success:!1}:{success:!0,skipped:t==="skipped"}}function UW(t){let e=t.members.map(n=>({accountName:n.accountName,accountId:n.accountId,region:n.region,duration:n.durationMs,...Z1e(n.result),...n.error!==void 0?{error:n.error}:{}}));if(t.platform===void 0)return{accountResults:e};let{platform:r}=t;return{accountResults:e,platformResult:{duration:r.durationMs,...Z1e(r.result),...r.error!==void 0?{error:r.error}:{}}}}var DDr,J1e,Noe=w(()=>{"use strict";DDr=Object.defineProperty,J1e=(t,e)=>DDr(t,"name",{value:e,configurable:!0});J1e(Ev,"projectScalarSummary");J1e(Z1e,"outcomeToRowFlags");J1e(UW,"projectAccountRows")});async function X1e(t,e,r,n){let{callbacks:a}=t,{providerAccounts:o,effectiveOrgConfig:s,totalSteps:i,cascadeErrors:c,allCascadeOutputs:l,orgId:u}=n,d=!1;a.onCascadeStart?.();let p=Date.now(),m=2,f=!1,g,v=!1,b=[],A=Xwt(N=>({members:b,...g!==void 0?{platform:g}:{},domainsDeployed:v,errors:c,totalDurationMs:N}),"buildLedger"),{platformAccount:C,memberAccounts:x}=Ru(o),k=Jp(t.orgConfig);if(C){let{id:N,name:_}=uo.CASCADE_PLATFORM;a.onStepStart?.(N,_,m,i),a.onCascadePhaseStart?.("platform");let M,B=Date.now();try{M=await Nae(t,e,r,C,"platform",a,{orgConfig:s,primaryRegion:k,orgId:u})}catch(U){let G=S(T(U));c.push({accountId:C.id,error:G}),a.onCascadePhaseComplete?.("platform"),a.onStepComplete?.(N,_,"error",m,i),M=y(new Error(G))}let j=Date.now()-B;if(M.success){f=!0;let U=M.data.skipped===!0;U||(d=!0),M.data.outputs&&l.push({accountId:C.id,outputs:M.data.outputs}),a.onCascadePhaseComplete?.("platform"),a.onStepComplete?.(N,_,U?"skipped":"completed",m,i),g={accountId:C.id,result:U?"skipped":"succeeded",durationMs:j}}else c.some(U=>U.accountId===C.id)||(c.push({accountId:C.id,error:S(M.error.message)}),a.onCascadePhaseComplete?.("platform"),a.onStepComplete?.(N,_,"error",m,i)),g={accountId:C.id,result:"failed",durationMs:j,error:S(M.error.message)};m++}let I=new Map;if(f&&C&&(I=await FNe(e,C,a,t.abortSignal)),t.domainProvider){let N=await jNe(t.domainProvider,a,{executingAccountId:e.awsProvider.getAccountId(),executingRegion:e.awsProvider.getRegion(),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{},...t.options?.skipCaaPreflight!==void 0?{skipCaaPreflight:t.options.skipCaaPreflight}:{}});v=N.domainsDeployed>0,v&&(d=!0);for(let _ of N.errors)c.push({accountId:"domains",error:S(_)})}if(C!==void 0&&!f&&x.length>0){let{id:N,name:_}=uo.CASCADE_ACCOUNTS;a.onStepStart?.(N,_,m,i),a.onStepComplete?.(N,_,"skipped",m,i),a.onLog?.("Skipping account cascade \u2014 platform deployment failed; platform is a prerequisite for member accounts.","warn")}else if(x.length>0){let{id:N,name:_}=uo.CASCADE_ACCOUNTS;a.onStepStart?.(N,_,m,i),a.onCascadePhaseStart?.("accounts");let M=mf(t.orgConfig),B=dv(x,M);(await dh(B,rW,async({account:U,region:G})=>{let V=I.get(`${U.id}-${hb(G)}`),L=Date.now();return{result:await Nae(t,e,r,U,"account",a,{ipamPoolId:V,orgConfig:s,region:G,primaryRegion:k,orgId:u}),durationMs:Date.now()-L}})).forEach((U,G)=>{let V=B[G];if(!V)return;let L=V.account;if(U.status==="rejected"){let ne=S(U.reason instanceof Error?U.reason.message:String(U.reason));b.push({accountId:L.id,accountName:L.name,region:V.region,result:"failed",durationMs:0,error:ne}),c.push({accountId:L.id,error:ne});return}let{result:H,durationMs:ae}=U.value;if(H.success){let ne=H.data.skipped===!0;ne||(d=!0),H.data.outputs&&l.push({accountId:L.id,outputs:H.data.outputs}),b.push({accountId:L.id,accountName:L.name,region:V.region,result:ne?"skipped":"succeeded",durationMs:ae})}else{let ne=S(H.error.message);b.push({accountId:L.id,accountName:L.name,region:V.region,result:"failed",durationMs:ae,error:ne}),c.push({accountId:L.id,error:ne})}});let j=Ev(A(0));a.onCascadePhaseComplete?.("accounts"),a.onStepComplete?.(N,_,j.accountsFailed>0?"error":j.accountsSkipped===x.length?"skipped":"completed",m,i)}let R=A(Date.now()-p);return a.onCascadeComplete?.(Ev(R)),a.onCascadeLedger?.(R),{anyCascadeDeployHappened:d}}var ODr,Xwt,Qwt=w(()=>{"use strict";Ce();Lw();gC();Noe();$();MW();ODr=Object.defineProperty,Xwt=(t,e)=>ODr(t,"name",{value:e,configurable:!0});Xwt(X1e,"executeCascade")});import{ListObjectsV2Command as eCt}from"@aws-sdk/client-s3";import{GetTrailStatusCommand as _Dr}from"@aws-sdk/client-cloudtrail";function tCt(t,e){let r=[],n=Math.floor((e-t)/_oe)*_oe;for(let a=n;a<=e;a+=_oe){let o=new Date(a),s=String(o.getUTCMonth()+1).padStart(2,"0"),i=String(o.getUTCDate()).padStart(2,"0");r.push(`${o.getUTCFullYear()}/${s}/${i}`)}return r.reverse()}async function rCt(t,e){let r=!1,n,a=!1,o=!1,s=TM(u=>{for(let d of u.Contents??[])r=!0,d.LastModified!==void 0&&((n===void 0||d.LastModified>n)&&(n=d.LastModified),d.LastModified.getTime()>=e.recentSinceMs&&(a=!0))},"ingest"),i=TM(u=>({delivered:r,recentDelivery:u,...n!==void 0?{latestObjectAt:n}:{}}),"outcome"),c=await t.send(new eCt({Bucket:e.bucketName,Prefix:e.accountPrefix,Delimiter:"/"}),{abortSignal:ee(e.abortSignal)});s(c);let l=(c.CommonPrefixes??[]).map(u=>u.Prefix).filter(u=>u!==void 0);if(c.IsTruncated===!0||l.length>MDr)return i(void 0);for(let u of l)for(let d of e.datePaths){let p,m=!1;for(let f=0;f<LDr&&!m;f++){if(Ae(e.abortSignal))throw new Error("Aborted: org-trail delivery scan cancelled by shutdown signal");let g=await t.send(new eCt({Bucket:e.bucketName,Prefix:`${u}${d}/`,...p!==void 0?{ContinuationToken:p}:{}}),{abortSignal:ee(e.abortSignal)});if(s(g),a)return i(!0);g.IsTruncated===!0?p=g.NextContinuationToken:m=!0}m||(o=!0)}return i(o?void 0:!1)}async function $oe(t,e){let r=e.recencyWindowMs??$Dr,n=Date.now(),a=tCt(r,n),o=[];for(let s of e.accountIds)try{let i=await rCt(t,{bucketName:e.bucketName,accountPrefix:`AWSLogs/${e.orgId}/${s}/CloudTrail/`,datePaths:a,recentSinceMs:n-r,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});o.push({accountId:s,...i})}catch(i){return Nt(i)==="NoSuchBucket"?y(new Error(`Organisation trail bucket ${e.bucketName} does not exist \u2014 the org trail has not been deployed yet.`)):y(new Error(`Failed to verify org-trail delivery for account ${s}: ${S(T(i))}`))}return E({bucketName:e.bucketName,perAccount:o})}async function FDr(t,e,r){try{let n=await t.send(new _Dr({Name:e}),{abortSignal:ee(r)});return E({isLogging:n.IsLogging===!0,...n.LatestDeliveryTime!==void 0?{latestDeliveryTime:n.LatestDeliveryTime}:{}})}catch(n){return y(new Error(`Failed to read trail status for ${e}: ${S(T(n))}`))}}var NDr,TM,_oe,$Dr,MDr,LDr,Q1e=w(()=>{"use strict";Ce();$();vt();NDr=Object.defineProperty,TM=(t,e)=>NDr(t,"name",{value:e,configurable:!0}),_oe=1440*60*1e3,$Dr=_oe,MDr=50,LDr=2;TM(tCt,"utcDatePathsForWindow");TM(rCt,"scanAccountDelivery");TM($oe,"verifyOrgTrailDelivery");TM(FDr,"getTrailLoggingStatus")});import{DeleteBucketCommand as BDr,HeadBucketCommand as UDr,ListObjectVersionsCommand as VDr}from"@aws-sdk/client-s3";import{DescribeTrailsCommand as zDr}from"@aws-sdk/client-cloudtrail";import{DescribeKeyCommand as GDr,ScheduleKeyDeletionCommand as WDr}from"@aws-sdk/client-kms";async function nCt(t,e,r){try{let n=await t.send(new zDr({trailNameList:[e]}),{abortSignal:ee(r)});return E((n.trailList??[]).length>0)}catch(n){return Nt(n)==="TrailNotFoundException"?E(!1):y(new Error(`Failed to probe trail ${e}: ${S(T(n))}`))}}async function aCt(t,e,r){try{return await t.send(new UDr({Bucket:e}),{abortSignal:ee(r)}),E(!0)}catch(n){return Cb(n)?E(!1):y(new Error(`Failed to probe bucket ${e}: ${S(T(n))}`))}}async function oCt(t,e,r){try{let n=await t.send(new VDr({Bucket:e,MaxKeys:1}),{abortSignal:ee(r)});return(n.Versions??[]).length===0&&(n.DeleteMarkers??[]).length===0}catch(n){return z.debug("memberTrailCleanup",`Emptiness probe failed for ${e}; treating as not proven empty`,{error:S(T(n))}),!1}}async function sCt(t,e,r){try{let n=(await t.send(new GDr({KeyId:e}),{abortSignal:ee(r)})).KeyMetadata?.KeyState;if(n==="PendingDeletion"||n==="PendingReplicaDeletion")return E(void 0)}catch(n){return Nt(n)==="NotFoundException"?E(void 0):y(new Error(`Failed to probe CMK: ${S(T(n))}`))}try{return await t.send(new WDr({KeyId:e,PendingWindowInDays:HDr}),{abortSignal:ee(r)}),E(void 0)}catch(n){return qDr.has(Nt(n))?E(void 0):y(new Error(`Failed to schedule CMK deletion: ${S(T(n))}`))}}async function zW(t,e,r){let n=await nCt(t.cloudTrailClient,e.trailName,e.abortSignal);if(!n.success)return y(n.error);if(n.data)return E({outcome:"blocked-trail-still-exists"});let a=await aCt(t.s3Client,e.bucketName,e.abortSignal);if(!a.success)return y(a.error);if(a.data){if(!await oCt(t.s3Client,e.bucketName,e.abortSignal)&&e.acknowledgeTrailHistoryLoss!==!0)return E({outcome:"blocked-awaiting-acknowledgement",bucketName:e.bucketName});await $h(t.s3Client,e.bucketName,r,e.abortSignal);try{await t.s3Client.send(new BDr({Bucket:e.bucketName}),{abortSignal:ee(e.abortSignal)})}catch(o){if(!Cb(o))return y(new Error(`Failed to delete bucket ${e.bucketName}: ${S(T(o))}`))}}if(e.keyArn!==void 0&&e.keyArn!==""){let o=await sCt(t.kmsClient,e.keyArn,e.abortSignal);if(!o.success)return y(o.error)}return E({outcome:"decommissioned"})}var jDr,VW,HDr,qDr,e$e=w(()=>{"use strict";Ce();$();Ct();vt();e$();jDr=Object.defineProperty,VW=(t,e)=>jDr(t,"name",{value:e,configurable:!0}),HDr=14,qDr=new Set(["NotFoundException","KMSInvalidStateException"]);VW(nCt,"trailStillExists");VW(aCt,"bucketExists");VW(oCt,"bucketProvenEmpty");VW(sCt,"scheduleKeyDeletion");VW(zW,"decommissionMemberTrailStorage")});function GW(t,e){if(t==="account")return{action:"hold",reason:"pinned to a per-account trail"};if(t==="org")return{action:"hold",reason:"already migrated to the org trail"};if(t===void 0)return e.orgDeliveryVerified===!0?{action:"advance",to:"draining"}:{action:"hold",reason:e.orgDeliveryVerified===!1?"org-trail delivery not yet verified (first delivery can take up to 24h)":"org-trail delivery could not be determined"};switch(e.decommissionOutcome){case"decommissioned":return{action:"advance",to:"org"};case"blocked-trail-still-exists":return{action:"hold",reason:"per-account trail still exists \u2014 draining deploy not yet applied"};case"blocked-awaiting-acknowledgement":return{action:"hold",reason:"awaiting acknowledgeTrailHistoryLoss before discarding history"};case"failed":return{action:"hold",reason:"decommission attempt failed"};default:return{action:"hold",reason:"decommission was not attempted"}}}function Av(t,e){t.onTrailMigrationPhase?.({...e,...e.detail!==void 0?{detail:S(e.detail)}:{}})}async function WW(t,e,r){let n=[],a=e.accounts.filter(i=>i.trailLifecycle===void 0),o=e.accounts.filter(i=>i.trailLifecycle==="draining"),s=new Map;if(a.length>0){Av(r,{accountId:"*",accountName:"organisation",phase:"verify-delivery",status:"started",detail:`Checking org-trail delivery for ${a.length} account(s) in s3://${e.orgTrailBucketName}`});let i=await $oe(t.managementS3Client,{bucketName:e.orgTrailBucketName,orgId:e.orgId,accountIds:a.map(c=>c.id),...e.recencyWindowMs!==void 0?{recencyWindowMs:e.recencyWindowMs}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(i.success){for(let c of i.data.perAccount)s.set(c.accountId,c.recentDelivery===void 0?void 0:c.delivered&&c.recentDelivery);Av(r,{accountId:"*",accountName:"organisation",phase:"verify-delivery",status:"completed"})}else Av(r,{accountId:"*",accountName:"organisation",phase:"verify-delivery",status:"failed",detail:i.error.message})}for(let i of a){let c={...s.get(i.id)!==void 0?{orgDeliveryVerified:s.get(i.id)}:{}},l=GW(void 0,c);l.action==="advance"?(r.onTrailLifecycleChanged?.(i.id,void 0,l.to),r.onLog?.(`${i.name}: org-trail delivery verified \u2014 trail lifecycle advanced to "draining" (the next deploy removes its per-account trail)`,"info"),n.push({accountId:i.id,accountName:i.name,from:void 0,to:l.to})):n.push({accountId:i.id,accountName:i.name,from:void 0,heldReason:l.reason})}for(let i of o){let c=i.region??e.defaultRegion,l=e.cascadeOutputs.get(i.id),u=l?.[gk],d=l?.[OQ];if(u===void 0||u===""){let g=`stack output ${gk} unavailable for this run`;r.onProgress?.({type:"warning",message:`${i.name}: trail decommission skipped \u2014 ${g}. The account stays "draining"; the next deploy retries.`}),n.push({accountId:i.id,accountName:i.name,from:"draining",heldReason:g});continue}Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"started"});let p,m=await t.getMemberClients(i,c);if(!m.success)p={decommissionOutcome:"failed"},r.onProgress?.({type:"warning",message:S(`${i.name}: trail decommission failed \u2014 ${m.error.message}. The account stays "draining"; the next deploy retries.`)}),Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"failed",detail:m.error.message});else{let g=await zW(m.data,{accountId:i.id,trailName:wit,bucketName:u,...d!==void 0&&d!==""?{keyArn:d}:{},acknowledgeTrailHistoryLoss:i.acknowledgeTrailHistoryLoss===!0,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}},r);if(!g.success)p={decommissionOutcome:"failed"},r.onProgress?.({type:"warning",message:S(`${i.name}: trail decommission failed \u2014 ${g.error.message}. The account stays "draining"; the next deploy retries.`)}),Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"failed",detail:g.error.message});else if(p={decommissionOutcome:g.data.outcome},g.data.outcome==="blocked-awaiting-acknowledgement"){let v=`${i.name}: per-account trail removed, but its log history in s3://${u} will be DISCARDED on decommission. Back the bucket up if the history matters, then set acknowledgeTrailHistoryLoss: true for account ${i.id} and redeploy.`;r.onProgress?.({type:"warning",message:v}),Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"blocked",detail:v})}else g.data.outcome==="blocked-trail-still-exists"?Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"blocked",detail:"per-account trail still exists \u2014 the draining deploy has not been applied yet"}):Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"completed",detail:`bucket s3://${u} removed; CMK scheduled for deletion`})}let f=GW("draining",p);f.action==="advance"?(r.onTrailLifecycleChanged?.(i.id,"draining",f.to),r.onLog?.(`${i.name}: trail storage decommissioned \u2014 trail lifecycle advanced to "org"`,"info"),n.push({accountId:i.id,accountName:i.name,from:"draining",to:f.to})):n.push({accountId:i.id,accountName:i.name,from:"draining",heldReason:f.reason})}return n}var KDr,t$e,r$e=w(()=>{"use strict";$();Ks();Q1e();e$e();KDr=Object.defineProperty,t$e=(t,e)=>KDr(t,"name",{value:e,configurable:!0});t$e(GW,"decideNextTransition");t$e(Av,"emitPhase");t$e(WW,"reconcileTrailMigration")});import{S3Client as n$e}from"@aws-sdk/client-s3";import{CloudTrailClient as iCt}from"@aws-sdk/client-cloudtrail";import{KMSClient as cCt}from"@aws-sdk/client-kms";async function a$e(t,e,r){let{callbacks:n}=t,{orgOutputs:a,allCascadeOutputs:o,orgDetails:s,providerAccounts:i}=r,c=a?.[q3];if(c!==void 0&&c!==""){let l=new Map;for(let d of o)(l.get(d.accountId)===void 0||gk in d.outputs)&&l.set(d.accountId,d.outputs);a!==void 0&&l.set(s.managementAccountId,a);let u=lCt(async(d,p)=>{if(d.id===s.managementAccountId)return E({cloudTrailClient:e.awsProvider.getClient(iCt),s3Client:e.awsProvider.getClient(n$e),kmsClient:e.awsProvider.getClient(cCt)});let m=await Ib(e.awsProvider,d.id,p,`fjall-trail-migration-${d.name}`,t.abortSignal);return m.success?E({cloudTrailClient:m.data.provider.getClient(iCt),s3Client:m.data.provider.getClient(n$e),kmsClient:m.data.provider.getClient(cCt)}):y(m.error)},"getMemberClients");try{await WW({managementS3Client:e.awsProvider.getClient(n$e),getMemberClients:u},{orgId:s.orgId,orgTrailBucketName:c,accounts:i,cascadeOutputs:l,defaultRegion:r.defaultRegion,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}},n)}catch(d){n.onLog?.(S(`Org-trail migration reconciliation failed (non-fatal): ${T(d)}`),"warn")}}}var YDr,lCt,uCt=w(()=>{"use strict";Ce();_d();r$e();$();YDr=Object.defineProperty,lCt=(t,e)=>YDr(t,"name",{value:e,configurable:!0});lCt(a$e,"reconcileOrgTrailOutputs")});import{join as dCt}from"node:path";import{OrganizationsClient as XDr}from"@aws-sdk/client-organizations";async function o$e(t,e,r,n){let{callbacks:a,options:o}=t,{providerAccounts:s,effectiveOrgConfig:i,defaultRegion:c}=await Y1e(t,e),l=await U1e(e,t.abortSignal);if(!l.success)return Qp(a,l.error.message);let u=await T1(e.awsProvider.getClient(XDr),l.data.rootId,t.abortSignal);if(!u.success)return Qp(a,u.error.message);let d={...l.data,...u.data!==void 0?{devOuId:u.data}:{}},p=s.find(re=>dr(re)==="organisation"),m=$W(t,e,r,"organisation",d,void 0,p?.trailLifecycle),f=o?.cascade!==!1,{platformAccount:g,memberAccounts:v}=Ru(s),b=f&&g!==void 0?1:0,A=f&&v.length>0?1:0,C=2+b+A,x=f?[...g!==void 0?[g]:[],...v]:[];if(x.length>0){let re=await LNe(e,x,a,t.abortSignal),le=g!==void 0?re.find(X=>X.accountId===g.id):void 0;if(le!==void 0)return Qp(a,`Pre-flight cascade role check failed for the platform account ${le.accountName} (${le.accountId}): ${le.error}`);for(let X of re)a.onProgress?.({type:"warning",message:S(`Pre-flight cascade role check failed for ${X.accountName} (${X.accountId}) \u2014 its cascade deploy is expected to fail: ${X.error}`)})}a.onCascadeAccountsReconciled?.({hasPlatformAccount:b>0,hasMemberAccounts:A>0});let{id:k,name:I}=uo.PREPARE;a.onStepStart?.(k,I,0,C),a.onLog?.("Synthesising organisation infrastructure\u2026","info");let R=await Hk(e,m,a,"CDK synthesis failed");if(!R.success)return a.onStepComplete?.(k,I,"error",0,C),R;let N=e.awsProvider.getAccountId(),_=e.awsProvider.getRegion();ZP(a,[{stackName:nn(Lt.ORGANISATION),...N!==""?{accountId:N}:{},..._!==""?{region:_}:{}},...f&&g!==void 0?[{stackName:nn(Lt.PLATFORM),accountId:g.id,region:g.region??_}]:[],...f?dv(v,mf(t.orgConfig)).map(({account:re,region:le})=>({stackName:nn(Lt.ACCOUNT),accountId:re.id,region:le})):[]]);let M=await qk(e,m,a,Rb({account:p,estate:"org",orgId:d.orgId}));if(!M.success)return a.onStepComplete?.(k,I,"error",0,C),M;a.onStepComplete?.(k,I,"completed",0,C);let{id:B,name:j}=uo.ORG_DEPLOY,U=nn(Lt.ORGANISATION),G=!0,V=await e.hashService.getTemplateHashes(dCt(m.path,"cdk.out"));if(V.success){let re=await e.hashService.compareWithState(V.data,m.path);re.success?G=re.data.stackChanges.get(U)??!0:a.onLog?.(S(`Org root change detection failed \u2014 deploying to be safe: ${re.error.message}`),"warn")}else a.onLog?.(S(`Org root template hashing failed \u2014 deploying to be safe: ${V.error.message}`),"warn");let L=G||o?.force===!0||!await e.cfnService.stackExists(U,void 0,t.abortSignal);a.onOrgChangesDetected?.({hasOrgChanges:L});let H;if(L){a.onStepStart?.(B,j,1,C);let re=await Xb(e.awsProvider,{stackNames:[U],cdkOutPath:dCt(m.path,"cdk.out"),cfnService:e.cfnService,callbacks:a,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(re.kind==="blocked")return a.onStepComplete?.(B,j,"error",1,C),Qp(a,re.message);let le=await vo(t.assertLeaseForStack,U,t.abortSignal);if(le!==void 0)return a.onStepComplete?.(B,j,"error",1,C),a.onError?.(le),y(le);let X=await e.cdkService.runCdkDeploy(m,U,Yi(a),Pb(a),e.awsProvider);if(!X.success)return a.onStepComplete?.(B,j,"error",1,C),Qp(a,X.error);H=await CM(e,a,U,"Failed to read org stack outputs (non-critical)",t.abortSignal);let ue=V.success?V.data.get(U):void 0;if(ue!==void 0){let ce=await e.hashService.updateStateAfterDeploy(m.path,new Map([[U,ue]]));ce.success||a.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy the org root: ${S(ce.error.message)}`,"warn")}a.onStepComplete?.(B,j,"completed",1,C)}else a.onLog?.("Organisation root: no infrastructure changes \u2014 skipping deploy","info"),H=await CM(e,a,U,"Failed to read org stack outputs (non-critical)",t.abortSignal);let ae=[],ne=[],Z=L;if(f&&s.length>0){let{anyCascadeDeployHappened:re}=await X1e(t,e,r,{providerAccounts:s,effectiveOrgConfig:i,totalSteps:C,cascadeErrors:ae,allCascadeOutputs:ne,orgId:d.orgId});if(re&&(Z=!0),await a$e(t,e,{orgOutputs:H,allCascadeOutputs:ne,orgDetails:l.data,providerAccounts:s,defaultRegion:c}),ae.length>0){let le=ae.map(X=>`  ${X.accountId}: ${X.error}`).join(`
+${Coe(a,e.appName,e.repairTarget)}${o}`,a)}catch(r){return z.debug(rDr,"Post-failure repair probe threw \u2014 offer skipped",{stackNames:[...e.stackNames],error:S(T(r))}),e.originalError}}async function Mwt(t,e,r){let n=t.getAccountId(),a=t.getRegion(),o=new Map,s=[],i=[];for(let c of e){let l=o.get(c.stackName);l===void 0&&(l=await Iu(n,a,c.stackName,r),o.set(c.stackName,l));let u=l.find(d=>d.verb==="recreate"&&d.targets.some(p=>p.logicalId===c.logicalId));u!==void 0?s.push({finding:c,opId:u.opId,...u.appName!==void 0?{appName:u.appName}:{}}):i.push(c)}return{covered:s,uncovered:i}}var tDr,IW,rDr,yf,xoe=w(()=>{"use strict";$();Ct();$G();hae();fC();XG();tDr=Object.defineProperty,IW=(t,e)=>tDr(t,"name",{value:e,configurable:!0}),rDr="PostFailureRepairOffer",yf=class extends Error{static{IW(this,"DriftRepairAvailableError")}findings;constructor(e,r){super(e),this.name="DriftRepairAvailableError",this.findings=r}};IW(Coe,"formatDriftRepairOffer");IW(O1e,"formatRecreateCoveredNotice");IW(TC,"composePostFailureRepairOffer");IW(Mwt,"partitionByRecreateCoverage")});import{DescribeTableCommand as aDr,DynamoDBClient as oDr}from"@aws-sdk/client-dynamodb";import{DescribeDBClustersCommand as sDr,DescribeDBInstancesCommand as iDr,RDSClient as Lwt}from"@aws-sdk/client-rds";function Toe(t){let e=typeof t=="object"&&t!==null&&"name"in t?String(t.name):"";return/NotFound/i.test(e)}async function Fwt(t,e,r){try{let n=await t.getClient(Lwt).send(new iDr({DBInstanceIdentifier:e}),{abortSignal:ee(r)});return E({blocked:n.DBInstances?.[0]?.DeletionProtection===!0,setting:"DeletionProtection"})}catch(n){return Toe(n)?E({blocked:!1,setting:"DeletionProtection"}):y(new Error(S(T(n))))}}async function jwt(t,e,r){try{let n=await t.getClient(Lwt).send(new sDr({DBClusterIdentifier:e}),{abortSignal:ee(r)});return E({blocked:n.DBClusters?.[0]?.DeletionProtection===!0,setting:"DeletionProtection"})}catch(n){return Toe(n)?E({blocked:!1,setting:"DeletionProtection"}):y(new Error(S(T(n))))}}async function Bwt(t,e,r){try{let n=await t.getClient(oDr).send(new aDr({TableName:e}),{abortSignal:ee(r)});return E({blocked:n.Table?.DeletionProtectionEnabled===!0,setting:"DeletionProtectionEnabled"})}catch(n){return Toe(n)?E({blocked:!1,setting:"DeletionProtectionEnabled"}):y(new Error(S(T(n))))}}var nDr,qP,RW,N1e=w(()=>{"use strict";Ce();$();vt();nDr=Object.defineProperty,qP=(t,e)=>nDr(t,"name",{value:e,configurable:!0});qP(Toe,"isNotFoundError");qP(Fwt,"probeDbInstanceDeletionProtection");qP(jwt,"probeDbClusterDeletionProtection");qP(Bwt,"probeDynamoTableDeletionProtection");RW={"AWS::RDS::DBInstance":{probe:Fwt,method:"rds:DescribeDBInstances",disableCommand:qP(t=>`aws rds modify-db-instance --db-instance-identifier ${t} --no-deletion-protection`,"disableCommand")},"AWS::RDS::DBCluster":{probe:jwt,method:"rds:DescribeDBClusters",disableCommand:qP(t=>`aws rds modify-db-cluster --db-cluster-identifier ${t} --no-deletion-protection`,"disableCommand")},"AWS::DynamoDB::Table":{probe:Bwt,method:"dynamodb:DescribeTable",disableCommand:qP(t=>`aws dynamodb update-table --table-name ${t} --no-deletion-protection-enabled`,"disableCommand")}}});import{CloudFormationClient as lDr,ListImportsCommand as uDr}from"@aws-sdk/client-cloudformation";async function Vwt(t,e,r){let n=t.getClient(lDr),a=[],o;try{do{if(Ae(r))return y(new Error(`aborted while listing imports of export '${e}'`));let s=await n.send(new uDr({ExportName:e,...o!==void 0?{NextToken:o}:{}}),{abortSignal:ee(r)});a.push(...s.Imports??[]),o=s.NextToken}while(o!==void 0);return E(a)}catch(s){return pDr.test(T(s))?E([]):y(new Error(S(T(s))))}}async function DW(t,e){for(let{stackName:r,targets:n}of e.stacks){if(Ae(e.abortSignal))return y(new Error(`Recreate pre-flight aborted before ${r} was checked \u2014 nothing was mutated in this run.`));let a=n.map(c=>c.logicalId),o=await Bd(t,r,e.abortSignal);if(!o.success)return y(new Error(`${o.error.message} Nothing was mutated in this run.`));let s=PP(o.data.templateBody,a,r);if(!s.success)return y(new Error(`${s.error.message} Nothing was mutated in this run.`));let i=new Set(s.data.alreadyAbsent);for(let c of s.data.strippedExports){if(c.exportName===void 0)return y(new Error(`Recreate pre-flight for ${r}: removing ${a.join(", ")} strips output '${c.outputName}' whose Export name is not a literal string, so its cross-stack consumers cannot be verified \u2014 perform the replacement manually. Nothing was mutated in this run.`));let l=await Vwt(t,c.exportName,e.abortSignal);if(!l.success)return y(new Error(`Recreate pre-flight for ${r}: could not verify whether export '${c.exportName}' (output '${c.outputName}') is imported by other stacks: ${l.error.message}. Retry the deploy. Nothing was mutated in this run.`));if(l.data.length>0)return y(new Error(`Recreate pre-flight for ${r}: removing ${a.join(", ")} strips export '${c.exportName}' (output '${c.outputName}'), which is imported by ${l.data.join(", ")} \u2014 CloudFormation refuses to drop an export while imports exist, so the surgery would fail mid-deploy. Redeploy the importing stack(s) without the import first, or perform the replacement manually. Nothing was mutated in this run.`))}for(let c of n){if(i.has(c.logicalId))continue;let l=RW[c.resourceType];if(l===void 0)continue;if(Ay(c,r)){z.debug(dDr,"No live physical id to probe \u2014 skipping",{stackName:r,logicalId:c.logicalId});continue}let u=await l.probe(t,c.physicalId,e.abortSignal);if(!u.success)return y(new Error(`Recreate pre-flight for ${r}: could not verify that ${c.physicalId} (${c.logicalId}) is deletable \u2014 ${l.method} failed: ${u.error.message}. Retry the deploy. Nothing was mutated in this run.`));if(u.data.blocked)return y(new Error(`Recreate pre-flight for ${r}: ${c.physicalId} (${c.logicalId}) has ${u.data.setting} enabled \u2014 CloudFormation cannot delete it, so the pinned-name replacement would fail mid-surgery. Disable it on the live resource (e.g. '${l.disableCommand(c.physicalId)}'), then re-run the deploy. Nothing was mutated in this run.`))}}return E(void 0)}var cDr,Uwt,dDr,pDr,_1e=w(()=>{"use strict";Ce();$();Ct();vt();ww();N1e();fC();qG();cDr=Object.defineProperty,Uwt=(t,e)=>cDr(t,"name",{value:e,configurable:!0}),dDr="RecreatePreFlight",pDr=/is not imported by any stack/i;Uwt(Vwt,"listExportImporters");Uwt(DW,"runRecreatePreFlight")});function koe(t){return M1e.has(t)?"Snapshot":"Delete"}function zwt(t){let e={};for(let r of t)e[r.logicalId]=koe(r.resourceType);return e}function $1e(t,e,r,n){let a=n.filter(s=>s!==r);if(a.length===0)return E(void 0);let o=a.map(s=>{let i=Jb(t,s,e,Xh);return`${s} covers ${i.success&&i.data.length>0?i.data.join(", "):"(could not recover its target set)"}`});return y(new Error(`Recreate operation ${r} on ${e} found target resources already carrying a ${Xh} marker from a different operation \u2014 its journal may live on another machine, and completing this operation over it would strand that surgery. Marked resources recovered from the live template: ${o.join("; ")}. Complete the foreign operation first (re-run its converge deploy on the machine that holds its journal), then re-run this deploy. Nothing was mutated.`))}async function OW(t,e,r){let{stackName:n,targets:a,onProgress:o,abortSignal:s}=e;if(a.length===0)return y(new Error("Recreate surgery requires at least one target"));let i=r?.now??(()=>new Date),c=t.getAccountId(),l=t.getRegion(),u=a.map(M=>M.logicalId),d=uv(n,u),p=zwt(a),m={markerKey:Xh,policyForTarget:KP(M=>p[M]??"Delete","policyForTarget")},f=e.appName!==void 0?`Re-run 'fjall deploy ${e.appName}' to resume the recreate.`:"Re-run the deploy to resume the recreate.",g=KP(M=>M.snapshotPolicies??p,"reportPolicies"),v=await mC(c,l,n,d,r?.journal);if(v!==null&&v.verb!=="recreate"&&v.phase!=="done")return y(new Error(`Recreate operation ${d} on ${n} collides with an in-flight '${v.verb}' operation covering the same resources \u2014 complete it first with 'fjall drift resume ${d}', then re-run this deploy. Nothing was mutated.`));if(v!==null&&v.phase==="removal-applied"){let M=await aM(t,{journal:v,...s!==void 0?{abortSignal:s}:{}},r);if(!M.success)return M;if(v=M.data.journal,M.data.status==="converge-pending"){let B=M.data.unverified,j=(e.plannedReplacementLogicalIds??[]).filter(U=>B.includes(U));if(j.length>0){let U=e.appName!==void 0?`fjall deploy ${e.appName}`:"fjall deploy";return y(new Error(`Recreate operation ${d} on ${n} already applied its removal, but the closure check could not verify ${j.join(", ")} (re-created, removed, or still orphaned) \u2014 and this deploy plans a pinned-name replacement for the same target(s), which CloudFormation would refuse while the name may still be held. Nothing further was mutated. Retry the deploy once AWS settles \u2014 a re-assert or converge still in flight clears on its own. If it persists, verify the resource state in the owning service; the terminating cure is to remove the resource(s) from the fjall config and re-run '${U}' \u2014 the converge clears the unverifiable declaration and the operation closes as removed \u2014 then re-add the configuration to re-create them under their pinned names.`))}return o?.(`Removal already applied on ${n} \u2014 the deploy re-creates any still-missing ${u.join(", ")} under the pinned names; already-present targets close once the post-deploy sweep verifies them`),E({opId:d,phase:v.phase,convergePending:!0,...v.forensicsPath!==void 0?{forensicsPath:v.forensicsPath}:{},snapshotPolicies:g(v),journal:v})}}if(v!==null&&v.phase==="done"){if(e.doneJournalPolicy!=="archive-and-restart")return o?.(KG(v)),E({opId:d,phase:"done",convergePending:!1,...v.forensicsPath!==void 0?{forensicsPath:v.forensicsPath}:{},snapshotPolicies:g(v),journal:v});let M=await IP(v,r?.journal);if(!M.success)return M;o?.(YG(v)),v=null}let b=KP(async M=>{let B=await pC(M,r?.journal);return B.success?E(M):y(B.error)},"persistJournal"),A;if(v===null){let M=await Bd(t,n,s);if(!M.success)return M;let B=Pu(M.data.templateBody,u,n,m);if(!B.success)return B;let j=$1e(M.data.templateBody,n,d,B.data.markerOpIds);if(!j.success)return j;if(B.data.markerOpIds.includes(d)){o?.(`Recognised in-flight recreate markers on ${n} \u2014 resuming from the ${Xh} marker`);let U=i().toISOString(),G=await b({version:1,opId:d,verb:"recreate",accountId:c,region:l,stackName:n,...e.appName!==void 0?{appName:e.appName}:{},targets:[...a],phase:B.data.allFlipped?"flip-applied":"captured",createdAt:U,updatedAt:U,snapshotPolicies:p});if(!G.success)return G;v=G.data,A=M.data}else{o?.(`Capturing forensics for ${n} (${d})`);let U=await EP(t,{stackName:n,opId:d,findings:e.findings??[],...s!==void 0?{abortSignal:s}:{}},r?.forensics);if(!U.success)return U;let G=i().toISOString(),V=await b({version:1,opId:d,verb:"recreate",accountId:c,region:l,stackName:n,...e.appName!==void 0?{appName:e.appName}:{},targets:[...a],phase:"captured",createdAt:G,updatedAt:G,forensicsPath:U.data.forensicsPath,snapshotPolicies:p,...e.consentedPhysicalNames!==void 0?{consentedPhysicalNames:[...e.consentedPhysicalNames]}:{}});if(!V.success)return V;v=V.data,A={templateBody:U.data.liveTemplateBody,capabilities:U.data.capabilities,parameterKeys:U.data.parameterKeys}}}if(A===void 0){let M=await Bd(t,n,s);if(!M.success)return M;A=M.data}let C=A.templateBody,x=Pu(C,u,n,m);if(!x.success)return x;let k=$1e(C,n,d,x.data.markerOpIds);if(!k.success)return k;let I=new Set(x.data.absentTargets),R=u.filter(M=>!I.has(M)),N=[];if(R.length>0){if(x.data.unflippedTargets.filter(L=>R.includes(L)).length>0){o?.(`Deriving the snapshot flip for ${n}`);let L=CP({liveTemplateBody:C,stackName:n,targets:R,opId:d,at:i().toISOString(),spec:m});if(!L.success)return L;let H=xP(C,L.data.flipTemplateBody,R,n,Xh);if(!H.success)return H;o?.("Proving the flip is metadata-only (review change set)");let ae=await TP(t,{stackName:n,flipTemplateBody:L.data.flipTemplateBody,targets:R,parameterKeys:A.parameterKeys,...s!==void 0?{abortSignal:s}:{}},r?.flip);if(!ae.success)return ae;let ne=await b({...v,phase:"flip-verified",updatedAt:i().toISOString(),liveTemplateDigest:L.data.liveTemplateDigest,proof:{diffGuardPassed:!0,changeSetMetadataOnly:!0,noChanges:ae.data.noChanges,provenAt:i().toISOString()}});if(!ne.success)return ne;v=ne.data,o?.(`Applying the snapshot flip to ${n}`);let Z=await lC(t,{stackName:n,flipTemplateBody:L.data.flipTemplateBody,capabilities:A.capabilities,parameterKeys:A.parameterKeys,derivedFromTemplateDigest:L.data.liveTemplateDigest,opId:d,operationLabel:"Snapshot-flip",resumeHint:f,...s!==void 0?{abortSignal:s}:{}},r?.flip);if(!Z.success)return Z;let re=await Bd(t,n,s);if(!re.success)return re;if(C=re.data.templateBody,x=Pu(C,u,n,m),!x.success)return x;let le=new Set(x.data.absentTargets),X=x.data.unflippedTargets.filter(ue=>!le.has(ue));if(X.length>0)return y(new Error(`Snapshot flip on ${n} reported ${Z.data.outcome} but GetTemplate does not show the snapshot policy + the ${Xh} marker on ${X.join(", ")} \u2014 aborting to manual repair.`))}if(v.phase==="captured"||v.phase==="flip-verified"){let L=await b({...v,phase:"flip-applied",updatedAt:i().toISOString(),liveTemplateDigest:Zp(C)});if(!L.success)return L;v=L.data}o?.(`Deriving the surgical removal of ${R.join(", ")} from ${n}`);let M=PP(C,u,n);if(!M.success)return y(new Error(`${M.error.message} The snapshot flip has already been applied on ${n}. ${f}`));N=M.data.coRemoved.map(L=>L.logicalId);let B=[...u,...N];if(M.data.coRemoved.length>0){let L=M.data.coRemoved.map(H=>`${H.logicalId} (${H.resourceType})`).join(", ");o?.(`Co-removing stateless referrer(s) of the recreate target(s): ${L} \u2014 CloudFormation cannot keep a resource that references a deleted one; the deploy re-creates them alongside the targets. No data is lost.`)}o?.("Proving the removal touches only the recreate targets (review change set)");let j=await HG(t,{stackName:n,removalTemplateBody:M.data.removalTemplateBody,targets:B,parameterKeys:A.parameterKeys,...s!==void 0?{abortSignal:s}:{}},r?.flip);if(!j.success)return j;if(!j.data.noChanges){let L=R.map(ae=>`${ae} \u2192 ${p[ae]??"Delete"}`).join(", ");o?.(`Removing ${R.join(", ")}${N.length>0?` (with co-removed ${N.join(", ")})`:""} from ${n} (deletion policies: ${L})`);let H=await lC(t,{stackName:n,flipTemplateBody:M.data.removalTemplateBody,capabilities:A.capabilities,parameterKeys:A.parameterKeys,derivedFromTemplateDigest:M.data.liveTemplateDigest,opId:d,operationLabel:"Recreate-removal",resumeHint:f,...s!==void 0?{abortSignal:s}:{}},{...r?.flip,updateTimeoutMs:r?.flip?.updateTimeoutMs??fDr});if(!H.success)return H}let U=await Bd(t,n,s);if(!U.success)return U;C=U.data.templateBody;let G=GG(C,B,n);if(!G.success)return G;if(G.data.length>0)return y(new Error(`Recreate removal on ${n} completed but GetTemplate still shows ${G.data.join(", ")} \u2014 aborting to manual repair. ${f}`));if(!j.data.noChanges){let L=await WG(t,n,B,s);if(!L.success)return y(new Error(`Recreate removal on ${n} removed ${R.join(", ")} from the template, but the physical deletion outcome could not be verified: ${L.error.message}. ${f}`));if(L.data.length>0){let H=L.data.map(ae=>`${ae.status} for ${ae.logicalId}${ae.statusReason!==void 0?` (${ae.statusReason})`:""}`).join("; ");return y(new Error(`Recreate removal on ${n} removed ${R.join(", ")} from the template, but CloudFormation reported ${H} \u2014 the physical resource(s) still exist outside the stack; a recreate target orphaned this way still holds its pinned name, so the deploy's re-create would collide. Resolve the deletion failure and delete the orphaned resource(s) manually, then re-run the deploy to resume.`))}}let V=R.filter(L=>p[L]==="Snapshot");V.length>0&&o?.(`Final snapshots were requested for ${V.join(", ")} \u2014 locate them in the owning service's console to restore data into the re-created resources`)}let _=await b({...v,phase:"removal-applied",updatedAt:i().toISOString(),liveTemplateDigest:Zp(C),...N.length>0?{coRemovedLogicalIds:N}:{}});return _.success?(v=_.data,o?.(`Surgical removal complete on ${n} \u2014 the deploy now re-creates ${u.join(", ")} under the pinned names`),E({opId:d,phase:v.phase,convergePending:!0,...v.forensicsPath!==void 0?{forensicsPath:v.forensicsPath}:{},snapshotPolicies:g(v),journal:v})):_}var mDr,KP,M1e,fDr,L1e=w(()=>{"use strict";Ce();fC();XG();Sae();VG();qG();mDr=Object.defineProperty,KP=(t,e)=>mDr(t,"name",{value:e,configurable:!0}),M1e=new Set(["AWS::DocDB::DBCluster","AWS::EC2::Volume","AWS::ElastiCache::CacheCluster","AWS::ElastiCache::ReplicationGroup","AWS::Neptune::DBCluster","AWS::RDS::DBCluster","AWS::RDS::DBInstance","AWS::Redshift::Cluster"]);KP(koe,"snapshotPolicyForType");fDr=30*6e4;KP(zwt,"buildSnapshotPolicies");KP($1e,"guardForeignRecreateMarkers");KP(OW,"runRecreateSurgery")});import{join as Gwt}from"path";import{CloudFormationClient as gDr}from"@aws-sdk/client-cloudformation";import{EC2Client as yDr}from"@aws-sdk/client-ec2";function Wwt(t){let e=Object.entries(t);if(e.length===0)return;let r={};for(let[n,a]of e){let o=uT(n);r[o]=a}return r}function Hwt(t){if(t?.mode!==void 0&&t.mode!=="rollback"){if(t.imageTag)return y(new Error(`--image-tag requires rollback mode (explicit mode '${t.mode}' was supplied alongside an image tag)`));if(t.serviceImageTags)return y(new Error(`serviceImageTags requires rollback mode (explicit mode '${t.mode}' was supplied alongside serviceImageTags)`))}if(t?.mode==="rollback"){if(t.imageTag&&t.serviceImageTags)return y(new Error("rollback mode accepts exactly one of --image-tag or serviceImageTags \u2014 they are mutually exclusive"));if(!t.imageTag&&!t.serviceImageTags)return y(new Error("rollback mode requires --image-tag <tag> or serviceImageTags naming the image(s) to roll to"))}if(t?.containerName!==void 0&&!t.imageTag)return y(new Error("--container-name requires --image-tag \u2014 it targets which container within the service's task definition receives the rolled-back image"));if(t?.serviceImageTags!==void 0){if(t.serviceName)return y(new Error("serviceImageTags already names its services \u2014 --service cannot be combined with it"));let e=Object.entries(t.serviceImageTags);if(e.length===0)return y(new Error("serviceImageTags must name at least one service"));for(let[r,n]of e){let a=ZA.safeParse(n);if(!a.success)return y(new Error(`serviceImageTags.${r} is not a valid image tag: ${a.error.message}`))}}return E(void 0)}function _W(t,e,r){if(t.onStackTargets===void 0||r.length===0)return;let n=e.awsProvider.getAccountId(),a=e.awsProvider.getRegion();t.onStackTargets(r.map(o=>({stackName:o,...n!==""?{accountId:n}:{},...a!==""?{region:a}:{}})))}async function F1e(t,e,r){let{callbacks:n,options:a}=t,o=Date.now(),s=a?.mode??(a?.imageTag||a?.serviceImageTags?"rollback":a?.deployOnly?"code-only":"full");if(s==="restart"){let ie=new Error('mode "restart" is not a deploy \u2014 call the restart() entry point (fjall rollout) instead');return n.onError?.(ie),y(ie)}let i=Hwt(a);if(!i.success){let ie=S(i.error.message),oe=new Error(ie);return n.onError?.(oe),y(oe)}let c=Oc.buildDeploymentContext({deployType:"application",target:r.appName,path:r.path,region:e.awsProvider.getRegion(),callerIdentity:sl(e.awsProvider.getAccountId()),...jp({orgConfig:t.orgConfig,identity:t.identity,skipOidc:t.options?.skipOidc}),...t.managedDomainBindings!==void 0?{managedDomainBindings:t.managedDomainBindings}:{}},{verbose:a?.verbose,infraOnly:a?.infraOnly},t.orgConfig),l=e.frameworkRegistry.resolve({appPath:r.path}),u,d=s==="rollback";if(l&&!d){u=l.builder.plan({appPath:r.path},l.detection);let ie=Y_e(n),oe=await l.builder.build(r.path,u,ie,{skipBuild:a?.skipBuild,infraOnly:a?.infraOnly,...t.abortSignal!==void 0&&{abortSignal:t.abortSignal}});if(!oe.success){let he=new Error(S(oe.error.message));return n.onError?.(he),y(he)}}if(s==="code-only"||d){n.onLog?.(d?a?.serviceImageTags?`Rollback mode \u2014 rolling ${Object.keys(a.serviceImageTags).length} service(s) to their release-recorded image tags`:`Rollback mode \u2014 rolling to image tag ${a?.imageTag}`:"Deploy-only mode \u2014 skipping infrastructure pipeline","info");let ie=Gwt(r.path,"cdk.out"),oe=o$(ie),he=oe.declaresBuild,Be=l?.detection.hasDockerfile===!0,lt=he||Be;z.debug(NW,"Deploy-only branch entered",{mode:s,imageTag:a?.imageTag,serviceImageTags:a?.serviceImageTags,appName:r.appName,appPath:r.path,cdkOutPath:ie,dockerProviderAvailable:t.dockerProvider!==void 0,builderName:l?.builder.name,hasDockerfileFromManifest:he,hasDockerfileFromDisk:Be,hasDockerfile:lt,manifestDockerServiceCount:oe.ecsServices.length,manifestDockerPaths:oe.ecsServices.map(Vt=>Vt.docker.path),manifestLambdaDockerEntryCount:oe.lambdaEntries.length}),!he&&!Be&&n.onLog?.("No Dockerfile detected via manifest or appPath \u2014 skipping Docker build. If this app uses a cross-repo Dockerfile, ensure a full deploy has run first to populate cdk.out/fjall-manifest.json.","warn");let Je=await yM([nr(r.appName,Te.COMPUTE)],e.cfnService,t.abortSignal);if(!Je.success)return n.onError?.(Je.error),y(Je.error);_W(n,e,[nr(r.appName,Te.COMPUTE)]);let At={},Xe;if(!d&&t.dockerProvider!==void 0&&lt){z.debug(NW,"Running Docker build before code-only deploy",{source:he?"manifest":"disk"});let Vt=await yW(t,e,r,n);if(!Vt.success)return y(Vt.error);At=Vt.data.contentHashTagsByService,Xe=Vt.data}else z.debug(NW,"Skipping Docker build",{reason:d?"rollback":t.dockerProvider===void 0?"no dockerProvider":"no Dockerfile detected"});let ut=await vo(t.assertLeaseForStack,nr(r.appName,Te.COMPUTE),t.abortSignal);return ut!==void 0?(n.onError?.(ut),y(ut)):u1e(t,e,r,At,Xe)}n.onLog?.("Analysing infrastructure\u2026","info");let p=await kIe(r,e,c,n,t.abortSignal);if(!p.success){let ie=new Error(S(p.error.message),{cause:p.error});return n.onError?.(ie),y(ie)}let m=p.data;try{await n.onDetectionComplete?.({...m,builderName:l?.builder.name??"unknown"})}catch(ie){let oe=new Error(S(T(ie)),{cause:ie});return n.onError?.(oe),y(oe)}let f={deploymentType:"application",operation:"deploy",deployOnly:!1,infraOnly:a?.infraOnly??!1,hasDockerfile:m.hasDockerfile,pattern:m.pattern,resources:m.resources,...l&&{builderName:l.builder.name}},g=Ns.getSteps(f),v=g.findIndex(ie=>ie.id===ve.TARGET_READINESS),b=await _P(n,{stepId:ve.TARGET_READINESS,stepName:Hr.TARGET_READINESS,...v>=0&&{stepIndex:v,totalSteps:g.length}},async()=>{if(a?.skipReadinessCheck)return n.onLog?.("Skipping target readiness check (--skip-readiness-check)","warn"),{kind:"skipped",data:void 0};let ie=e.awsProvider.getAccountId(),oe=t.orgConfig?.providerAccounts.find(Je=>Je.id===ie)?.name,he=e.awsProvider.getCredentials(),Be=Jp(t.orgConfig),lt=await Ik({cloudFormation:e.awsProvider.getClient(gDr),ec2:new yDr({region:Be,...he!==void 0&&{credentials:he}})},{id:ie,...oe!==void 0&&{name:oe}},e.awsProvider.getRegion(),t.orgConfig,t.abortSignal);return lt.success?lt.data.ready?{kind:"completed",data:void 0}:{kind:"error",error:new Error(S(lt.data.advisory))}:{kind:"error",error:new Error(S(lt.error.message),{cause:lt.error})}},t.abortSignal);if(!b.success)return b;let A=Cy({pattern:m.pattern,resources:m.resources}),C=A.length,x=m.hasDockerfile&&t.dockerProvider!==void 0&&A.includes(Te.COMPUTE)&&a?.infraOnly!==!0;if(!m.hasDifferences&&!a?.force&&!x){n.onLog?.("No infrastructure changes detected","info"),n.onLog?.(a?.infraOnly===!0?"Infrastructure-only mode \u2014 application code was not rebuilt. Run with --deploy-only to deploy code changes.":"Nothing to deploy. Run with --deploy-only to redeploy application code.","info");let ie=m.hasDockerfile&&t.dockerProvider!==void 0&&A.includes(Te.COMPUTE);for(let he=0;he<A.length;he++){let Be=A[he];ie&&Be===Te.COMPUTE&&(n.onStepStart?.(ve.DOCKER_OPERATIONS,tg),n.onStepComplete?.(ve.DOCKER_OPERATIONS,tg,"skipped"));let lt=Dn(Be,"deploy"),Je=Rn(Be,"deploy");n.onStepStart?.(lt,Je,he,C),n.onStepComplete?.(lt,Je,"skipped",he,C)}let oe=await e.stackService.resolveWebsiteUrl(r.appName);return E({target:r.appName,deploymentType:"application",outputs:oe?{websiteUrl:oe}:void 0,noChanges:!0,artefacts:[],durationMs:Date.now()-o})}let k=Gwt(r.path,"cdk.out"),I=V_e({deployOrder:A,stackChanges:m.stackChanges,appName:r.appName,force:a?.force===!0,computeBuildPossible:x});_W(n,e,[...I]);let R=await yM([...I],e.cfnService,t.abortSignal);if(!R.success)return n.onError?.(R.error),y(R.error);let N={stacksToDeploy:[...I],imageBuild:z_e({stackNamesToDeploy:I,appName:r.appName,hasDockerProvider:t.dockerProvider!==void 0,hasDockerfile:m.hasDockerfile,infraOnly:a?.infraOnly===!0})},_=yv(m.currentHashes,N),M=kW({cfnService:e.cfnService,cdkOutPath:k,changedStacks:[...I],assemblyDigest:_,registry:new K1(e.awsProvider),changeSetProbe:new Eae(e.awsProvider),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}),B=await Xb(e.awsProvider,{stackNames:[...I],cdkOutPath:k,cfnService:e.cfnService,callbacks:n,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(B.kind==="blocked"){let ie=new Error(B.message);return n.onError?.(ie),y(ie)}let j=B.verifiedAbsentByNecessity??[],U=t.approvalGate!==void 0||a?.approvalToken!==void 0&&a.approvalToken!==""||a?.planOnly===!0;if(U){let ie=await PW({approvalGate:t.approvalGate,options:a??{},target:r.appName,cdkOutPath:k,detection:{stackChanges:m.stackChanges,currentHashes:m.currentHashes},scope:N,cfnService:e.cfnService,loadPlan:M,callbacks:n,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!ie.success)return ie;let oe=ie.data;if(oe.kind==="rejected")return n.onLog?.(`Deploy rejected: ${S(oe.reason)}`,"warn"),E({target:r.appName,deploymentType:"application",rejected:!0,artefacts:[],...oe.planDetail!==void 0?{planDetail:oe.planDetail}:{},durationMs:Date.now()-o});if(oe.kind==="awaiting"){let he=await M(),Be=he.success?Z$(he.data,j):void 0;return E({target:r.appName,deploymentType:"application",awaitingApproval:!0,approvalToken:oe.approvalToken,assemblyDigest:oe.assemblyDigest,planDetail:oe.planDetail,...Be!==void 0?{destructionTicket:Be}:{},artefacts:[],durationMs:Date.now()-o})}}let G=await IG({loadPlan:M,options:a??{},target:r.appName,callbacks:n,verifiedAbsentByNecessity:j,...t.destructionConsentGate!==void 0?{consentGate:t.destructionConsentGate}:{}});if(!G.success)return n.onError?.(G.error),y(G.error);if(G.data.kind==="withheld"){let ie=U?Sv({assemblyDigest:_,ttlMs:Owt}):void 0;return E({target:r.appName,deploymentType:"application",destructionPending:!0,destructionTicket:G.data.ticket,destructionOutcome:G.data.outcome,destructionHaltReasons:G.data.reasons,...ie!==void 0?{destructionResumeToken:ie.token,destructionResumeExpiresAt:ie.expiresAt}:{},artefacts:[],durationMs:Date.now()-o})}if(G.data.kind==="proceed"){let{ticket:ie,verbsByPhysicalName:oe}=G.data,he=ie.resources.filter(lt=>oe.get(lt.physicalName)==="pin");if(he.length>0){n.onLog?.(`Pin remediation for ${r.appName}: probing live value(s) for ${he.length} consented pin(s) \u2014 deploy stopped for config write-back; nothing was applied`,"warn");let lt=await kG(e.awsProvider,{targets:he.map(Je=>({stack:Je.stack,logicalId:Je.logicalId,resourceType:Je.resourceType,physicalName:Je.physicalName,offendingProperties:Je.offendingProperties})),...t.infrastructureSource!==void 0?{infrastructureContent:t.infrastructureSource.content,infrastructureFilePath:t.infrastructureSource.filePath}:{},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});for(let Je of TG(lt))n.onLog?.(Je,"warn");return he.length<ie.resources.length&&n.onLog?.("Remaining consented change(s) were not applied \u2014 the config write-back changes the plan, so they re-consent on the next deploy","warn"),E({target:r.appName,deploymentType:"application",pinPending:!0,pinReport:lt,pinDeferredConsents:ie.resources.length-he.length,destructionTicket:ie,artefacts:[],durationMs:Date.now()-o})}let Be=ie.resources.filter(lt=>lt.finding==="pinned-name-replacement"&&oe.get(lt.physicalName)==="recreate");if(Be.length>0){let lt=new Map;for(let Xe of Be){let ut=lt.get(Xe.stack)??[];ut.push(Xe),lt.set(Xe.stack,ut)}let Je=await DW(e.awsProvider,{stacks:[...lt].map(([Xe,ut])=>({stackName:Xe,targets:ut.map(Vt=>({logicalId:Vt.logicalId,resourceType:Vt.resourceType,physicalId:Vt.physicalName}))})),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!Je.success){let Xe=new Error(S(Je.error.message),{cause:Je.error});return n.onError?.(Xe),y(Xe)}let At=[];for(let[Xe,ut]of lt){let Vt=await vo(t.assertLeaseForStack,Xe,t.abortSignal,"destroy");if(Vt!==void 0)return At.length>0&&n.onLog?.(`Surgery already completed on ${At.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`,"warn"),n.onError?.(Vt),y(Vt);let tn=ut.map(Qn=>Qn.physicalName);n.onLog?.(`Recreate remediation for ${r.appName}: orchestrating the pinned-name replacement of ${tn.join(", ")} on ${Xe}`,"warn");let da=await OW(e.awsProvider,{stackName:Xe,targets:ut.map(Qn=>({logicalId:Qn.logicalId,resourceType:Qn.resourceType,physicalId:Qn.physicalName})),appName:r.appName,consentedPhysicalNames:tn,doneJournalPolicy:"archive-and-restart",plannedReplacementLogicalIds:ut.map(Qn=>Qn.logicalId),onProgress:YP(Qn=>n.onLog?.(Qn,"info"),"onProgress"),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(!da.success){let Qn=At.length>0?` Surgery already completed on ${At.join("; ")} \u2014 those resources were removed and re-running the deploy resumes their journals and re-creates them.`:"",Dr=new Error(S(`${da.error.message}${Qn}`));return n.onError?.(Dr),y(Dr)}At.push(`${Xe} (${tn.join(", ")})`)}}}let V=t.orgConfig!==void 0&&!bu(t.orgConfig.providerAccounts),L=Rb({account:t.orgConfig?.providerAccounts.find(ie=>ie.id===e.awsProvider.getAccountId()),estate:V?"solo":"org"}),H=await qk(e,c,n,L);if(!H.success)return H;let ae=nr(r.appName,Te.DATABASE),ne=I.has(ae),Z=ne?await roe(e.cfnService,r.appName,t.abortSignal):void 0,re=ne?await e1e(e.ecsResolver,e.ecsService,r.appName,t.abortSignal):void 0,le={},X=new Map,ue,ce={},_e=YP(async()=>{!ne||!X.has(ae)||await t1e({appName:r.appName,connectionOutputsBefore:Z,serviceTaskDefinitionsBefore:re,services:{cfnService:e.cfnService,ecsService:e.ecsService,ecsResolver:e.ecsResolver},callbacks:n,...t.confirmDatabaseEndpointRestart!==void 0?{confirmRestart:t.confirmDatabaseEndpointRestart}:{},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}})},"reconcileIfDatabaseReplaced");for(let ie=0;ie<A.length;ie++){let oe=A[ie],he=nr(r.appName,oe),Be=Dn(oe,"deploy"),lt=Rn(oe,"deploy");if(!I.has(he)){n.onStepStart?.(Be,lt,ie,C),n.onLog?.(`Skipping ${oe} \u2014 no changes detected`,"info"),n.onStepComplete?.(Be,lt,"skipped",ie,C);continue}let Je=await vo(t.assertLeaseForStack,he,t.abortSignal);if(Je!==void 0)return await _e(),n.onError?.(Je),y(Je);let At=G_e(A,ie,r.appName,I);if(At.length>=2){let Dr=await Jae({hashService:e.hashService,cdkOutPath:k,stackNames:At.map(vc=>nr(r.appName,vc)),detectionHashes:m.currentHashes,approvalGated:U});if(!Dr.success)return await _e(),n.onError?.(Dr.error),y(Dr.error);let un=await W_e(At,r,e,c,n,ie,C,m,le,X);if(!un.success)return await _e(),y(await TC(e.awsProvider,{stackNames:At.map(vc=>nr(r.appName,vc)),appName:r.appName,originalError:un.error,cfnService:e.cfnService,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}));ie+=At.length-1;continue}let Xe=await q_e(oe,t,e,r,n,m.hasDockerfile);if(Xe!==null&&!Xe.success)return await _e(),y(Xe.error);Xe!==null&&Xe.success&&(ue=Xe.data);let ut=Xe!==null&&Xe.success?Xe.data.contentHashTagsByService:{},Vt=Wwt(ut);if(Xe!==null){let Dr=await vo(t.assertLeaseForStack,he,t.abortSignal);if(Dr!==void 0)return await _e(),n.onError?.(Dr),y(Dr)}let tn=await Jae({hashService:e.hashService,cdkOutPath:k,stackNames:[he],detectionHashes:m.currentHashes,approvalGated:U});if(!tn.success)return await _e(),n.onError?.(tn.error),y(tn.error);let da=await H_e(oe,e,c,n,ie,C,le,Vt!==void 0||t.abortSignal!==void 0?{...Vt!==void 0?{parameters:Vt}:{},...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}:void 0);if(!da.success)return await _e(),y(await TC(e.awsProvider,{stackNames:[he],appName:r.appName,originalError:da.error,cfnService:e.cfnService,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}));oe===Te.COMPUTE&&(ce=await K_e(r,e,n,ut,t.abortSignal));let Qn=m.currentHashes.get(he);Qn&&X.set(he,Qn)}if(await _e(),X.size>0){let ie=await e.hashService.updateStateAfterDeploy(r.path,X);if(!ie.success){let oe=S(ie.error.message);z.debug(NW,"Failed to update state file",{error:oe}),n.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy unchanged stacks: ${oe}`,"warn")}}let Se=await e.stackService.resolveWebsiteUrl(r.appName);Se&&(le.websiteUrl=Se);let de=await m1e(e,r.appName,ue,n,k,ce,t.abortSignal);return await NP(e.awsProvider,{stackNames:[...I],appName:r.appName,onLog:YP((ie,oe)=>n.onLog?.(ie,oe),"onLog"),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}).catch(ie=>{z.debug(NW,"Forget completion sweep failed",{error:S(T(ie))})}),E({target:r.appName,deploymentType:"application",outputs:Object.keys(le).length>0?le:void 0,artefacts:de,durationMs:Date.now()-o})}var hDr,YP,NW,j1e=w(()=>{"use strict";Ce();Ct();$();Vy();sb();Oo();Uw();_d();fz();Nw();Pmt();Cw();PIe();tte();gC();_ae();vW();XAt();ewt();nwt();EW();uoe();jy();fwt();VPe();Aae();D1e();RG();woe();CW();boe();tW();fC();xoe();tae();_1e();L1e();hDr=Object.defineProperty,YP=(t,e)=>hDr(t,"name",{value:e,configurable:!0}),NW="applicationDeploy";YP(Wwt,"buildCdkImageTagParameters");YP(Hwt,"validateRollbackOptions");YP(_W,"emitStackTargets");YP(F1e,"deployApplication")});import{OrganizationsClient as B1e}from"@aws-sdk/client-organizations";function $W(t,e,r,n,a,o,s,i){let c=e.awsProvider.getRegion();return Oc.buildDeploymentContext({deployType:n,target:r.target,path:r.path,region:c,accountName:o,callerIdentity:sl(e.awsProvider.getAccountId()),orgId:a?.orgId,rootId:a?.rootId,managementAccountId:a?.managementAccountId,devOuId:a?.devOuId,...jp({orgConfig:t.orgConfig,identity:t.identity,skipOidc:EIe(n,t.orgConfig,t.options?.skipOidc,i),...n!=="organisation"?{region:c,primaryRegion:t.orgConfig?.primaryRegion}:{},trailLifecycle:s})},{verbose:t.options?.verbose,infraOnly:t.options?.infraOnly},t.orgConfig)}async function U1e(t,e){let r=t.awsProvider.getClient(B1e),n=await $y(r,e);return n.success?E({orgId:n.data.orgId,rootId:n.data.rootId,managementAccountId:n.data.managementAccountId}):y(n.error)}async function V1e(t,e){let r=t.awsProvider.getClient(B1e),n=await rte(r,e);return n.success?n.data===null?E(void 0):E({orgId:n.data.orgId,managementAccountId:n.data.managementAccountId,...n.data.rootId!==void 0?{rootId:n.data.rootId}:{}}):y(n.error)}async function z1e(t,e){let r=t.awsProvider.getClient(B1e),n=await m1(r,e,{tolerateAccessDenied:!0});if(!(!n.success||n.data===null))return{orgId:n.data.orgId,rootId:n.data.rootId,managementAccountId:n.data.managementAccountId}}var vDr,Poe,G1e=w(()=>{"use strict";Ce();Uw();sb();ate();_d();vDr=Object.defineProperty,Poe=(t,e)=>vDr(t,"name",{value:e,configurable:!0});Poe($W,"buildOrgContext");Poe(U1e,"resolveOrgDetails");Poe(V1e,"resolveOrgDetailsForMemberComponent");Poe(z1e,"resolveOrgDetailsForSolo")});function ZP(t,e){t.onStackTargets===void 0||e.length===0||t.onStackTargets(e)}function aE(t){t.onStepComplete?.(uo.PREPARE.id,uo.PREPARE.name,"error",1,bv)}function Qp(t,e){let r=new Error(S(e));return t.onError?.(r),y(r)}async function CM(t,e,r,n,a){let o=await t.cfnService.getStackOutputs(r,void 0,a);return o.success||e.onLog?.(n,"debug"),i$(o)}var SDr,Ioe,uo,bv,MW=w(()=>{"use strict";Ce();_d();$();Cw();SDr=Object.defineProperty,Ioe=(t,e)=>SDr(t,"name",{value:e,configurable:!0}),uo={CONNECT:{id:ve.CONNECT,name:Pc.CONNECT},PREPARE:{id:ve.PREPARE_ENVIRONMENT,name:Pc.PREPARE},DEPLOY:{id:ve.DEPLOY,name:Pc.DEPLOY},MONITORING:{id:ve.MONITORING,name:Pc.MONITORING},ORG_DEPLOY:{id:ve.ORG_DEPLOY,name:Hr.ORG_DEPLOY},CASCADE_PLATFORM:{id:ve.CASCADE_PLATFORM,name:Hr.CASCADE_PLATFORM},CASCADE_ACCOUNTS:{id:ve.CASCADE_ACCOUNTS,name:Hr.CASCADE_ACCOUNTS}},bv=4;Ioe(ZP,"emitOrgStackTargets");Ioe(aE,"failPrepareStep");Ioe(Qp,"maskAndFail");Ioe(CM,"readStackOutputsBestEffort")});import{join as EDr}from"path";import{BackupClient as ADr}from"@aws-sdk/client-backup";import{IAMClient as wDr}from"@aws-sdk/client-iam";async function Roe(t,e,r,n,a){let{callbacks:o}=t;o.onStepComplete?.(uo.CONNECT.id,uo.CONNECT.name,"completed",0,bv),o.onStepStart?.(uo.PREPARE.id,uo.PREPARE.name,1,bv);let s=e.awsProvider.getRegion(),i=t.orgConfig?.primaryRegion;if(i!==void 0&&Sre(s,i)){let N=await Uke(e.awsProvider.getClient(wDr),t.abortSignal);if(!N.success)return aE(o),Qp(o,N.error.message);if(!N.data)return aE(o),Qp(o,Vke({target:r.target,deployRegion:s,primaryRegion:i,...t.orgConfig!==void 0?{providerAccounts:t.orgConfig.providerAccounts}:{}}))}let c=bu(t.orgConfig?.providerAccounts),l;if(c){let N=await V1e(e,t.abortSignal);if(!N.success)return aE(o),Qp(o,N.error.message);l=N.data}else l=await z1e(e,t.abortSignal);let u=n==="account"?t.orgConfig?.providerAccounts.find(N=>N.id===e.awsProvider.getAccountId()):t.orgConfig?.providerAccounts.find(N=>dr(N)==="platform"),d=n==="account"&&u!==void 0&&dr(u)==="organisation",p=$W(t,e,r,n,l,n==="account"?u?.name??r.target:void 0,u?.trailLifecycle,d),m=t.orgConfig?.disasterRecoveryRegion;if(n==="account"&&m!==void 0&&m!==""&&(u===void 0||Rk(u.environment,m))){let N=await _V(e.awsProvider.getClient(ADr),t.abortSignal);if(!N.success)return aE(o),Qp(o,N.error.message);p.fjallAdoptBackupVault=N.data}o.onLog?.(`Synthesising ${n} infrastructure\u2026`,"info");let f=await Hk(e,p,o,"CDK synthesis failed");if(!f.success)return aE(o),f;let g=nn(r.type),v=e.awsProvider.getAccountId(),b=e.awsProvider.getRegion();ZP(o,[{stackName:g,...v!==""?{accountId:v}:{},...b!==""?{region:b}:{}}]);let A=await Xb(e.awsProvider,{stackNames:[g],cdkOutPath:EDr(r.path,"cdk.out"),cfnService:e.cfnService,callbacks:o,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(A.kind==="blocked")return aE(o),Qp(o,A.message);let C=await qk(e,p,o,Rb({account:u,estate:c?"org":"solo",...l?.orgId!==void 0?{orgId:l.orgId}:{}}));if(!C.success)return aE(o),C;o.onStepComplete?.(uo.PREPARE.id,uo.PREPARE.name,"completed",1,bv);let x=await vo(t.assertLeaseForStack,g,t.abortSignal);if(x!==void 0)return o.onError?.(x),y(x);o.onStepStart?.(uo.DEPLOY.id,uo.DEPLOY.name,2,bv);let k=await e.cdkService.runCdkDeploy(p,g,Yi(o),Pb(o),e.awsProvider);if(!k.success){o.onStepComplete?.(uo.DEPLOY.id,uo.DEPLOY.name,"error",2,bv);let N=await TC(e.awsProvider,{stackNames:[g],repairTarget:`--stack ${g}`,originalError:new Error(S(k.error)),cfnService:e.cfnService,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});return o.onError?.(N),y(N)}o.onStepComplete?.(uo.DEPLOY.id,uo.DEPLOY.name,"completed",2,bv);let I=await CM(e,o,g,"Failed to read stack outputs (non-critical)",t.abortSignal);await s$(p,e.awsProvider,o,t.abortSignal),o.onStepStart?.(uo.MONITORING.id,uo.MONITORING.name,3,bv),o.onStepComplete?.(uo.MONITORING.id,uo.MONITORING.name,"completed",3,bv),await NP(e.awsProvider,{stackNames:[g],onLog:qwt((N,_)=>o.onLog?.(N,_),"onLog"),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}}).catch(N=>{z.debug("SingleComponentDeploy","Forget completion sweep failed",{error:S(T(N))})});let R=k.data?.status==="NO_CHANGES"&&t.options?.force!==!0;return E({target:r.target,deploymentType:"organisation",outputs:I,artefacts:[],...R?{noChanges:!0}:{},durationMs:Date.now()-a})}var bDr,qwt,Kwt=w(()=>{"use strict";Ce();Ct();Oo();A1();Nw();_d();$();tW();fC();xoe();G1e();Nw();fz();MW();jy();bDr=Object.defineProperty,qwt=(t,e)=>bDr(t,"name",{value:e,configurable:!0});qwt(Roe,"deploySingleComponent")});function LW(t){return xDr.has(t)}function Doe(t){return Array.isArray(t)&&t.every(e=>typeof e=="string")}function FW(t){return typeof t!="object"||t===null?!1:Object.entries(t).every(([e,r])=>typeof e=="string"&&(typeof r=="string"||Doe(r)||FW(r)))}function kC(t){let e=[];for(let[r,n]of Object.entries(t))if(typeof n=="string")e.push({accountName:n,environment:r});else if(Array.isArray(n))for(let a of n)e.push({accountName:a,environment:r});else typeof n=="object"&&n!==null&&e.push(...kC(n));return e}function Ooe(t){let e=[];for(let r of Object.values(t))typeof r=="string"?e.push(r):Array.isArray(r)?e.push(...r):typeof r=="object"&&r!==null&&e.push(...Ooe(r));return e}function xM(t){let e={};for(let[r,n]of Object.entries(t))typeof n=="string"?e[r]=[n]:Array.isArray(n)?e[r]=[...n]:typeof n=="object"&&n!==null&&(e[r]=xM(n));return e}async function oE(t){try{let e=await import("path"),r=await import("fs"),{pathToFileURL:n}=await import("url"),a=e.join(t,"fjall","organisation",W1e);if(!r.existsSync(a))return E(null);let{tsImport:o}=await import("tsx/esm/api"),s=n(a).href,i=await o(a,s),c=i.default,l=i.ACCOUNTS||c?.ACCOUNTS;return l?FW(l)?E(l):y(new yu("ACCOUNTS configuration has invalid structure","ACCOUNTS",a,{providedValue:l})):y(new yu(`ACCOUNTS constant not found in organisation/${W1e}`,"ACCOUNTS",a,{moduleKeys:Object.keys(i),hasDefault:i.default!==void 0}))}catch(e){let r=S(T(e));return y(new yu(`Failed to import ACCOUNTS from organisation/${W1e}: ${r}`,"ACCOUNTS",void 0,{originalError:e}))}}var CDr,JP,W1e,H1e,xDr,q1e=w(()=>{"use strict";Ce();$();Xm();CDr=Object.defineProperty,JP=(t,e)=>CDr(t,"name",{value:e,configurable:!0}),W1e="infrastructure.ts",H1e=["security","suspended"],xDr=new Set(H1e);JP(LW,"isOuOnlyAccountBucket");JP(Doe,"isStringArray");JP(FW,"isAccountsConfig");JP(kC,"flattenAccountsToEnvironments");JP(Ooe,"extractAllAccountNames");JP(xM,"accountsConfigToOUTree");JP(oE,"parseAccountsConfiguration")});import{OrganizationsClient as kDr}from"@aws-sdk/client-organizations";async function jW(t,e){let r,n=new Promise((p,m)=>{r=setTimeout(()=>m(new Error(`Timed out parsing ACCOUNTS configuration after ${Ywt}ms`)),Ywt)}),a;try{a=await Promise.race([oE(e),n])}catch(p){return y(_r(p))}finally{r!==void 0&&clearTimeout(r)}if(!a.success)return y(new Error(`Failed to parse ACCOUNTS configuration: ${a.error.message}`));if(a.data===null)return y(new Error("ACCOUNTS configuration file not found"));let o=kC(a.data),s=new Map;for(let{accountName:p,environment:m}of o)s.set(p.toLowerCase(),{environment:m,displayName:p});let i;try{i=t.awsProvider.getClient(kDr)}catch(p){return y(_r(p))}let c=await Mp(i);if(!c.success)return y(c.error);let l=new Map;for(let p of c.data){let m=PDr.safeParse(p);m.success&&l.set(m.data.Name.toLowerCase(),{id:m.data.Id,name:m.data.Name})}let u=[],d=[];for(let[p,{environment:m,displayName:f}]of s){let g=l.get(p);if(!g){d.push(f);continue}BS(m)!=="organisation"&&u.push({id:g.id,name:g.name,tier:BS(m),environment:xT(m)})}return E({providerAccounts:u,missingAccountNames:d})}function BW(t,e){let r=new Map;for(let n of t?.providerAccounts??[])r.set(n.id,n);for(let n of e)r.has(n.id)||r.set(n.id,n);return{...t??{},providerAccounts:Array.from(r.values())}}var TDr,Zwt,Ywt,PDr,K1e=w(()=>{"use strict";Ft();Ce();$();ste();q1e();TDr=Object.defineProperty,Zwt=(t,e)=>TDr(t,"name",{value:e,configurable:!0}),Ywt=6e4,PDr=h.object({Id:h.string().min(1),Name:h.string().min(1)});Zwt(jW,"reconcileProviderAccounts");Zwt(BW,"mergeReconciledProviderAccounts")});async function Y1e(t,e){let{callbacks:r}=t,n=t.orgConfig?.providerAccounts??[];if(n.length===0||n.every(s=>dr(s)==="organisation")){let s=await jW(e,t.workingDirectory);if(s.success){let{providerAccounts:i,missingAccountNames:c}=s.data;i.length>0&&(n=BW(t.orgConfig,i).providerAccounts,r.onLog?.(`Reconciled ${i.length} account(s) from AWS Organizations`,"info")),c.length>0&&(r.onCascadeMissingAccounts?.(c),r.onProgress?.({type:"warning",message:S(`Accounts declared in ACCOUNTS but not yet in AWS Organizations (cascade will skip): ${c.join(", ")}`)}))}else r.onProgress?.({type:"warning",message:S(`Could not reconcile accounts from AWS Organizations \u2014 cascade may skip accounts: ${s.error.message}`)})}let a=Jp(t.orgConfig);n=n.map(s=>s.region!==void 0?s:{...s,region:a});let o=t.orgConfig!==void 0?{...t.orgConfig,providerAccounts:n}:n.length>0?{providerAccounts:n}:void 0;return{providerAccounts:n,effectiveOrgConfig:o,defaultRegion:a}}var IDr,RDr,Jwt=w(()=>{"use strict";gC();K1e();$();IDr=Object.defineProperty,RDr=(t,e)=>IDr(t,"name",{value:e,configurable:!0});RDr(Y1e,"resolveCascadeAccounts")});function Ev(t){let e=new Set,r=new Set,n=new Set;for(let l of t.members)l.result==="succeeded"?e.add(l.accountId):l.result==="failed"?r.add(l.accountId):n.add(l.accountId);let a=0;for(let l of n)!e.has(l)&&!r.has(l)&&a++;let{platform:o}=t,s=o!==void 0&&(o.result==="succeeded"||o.result==="skipped"),i=o!==void 0&&o.result==="skipped",c=o!==void 0&&o.result==="failed";return{platformDeployed:s,platformSkipped:i,platformFailed:c,domainsDeployed:t.domainsDeployed,accountsDeployed:e.size,accountsSkipped:a,accountsFailed:r.size,errors:t.errors}}function Z1e(t){return t==="failed"?{success:!1}:{success:!0,skipped:t==="skipped"}}function UW(t){let e=t.members.map(n=>({accountName:n.accountName,accountId:n.accountId,region:n.region,duration:n.durationMs,...Z1e(n.result),...n.error!==void 0?{error:n.error}:{}}));if(t.platform===void 0)return{accountResults:e};let{platform:r}=t;return{accountResults:e,platformResult:{duration:r.durationMs,...Z1e(r.result),...r.error!==void 0?{error:r.error}:{}}}}var DDr,J1e,Noe=w(()=>{"use strict";DDr=Object.defineProperty,J1e=(t,e)=>DDr(t,"name",{value:e,configurable:!0});J1e(Ev,"projectScalarSummary");J1e(Z1e,"outcomeToRowFlags");J1e(UW,"projectAccountRows")});async function X1e(t,e,r,n){let{callbacks:a}=t,{providerAccounts:o,effectiveOrgConfig:s,totalSteps:i,cascadeErrors:c,allCascadeOutputs:l,orgId:u}=n,d=!1;a.onCascadeStart?.();let p=Date.now(),m=2,f=!1,g,v=!1,b=[],A=Xwt(N=>({members:b,...g!==void 0?{platform:g}:{},domainsDeployed:v,errors:c,totalDurationMs:N}),"buildLedger"),{platformAccount:C,memberAccounts:x}=Ru(o),k=Jp(t.orgConfig);if(C){let{id:N,name:_}=uo.CASCADE_PLATFORM;a.onStepStart?.(N,_,m,i),a.onCascadePhaseStart?.("platform");let M,B=Date.now();try{M=await Nae(t,e,r,C,"platform",a,{orgConfig:s,primaryRegion:k,orgId:u})}catch(U){let G=S(T(U));c.push({accountId:C.id,error:G}),a.onCascadePhaseComplete?.("platform"),a.onStepComplete?.(N,_,"error",m,i),M=y(new Error(G))}let j=Date.now()-B;if(M.success){f=!0;let U=M.data.skipped===!0;U||(d=!0),M.data.outputs&&l.push({accountId:C.id,outputs:M.data.outputs}),a.onCascadePhaseComplete?.("platform"),a.onStepComplete?.(N,_,U?"skipped":"completed",m,i),g={accountId:C.id,result:U?"skipped":"succeeded",durationMs:j}}else c.some(U=>U.accountId===C.id)||(c.push({accountId:C.id,error:S(M.error.message)}),a.onCascadePhaseComplete?.("platform"),a.onStepComplete?.(N,_,"error",m,i)),g={accountId:C.id,result:"failed",durationMs:j,error:S(M.error.message)};m++}let I=new Map;if(f&&C&&(I=await FNe(e,C,a,t.abortSignal)),t.domainProvider){let N=await jNe(t.domainProvider,a,{executingAccountId:e.awsProvider.getAccountId(),executingRegion:e.awsProvider.getRegion(),...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{},...t.options?.skipCaaPreflight!==void 0?{skipCaaPreflight:t.options.skipCaaPreflight}:{}});v=N.domainsDeployed>0,v&&(d=!0);for(let _ of N.errors)c.push({accountId:"domains",error:S(_)})}if(C!==void 0&&!f&&x.length>0){let{id:N,name:_}=uo.CASCADE_ACCOUNTS;a.onStepStart?.(N,_,m,i),a.onStepComplete?.(N,_,"skipped",m,i),a.onLog?.("Skipping account cascade \u2014 platform deployment failed; platform is a prerequisite for member accounts.","warn")}else if(x.length>0){let{id:N,name:_}=uo.CASCADE_ACCOUNTS;a.onStepStart?.(N,_,m,i),a.onCascadePhaseStart?.("accounts");let M=mf(t.orgConfig),B=dv(x,M);(await dh(B,rW,async({account:U,region:G})=>{let V=I.get(`${U.id}-${hb(G)}`),L=Date.now();return{result:await Nae(t,e,r,U,"account",a,{ipamPoolId:V,orgConfig:s,region:G,primaryRegion:k,orgId:u}),durationMs:Date.now()-L}})).forEach((U,G)=>{let V=B[G];if(!V)return;let L=V.account;if(U.status==="rejected"){let ne=S(U.reason instanceof Error?U.reason.message:String(U.reason));b.push({accountId:L.id,accountName:L.name,region:V.region,result:"failed",durationMs:0,error:ne}),c.push({accountId:L.id,error:ne});return}let{result:H,durationMs:ae}=U.value;if(H.success){let ne=H.data.skipped===!0;ne||(d=!0),H.data.outputs&&l.push({accountId:L.id,outputs:H.data.outputs}),b.push({accountId:L.id,accountName:L.name,region:V.region,result:ne?"skipped":"succeeded",durationMs:ae})}else{let ne=S(H.error.message);b.push({accountId:L.id,accountName:L.name,region:V.region,result:"failed",durationMs:ae,error:ne}),c.push({accountId:L.id,error:ne})}});let j=Ev(A(0));a.onCascadePhaseComplete?.("accounts"),a.onStepComplete?.(N,_,j.accountsFailed>0?"error":j.accountsSkipped===x.length?"skipped":"completed",m,i)}let R=A(Date.now()-p);return a.onCascadeComplete?.(Ev(R)),a.onCascadeLedger?.(R),{anyCascadeDeployHappened:d}}var ODr,Xwt,Qwt=w(()=>{"use strict";Ce();Lw();gC();Noe();$();MW();ODr=Object.defineProperty,Xwt=(t,e)=>ODr(t,"name",{value:e,configurable:!0});Xwt(X1e,"executeCascade")});import{ListObjectsV2Command as eCt}from"@aws-sdk/client-s3";import{GetTrailStatusCommand as _Dr}from"@aws-sdk/client-cloudtrail";function tCt(t,e){let r=[],n=Math.floor((e-t)/_oe)*_oe;for(let a=n;a<=e;a+=_oe){let o=new Date(a),s=String(o.getUTCMonth()+1).padStart(2,"0"),i=String(o.getUTCDate()).padStart(2,"0");r.push(`${o.getUTCFullYear()}/${s}/${i}`)}return r.reverse()}async function rCt(t,e){let r=!1,n,a=!1,o=!1,s=TM(u=>{for(let d of u.Contents??[])r=!0,d.LastModified!==void 0&&((n===void 0||d.LastModified>n)&&(n=d.LastModified),d.LastModified.getTime()>=e.recentSinceMs&&(a=!0))},"ingest"),i=TM(u=>({delivered:r,recentDelivery:u,...n!==void 0?{latestObjectAt:n}:{}}),"outcome"),c=await t.send(new eCt({Bucket:e.bucketName,Prefix:e.accountPrefix,Delimiter:"/"}),{abortSignal:ee(e.abortSignal)});s(c);let l=(c.CommonPrefixes??[]).map(u=>u.Prefix).filter(u=>u!==void 0);if(c.IsTruncated===!0||l.length>MDr)return i(void 0);for(let u of l)for(let d of e.datePaths){let p,m=!1;for(let f=0;f<LDr&&!m;f++){if(Ae(e.abortSignal))throw new Error("Aborted: org-trail delivery scan cancelled by shutdown signal");let g=await t.send(new eCt({Bucket:e.bucketName,Prefix:`${u}${d}/`,...p!==void 0?{ContinuationToken:p}:{}}),{abortSignal:ee(e.abortSignal)});if(s(g),a)return i(!0);g.IsTruncated===!0?p=g.NextContinuationToken:m=!0}m||(o=!0)}return i(o?void 0:!1)}async function $oe(t,e){let r=e.recencyWindowMs??$Dr,n=Date.now(),a=tCt(r,n),o=[];for(let s of e.accountIds)try{let i=await rCt(t,{bucketName:e.bucketName,accountPrefix:`AWSLogs/${e.orgId}/${s}/CloudTrail/`,datePaths:a,recentSinceMs:n-r,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});o.push({accountId:s,...i})}catch(i){return Nt(i)==="NoSuchBucket"?y(new Error(`Organisation trail bucket ${e.bucketName} does not exist \u2014 the org trail has not been deployed yet.`)):y(new Error(`Failed to verify org-trail delivery for account ${s}: ${S(T(i))}`))}return E({bucketName:e.bucketName,perAccount:o})}async function FDr(t,e,r){try{let n=await t.send(new _Dr({Name:e}),{abortSignal:ee(r)});return E({isLogging:n.IsLogging===!0,...n.LatestDeliveryTime!==void 0?{latestDeliveryTime:n.LatestDeliveryTime}:{}})}catch(n){return y(new Error(`Failed to read trail status for ${e}: ${S(T(n))}`))}}var NDr,TM,_oe,$Dr,MDr,LDr,Q1e=w(()=>{"use strict";Ce();$();vt();NDr=Object.defineProperty,TM=(t,e)=>NDr(t,"name",{value:e,configurable:!0}),_oe=1440*60*1e3,$Dr=_oe,MDr=50,LDr=2;TM(tCt,"utcDatePathsForWindow");TM(rCt,"scanAccountDelivery");TM($oe,"verifyOrgTrailDelivery");TM(FDr,"getTrailLoggingStatus")});import{DeleteBucketCommand as BDr,HeadBucketCommand as UDr,ListObjectVersionsCommand as VDr}from"@aws-sdk/client-s3";import{DescribeTrailsCommand as zDr}from"@aws-sdk/client-cloudtrail";import{DescribeKeyCommand as GDr,ScheduleKeyDeletionCommand as WDr}from"@aws-sdk/client-kms";async function nCt(t,e,r){try{let n=await t.send(new zDr({trailNameList:[e]}),{abortSignal:ee(r)});return E((n.trailList??[]).length>0)}catch(n){return Nt(n)==="TrailNotFoundException"?E(!1):y(new Error(`Failed to probe trail ${e}: ${S(T(n))}`))}}async function aCt(t,e,r){try{return await t.send(new UDr({Bucket:e}),{abortSignal:ee(r)}),E(!0)}catch(n){return Cb(n)?E(!1):y(new Error(`Failed to probe bucket ${e}: ${S(T(n))}`))}}async function oCt(t,e,r){try{let n=await t.send(new VDr({Bucket:e,MaxKeys:1}),{abortSignal:ee(r)});return(n.Versions??[]).length===0&&(n.DeleteMarkers??[]).length===0}catch(n){return z.debug("memberTrailCleanup",`Emptiness probe failed for ${e}; treating as not proven empty`,{error:S(T(n))}),!1}}async function sCt(t,e,r){try{let n=(await t.send(new GDr({KeyId:e}),{abortSignal:ee(r)})).KeyMetadata?.KeyState;if(n==="PendingDeletion"||n==="PendingReplicaDeletion")return E(void 0)}catch(n){return Nt(n)==="NotFoundException"?E(void 0):y(new Error(`Failed to probe CMK: ${S(T(n))}`))}try{return await t.send(new WDr({KeyId:e,PendingWindowInDays:HDr}),{abortSignal:ee(r)}),E(void 0)}catch(n){return qDr.has(Nt(n))?E(void 0):y(new Error(`Failed to schedule CMK deletion: ${S(T(n))}`))}}async function zW(t,e,r){let n=await nCt(t.cloudTrailClient,e.trailName,e.abortSignal);if(!n.success)return y(n.error);if(n.data)return E({outcome:"blocked-trail-still-exists"});let a=await aCt(t.s3Client,e.bucketName,e.abortSignal);if(!a.success)return y(a.error);if(a.data){if(!await oCt(t.s3Client,e.bucketName,e.abortSignal)&&e.acknowledgeTrailHistoryLoss!==!0)return E({outcome:"blocked-awaiting-acknowledgement",bucketName:e.bucketName});await $h(t.s3Client,e.bucketName,r,e.abortSignal);try{await t.s3Client.send(new BDr({Bucket:e.bucketName}),{abortSignal:ee(e.abortSignal)})}catch(o){if(!Cb(o))return y(new Error(`Failed to delete bucket ${e.bucketName}: ${S(T(o))}`))}}if(e.keyArn!==void 0&&e.keyArn!==""){let o=await sCt(t.kmsClient,e.keyArn,e.abortSignal);if(!o.success)return y(o.error)}return E({outcome:"decommissioned"})}var jDr,VW,HDr,qDr,e$e=w(()=>{"use strict";Ce();$();Ct();vt();e$();jDr=Object.defineProperty,VW=(t,e)=>jDr(t,"name",{value:e,configurable:!0}),HDr=14,qDr=new Set(["NotFoundException","KMSInvalidStateException"]);VW(nCt,"trailStillExists");VW(aCt,"bucketExists");VW(oCt,"bucketProvenEmpty");VW(sCt,"scheduleKeyDeletion");VW(zW,"decommissionMemberTrailStorage")});function GW(t,e){if(t==="account")return{action:"hold",reason:"pinned to a per-account trail"};if(t==="org")return{action:"hold",reason:"already migrated to the org trail"};if(t===void 0)return e.orgDeliveryVerified===!0?{action:"advance",to:"draining"}:{action:"hold",reason:e.orgDeliveryVerified===!1?"org-trail delivery not yet verified (first delivery can take up to 24h)":"org-trail delivery could not be determined"};switch(e.decommissionOutcome){case"decommissioned":return{action:"advance",to:"org"};case"blocked-trail-still-exists":return{action:"hold",reason:"per-account trail still exists \u2014 draining deploy not yet applied"};case"blocked-awaiting-acknowledgement":return{action:"hold",reason:"awaiting acknowledgeTrailHistoryLoss before discarding history"};case"failed":return{action:"hold",reason:"decommission attempt failed"};default:return{action:"hold",reason:"decommission was not attempted"}}}function Av(t,e){t.onTrailMigrationPhase?.({...e,...e.detail!==void 0?{detail:S(e.detail)}:{}})}async function WW(t,e,r){let n=[],a=e.accounts.filter(i=>i.trailLifecycle===void 0),o=e.accounts.filter(i=>i.trailLifecycle==="draining"),s=new Map;if(a.length>0){Av(r,{accountId:"*",accountName:"organisation",phase:"verify-delivery",status:"started",detail:`Checking org-trail delivery for ${a.length} account(s) in s3://${e.orgTrailBucketName}`});let i=await $oe(t.managementS3Client,{bucketName:e.orgTrailBucketName,orgId:e.orgId,accountIds:a.map(c=>c.id),...e.recencyWindowMs!==void 0?{recencyWindowMs:e.recencyWindowMs}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}});if(i.success){for(let c of i.data.perAccount)s.set(c.accountId,c.recentDelivery===void 0?void 0:c.delivered&&c.recentDelivery);Av(r,{accountId:"*",accountName:"organisation",phase:"verify-delivery",status:"completed"})}else Av(r,{accountId:"*",accountName:"organisation",phase:"verify-delivery",status:"failed",detail:i.error.message})}for(let i of a){let c={...s.get(i.id)!==void 0?{orgDeliveryVerified:s.get(i.id)}:{}},l=GW(void 0,c);l.action==="advance"?(r.onTrailLifecycleChanged?.(i.id,void 0,l.to),r.onLog?.(`${i.name}: org-trail delivery verified \u2014 trail lifecycle advanced to "draining" (the next deploy removes its per-account trail)`,"info"),n.push({accountId:i.id,accountName:i.name,from:void 0,to:l.to})):n.push({accountId:i.id,accountName:i.name,from:void 0,heldReason:l.reason})}for(let i of o){let c=i.region??e.defaultRegion,l=e.cascadeOutputs.get(i.id),u=l?.[gk],d=l?.[OQ];if(u===void 0||u===""){let g=`stack output ${gk} unavailable for this run`;r.onProgress?.({type:"warning",message:`${i.name}: trail decommission skipped \u2014 ${g}. The account stays "draining"; the next deploy retries.`}),n.push({accountId:i.id,accountName:i.name,from:"draining",heldReason:g});continue}Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"started"});let p,m=await t.getMemberClients(i,c);if(!m.success)p={decommissionOutcome:"failed"},r.onProgress?.({type:"warning",message:S(`${i.name}: trail decommission failed \u2014 ${m.error.message}. The account stays "draining"; the next deploy retries.`)}),Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"failed",detail:m.error.message});else{let g=await zW(m.data,{accountId:i.id,trailName:wit,bucketName:u,...d!==void 0&&d!==""?{keyArn:d}:{},acknowledgeTrailHistoryLoss:i.acknowledgeTrailHistoryLoss===!0,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}},r);if(!g.success)p={decommissionOutcome:"failed"},r.onProgress?.({type:"warning",message:S(`${i.name}: trail decommission failed \u2014 ${g.error.message}. The account stays "draining"; the next deploy retries.`)}),Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"failed",detail:g.error.message});else if(p={decommissionOutcome:g.data.outcome},g.data.outcome==="blocked-awaiting-acknowledgement"){let v=`${i.name}: per-account trail removed, but its log history in s3://${u} will be DISCARDED on decommission. Back the bucket up if the history matters, then set acknowledgeTrailHistoryLoss: true for account ${i.id} and redeploy.`;r.onProgress?.({type:"warning",message:v}),Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"blocked",detail:v})}else g.data.outcome==="blocked-trail-still-exists"?Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"blocked",detail:"per-account trail still exists \u2014 the draining deploy has not been applied yet"}):Av(r,{accountId:i.id,accountName:i.name,phase:"decommission",status:"completed",detail:`bucket s3://${u} removed; CMK scheduled for deletion`})}let f=GW("draining",p);f.action==="advance"?(r.onTrailLifecycleChanged?.(i.id,"draining",f.to),r.onLog?.(`${i.name}: trail storage decommissioned \u2014 trail lifecycle advanced to "org"`,"info"),n.push({accountId:i.id,accountName:i.name,from:"draining",to:f.to})):n.push({accountId:i.id,accountName:i.name,from:"draining",heldReason:f.reason})}return n}var KDr,t$e,r$e=w(()=>{"use strict";$();Ks();Q1e();e$e();KDr=Object.defineProperty,t$e=(t,e)=>KDr(t,"name",{value:e,configurable:!0});t$e(GW,"decideNextTransition");t$e(Av,"emitPhase");t$e(WW,"reconcileTrailMigration")});import{S3Client as n$e}from"@aws-sdk/client-s3";import{CloudTrailClient as iCt}from"@aws-sdk/client-cloudtrail";import{KMSClient as cCt}from"@aws-sdk/client-kms";async function a$e(t,e,r){let{callbacks:n}=t,{orgOutputs:a,allCascadeOutputs:o,orgDetails:s,providerAccounts:i}=r,c=a?.[q3];if(c!==void 0&&c!==""){let l=new Map;for(let d of o)(l.get(d.accountId)===void 0||gk in d.outputs)&&l.set(d.accountId,d.outputs);a!==void 0&&l.set(s.managementAccountId,a);let u=lCt(async(d,p)=>{if(d.id===s.managementAccountId)return E({cloudTrailClient:e.awsProvider.getClient(iCt),s3Client:e.awsProvider.getClient(n$e),kmsClient:e.awsProvider.getClient(cCt)});let m=await Ib(e.awsProvider,d.id,p,`fjall-trail-migration-${d.name}`,t.abortSignal);return m.success?E({cloudTrailClient:m.data.provider.getClient(iCt),s3Client:m.data.provider.getClient(n$e),kmsClient:m.data.provider.getClient(cCt)}):y(m.error)},"getMemberClients");try{await WW({managementS3Client:e.awsProvider.getClient(n$e),getMemberClients:u},{orgId:s.orgId,orgTrailBucketName:c,accounts:i,cascadeOutputs:l,defaultRegion:r.defaultRegion,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}},n)}catch(d){n.onLog?.(S(`Org-trail migration reconciliation failed (non-fatal): ${T(d)}`),"warn")}}}var YDr,lCt,uCt=w(()=>{"use strict";Ce();_d();r$e();$();YDr=Object.defineProperty,lCt=(t,e)=>YDr(t,"name",{value:e,configurable:!0});lCt(a$e,"reconcileOrgTrailOutputs")});import{join as dCt}from"node:path";import{OrganizationsClient as XDr}from"@aws-sdk/client-organizations";async function o$e(t,e,r,n){let{callbacks:a,options:o}=t,{providerAccounts:s,effectiveOrgConfig:i,defaultRegion:c}=await Y1e(t,e),l=await U1e(e,t.abortSignal);if(!l.success)return Qp(a,l.error.message);let u=await T1(e.awsProvider.getClient(XDr),l.data.rootId,t.abortSignal);if(!u.success)return Qp(a,u.error.message);let d={...l.data,...u.data!==void 0?{devOuId:u.data}:{}},p=s.find(re=>dr(re)==="organisation"),m=$W(t,e,r,"organisation",d,void 0,p?.trailLifecycle),f=o?.cascade!==!1,{platformAccount:g,memberAccounts:v}=Ru(s),b=f&&g!==void 0?1:0,A=f&&v.length>0?1:0,C=2+b+A,x=f?[...g!==void 0?[g]:[],...v]:[];if(x.length>0){let re=await LNe(e,x,a,t.abortSignal),le=g!==void 0?re.find(X=>X.accountId===g.id):void 0;if(le!==void 0)return Qp(a,`Pre-flight cascade role check failed for the platform account ${le.accountName} (${le.accountId}): ${le.error}`);for(let X of re)a.onProgress?.({type:"warning",message:S(`Pre-flight cascade role check failed for ${X.accountName} (${X.accountId}) \u2014 its cascade deploy is expected to fail: ${X.error}`)})}a.onCascadeAccountsReconciled?.({hasPlatformAccount:b>0,hasMemberAccounts:A>0});let{id:k,name:I}=uo.PREPARE;a.onStepStart?.(k,I,0,C),a.onLog?.("Synthesising organisation infrastructure\u2026","info");let R=await Hk(e,m,a,"CDK synthesis failed");if(!R.success)return a.onStepComplete?.(k,I,"error",0,C),R;let N=e.awsProvider.getAccountId(),_=e.awsProvider.getRegion();ZP(a,[{stackName:nn(Lt.ORGANISATION),...N!==""?{accountId:N}:{},..._!==""?{region:_}:{}},...f&&g!==void 0?[{stackName:nn(Lt.PLATFORM),accountId:g.id,region:g.region??_}]:[],...f?dv(v,mf(t.orgConfig)).map(({account:re,region:le})=>({stackName:nn(Lt.ACCOUNT),accountId:re.id,region:le})):[]]);let M=await qk(e,m,a,Rb({account:p,estate:"org",orgId:d.orgId}));if(!M.success)return a.onStepComplete?.(k,I,"error",0,C),M;a.onStepComplete?.(k,I,"completed",0,C);let{id:B,name:j}=uo.ORG_DEPLOY,U=nn(Lt.ORGANISATION),G=!0,V=await e.hashService.getTemplateHashes(dCt(m.path,"cdk.out"));if(V.success){let re=await e.hashService.compareWithState(V.data,m.path);re.success?G=re.data.stackChanges.get(U)??!0:a.onLog?.(S(`Org root change detection failed \u2014 deploying to be safe: ${re.error.message}`),"warn")}else a.onLog?.(S(`Org root template hashing failed \u2014 deploying to be safe: ${V.error.message}`),"warn");let L=G||o?.force===!0||!await e.cfnService.stackExists(U,void 0,t.abortSignal);a.onOrgChangesDetected?.({hasOrgChanges:L});let H;if(L){a.onStepStart?.(B,j,1,C);let re=await Xb(e.awsProvider,{stackNames:[U],cdkOutPath:dCt(m.path,"cdk.out"),cfnService:e.cfnService,callbacks:a,...t.abortSignal!==void 0?{abortSignal:t.abortSignal}:{}});if(re.kind==="blocked")return a.onStepComplete?.(B,j,"error",1,C),Qp(a,re.message);let le=await vo(t.assertLeaseForStack,U,t.abortSignal);if(le!==void 0)return a.onStepComplete?.(B,j,"error",1,C),a.onError?.(le),y(le);let X=await e.cdkService.runCdkDeploy(m,U,Yi(a),Pb(a),e.awsProvider);if(!X.success)return a.onStepComplete?.(B,j,"error",1,C),Qp(a,X.error);H=await CM(e,a,U,"Failed to read org stack outputs (non-critical)",t.abortSignal);let ue=V.success?V.data.get(U):void 0;if(ue!==void 0){let ce=await e.hashService.updateStateAfterDeploy(m.path,new Map([[U,ue]]));ce.success||a.onLog?.(`Warning: failed to update state file \u2014 next deploy may re-deploy the org root: ${S(ce.error.message)}`,"warn")}a.onStepComplete?.(B,j,"completed",1,C)}else a.onLog?.("Organisation root: no infrastructure changes \u2014 skipping deploy","info"),H=await CM(e,a,U,"Failed to read org stack outputs (non-critical)",t.abortSignal);let ae=[],ne=[],Z=L;if(f&&s.length>0){let{anyCascadeDeployHappened:re}=await X1e(t,e,r,{providerAccounts:s,effectiveOrgConfig:i,totalSteps:C,cascadeErrors:ae,allCascadeOutputs:ne,orgId:d.orgId});if(re&&(Z=!0),await a$e(t,e,{orgOutputs:H,allCascadeOutputs:ne,orgDetails:l.data,providerAccounts:s,defaultRegion:c}),ae.length>0){let le=ae.map(X=>`  ${X.accountId}: ${X.error}`).join(`
 `);a.onLog?.(S(`Cascade failed for ${ae.length} target(s):
 ${le}`),"warn")}}if(ae.length>0){let re=ae.map(X=>S(`${X.accountId}: ${X.error}`)).join(`
 `),le=new Error(`Organisation root deployed, but the cascade failed for ${ae.length} target(s):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fjall",
-  "version": "3.11.1",
+  "version": "3.11.2",
   "description": "Fjall CLI",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -50,7 +50,7 @@
     "typescript": "^6.0.3"
   },
   "devDependencies": {
-    "@fjall/cli": "^3.11.1",
+    "@fjall/cli": "^3.11.2",
     "esbuild": "^0.28.0",
     "vitest": "^4.1.5"
   },