@fjall/deploy-core 2.25.0 → 2.29.0

package/dist/src/types/destruction.d.ts

@@ -0,0 +1,212 @@
+/**
+ * The destruction-ticket contract — the single cross-surface shape for the
+ * unconditional destruction gate (drift-remediation plan § 4.1). Declared ONCE
+ * here; the CLI and webapp re-export, never redeclare (coupled discriminated
+ * unions share a source at 2 occurrences).
+ *
+ * Consent semantics: exact, case-sensitive `{physicalName, verb}` pairs. No
+ * blanket flag exists or will exist — `autoApprove`, `skipConfirmation`,
+ * `force`, and approval tokens NEVER satisfy the gate.
+ */
+import { z } from "zod";
+export declare const RemediationVerbSchema: z.ZodEnum<{
+    abort: "abort";
+    forget: "forget";
+    recreate: "recreate";
+    pin: "pin";
+    repair: "repair";
+}>;
+export type RemediationVerb = z.infer<typeof RemediationVerbSchema>;
+/**
+ * Canonical one-line meaning per verb (plan § 3) — the SSoT gloss every
+ * surface renders (coupled values, one home): the interactive ceremony's verb
+ * menu and the drift surface's verb list consume THIS record, never local
+ * prose. Exhaustive over the schema-derived union, so a verb addition fails
+ * typecheck here. Context-neutral wording — the same line must read correctly
+ * as a menu consequence and as a `verb (gloss)` parenthetical.
+ */
+export declare const REMEDIATION_VERB_GLOSS: Readonly<Record<RemediationVerb, string>>;
+export declare const DESTRUCTION_FINDINGS: readonly ["replacement-required", "pinned-name-replacement", "resource-deleted", "stack-deleted", "data-loss-delete"];
+export declare const DestructionFindingSchema: z.ZodEnum<{
+    "replacement-required": "replacement-required";
+    "pinned-name-replacement": "pinned-name-replacement";
+    "resource-deleted": "resource-deleted";
+    "stack-deleted": "stack-deleted";
+    "data-loss-delete": "data-loss-delete";
+}>;
+export type DestructionFinding = z.infer<typeof DestructionFindingSchema>;
+/**
+ * Ticket verdict provenance = the plan's replacement-verdict sources plus
+ * `drift-probe` (a resource-deleted row proven by a direct NotFound from the
+ * owning service — Phase 6 drift-repair tickets). Deliberately a superset:
+ * plan rows never claim `drift-probe`, and the plan union must not widen.
+ */
+export declare const TICKET_VERDICT_SOURCES: readonly ["registry", "registry (change-set unverified)", "change-set", "cdk-spec (unverified)", "drift-probe"];
+export declare const TicketVerdictSourceSchema: z.ZodEnum<{
+    registry: "registry";
+    "registry (change-set unverified)": "registry (change-set unverified)";
+    "change-set": "change-set";
+    "cdk-spec (unverified)": "cdk-spec (unverified)";
+    "drift-probe": "drift-probe";
+}>;
+export type TicketVerdictSource = z.infer<typeof TicketVerdictSourceSchema>;
+export declare const DestructionTicketResourceSchema: z.ZodObject<{
+    stack: z.ZodString;
+    logicalId: z.ZodString;
+    resourceType: z.ZodString;
+    physicalName: z.ZodString;
+    finding: z.ZodEnum<{
+        "replacement-required": "replacement-required";
+        "pinned-name-replacement": "pinned-name-replacement";
+        "resource-deleted": "resource-deleted";
+        "stack-deleted": "stack-deleted";
+        "data-loss-delete": "data-loss-delete";
+    }>;
+    cause: z.ZodString;
+    offendingProperties: z.ZodArray<z.ZodString>;
+    verdictSource: z.ZodEnum<{
+        registry: "registry";
+        "registry (change-set unverified)": "registry (change-set unverified)";
+        "change-set": "change-set";
+        "cdk-spec (unverified)": "cdk-spec (unverified)";
+        "drift-probe": "drift-probe";
+    }>;
+    dataLossRisk: z.ZodBoolean;
+    verbs: z.ZodArray<z.ZodEnum<{
+        abort: "abort";
+        forget: "forget";
+        recreate: "recreate";
+        pin: "pin";
+        repair: "repair";
+    }>>;
+}, z.core.$strict>;
+export type DestructionTicketResource = z.infer<typeof DestructionTicketResourceSchema>;
+export declare const DestructionTicketSchema: z.ZodObject<{
+    ticketDigest: z.ZodString;
+    resources: z.ZodArray<z.ZodObject<{
+        stack: z.ZodString;
+        logicalId: z.ZodString;
+        resourceType: z.ZodString;
+        physicalName: z.ZodString;
+        finding: z.ZodEnum<{
+            "replacement-required": "replacement-required";
+            "pinned-name-replacement": "pinned-name-replacement";
+            "resource-deleted": "resource-deleted";
+            "stack-deleted": "stack-deleted";
+            "data-loss-delete": "data-loss-delete";
+        }>;
+        cause: z.ZodString;
+        offendingProperties: z.ZodArray<z.ZodString>;
+        verdictSource: z.ZodEnum<{
+            registry: "registry";
+            "registry (change-set unverified)": "registry (change-set unverified)";
+            "change-set": "change-set";
+            "cdk-spec (unverified)": "cdk-spec (unverified)";
+            "drift-probe": "drift-probe";
+        }>;
+        dataLossRisk: z.ZodBoolean;
+        verbs: z.ZodArray<z.ZodEnum<{
+            abort: "abort";
+            forget: "forget";
+            recreate: "recreate";
+            pin: "pin";
+            repair: "repair";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DestructionTicket = z.infer<typeof DestructionTicketSchema>;
+/** One named consent: the exact physical name plus the chosen verb. */
+export declare const DestructionConsentSchema: z.ZodObject<{
+    physicalName: z.ZodString;
+    verb: z.ZodEnum<{
+        abort: "abort";
+        forget: "forget";
+        recreate: "recreate";
+        pin: "pin";
+        repair: "repair";
+    }>;
+}, z.core.$strict>;
+export type DestructionConsent = z.infer<typeof DestructionConsentSchema>;
+/**
+ * Per-consent verdicts for the fail-closed report ([G6]): a consent either
+ * matched a pending resource with a legal verb, named a resource the ticket
+ * does not contain (surplus / misspelt — fail closed, never ignored), or
+ * named a real resource with an illegal verb.
+ */
+export declare const CONSENT_VERDICTS: readonly ["matched", "unmatched", "wrong-verb"];
+export type ConsentVerdict = (typeof CONSENT_VERDICTS)[number];
+export interface ConsentVerdictRow {
+    physicalName: string;
+    verb: RemediationVerb;
+    verdict: ConsentVerdict;
+    /** Human detail for non-matched rows (e.g. the legal verbs). */
+    detail?: string;
+}
+/** The full consent evaluation — rendered as the per-name verdict table. */
+export interface DestructionConsentReport {
+    /** One row per supplied consent, in supply order. */
+    rows: ConsentVerdictRow[];
+    /** Ticket physical names no consent covered. */
+    uncovered: string[];
+    /**
+     * Consents were minted against a different ticket digest (the plan changed
+     * between mint and apply) — every consent is treated as stale (TOCTOU).
+     */
+    digestMismatch: boolean;
+    /** On mismatch: the digest the consents were minted against. */
+    suppliedDigest?: string;
+    /** On mismatch: what the pending destructive changes digest to now. */
+    currentDigest?: string;
+    /** True only when every resource is covered by a matched consent. */
+    satisfied: boolean;
+}
+/**
+ * WHY the gate withheld — the structured outcome every surface branches on so
+ * a user who completed the ceremony is never told to consent again:
+ *   - `awaiting-consent`        — no consents were supplied at all
+ *   - `declined`                — the interactive ceremony was declined, or an
+ *                                 abort verb was consented (operator withhold)
+ *   - `consents-invalid`        — consents were supplied but failed evaluation
+ *                                 (mismatch, wrong verb, uncovered, stale digest)
+ *   - `consent-not-executable`  — consents fully satisfied the ticket, but a
+ *                                 consented verb has no execution arm in this
+ *                                 release (truthful withhold, reasons name it)
+ */
+export declare const DestructionOutcomeSchema: z.ZodEnum<{
+    "awaiting-consent": "awaiting-consent";
+    declined: "declined";
+    "consents-invalid": "consents-invalid";
+    "consent-not-executable": "consent-not-executable";
+}>;
+export type DestructionOutcome = z.infer<typeof DestructionOutcomeSchema>;
+/** What the interactive ceremony is asked to resolve. */
+export interface DestructionConsentRequest {
+    target: string;
+    ticket: DestructionTicket;
+}
+/**
+ * The ceremony's answer: resolved consent pairs bound to the digest of the
+ * ticket the user actually saw, or an abort (decline). The pairs are
+ * re-evaluated engine-side against the live ticket — the resolution can never
+ * widen consent beyond what the `--remediate` flags could express.
+ */
+export type DestructionConsentResolution = {
+    kind: "consents";
+    consents: readonly DestructionConsent[];
+    /** Digest of the ticket the ceremony displayed (TOCTOU binding). */
+    ticketDigest: string;
+} | {
+    kind: "abort";
+};
+/**
+ * Interactive destruction-consent resolver — the injected-resolver mirror of
+ * the approval gate's `ApprovalGate` (types/approval.ts), for the
+ * UNCONDITIONAL destruction gate. Consent EVALUATION stays engine-side: the
+ * resolved pairs feed the same `evaluateDestructionConsents` + ticket-digest
+ * TOCTOU path the `--remediate` flags use, so a typed name that does not
+ * exactly match is rejected by the engine regardless of what the surface
+ * validated. Omitting the resolver leaves the gate fail-closed (withheld).
+ */
+export interface DestructionConsentGate {
+    resolve(request: DestructionConsentRequest): Promise<DestructionConsentResolution>;
+}

package/dist/src/types/destruction.js

@@ -0,0 +1 @@
+import{z as e}from"zod";import{REPLACEMENT_VERDICT_SOURCES as r}from"../orchestration/application/plan/types.js";const t=e.enum(["abort","pin","recreate","forget","repair"]),u={abort:"stop here \u2014 nothing is changed",pin:"accept the live value into your fjall config so the change disappears; non-destructive",recreate:"accept a new physical resource under this name \u2014 data survives only via snapshot or backup (none if the resource is already deleted and no backup exists)",forget:"stop managing the resource \u2014 the physical resource is never touched",repair:"report-only: forensics plus a manual runbook, nothing is mutated"},n=["replacement-required","pinned-name-replacement","resource-deleted","stack-deleted","data-loss-delete"],o=e.enum(n),c=[...r,"drift-probe"],s=e.enum(c),a=e.object({stack:e.string(),logicalId:e.string(),resourceType:e.string(),physicalName:e.string(),finding:o,cause:e.string(),offendingProperties:e.array(e.string()),verdictSource:s,dataLossRisk:e.boolean(),verbs:e.array(t)}).strict(),d=e.object({ticketDigest:e.string(),resources:e.array(a)}).strict(),m=e.object({physicalName:e.string().min(1,"Consent physical name cannot be empty"),verb:t}).strict(),h=["matched","unmatched","wrong-verb"],l=e.enum(["awaiting-consent","declined","consents-invalid","consent-not-executable"]);export{h as CONSENT_VERDICTS,n as DESTRUCTION_FINDINGS,m as DestructionConsentSchema,o as DestructionFindingSchema,l as DestructionOutcomeSchema,a as DestructionTicketResourceSchema,d as DestructionTicketSchema,u as REMEDIATION_VERB_GLOSS,t as RemediationVerbSchema,c as TICKET_VERDICT_SOURCES,s as TicketVerdictSourceSchema};

package/dist/src/types/drift.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The Class 1 drift contract — out-of-band-deletion suspects, probe verdicts
+ * and the persisted suspect journal (drift-remediation plan § Phase 5).
+ * Declared ONCE here; the CLI re-exports, never redeclares (coupled
+ * discriminated unions share a source at 2 occurrences).
+ *
+ * Verdict semantics are fail-closed: only an authoritative NotFound from the
+ * service that owns the resource yields `confirmed-deleted`. Every other
+ * probe outcome (throttle, AccessDenied, network failure) stays `unconfirmed`
+ * and presentation is repair-only — no destructive verbs.
+ */
+import { z } from "zod";
+import { type RemediationVerb } from "./destruction.js";
+export declare const DRIFT_VERDICTS: readonly ["confirmed-deleted", "present", "unconfirmed", "stack-missing"];
+export declare const DriftVerdictSchema: z.ZodEnum<{
+    "confirmed-deleted": "confirmed-deleted";
+    present: "present";
+    unconfirmed: "unconfirmed";
+    "stack-missing": "stack-missing";
+}>;
+export type DriftVerdict = z.infer<typeof DriftVerdictSchema>;
+export declare const DriftSuspectSchema: z.ZodObject<{
+    stackName: z.ZodString;
+    logicalId: z.ZodString;
+    resourceType: z.ZodString;
+    physicalId: z.ZodOptional<z.ZodString>;
+    failedStatus: z.ZodString;
+    statusReason: z.ZodString;
+}, z.core.$strict>;
+export type DriftSuspect = z.infer<typeof DriftSuspectSchema>;
+export declare const DriftFindingSchema: z.ZodObject<{
+    verdict: z.ZodEnum<{
+        "confirmed-deleted": "confirmed-deleted";
+        present: "present";
+        unconfirmed: "unconfirmed";
+        "stack-missing": "stack-missing";
+    }>;
+    verdictDetail: z.ZodString;
+    probeMethod: z.ZodString;
+    verbs: z.ZodArray<z.ZodEnum<{
+        abort: "abort";
+        forget: "forget";
+        recreate: "recreate";
+        pin: "pin";
+        repair: "repair";
+    }>>;
+    stackName: z.ZodString;
+    logicalId: z.ZodString;
+    resourceType: z.ZodString;
+    physicalId: z.ZodOptional<z.ZodString>;
+    failedStatus: z.ZodString;
+    statusReason: z.ZodString;
+}, z.core.$strict>;
+export type DriftFinding = z.infer<typeof DriftFindingSchema>;
+/** Legal verbs per verdict — single source for CLI presentation. */
+export declare function verbsForDriftVerdict(verdict: DriftVerdict): RemediationVerb[];
+export declare const DriftJournalRecordSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    accountId: z.ZodString;
+    region: z.ZodString;
+    stackName: z.ZodString;
+    recordedAt: z.ZodString;
+    suspects: z.ZodArray<z.ZodObject<{
+        stackName: z.ZodString;
+        logicalId: z.ZodString;
+        resourceType: z.ZodString;
+        physicalId: z.ZodOptional<z.ZodString>;
+        failedStatus: z.ZodString;
+        statusReason: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DriftJournalRecord = z.infer<typeof DriftJournalRecordSchema>;

package/dist/src/types/drift.js

@@ -0,0 +1 @@
+import{z as t}from"zod";import{RemediationVerbSchema as i}from"./destruction.js";const n=["confirmed-deleted","present","unconfirmed","stack-missing"],s=t.enum(n),e=t.object({stackName:t.string().min(1),logicalId:t.string().min(1),resourceType:t.string().min(1),physicalId:t.string().min(1).optional(),failedStatus:t.string().min(1),statusReason:t.string()}).strict(),a=t.object({...e.shape,verdict:s,verdictDetail:t.string(),probeMethod:t.string(),verbs:t.array(i)}).strict();function m(r){switch(r){case"confirmed-deleted":return["forget","recreate"];case"present":return[];case"unconfirmed":case"stack-missing":return["repair"]}}const d=t.object({version:t.literal(1),accountId:t.string().min(1),region:t.string().min(1),stackName:t.string().min(1),recordedAt:t.string().min(1),suspects:t.array(e)}).strict();export{n as DRIFT_VERDICTS,a as DriftFindingSchema,d as DriftJournalRecordSchema,e as DriftSuspectSchema,s as DriftVerdictSchema,m as verbsForDriftVerdict};

package/dist/src/types/index.d.ts

@@ -1,7 +1,7 @@
 export { DeploymentEventSchema, DEPLOYMENT_EVENT_TYPES, DEPLOYMENT_EVENT_RESOURCE_CATEGORIES, DEPLOYMENT_EVENT_STATUS_REASON_MAX, DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX, DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX, CASCADE_PHASES, CASCADE_ACCOUNT_STATUSES, toCascadePhase } from "./deploymentEventSchema.js";
 export type { DeploymentEvent, DeploymentEventType, DeploymentEventResourceCategory, DeploymentEventCascadePhase, DeploymentEventCascadeAccountStatus } from "./deploymentEventSchema.js";
 export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter } from "./credentials.js";
-export type { DeployCallbacks, StepCompleteStatus, StackCleanupPhase, CascadeAccountPhase, LogLevel, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail } from "./callbacks.js";
+export type { DeployCallbacks, StepCompleteStatus, StackCleanupPhase, CascadeAccountPhase, LogLevel, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, StackTarget } from "./callbacks.js";
 export { isQuarantineDetail, isRetainedBucketsDetail } from "./callbacks.js";
 export { DeployEventSchema, StepProgressSchema, DeployResourceSchema, PlanChangeSchema, PlanPropertyChangeSchema, ChangeCountsSchema, DEPLOY_EVENT_CONTRACT, DEPLOY_EVENT_CONTRACT_MAJOR, DEPLOY_EVENT_CONTRACT_MINOR, SUPPORTED_CONTRACT_MARKERS, DEPLOY_EVENT_ID_MAX, DEPLOY_EVENT_NAME_MAX, DEPLOY_EVENT_MESSAGE_MAX, DEPLOY_EVENT_STATUS_REASON_MAX, DEPLOY_EVENT_ERROR_MESSAGE_MAX, DEPLOY_EVENT_TRAIL_DETAIL_MAX, DEPLOY_EVENT_OUTPUT_MAX, DEPLOY_EVENT_ARN_MAX, DEPLOY_EVENT_URL_MAX, STEP_COMPLETE_STATUSES, LOG_LEVELS, STACK_CLEANUP_PHASES, CASCADE_ACCOUNT_PHASES, DEPLOY_RESULTS, DETECTION_PHASES, PHASE_STATUSES, BUILDERS, CASCADE_OUTCOME_RESULTS, PLAN_ACTIONS, REPLACEMENT_MODES, APPROVAL_KINDS, APPROVAL_DECISIONS, ALL_PROGRESS_KINDS } from "./deployEvent.js";
 export type { DeployEvent, ProgressKind, StepProgress, DeployResource, PlanChange, PlanPropertyChange, ChangeCounts, PlanAction, ReplacementMode, ApprovalKind, ApprovalDecision, DeployRunResult } from "./deployEvent.js";
@@ -10,8 +10,14 @@ export { parseDeployEvent, parseDeployContractVersion, type ParsedDeployEvent }
 export type { ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent } from "./events.js";
 export { TRAIL_MIGRATION_PHASES, TRAIL_MIGRATION_STATUSES } from "./events.js";
 export type { ApiClientInterface, EntitlementsData } from "./apiClient.js";
-export type { DeployParams, DeployOptions, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult } from "./params.js";
+export type { DeployParams, DeployOptions, DatabaseEndpointRestartRequest, InfrastructureSource, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, StackLeaseVerdict } from "./params.js";
 export type { ApprovalGate, ApprovalGatePlanDetail, ApprovalRequest, GateResolution } from "./approval.js";
+export { RemediationVerbSchema, REMEDIATION_VERB_GLOSS, DestructionFindingSchema, DestructionTicketResourceSchema, DestructionTicketSchema, DestructionConsentSchema, DestructionOutcomeSchema, DESTRUCTION_FINDINGS, CONSENT_VERDICTS, TICKET_VERDICT_SOURCES, TicketVerdictSourceSchema } from "./destruction.js";
+export type { RemediationVerb, DestructionFinding, DestructionTicketResource, DestructionTicket, DestructionConsent, ConsentVerdict, ConsentVerdictRow, DestructionConsentReport, DestructionConsentRequest, DestructionConsentResolution, DestructionConsentGate, DestructionOutcome, TicketVerdictSource } from "./destruction.js";
+export { DRIFT_VERDICTS, DriftVerdictSchema, DriftSuspectSchema, DriftFindingSchema, DriftJournalRecordSchema, verbsForDriftVerdict } from "./drift.js";
+export type { DriftVerdict, DriftSuspect, DriftFinding, DriftJournalRecord } from "./drift.js";
+export { REMEDIATION_PHASES, RemediationPhaseSchema, RemediationTargetSchema, RemediationFlipProofSchema, RemediationJournalRecordSchema, RemediationVerbWithSurgerySchema, remediationPhaseRank, remediationPlaceholderPhysicalId, isRemediationPlaceholderPhysicalId } from "./remediation.js";
+export type { RemediationPhase, RemediationTarget, RemediationFlipProof, RemediationJournalRecord, RemediationVerbWithSurgery } from "./remediation.js";
 export type { OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession } from "./config/orgConfig.js";
 export type { Entitlements } from "./config/entitlements.js";
 export type { StackOutput, StackOutputsRecord, DeploymentContext, StepOutput, ApplicationDeploymentContext, CallerIdentity } from "./deployment/index.js";

package/dist/src/types/index.js

@@ -1 +1 @@
-import{DeploymentEventSchema as e,DEPLOYMENT_EVENT_TYPES as A,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as S,DEPLOYMENT_EVENT_STATUS_REASON_MAX as T,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as t,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as O,CASCADE_PHASES as P,CASCADE_ACCOUNT_STATUSES as r,toCascadePhase as N}from"./deploymentEventSchema.js";import{isQuarantineDetail as a,isRetainedBucketsDetail as R}from"./callbacks.js";import{DeployEventSchema as p,StepProgressSchema as D,DeployResourceSchema as C,PlanChangeSchema as i,PlanPropertyChangeSchema as l,ChangeCountsSchema as I,DEPLOY_EVENT_CONTRACT as M,DEPLOY_EVENT_CONTRACT_MAJOR as n,DEPLOY_EVENT_CONTRACT_MINOR as m,SUPPORTED_CONTRACT_MARKERS as s,DEPLOY_EVENT_ID_MAX as c,DEPLOY_EVENT_NAME_MAX as Y,DEPLOY_EVENT_MESSAGE_MAX as U,DEPLOY_EVENT_STATUS_REASON_MAX as V,DEPLOY_EVENT_ERROR_MESSAGE_MAX as f,DEPLOY_EVENT_TRAIL_DETAIL_MAX as x,DEPLOY_EVENT_OUTPUT_MAX as g,DEPLOY_EVENT_ARN_MAX as X,DEPLOY_EVENT_URL_MAX as h,STEP_COMPLETE_STATUSES as G,LOG_LEVELS as y,STACK_CLEANUP_PHASES as F,CASCADE_ACCOUNT_PHASES as d,DEPLOY_RESULTS as u,DETECTION_PHASES as K,PHASE_STATUSES as H,BUILDERS as k,CASCADE_OUTCOME_RESULTS as v,PLAN_ACTIONS as w,REPLACEMENT_MODES as B,APPROVAL_KINDS as b,APPROVAL_DECISIONS as j,ALL_PROGRESS_KINDS as J}from"./deployEvent.js";import{createDeployEmitter as q}from"./deployEmitter.js";import{parseDeployEvent as W,parseDeployContractVersion as Z}from"./deployEventParse.js";import{TRAIL_MIGRATION_PHASES as EE,TRAIL_MIGRATION_STATUSES as _E}from"./events.js";import{stubCallerIdentity as AE}from"./deployment/index.js";import{ProgressReporter as TE}from"./ProgressEvent.js";import{APPLICATION_STACKS as OE,ORGANISATION_TYPES as PE,APPLICATION_DEPLOY_ORDER as rE,APPLICATION_DESTROY_ORDER as NE,OPENNEXT_DEPLOY_ORDER as oE,OPENNEXT_DESTROY_ORDER as aE,PARALLEL_DEPLOY_GROUPS as RE,PARALLEL_DESTROY_GROUPS as LE,OPENNEXT_PARALLEL_GROUPS as pE,isApplicationOperation as DE,isOrganisationOperation as CE,getParallelDeployGroups as iE,getParallelDestroyGroups as lE,getApplicationDeployOrder as IE,getApplicationDestroyOrder as ME,getApplicationStackName as nE,getOrganisationStackName as mE,isApplicationStack as sE,getApplicationStepName as cE,getApplicationStepId as YE,toPascalCase as UE}from"./operations.js";import{PARALLEL_OPERATION_TYPES as fE}from"./deployment/index.js";import{isOpenNextPattern as gE,OPENNEXT_PATTERNS as XE}from"./detection/patternTypes.js";import{deriveResourcesFromManifestStacks as GE}from"./detection/patternDetection.js";import{STACK_NOT_FOUND_PATTERN as FE,STACK_FAILED_STATE_PATTERN as dE,CDK_NO_STACKS_MATCH as uE,INFRASTRUCTURE_FILENAME as KE}from"./constants.js";import{ApplicationError as kE,wrapApplicationError as vE}from"./application/index.js";import{FjallStateFileSchema as BE,readStateFile as bE,writeStateFile as jE,createEmptyState as JE,deleteStateFile as QE,updateTemplateHash as qE,getStateFilePath as zE,regionSuffix as WE}from"./config/FjallState.js";import{STEP_IDS as $E,STEP_NAMES as E_,INFRASTRUCTURE_STEP_NAMES as __,INFRA_STEP_NAME as e_}from"./stepDefinitions.js";export{J as ALL_PROGRESS_KINDS,rE as APPLICATION_DEPLOY_ORDER,NE as APPLICATION_DESTROY_ORDER,OE as APPLICATION_STACKS,j as APPROVAL_DECISIONS,b as APPROVAL_KINDS,kE as ApplicationError,k as BUILDERS,d as CASCADE_ACCOUNT_PHASES,r as CASCADE_ACCOUNT_STATUSES,v as CASCADE_OUTCOME_RESULTS,P as CASCADE_PHASES,uE as CDK_NO_STACKS_MATCH,I as ChangeCountsSchema,t as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,S as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,T as DEPLOYMENT_EVENT_STATUS_REASON_MAX,O as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,A as DEPLOYMENT_EVENT_TYPES,X as DEPLOY_EVENT_ARN_MAX,M as DEPLOY_EVENT_CONTRACT,n as DEPLOY_EVENT_CONTRACT_MAJOR,m as DEPLOY_EVENT_CONTRACT_MINOR,f as DEPLOY_EVENT_ERROR_MESSAGE_MAX,c as DEPLOY_EVENT_ID_MAX,U as DEPLOY_EVENT_MESSAGE_MAX,Y as DEPLOY_EVENT_NAME_MAX,g as DEPLOY_EVENT_OUTPUT_MAX,V as DEPLOY_EVENT_STATUS_REASON_MAX,x as DEPLOY_EVENT_TRAIL_DETAIL_MAX,h as DEPLOY_EVENT_URL_MAX,u as DEPLOY_RESULTS,K as DETECTION_PHASES,p as DeployEventSchema,C as DeployResourceSchema,e as DeploymentEventSchema,BE as FjallStateFileSchema,KE as INFRASTRUCTURE_FILENAME,__ as INFRASTRUCTURE_STEP_NAMES,e_ as INFRA_STEP_NAME,y as LOG_LEVELS,oE as OPENNEXT_DEPLOY_ORDER,aE as OPENNEXT_DESTROY_ORDER,pE as OPENNEXT_PARALLEL_GROUPS,XE as OPENNEXT_PATTERNS,PE as ORGANISATION_TYPES,RE as PARALLEL_DEPLOY_GROUPS,LE as PARALLEL_DESTROY_GROUPS,fE as PARALLEL_OPERATION_TYPES,H as PHASE_STATUSES,w as PLAN_ACTIONS,i as PlanChangeSchema,l as PlanPropertyChangeSchema,TE as ProgressReporter,B as REPLACEMENT_MODES,F as STACK_CLEANUP_PHASES,dE as STACK_FAILED_STATE_PATTERN,FE as STACK_NOT_FOUND_PATTERN,G as STEP_COMPLETE_STATUSES,$E as STEP_IDS,E_ as STEP_NAMES,s as SUPPORTED_CONTRACT_MARKERS,D as StepProgressSchema,EE as TRAIL_MIGRATION_PHASES,_E as TRAIL_MIGRATION_STATUSES,q as createDeployEmitter,JE as createEmptyState,QE as deleteStateFile,GE as deriveResourcesFromManifestStacks,IE as getApplicationDeployOrder,ME as getApplicationDestroyOrder,nE as getApplicationStackName,YE as getApplicationStepId,cE as getApplicationStepName,mE as getOrganisationStackName,iE as getParallelDeployGroups,lE as getParallelDestroyGroups,zE as getStateFilePath,DE as isApplicationOperation,sE as isApplicationStack,gE as isOpenNextPattern,CE as isOrganisationOperation,a as isQuarantineDetail,R as isRetainedBucketsDetail,Z as parseDeployContractVersion,W as parseDeployEvent,bE as readStateFile,WE as regionSuffix,AE as stubCallerIdentity,N as toCascadePhase,UE as toPascalCase,qE as updateTemplateHash,vE as wrapApplicationError,jE as writeStateFile};
+import{DeploymentEventSchema as S,DEPLOYMENT_EVENT_TYPES as t,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as _,DEPLOYMENT_EVENT_STATUS_REASON_MAX as T,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as r,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as A,CASCADE_PHASES as a,CASCADE_ACCOUNT_STATUSES as o,toCascadePhase as i}from"./deploymentEventSchema.js";import{isQuarantineDetail as O,isRetainedBucketsDetail as P}from"./callbacks.js";import{DeployEventSchema as D,StepProgressSchema as c,DeployResourceSchema as p,PlanChangeSchema as m,PlanPropertyChangeSchema as L,ChangeCountsSchema as n,DEPLOY_EVENT_CONTRACT as C,DEPLOY_EVENT_CONTRACT_MAJOR as I,DEPLOY_EVENT_CONTRACT_MINOR as l,SUPPORTED_CONTRACT_MARKERS as s,DEPLOY_EVENT_ID_MAX as M,DEPLOY_EVENT_NAME_MAX as h,DEPLOY_EVENT_MESSAGE_MAX as d,DEPLOY_EVENT_STATUS_REASON_MAX as V,DEPLOY_EVENT_ERROR_MESSAGE_MAX as f,DEPLOY_EVENT_TRAIL_DETAIL_MAX as U,DEPLOY_EVENT_OUTPUT_MAX as Y,DEPLOY_EVENT_ARN_MAX as u,DEPLOY_EVENT_URL_MAX as g,STEP_COMPLETE_STATUSES as x,LOG_LEVELS as F,STACK_CLEANUP_PHASES as y,CASCADE_ACCOUNT_PHASES as G,DEPLOY_RESULTS as X,DETECTION_PHASES as K,PHASE_STATUSES as k,BUILDERS as H,CASCADE_OUTCOME_RESULTS as v,PLAN_ACTIONS as b,REPLACEMENT_MODES as B,APPROVAL_KINDS as J,APPROVAL_DECISIONS as w,ALL_PROGRESS_KINDS as j}from"./deployEvent.js";import{createDeployEmitter as W}from"./deployEmitter.js";import{parseDeployEvent as z,parseDeployContractVersion as Z}from"./deployEventParse.js";import{TRAIL_MIGRATION_PHASES as ee,TRAIL_MIGRATION_STATUSES as Ee}from"./events.js";import{RemediationVerbSchema as te,REMEDIATION_VERB_GLOSS as _e,DestructionFindingSchema as Te,DestructionTicketResourceSchema as re,DestructionTicketSchema as Ae,DestructionConsentSchema as ae,DestructionOutcomeSchema as oe,DESTRUCTION_FINDINGS as ie,CONSENT_VERDICTS as Re,TICKET_VERDICT_SOURCES as Oe,TicketVerdictSourceSchema as Pe}from"./destruction.js";import{DRIFT_VERDICTS as De,DriftVerdictSchema as ce,DriftSuspectSchema as pe,DriftFindingSchema as me,DriftJournalRecordSchema as Le,verbsForDriftVerdict as ne}from"./drift.js";import{REMEDIATION_PHASES as Ie,RemediationPhaseSchema as le,RemediationTargetSchema as se,RemediationFlipProofSchema as Me,RemediationJournalRecordSchema as he,RemediationVerbWithSurgerySchema as de,remediationPhaseRank as Ve,remediationPlaceholderPhysicalId as fe,isRemediationPlaceholderPhysicalId as Ue}from"./remediation.js";import{stubCallerIdentity as ue}from"./deployment/index.js";import{ProgressReporter as xe}from"./ProgressEvent.js";import{APPLICATION_STACKS as ye,ORGANISATION_TYPES as Ge,APPLICATION_DEPLOY_ORDER as Xe,APPLICATION_DESTROY_ORDER as Ke,OPENNEXT_DEPLOY_ORDER as ke,OPENNEXT_DESTROY_ORDER as He,PARALLEL_DEPLOY_GROUPS as ve,PARALLEL_DESTROY_GROUPS as be,OPENNEXT_PARALLEL_GROUPS as Be,isApplicationOperation as Je,isOrganisationOperation as we,getParallelDeployGroups as je,getParallelDestroyGroups as Qe,getApplicationDeployOrder as We,getApplicationDestroyOrder as qe,getApplicationStackName as ze,getOrganisationStackName as Ze,isApplicationStack as $e,getApplicationStepName as eE,getApplicationStepId as EE,toPascalCase as SE}from"./operations.js";import{PARALLEL_OPERATION_TYPES as _E}from"./deployment/index.js";import{isOpenNextPattern as rE,OPENNEXT_PATTERNS as AE}from"./detection/patternTypes.js";import{deriveResourcesFromManifestStacks as oE}from"./detection/patternDetection.js";import{STACK_NOT_FOUND_PATTERN as RE,STACK_FAILED_STATE_PATTERN as OE,CDK_NO_STACKS_MATCH as PE,INFRASTRUCTURE_FILENAME as NE}from"./constants.js";import{ApplicationError as cE,wrapApplicationError as pE}from"./application/index.js";import{FjallStateFileSchema as LE,readStateFile as nE,writeStateFile as CE,createEmptyState as IE,deleteStateFile as lE,updateTemplateHash as sE,getStateFilePath as ME,regionSuffix as hE}from"./config/FjallState.js";import{STEP_IDS as VE,STEP_NAMES as fE,INFRASTRUCTURE_STEP_NAMES as UE,INFRA_STEP_NAME as YE}from"./stepDefinitions.js";export{j as ALL_PROGRESS_KINDS,Xe as APPLICATION_DEPLOY_ORDER,Ke as APPLICATION_DESTROY_ORDER,ye as APPLICATION_STACKS,w as APPROVAL_DECISIONS,J as APPROVAL_KINDS,cE as ApplicationError,H as BUILDERS,G as CASCADE_ACCOUNT_PHASES,o as CASCADE_ACCOUNT_STATUSES,v as CASCADE_OUTCOME_RESULTS,a as CASCADE_PHASES,PE as CDK_NO_STACKS_MATCH,Re as CONSENT_VERDICTS,n as ChangeCountsSchema,r as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,_ as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,T as DEPLOYMENT_EVENT_STATUS_REASON_MAX,A as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,t as DEPLOYMENT_EVENT_TYPES,u as DEPLOY_EVENT_ARN_MAX,C as DEPLOY_EVENT_CONTRACT,I as DEPLOY_EVENT_CONTRACT_MAJOR,l as DEPLOY_EVENT_CONTRACT_MINOR,f as DEPLOY_EVENT_ERROR_MESSAGE_MAX,M as DEPLOY_EVENT_ID_MAX,d as DEPLOY_EVENT_MESSAGE_MAX,h as DEPLOY_EVENT_NAME_MAX,Y as DEPLOY_EVENT_OUTPUT_MAX,V as DEPLOY_EVENT_STATUS_REASON_MAX,U as DEPLOY_EVENT_TRAIL_DETAIL_MAX,g as DEPLOY_EVENT_URL_MAX,X as DEPLOY_RESULTS,ie as DESTRUCTION_FINDINGS,K as DETECTION_PHASES,De as DRIFT_VERDICTS,D as DeployEventSchema,p as DeployResourceSchema,S as DeploymentEventSchema,ae as DestructionConsentSchema,Te as DestructionFindingSchema,oe as DestructionOutcomeSchema,re as DestructionTicketResourceSchema,Ae as DestructionTicketSchema,me as DriftFindingSchema,Le as DriftJournalRecordSchema,pe as DriftSuspectSchema,ce as DriftVerdictSchema,LE as FjallStateFileSchema,NE as INFRASTRUCTURE_FILENAME,UE as INFRASTRUCTURE_STEP_NAMES,YE as INFRA_STEP_NAME,F as LOG_LEVELS,ke as OPENNEXT_DEPLOY_ORDER,He as OPENNEXT_DESTROY_ORDER,Be as OPENNEXT_PARALLEL_GROUPS,AE as OPENNEXT_PATTERNS,Ge as ORGANISATION_TYPES,ve as PARALLEL_DEPLOY_GROUPS,be as PARALLEL_DESTROY_GROUPS,_E as PARALLEL_OPERATION_TYPES,k as PHASE_STATUSES,b as PLAN_ACTIONS,m as PlanChangeSchema,L as PlanPropertyChangeSchema,xe as ProgressReporter,Ie as REMEDIATION_PHASES,_e as REMEDIATION_VERB_GLOSS,B as REPLACEMENT_MODES,Me as RemediationFlipProofSchema,he as RemediationJournalRecordSchema,le as RemediationPhaseSchema,se as RemediationTargetSchema,te as RemediationVerbSchema,de as RemediationVerbWithSurgerySchema,y as STACK_CLEANUP_PHASES,OE as STACK_FAILED_STATE_PATTERN,RE as STACK_NOT_FOUND_PATTERN,x as STEP_COMPLETE_STATUSES,VE as STEP_IDS,fE as STEP_NAMES,s as SUPPORTED_CONTRACT_MARKERS,c as StepProgressSchema,Oe as TICKET_VERDICT_SOURCES,ee as TRAIL_MIGRATION_PHASES,Ee as TRAIL_MIGRATION_STATUSES,Pe as TicketVerdictSourceSchema,W as createDeployEmitter,IE as createEmptyState,lE as deleteStateFile,oE as deriveResourcesFromManifestStacks,We as getApplicationDeployOrder,qe as getApplicationDestroyOrder,ze as getApplicationStackName,EE as getApplicationStepId,eE as getApplicationStepName,Ze as getOrganisationStackName,je as getParallelDeployGroups,Qe as getParallelDestroyGroups,ME as getStateFilePath,Je as isApplicationOperation,$e as isApplicationStack,rE as isOpenNextPattern,we as isOrganisationOperation,O as isQuarantineDetail,Ue as isRemediationPlaceholderPhysicalId,P as isRetainedBucketsDetail,Z as parseDeployContractVersion,z as parseDeployEvent,nE as readStateFile,hE as regionSuffix,Ve as remediationPhaseRank,fe as remediationPlaceholderPhysicalId,ue as stubCallerIdentity,i as toCascadePhase,SE as toPascalCase,sE as updateTemplateHash,ne as verbsForDriftVerdict,pE as wrapApplicationError,CE as writeStateFile};

package/dist/src/types/params.d.ts

@@ -6,7 +6,9 @@ import type { ApiClientInterface } from "./apiClient.js";
 import type { OrgConfig } from "./config/orgConfig.js";
 import type { DockerProvider } from "../orchestration/dockerInterface.js";
 import type { DomainDeployProvider } from "../orchestration/domainInterface.js";
+import type { PinRemediationReport } from "../orchestration/remediation/pinRemediation.js";
 import type { ApprovalGate, ApprovalGatePlanDetail } from "./approval.js";
+import type { DestructionConsent, DestructionConsentGate, DestructionOutcome, DestructionTicket } from "./destruction.js";
 import type { FailureAnalysis } from "@fjall/util/aws";
 import type { DockerBuildSecretRef } from "@fjall/util/manifest/schemas";
 export interface DeployParams {
@@ -76,6 +78,73 @@ export interface DeployParams {
      * the gate even when this is omitted.
      */
     approvalGate?: ApprovalGate;
+    /**
+     * Optional interactive destruction-consent resolver — the ceremony seam for
+     * the UNCONDITIONAL destruction gate (mirrors `approvalGate`'s injected-
+     * resolver mechanism). Consulted ONLY when the gate ticketed destructive
+     * rows and no `options.destructionConsents` were supplied; the returned
+     * pairs are re-evaluated engine-side (exact-match + digest TOCTOU), so the
+     * resolver can never widen consent beyond what the `--remediate` flags
+     * could. Omitted ⇒ the gate withholds fail-closed exactly as before. No
+     * flag can disengage the gate; this only changes HOW consent is obtained.
+     */
+    destructionConsentGate?: DestructionConsentGate;
+    /**
+     * The user's fjall infrastructure config source, consumed by the pin arm
+     * when a destructive change is consented with `pin`: the engine composes an
+     * edit-ready codemod against it and returns the result for surface-side
+     * write-back — the engine never writes the file. Absent (worker surfaces
+     * with no config checkout) the pin arm degrades to report-only outcomes
+     * carrying the exact config lines.
+     */
+    infrastructureSource?: InfrastructureSource;
+    /**
+     * Asked before the post-deploy database-endpoint reconcile restarts the
+     * application's ECS services (fires only when a deploy replaced the
+     * database — e.g. a snapshot restore — without also rolling a fresh image).
+     * Omitted ⇒ restart without asking: running containers are actively writing
+     * to the doomed old database, so automation surfaces (worker,
+     * non-interactive CLI) must not block on consent.
+     */
+    confirmDatabaseEndpointRestart?: (request: DatabaseEndpointRestartRequest) => Promise<boolean>;
+    /**
+     * Optional stack-boundary lease gate (§5.3). Invoked immediately before each
+     * stack's first mutating CloudFormation operation. The engine passes the
+     * stack name and the caller's shutdown signal; the resolver returns the lease
+     * verdict:
+     *   - "denied"  ⇒ the deployment's lease is gone (swept, superseded, adopted
+     *     by another runner, or force-released). The engine aborts BEFORE
+     *     starting that stack with a typed `LeaseDeniedError`; already-completed
+     *     stacks stand.
+     *   - "unknown" ⇒ the liveness probe could not reach the server. Fail OPEN
+     *     and proceed — leases are a liveness signal, not a safety gate, and
+     *     CloudFormation's own ClientRequestToken is the fencing backstop.
+     *   - "ok"      ⇒ proceed.
+     * Omitted ⇒ no gate (fully backward-compatible). The CLI wires this to the
+     * DeploymentTracker's on-demand heartbeat; the worker omits it.
+     */
+    assertLeaseForStack?: (stackName: string, abortSignal?: AbortSignal) => Promise<StackLeaseVerdict>;
+}
+/** Verdict of the stack-boundary lease gate (§5.3 heartbeat protocol). */
+export type StackLeaseVerdict = "ok" | "denied" | "unknown";
+/**
+ * The infrastructure config source handed to the pin arm — the surface that
+ * owns the config checkout supplies both halves so codemod diagnostics and
+ * the eventual write-back target the same file.
+ */
+export interface InfrastructureSource {
+    content: string;
+    filePath: string;
+}
+/**
+ * Context handed to `confirmDatabaseEndpointRestart` so an interactive
+ * surface can render what changed and what a "yes" will restart.
+ */
+export interface DatabaseEndpointRestartRequest {
+    appName: string;
+    /** Database-stack output keys whose value changed (e.g. `AppDbEndpoint`). */
+    changedOutputs: string[];
+    serviceCount: number;
 }
 export interface DeployOptions {
     /**
@@ -163,6 +232,22 @@ export interface DeployOptions {
      * validated through `DockerBuildSecretRefSchema` (CLI) before it reaches here.
      */
     flagBuildSecrets?: readonly DockerBuildSecretRef[];
+    /**
+     * Destruction-gate consents: exact, case-sensitive `{physicalName, verb}`
+     * pairs from the repeatable `--remediate <name>=<verb>` / `--allow-replace
+     * <name>` flags (or a surface's pre-authorisation). The unconditional gate
+     * fail-closes unless EVERY ticketed resource is covered; surplus, misspelt
+     * or wrong-verb consents fail closed with a verdict table. `autoApprove`,
+     * `skipConfirmation`, `force` and approval tokens never satisfy the gate.
+     */
+    destructionConsents?: readonly DestructionConsent[];
+    /**
+     * The `ticketDigest` the consents were minted against (webapp pre-auth /
+     * resumed runs). Re-verified against the digest recomputed at apply time;
+     * a mismatch fail-closes every consent (TOCTOU discipline). Flag-minted
+     * consents omit it — they are supplied at apply time by definition.
+     */
+    destructionConsentDigest?: string;
 }
 export type DeploymentType = "application" | "organisation";
 export interface DeployResult {
@@ -246,6 +331,73 @@ export interface DeployResult {
      * resume token never computed one).
      */
     planDetail?: ApprovalGatePlanDetail;
+    /**
+     * Destruction-gate: set when the unconditional gate withheld the deploy —
+     * the plan contained destructive rows without full named consent (or a
+     * consented verb has no execution arm yet). Nothing was mutated. Surfaces
+     * map this to exit code 4 (distinct from rejection/failure).
+     */
+    destructionPending?: boolean;
+    /**
+     * Destruction-gate: the ticket enumerating every destructive resource, its
+     * finding, cause and legal verbs. Present with `destructionPending`, and on
+     * an `awaitingApproval` plan-only result whose plan carries destructive
+     * rows (so a plan consumer can mint consents against `ticketDigest`).
+     */
+    destructionTicket?: DestructionTicket;
+    /**
+     * Destruction-gate: WHY the deploy was withheld. Present with
+     * `destructionPending`. Surfaces branch on this so a user who consented
+     * (`consent-not-executable`) or declined (`declined`) is never shown the
+     * generic "requires named consent" message or told to redo their consent.
+     */
+    destructionOutcome?: DestructionOutcome;
+    /**
+     * Destruction-gate: the halt/decline reason lines (identifier-only,
+     * pre-masked by construction) — e.g. "verb 'repair' is accepted vocabulary
+     * but not yet executable in this release for resource-deleted". Present
+     * with `destructionPending`; may be empty.
+     */
+    destructionHaltReasons?: string[];
+    /**
+     * Destruction-gate: a fresh approval token re-minted at withhold time for
+     * approval-gated runs, bound to the withheld run's assembly digest with the
+     * consent-ceremony TTL (`DESTRUCTION_RESUME_TTL_MS`). The original approval
+     * token's 15-minute TTL expires during a ceremony that can take hours; the
+     * consented re-queue MUST carry this token instead. Present with
+     * `destructionPending` only when the run was approval-gated. NOT a secret —
+     * digest-bound capability, same trust model as `approvalToken`.
+     */
+    destructionResumeToken?: string;
+    /**
+     * Destruction-gate: ISO expiry of `destructionResumeToken`. Present
+     * together with it.
+     */
+    destructionResumeExpiresAt?: string;
+    /**
+     * Pin arm: set when consented `pin` verb(s) ran the pre-bootstrap
+     * live-value probes and the deploy stopped for config write-back. Nothing
+     * was mutated — CloudFormation never ran. Surfaces render `pinReport` and
+     * re-run the deploy once the config change lands (the plan then carries no
+     * pinned rows). Distinct from `destructionPending` (consent withheld) —
+     * pin consent was GIVEN and its arm executed.
+     */
+    pinPending?: boolean;
+    /**
+     * Pin arm: per-resource outcomes, plus the composed `modifiedContent` when
+     * at least one target reached edit-ready. Present with `pinPending`. The
+     * surface that supplied `DeployParams.infrastructureSource` owns writing
+     * `modifiedContent` back to the config file.
+     */
+    pinReport?: PinRemediationReport;
+    /**
+     * Pin arm: count of consented NON-pin change(s) (e.g. recreate rows) the
+     * pin stop deferred — they did not run in this deploy and re-consent
+     * against the recomputed plan on the next one. Present with `pinPending`;
+     * 0 when the consent set was pure-pin. Surfaces MUST NOT claim "no
+     * --remediate needed" on the re-run when this is non-zero.
+     */
+    pinDeferredConsents?: number;
 }
 /**
  * Parameters for the destroy entry point.
@@ -283,6 +435,15 @@ export interface DestroyParams {
      * (mirrors DeployParams.abortSignal).
      */
     abortSignal?: AbortSignal;
+    /**
+     * Optional stack-boundary lease gate (§5.3) — the destroy twin of
+     * `DeployParams.assertLeaseForStack`, same resolver and verdict semantics:
+     * "denied" aborts BEFORE the stack's DeleteStack (already-destroyed stacks
+     * stand), "unknown" fails open, absent ⇒ no gate. Consulted immediately
+     * before each stack's DeleteStack; a parallel destroy group gates once on
+     * entry.
+     */
+    assertLeaseForStack?: DeployParams["assertLeaseForStack"];
 }
 export interface DestroyOptions {
     /** Skip interactive confirmation prompts */