@fjall/deploy-core 2.27.0 → 2.29.0

package/dist/src/types/remediation.d.ts

@@ -0,0 +1,126 @@
+/**
+ * The remediation-journal contract for the two-deploy `forget` orchestration
+ * and its snapshot-flip `recreate` variant (drift-remediation plan § 3.2 /
+ * Phase 7). Declared ONCE here; the CLI re-exports, never redeclares (coupled
+ * discriminated unions share a source at 2 occurrences).
+ *
+ * Phases are strictly ordered: `captured → flip-verified → flip-applied →
+ * removal-applied → done`. Every phase re-derives its precondition from live
+ * state before acting, so a lost journal degrades to correct re-detection via
+ * the in-template `fjall:forget` / `fjall:recreate` marker [G3] — the journal
+ * is the local resume record and audit trail, not the sole authority.
+ * Exception: targets advanced via the FLIPLESS fast-path (`fliplessTargets` —
+ * live policies already satisfied the flip spec, so no UpdateStack ran and no
+ * marker was stamped; 2026-07-12 live defect #5) and via the
+ * FLIPLESS-BY-NECESSITY path (`fliplessByNecessity` — the flip was
+ * structurally impossible and the target verified physically deleted; same
+ * incident, second direction) carry no AWS-side resume state — their
+ * lost-journal degradation is re-consent at the ceremony, never a silent
+ * skip.
+ */
+import { z } from "zod";
+export declare const REMEDIATION_PHASES: readonly ["captured", "flip-verified", "flip-applied", "removal-applied", "done"];
+export declare const RemediationPhaseSchema: z.ZodEnum<{
+    captured: "captured";
+    "flip-verified": "flip-verified";
+    "flip-applied": "flip-applied";
+    "removal-applied": "removal-applied";
+    done: "done";
+}>;
+export type RemediationPhase = z.infer<typeof RemediationPhaseSchema>;
+/** Ordinal comparison for phase progression checks. */
+export declare function remediationPhaseRank(phase: RemediationPhase): number;
+export declare const RemediationTargetSchema: z.ZodObject<{
+    logicalId: z.ZodString;
+    resourceType: z.ZodString;
+    physicalId: z.ZodString;
+}, z.core.$strict>;
+export type RemediationTarget = z.infer<typeof RemediationTargetSchema>;
+/**
+ * Placeholder physicalId for a target whose live physical id is unknown —
+ * an adopted foreign-op target recovered from the `fjall:forget` marker, or
+ * a confirmed finding whose membership listing could not resolve an id. The
+ * shape is structurally recognisable so probe paths can refuse to treat it
+ * as an owning-service address: probing `MyStack/MyKey` against
+ * kms:DescribeKey returns an authoritative NotFound for a resource that may
+ * be live. Coupled values, one home — every minting site routes through this
+ * builder: the CLI's journal targets, the drift-repair ticket's [G6]
+ * `physicalName` fallback (which must byte-agree with those targets so the
+ * consent covers what is operated on), and the deploy destruction ticket's
+ * unpinned-name fallback (the same resource renders on both tickets in the
+ * blocked-deploy → repair flow); deploy-core's closure probe recognises the
+ * shape via the predicate below.
+ */
+export declare function remediationPlaceholderPhysicalId(stackName: string, logicalId: string): string;
+/**
+ * True when the target's physicalId is the placeholder minted by
+ * `remediationPlaceholderPhysicalId` — never a probeable address.
+ */
+export declare function isRemediationPlaceholderPhysicalId(target: RemediationTarget, stackName: string): boolean;
+/** Proof record that the retain flip was verified metadata-only (§3.2 ph 2). */
+export declare const RemediationFlipProofSchema: z.ZodObject<{
+    diffGuardPassed: z.ZodBoolean;
+    changeSetMetadataOnly: z.ZodBoolean;
+    noChanges: z.ZodBoolean;
+    provenAt: z.ZodString;
+}, z.core.$strict>;
+export type RemediationFlipProof = z.infer<typeof RemediationFlipProofSchema>;
+/**
+ * The verbs with an orchestrated surgery arm. `forget` retains-and-abandons
+ * (converge removes the declaration); `recreate` snapshot-flips and surgically
+ * removes so the converge re-CREATEs under the same pinned name. The opId
+ * derivation deliberately excludes the verb — both orchestrators verb-guard
+ * the journal they read, failing closed on a cross-verb collision.
+ */
+export declare const RemediationVerbWithSurgerySchema: z.ZodEnum<{
+    forget: "forget";
+    recreate: "recreate";
+}>;
+export type RemediationVerbWithSurgery = z.infer<typeof RemediationVerbWithSurgerySchema>;
+export declare const RemediationJournalRecordSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    opId: z.ZodString;
+    verb: z.ZodEnum<{
+        forget: "forget";
+        recreate: "recreate";
+    }>;
+    accountId: z.ZodString;
+    region: z.ZodString;
+    stackName: z.ZodString;
+    appName: z.ZodOptional<z.ZodString>;
+    targets: z.ZodArray<z.ZodObject<{
+        logicalId: z.ZodString;
+        resourceType: z.ZodString;
+        physicalId: z.ZodString;
+    }, z.core.$strict>>;
+    phase: z.ZodEnum<{
+        captured: "captured";
+        "flip-verified": "flip-verified";
+        "flip-applied": "flip-applied";
+        "removal-applied": "removal-applied";
+        done: "done";
+    }>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    liveTemplateDigest: z.ZodOptional<z.ZodString>;
+    forensicsPath: z.ZodOptional<z.ZodString>;
+    proof: z.ZodOptional<z.ZodObject<{
+        diffGuardPassed: z.ZodBoolean;
+        changeSetMetadataOnly: z.ZodBoolean;
+        noChanges: z.ZodBoolean;
+        provenAt: z.ZodString;
+    }, z.core.$strict>>;
+    consentedPhysicalNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    retainedByRedeclaration: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    fliplessTargets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    fliplessByNecessity: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    recreatedResources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    snapshotPolicies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        Snapshot: "Snapshot";
+        Delete: "Delete";
+    }>>>;
+    orphanedResources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    unverifiedRemovals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    completedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type RemediationJournalRecord = z.infer<typeof RemediationJournalRecordSchema>;

package/dist/src/types/remediation.js

@@ -0,0 +1 @@
+import{z as e}from"zod";const t=["captured","flip-verified","flip-applied","removal-applied","done"],r=e.enum(t);function p(i){return t.indexOf(i)}const o=e.object({logicalId:e.string().min(1),resourceType:e.string().min(1),physicalId:e.string().min(1)}).strict();function a(i,n){return`${i}/${n}`}function m(i,n){return i.physicalId===a(n,i.logicalId)}const s=e.object({diffGuardPassed:e.boolean(),changeSetMetadataOnly:e.boolean(),noChanges:e.boolean(),provenAt:e.string().min(1)}).strict(),l=e.enum(["forget","recreate"]),d=e.object({version:e.literal(1),opId:e.string().min(1),verb:l,accountId:e.string().min(1),region:e.string().min(1),stackName:e.string().min(1),appName:e.string().min(1).optional(),targets:e.array(o).min(1),phase:r,createdAt:e.string().min(1),updatedAt:e.string().min(1),liveTemplateDigest:e.string().min(1).optional(),forensicsPath:e.string().min(1).optional(),proof:s.optional(),consentedPhysicalNames:e.array(e.string()).optional(),retainedByRedeclaration:e.array(e.string().min(1)).optional(),fliplessTargets:e.array(e.string().min(1)).optional(),fliplessByNecessity:e.array(e.string().min(1)).optional(),recreatedResources:e.array(e.string().min(1)).optional(),snapshotPolicies:e.record(e.string().min(1),e.enum(["Snapshot","Delete"])).optional(),orphanedResources:e.array(e.string().min(1)).optional(),unverifiedRemovals:e.array(e.string().min(1)).optional(),completedAt:e.string().min(1).optional()}).strict();export{t as REMEDIATION_PHASES,s as RemediationFlipProofSchema,d as RemediationJournalRecordSchema,r as RemediationPhaseSchema,o as RemediationTargetSchema,l as RemediationVerbWithSurgerySchema,m as isRemediationPlaceholderPhysicalId,p as remediationPhaseRank,a as remediationPlaceholderPhysicalId};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "2.27.0",
+  "version": "2.29.0",
   "description": "Shared deployment engine for Fjall — used by CLI and webapp worker",
   "type": "module",
   "main": "dist/src/index.js",
@@ -76,14 +76,15 @@
     "@aws-sdk/client-kms": "^3.1065.0",
     "@aws-sdk/client-organizations": "^3.1038.0",
     "@aws-sdk/client-ram": "^3.1038.0",
+    "@aws-sdk/client-rds": "^3.1038.0",
     "@aws-sdk/client-s3": "^3.1038.0",
     "@aws-sdk/client-secrets-manager": "^3.1038.0",
     "@aws-sdk/client-sqs": "^3.1067.0",
     "@aws-sdk/client-ssm": "^3.1038.0",
     "@aws-sdk/client-sso-admin": "^3.1038.0",
     "@aws-sdk/client-sts": "^3.1038.0",
-    "@fjall/generator": "^2.27.0",
-    "@fjall/util": "^2.27.0",
+    "@fjall/generator": "^2.29.0",
+    "@fjall/util": "^2.29.0",
     "@smithy/node-http-handler": "^4.6.1",
     "aws-cdk": "^2.1128.1",
     "tsx": "^4.21.0",
@@ -94,5 +95,5 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.5"
   },
-  "gitHead": "921ecd4f65f52c17037a8a24834d7e4c196b9347"
+  "gitHead": "c40ea0e1435400f3f42faaad5bcbf50e4400c1d4"
 }