@fjall/deploy-core 2.27.0 → 2.30.0

package/dist/src/types/deploymentEventSchema.js

@@ -1 +1 @@
-import{z as e}from"zod";import{TRAIL_MIGRATION_PHASES as r,TRAIL_MIGRATION_STATUSES as i}from"./events.js";const c=["security","network","compute","database","storage","monitoring","dns","identity","bootstrap","events","registry","backup"],n=["platform","domains","accounts"],m=["started","deploying","completed","failed"],l=2048,p=4096,u=2048,g=["step","resource","docker","ecs","error","complete","cascade_phase","cascade_account","cascade_missing_accounts","parallel_phase","detection","trail_migration","log"],d={step:"step",resource:"resource",docker:"docker",ecs:"ecs",error:"error",complete:null,cascade_phase:"cascadePhase",cascade_account:"cascadeAccount",cascade_missing_accounts:"cascadeMissingAccounts",parallel_phase:"parallelPhase",detection:"detection",trail_migration:"trailMigration",log:"log"},_=e.object({type:e.enum(g),timestamp:e.string().max(64),sequence:e.number().int().nonnegative().optional(),step:e.object({id:e.string().max(256),name:e.string().max(256),index:e.number(),total:e.number(),status:e.string().max(64)}).strict().optional(),resource:e.object({logicalId:e.string().max(256),resourceType:e.string().max(256),category:e.enum(c),group:e.string().max(128).optional(),constructPath:e.string().max(512).optional(),displayName:e.string().max(256),status:e.string().max(64),statusReason:e.string().max(l).optional(),physicalId:e.string().max(2048).optional(),expectedDurationSeconds:e.number().optional(),stack:e.string().max(256).optional()}).strict().optional(),docker:e.object({message:e.string().max(2048),percentage:e.number().optional()}).strict().optional(),ecs:e.object({status:e.string().max(64),message:e.string().max(2048).optional(),percentage:e.number().optional()}).strict().optional(),error:e.object({message:e.string().max(p),category:e.string().max(128).optional(),remediation:e.array(e.string().max(1024)).max(10).optional()}).strict().optional(),message:e.string().max(2048).optional(),cascadePhase:e.object({phase:e.enum(n),status:e.enum(["started","completed"])}).strict().optional(),cascadeAccount:e.object({accountId:e.string().max(32),region:e.string().max(32),operationKey:e.string().max(256),status:e.enum(m),error:e.string().max(2048).optional(),phase:e.enum(["bootstrap","synth","deploy","destroy"]).optional(),cascadePhase:e.enum(n).optional()}).strict().optional(),cascadeMissingAccounts:e.object({accountNames:e.array(e.string().max(256)).max(256)}).strict().optional(),parallelPhase:e.object({stacks:e.array(e.string().max(256)).max(20),status:e.enum(["started","completed"]),results:e.array(e.object({stack:e.string().max(256),success:e.boolean(),error:e.string().max(2048).optional()}).strict()).max(20).optional()}).strict().optional(),detection:e.object({pattern:e.string().max(128).nullable(),hasDockerfile:e.boolean(),hasDifferences:e.boolean(),resources:e.object({hasNetwork:e.boolean(),hasCompute:e.boolean(),hasDatabase:e.boolean(),hasStorage:e.boolean(),hasMessaging:e.boolean(),hasCdn:e.boolean()}).strict(),requiredSecrets:e.array(e.string().max(512)).max(100).optional()}).strict().optional(),trailMigration:e.object({accountId:e.string().max(32),accountName:e.string().max(256),phase:e.enum(r),status:e.enum(i),detail:e.string().max(u).optional()}).strict().optional(),log:e.object({message:e.string().max(2048),level:e.enum(["info","debug","warn"])}).strict().optional()}).strict().superRefine((t,o)=>{const a=d[t.type],s=a?t[a]:void 0;a&&s==null&&o.addIssue({code:e.ZodIssueCode.custom,message:`"${a}" is required when type is "${t.type}"`,path:[a]}),t.type==="complete"&&!t.message&&o.addIssue({code:e.ZodIssueCode.custom,message:'"message" is required when type is "complete"',path:["message"]})});function b(t){if(t==="platform")return"platform";if(t==="account")return"accounts"}export{m as CASCADE_ACCOUNT_STATUSES,n as CASCADE_PHASES,p as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,l as DEPLOYMENT_EVENT_STATUS_REASON_MAX,u as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,g as DEPLOYMENT_EVENT_TYPES,_ as DeploymentEventSchema,b as toCascadePhase};
+import{z as e}from"zod";import{TRAIL_MIGRATION_PHASES as r,TRAIL_MIGRATION_STATUSES as i}from"./events.js";const c=["security","network","compute","database","storage","monitoring","dns","identity","bootstrap","events","registry","backup"],n=["platform","domains","accounts"],m=["started","deploying","completed","failed"],l=2048,p=4096,u=2048,g=["step","resource","docker","ecs","error","complete","cascade_phase","cascade_account","cascade_missing_accounts","parallel_phase","detection","trail_migration","log"],d={step:"step",resource:"resource",docker:"docker",ecs:"ecs",error:"error",complete:null,cascade_phase:"cascadePhase",cascade_account:"cascadeAccount",cascade_missing_accounts:"cascadeMissingAccounts",parallel_phase:"parallelPhase",detection:"detection",trail_migration:"trailMigration",log:"log"},_=e.object({type:e.enum(g),timestamp:e.string().max(64),sequence:e.number().int().nonnegative().optional(),step:e.object({id:e.string().max(256),name:e.string().max(256),index:e.number(),total:e.number(),status:e.string().max(64)}).strict().optional(),resource:e.object({logicalId:e.string().max(256),resourceType:e.string().max(256),category:e.enum(c),group:e.string().max(128).optional(),constructPath:e.string().max(512).optional(),displayName:e.string().max(256),status:e.string().max(64),statusReason:e.string().max(l).optional(),physicalId:e.string().max(2048).optional(),expectedDurationSeconds:e.number().optional(),stack:e.string().max(256).optional(),clientRequestToken:e.string().max(256).optional()}).strict().optional(),docker:e.object({message:e.string().max(2048),percentage:e.number().optional()}).strict().optional(),ecs:e.object({status:e.string().max(64),message:e.string().max(2048).optional(),percentage:e.number().optional()}).strict().optional(),error:e.object({message:e.string().max(p),category:e.string().max(128).optional(),remediation:e.array(e.string().max(1024)).max(10).optional()}).strict().optional(),message:e.string().max(2048).optional(),cascadePhase:e.object({phase:e.enum(n),status:e.enum(["started","completed"])}).strict().optional(),cascadeAccount:e.object({accountId:e.string().max(32),region:e.string().max(32),operationKey:e.string().max(256),status:e.enum(m),error:e.string().max(2048).optional(),phase:e.enum(["bootstrap","synth","deploy","destroy"]).optional(),cascadePhase:e.enum(n).optional()}).strict().optional(),cascadeMissingAccounts:e.object({accountNames:e.array(e.string().max(256)).max(256)}).strict().optional(),parallelPhase:e.object({stacks:e.array(e.string().max(256)).max(20),status:e.enum(["started","completed"]),results:e.array(e.object({stack:e.string().max(256),success:e.boolean(),error:e.string().max(2048).optional()}).strict()).max(20).optional()}).strict().optional(),detection:e.object({pattern:e.string().max(128).nullable(),hasDockerfile:e.boolean(),hasDifferences:e.boolean(),resources:e.object({hasNetwork:e.boolean(),hasCompute:e.boolean(),hasDatabase:e.boolean(),hasStorage:e.boolean(),hasMessaging:e.boolean(),hasCdn:e.boolean()}).strict(),requiredSecrets:e.array(e.string().max(512)).max(100).optional()}).strict().optional(),trailMigration:e.object({accountId:e.string().max(32),accountName:e.string().max(256),phase:e.enum(r),status:e.enum(i),detail:e.string().max(u).optional()}).strict().optional(),log:e.object({message:e.string().max(2048),level:e.enum(["info","debug","warn"])}).strict().optional()}).strict().superRefine((t,o)=>{const a=d[t.type],s=a?t[a]:void 0;a&&s==null&&o.addIssue({code:e.ZodIssueCode.custom,message:`"${a}" is required when type is "${t.type}"`,path:[a]}),t.type==="complete"&&!t.message&&o.addIssue({code:e.ZodIssueCode.custom,message:'"message" is required when type is "complete"',path:["message"]})});function b(t){if(t==="platform")return"platform";if(t==="account")return"accounts"}export{m as CASCADE_ACCOUNT_STATUSES,n as CASCADE_PHASES,p as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,c as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,l as DEPLOYMENT_EVENT_STATUS_REASON_MAX,u as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,g as DEPLOYMENT_EVENT_TYPES,_ as DeploymentEventSchema,b as toCascadePhase};

package/dist/src/types/destruction.d.ts

@@ -0,0 +1,212 @@
+/**
+ * The destruction-ticket contract — the single cross-surface shape for the
+ * unconditional destruction gate (drift-remediation plan § 4.1). Declared ONCE
+ * here; the CLI and webapp re-export, never redeclare (coupled discriminated
+ * unions share a source at 2 occurrences).
+ *
+ * Consent semantics: exact, case-sensitive `{physicalName, verb}` pairs. No
+ * blanket flag exists or will exist — `autoApprove`, `skipConfirmation`,
+ * `force`, and approval tokens NEVER satisfy the gate.
+ */
+import { z } from "zod";
+export declare const RemediationVerbSchema: z.ZodEnum<{
+    abort: "abort";
+    forget: "forget";
+    recreate: "recreate";
+    pin: "pin";
+    repair: "repair";
+}>;
+export type RemediationVerb = z.infer<typeof RemediationVerbSchema>;
+/**
+ * Canonical one-line meaning per verb (plan § 3) — the SSoT gloss every
+ * surface renders (coupled values, one home): the interactive ceremony's verb
+ * menu and the drift surface's verb list consume THIS record, never local
+ * prose. Exhaustive over the schema-derived union, so a verb addition fails
+ * typecheck here. Context-neutral wording — the same line must read correctly
+ * as a menu consequence and as a `verb (gloss)` parenthetical.
+ */
+export declare const REMEDIATION_VERB_GLOSS: Readonly<Record<RemediationVerb, string>>;
+export declare const DESTRUCTION_FINDINGS: readonly ["replacement-required", "pinned-name-replacement", "resource-deleted", "stack-deleted", "data-loss-delete"];
+export declare const DestructionFindingSchema: z.ZodEnum<{
+    "replacement-required": "replacement-required";
+    "pinned-name-replacement": "pinned-name-replacement";
+    "resource-deleted": "resource-deleted";
+    "stack-deleted": "stack-deleted";
+    "data-loss-delete": "data-loss-delete";
+}>;
+export type DestructionFinding = z.infer<typeof DestructionFindingSchema>;
+/**
+ * Ticket verdict provenance = the plan's replacement-verdict sources plus
+ * `drift-probe` (a resource-deleted row proven by a direct NotFound from the
+ * owning service — Phase 6 drift-repair tickets). Deliberately a superset:
+ * plan rows never claim `drift-probe`, and the plan union must not widen.
+ */
+export declare const TICKET_VERDICT_SOURCES: readonly ["registry", "registry (change-set unverified)", "change-set", "cdk-spec (unverified)", "drift-probe"];
+export declare const TicketVerdictSourceSchema: z.ZodEnum<{
+    registry: "registry";
+    "registry (change-set unverified)": "registry (change-set unverified)";
+    "change-set": "change-set";
+    "cdk-spec (unverified)": "cdk-spec (unverified)";
+    "drift-probe": "drift-probe";
+}>;
+export type TicketVerdictSource = z.infer<typeof TicketVerdictSourceSchema>;
+export declare const DestructionTicketResourceSchema: z.ZodObject<{
+    stack: z.ZodString;
+    logicalId: z.ZodString;
+    resourceType: z.ZodString;
+    physicalName: z.ZodString;
+    finding: z.ZodEnum<{
+        "replacement-required": "replacement-required";
+        "pinned-name-replacement": "pinned-name-replacement";
+        "resource-deleted": "resource-deleted";
+        "stack-deleted": "stack-deleted";
+        "data-loss-delete": "data-loss-delete";
+    }>;
+    cause: z.ZodString;
+    offendingProperties: z.ZodArray<z.ZodString>;
+    verdictSource: z.ZodEnum<{
+        registry: "registry";
+        "registry (change-set unverified)": "registry (change-set unverified)";
+        "change-set": "change-set";
+        "cdk-spec (unverified)": "cdk-spec (unverified)";
+        "drift-probe": "drift-probe";
+    }>;
+    dataLossRisk: z.ZodBoolean;
+    verbs: z.ZodArray<z.ZodEnum<{
+        abort: "abort";
+        forget: "forget";
+        recreate: "recreate";
+        pin: "pin";
+        repair: "repair";
+    }>>;
+}, z.core.$strict>;
+export type DestructionTicketResource = z.infer<typeof DestructionTicketResourceSchema>;
+export declare const DestructionTicketSchema: z.ZodObject<{
+    ticketDigest: z.ZodString;
+    resources: z.ZodArray<z.ZodObject<{
+        stack: z.ZodString;
+        logicalId: z.ZodString;
+        resourceType: z.ZodString;
+        physicalName: z.ZodString;
+        finding: z.ZodEnum<{
+            "replacement-required": "replacement-required";
+            "pinned-name-replacement": "pinned-name-replacement";
+            "resource-deleted": "resource-deleted";
+            "stack-deleted": "stack-deleted";
+            "data-loss-delete": "data-loss-delete";
+        }>;
+        cause: z.ZodString;
+        offendingProperties: z.ZodArray<z.ZodString>;
+        verdictSource: z.ZodEnum<{
+            registry: "registry";
+            "registry (change-set unverified)": "registry (change-set unverified)";
+            "change-set": "change-set";
+            "cdk-spec (unverified)": "cdk-spec (unverified)";
+            "drift-probe": "drift-probe";
+        }>;
+        dataLossRisk: z.ZodBoolean;
+        verbs: z.ZodArray<z.ZodEnum<{
+            abort: "abort";
+            forget: "forget";
+            recreate: "recreate";
+            pin: "pin";
+            repair: "repair";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DestructionTicket = z.infer<typeof DestructionTicketSchema>;
+/** One named consent: the exact physical name plus the chosen verb. */
+export declare const DestructionConsentSchema: z.ZodObject<{
+    physicalName: z.ZodString;
+    verb: z.ZodEnum<{
+        abort: "abort";
+        forget: "forget";
+        recreate: "recreate";
+        pin: "pin";
+        repair: "repair";
+    }>;
+}, z.core.$strict>;
+export type DestructionConsent = z.infer<typeof DestructionConsentSchema>;
+/**
+ * Per-consent verdicts for the fail-closed report ([G6]): a consent either
+ * matched a pending resource with a legal verb, named a resource the ticket
+ * does not contain (surplus / misspelt — fail closed, never ignored), or
+ * named a real resource with an illegal verb.
+ */
+export declare const CONSENT_VERDICTS: readonly ["matched", "unmatched", "wrong-verb"];
+export type ConsentVerdict = (typeof CONSENT_VERDICTS)[number];
+export interface ConsentVerdictRow {
+    physicalName: string;
+    verb: RemediationVerb;
+    verdict: ConsentVerdict;
+    /** Human detail for non-matched rows (e.g. the legal verbs). */
+    detail?: string;
+}
+/** The full consent evaluation — rendered as the per-name verdict table. */
+export interface DestructionConsentReport {
+    /** One row per supplied consent, in supply order. */
+    rows: ConsentVerdictRow[];
+    /** Ticket physical names no consent covered. */
+    uncovered: string[];
+    /**
+     * Consents were minted against a different ticket digest (the plan changed
+     * between mint and apply) — every consent is treated as stale (TOCTOU).
+     */
+    digestMismatch: boolean;
+    /** On mismatch: the digest the consents were minted against. */
+    suppliedDigest?: string;
+    /** On mismatch: what the pending destructive changes digest to now. */
+    currentDigest?: string;
+    /** True only when every resource is covered by a matched consent. */
+    satisfied: boolean;
+}
+/**
+ * WHY the gate withheld — the structured outcome every surface branches on so
+ * a user who completed the ceremony is never told to consent again:
+ *   - `awaiting-consent`        — no consents were supplied at all
+ *   - `declined`                — the interactive ceremony was declined, or an
+ *                                 abort verb was consented (operator withhold)
+ *   - `consents-invalid`        — consents were supplied but failed evaluation
+ *                                 (mismatch, wrong verb, uncovered, stale digest)
+ *   - `consent-not-executable`  — consents fully satisfied the ticket, but a
+ *                                 consented verb has no execution arm in this
+ *                                 release (truthful withhold, reasons name it)
+ */
+export declare const DestructionOutcomeSchema: z.ZodEnum<{
+    "awaiting-consent": "awaiting-consent";
+    declined: "declined";
+    "consents-invalid": "consents-invalid";
+    "consent-not-executable": "consent-not-executable";
+}>;
+export type DestructionOutcome = z.infer<typeof DestructionOutcomeSchema>;
+/** What the interactive ceremony is asked to resolve. */
+export interface DestructionConsentRequest {
+    target: string;
+    ticket: DestructionTicket;
+}
+/**
+ * The ceremony's answer: resolved consent pairs bound to the digest of the
+ * ticket the user actually saw, or an abort (decline). The pairs are
+ * re-evaluated engine-side against the live ticket — the resolution can never
+ * widen consent beyond what the `--remediate` flags could express.
+ */
+export type DestructionConsentResolution = {
+    kind: "consents";
+    consents: readonly DestructionConsent[];
+    /** Digest of the ticket the ceremony displayed (TOCTOU binding). */
+    ticketDigest: string;
+} | {
+    kind: "abort";
+};
+/**
+ * Interactive destruction-consent resolver — the injected-resolver mirror of
+ * the approval gate's `ApprovalGate` (types/approval.ts), for the
+ * UNCONDITIONAL destruction gate. Consent EVALUATION stays engine-side: the
+ * resolved pairs feed the same `evaluateDestructionConsents` + ticket-digest
+ * TOCTOU path the `--remediate` flags use, so a typed name that does not
+ * exactly match is rejected by the engine regardless of what the surface
+ * validated. Omitting the resolver leaves the gate fail-closed (withheld).
+ */
+export interface DestructionConsentGate {
+    resolve(request: DestructionConsentRequest): Promise<DestructionConsentResolution>;
+}

package/dist/src/types/destruction.js

@@ -0,0 +1 @@
+import{z as e}from"zod";import{REPLACEMENT_VERDICT_SOURCES as r}from"../orchestration/application/plan/types.js";const t=e.enum(["abort","pin","recreate","forget","repair"]),u={abort:"stop here \u2014 nothing is changed",pin:"accept the live value into your fjall config so the change disappears; non-destructive",recreate:"accept a new physical resource under this name \u2014 data survives only via snapshot or backup (none if the resource is already deleted and no backup exists)",forget:"stop managing the resource \u2014 the physical resource is never touched",repair:"report-only: forensics plus a manual runbook, nothing is mutated"},n=["replacement-required","pinned-name-replacement","resource-deleted","stack-deleted","data-loss-delete"],o=e.enum(n),c=[...r,"drift-probe"],s=e.enum(c),a=e.object({stack:e.string(),logicalId:e.string(),resourceType:e.string(),physicalName:e.string(),finding:o,cause:e.string(),offendingProperties:e.array(e.string()),verdictSource:s,dataLossRisk:e.boolean(),verbs:e.array(t)}).strict(),d=e.object({ticketDigest:e.string(),resources:e.array(a)}).strict(),m=e.object({physicalName:e.string().min(1,"Consent physical name cannot be empty"),verb:t}).strict(),h=["matched","unmatched","wrong-verb"],l=e.enum(["awaiting-consent","declined","consents-invalid","consent-not-executable"]);export{h as CONSENT_VERDICTS,n as DESTRUCTION_FINDINGS,m as DestructionConsentSchema,o as DestructionFindingSchema,l as DestructionOutcomeSchema,a as DestructionTicketResourceSchema,d as DestructionTicketSchema,u as REMEDIATION_VERB_GLOSS,t as RemediationVerbSchema,c as TICKET_VERDICT_SOURCES,s as TicketVerdictSourceSchema};

package/dist/src/types/detection/patternTypes.d.ts

@@ -4,10 +4,16 @@
  * These are safe for browser bundles. Filesystem-based detection functions
  * remain in patternDetection.ts.
  */
-declare const OPENNEXT_PATTERNS_ARRAY: readonly ["payload", "nextjs"];
-export type OpenNextPattern = (typeof OPENNEXT_PATTERNS_ARRAY)[number];
+import { isOpenNextPatternType, type OpenNextPatternType } from "@fjall/util/patterns";
+/**
+ * The OpenNext accept-set is derived from `PATTERN_REGISTRY` in `@fjall/util`:
+ * a pattern is OpenNext-shaped iff its declared artefact is an OpenNext Lambda
+ * bundle. Re-listing the members here is how `staticsite` would silently join
+ * the OpenNext build path.
+ */
+export type OpenNextPattern = OpenNextPatternType;
 export declare const OPENNEXT_PATTERNS: ReadonlySet<string>;
-export declare function isOpenNextPattern(pattern: string | undefined | null): pattern is OpenNextPattern;
+export declare const isOpenNextPattern: typeof isOpenNextPatternType;
 export interface AppResourceFlags {
     hasNetwork: boolean;
     hasCompute: boolean;
@@ -16,4 +22,3 @@ export interface AppResourceFlags {
     hasMessaging: boolean;
     hasCdn: boolean;
 }
-export {};

package/dist/src/types/detection/patternTypes.js

@@ -1 +1 @@
-const e=["payload","nextjs"],t=new Set(e);function N(n){return n!=null&&t.has(n)}export{t as OPENNEXT_PATTERNS,N as isOpenNextPattern};
+import{OPENNEXT_PATTERN_TYPES as t,isOpenNextPatternType as e}from"@fjall/util/patterns";const T=new Set(t),n=e;export{T as OPENNEXT_PATTERNS,n as isOpenNextPattern};

package/dist/src/types/drift.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The Class 1 drift contract — out-of-band-deletion suspects, probe verdicts
+ * and the persisted suspect journal (drift-remediation plan § Phase 5).
+ * Declared ONCE here; the CLI re-exports, never redeclares (coupled
+ * discriminated unions share a source at 2 occurrences).
+ *
+ * Verdict semantics are fail-closed: only an authoritative NotFound from the
+ * service that owns the resource yields `confirmed-deleted`. Every other
+ * probe outcome (throttle, AccessDenied, network failure) stays `unconfirmed`
+ * and presentation is repair-only — no destructive verbs.
+ */
+import { z } from "zod";
+import { type RemediationVerb } from "./destruction.js";
+export declare const DRIFT_VERDICTS: readonly ["confirmed-deleted", "present", "unconfirmed", "stack-missing"];
+export declare const DriftVerdictSchema: z.ZodEnum<{
+    "confirmed-deleted": "confirmed-deleted";
+    present: "present";
+    unconfirmed: "unconfirmed";
+    "stack-missing": "stack-missing";
+}>;
+export type DriftVerdict = z.infer<typeof DriftVerdictSchema>;
+export declare const DriftSuspectSchema: z.ZodObject<{
+    stackName: z.ZodString;
+    logicalId: z.ZodString;
+    resourceType: z.ZodString;
+    physicalId: z.ZodOptional<z.ZodString>;
+    failedStatus: z.ZodString;
+    statusReason: z.ZodString;
+}, z.core.$strict>;
+export type DriftSuspect = z.infer<typeof DriftSuspectSchema>;
+export declare const DriftFindingSchema: z.ZodObject<{
+    verdict: z.ZodEnum<{
+        "confirmed-deleted": "confirmed-deleted";
+        present: "present";
+        unconfirmed: "unconfirmed";
+        "stack-missing": "stack-missing";
+    }>;
+    verdictDetail: z.ZodString;
+    probeMethod: z.ZodString;
+    verbs: z.ZodArray<z.ZodEnum<{
+        abort: "abort";
+        forget: "forget";
+        recreate: "recreate";
+        pin: "pin";
+        repair: "repair";
+    }>>;
+    stackName: z.ZodString;
+    logicalId: z.ZodString;
+    resourceType: z.ZodString;
+    physicalId: z.ZodOptional<z.ZodString>;
+    failedStatus: z.ZodString;
+    statusReason: z.ZodString;
+}, z.core.$strict>;
+export type DriftFinding = z.infer<typeof DriftFindingSchema>;
+/** Legal verbs per verdict — single source for CLI presentation. */
+export declare function verbsForDriftVerdict(verdict: DriftVerdict): RemediationVerb[];
+export declare const DriftJournalRecordSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    accountId: z.ZodString;
+    region: z.ZodString;
+    stackName: z.ZodString;
+    recordedAt: z.ZodString;
+    suspects: z.ZodArray<z.ZodObject<{
+        stackName: z.ZodString;
+        logicalId: z.ZodString;
+        resourceType: z.ZodString;
+        physicalId: z.ZodOptional<z.ZodString>;
+        failedStatus: z.ZodString;
+        statusReason: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DriftJournalRecord = z.infer<typeof DriftJournalRecordSchema>;

package/dist/src/types/drift.js

@@ -0,0 +1 @@
+import{z as t}from"zod";import{RemediationVerbSchema as i}from"./destruction.js";const n=["confirmed-deleted","present","unconfirmed","stack-missing"],s=t.enum(n),e=t.object({stackName:t.string().min(1),logicalId:t.string().min(1),resourceType:t.string().min(1),physicalId:t.string().min(1).optional(),failedStatus:t.string().min(1),statusReason:t.string()}).strict(),a=t.object({...e.shape,verdict:s,verdictDetail:t.string(),probeMethod:t.string(),verbs:t.array(i)}).strict();function m(r){switch(r){case"confirmed-deleted":return["forget","recreate"];case"present":return[];case"unconfirmed":case"stack-missing":return["repair"]}}const d=t.object({version:t.literal(1),accountId:t.string().min(1),region:t.string().min(1),stackName:t.string().min(1),recordedAt:t.string().min(1),suspects:t.array(e)}).strict();export{n as DRIFT_VERDICTS,a as DriftFindingSchema,d as DriftJournalRecordSchema,e as DriftSuspectSchema,s as DriftVerdictSchema,m as verbsForDriftVerdict};

package/dist/src/types/frameworkBuilder.d.ts

@@ -40,6 +40,13 @@ export interface BuildPlan {
     readonly buildCommand: BuildCommand | null;
     /** Whether this plan requires a Docker build (standard apps with Dockerfile) */
     readonly requiresDockerBuild: boolean;
+    /**
+     * Directory the build must produce, relative to the build command's `cwd`.
+     * Verified to exist after `build()` completes. Set by builders whose artefacts
+     * are uploaded to a bucket rather than containerised (static sites); the
+     * Docker/OpenNext builders leave it undefined.
+     */
+    readonly artefactDir?: string;
     /** Infrastructure requirements */
     readonly resources: AppResourceFlags;
 }
@@ -71,6 +78,13 @@ export interface BuildOptions {
     readonly skipBuild?: boolean;
     /** Only deploy infrastructure, skip application build */
     readonly infraOnly?: boolean;
+    /**
+     * The deploy's cancellation signal (`DeployParams.abortSignal` — Ctrl-C, or
+     * `fjall deployments cancel`). A build can run for minutes; without the
+     * signal a cancelled deploy has no way to reach the child process and waits
+     * out the full build timeout before noticing.
+     */
+    readonly abortSignal?: AbortSignal;
 }
 /** The FrameworkBuilder interface — detect/plan/build lifecycle */
 export interface FrameworkBuilder {

package/dist/src/types/index.d.ts

@@ -1,7 +1,43 @@
+/**
+ * `@fjall/deploy-core/types` — the BROWSER-SAFE type/schema barrel.
+ *
+ * INVARIANT: nothing re-exported here may ACCESS a Node builtin at MODULE-EVAL.
+ * The webapp imports this subpath from CLIENT-reachable modules (e.g.
+ * `app/types/approval-plan.ts`, `app/types/destruction-consent.ts`); Vite's dev
+ * esbuild bundles the whole barrel without tree-shaking and stubs each Node
+ * builtin with a shim that THROWS ON ACCESS, killing React hydration app-wide in
+ * dev — while prod Rollup tree-shakes the unused module out, so CI stays green
+ * and the breakage is invisible to CI (the 2026-07-07 incident). Two shapes trip
+ * the eval-time access: a NAMED builtin import (`import { readFileSync } from
+ * "fs"`) binds to the throwing shim at link time, and a top-level builtin call
+ * (`readFileSync(...)` at module scope) calls it immediately. A bare NAMESPACE
+ * import (`import * as fs from "fs"`) used only inside functions does NOT trip it
+ * — the shim is never accessed at eval.
+ *
+ * deploy-core's OWN re-exported modules are kept fully Node-builtin-free: the
+ * fs-based helpers (`deriveResourcesFromManifestStacks` with its named `fs`
+ * import; the FjallState IO functions with named `fs`/`crypto`) — the two
+ * modules that tripped the 2026-07-07 incident — are NOT re-exported here. Their
+ * server-only consumers import them straight from the LEAF modules
+ * (`./detection/patternDetection.js`, `./config/FjallState.js`) and the ROOT
+ * barrel (`../index.js`) re-exports them — never from here.
+ *
+ * One TOLERATED cross-package builtin edge: `deployEvent.js` imports the static
+ * const `TRAIL_LIFECYCLE_STATES` from `@fjall/util/config`, which carries
+ * `import * as fs`/`import * as path` used ONLY inside functions. That is
+ * import-safe (verified: esbuild-bundle this barrel for the browser with a
+ * throw-on-access builtin stub → importing it does not throw). FRAGILE: if
+ * `config.js` ever adds a top-level fs/path call or a named builtin import, this
+ * barrel breaks — `TRAIL_LIFECYCLE_STATES` should then move to a genuinely
+ * builtin-free `@fjall/util` module. Before adding a re-export here, prefer a
+ * Node-builtin-free module; if it transitively pulls a builtin, that builtin
+ * MUST be a namespace import never accessed at eval (`import type` is always
+ * fine — it is erased).
+ */
 export { DeploymentEventSchema, DEPLOYMENT_EVENT_TYPES, DEPLOYMENT_EVENT_RESOURCE_CATEGORIES, DEPLOYMENT_EVENT_STATUS_REASON_MAX, DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX, DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX, CASCADE_PHASES, CASCADE_ACCOUNT_STATUSES, toCascadePhase } from "./deploymentEventSchema.js";
 export type { DeploymentEvent, DeploymentEventType, DeploymentEventResourceCategory, DeploymentEventCascadePhase, DeploymentEventCascadeAccountStatus } from "./deploymentEventSchema.js";
 export type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter } from "./credentials.js";
-export type { DeployCallbacks, StepCompleteStatus, StackCleanupPhase, CascadeAccountPhase, LogLevel, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail } from "./callbacks.js";
+export type { DeployCallbacks, StepCompleteStatus, StackCleanupPhase, CascadeAccountPhase, LogLevel, StackCleanupQuarantineDetail, StackCleanupRetainedBucketsDetail, StackTarget } from "./callbacks.js";
 export { isQuarantineDetail, isRetainedBucketsDetail } from "./callbacks.js";
 export { DeployEventSchema, StepProgressSchema, DeployResourceSchema, PlanChangeSchema, PlanPropertyChangeSchema, ChangeCountsSchema, DEPLOY_EVENT_CONTRACT, DEPLOY_EVENT_CONTRACT_MAJOR, DEPLOY_EVENT_CONTRACT_MINOR, SUPPORTED_CONTRACT_MARKERS, DEPLOY_EVENT_ID_MAX, DEPLOY_EVENT_NAME_MAX, DEPLOY_EVENT_MESSAGE_MAX, DEPLOY_EVENT_STATUS_REASON_MAX, DEPLOY_EVENT_ERROR_MESSAGE_MAX, DEPLOY_EVENT_TRAIL_DETAIL_MAX, DEPLOY_EVENT_OUTPUT_MAX, DEPLOY_EVENT_ARN_MAX, DEPLOY_EVENT_URL_MAX, STEP_COMPLETE_STATUSES, LOG_LEVELS, STACK_CLEANUP_PHASES, CASCADE_ACCOUNT_PHASES, DEPLOY_RESULTS, DETECTION_PHASES, PHASE_STATUSES, BUILDERS, CASCADE_OUTCOME_RESULTS, PLAN_ACTIONS, REPLACEMENT_MODES, APPROVAL_KINDS, APPROVAL_DECISIONS, ALL_PROGRESS_KINDS } from "./deployEvent.js";
 export type { DeployEvent, ProgressKind, StepProgress, DeployResource, PlanChange, PlanPropertyChange, ChangeCounts, PlanAction, ReplacementMode, ApprovalKind, ApprovalDecision, DeployRunResult } from "./deployEvent.js";
@@ -10,8 +46,14 @@ export { parseDeployEvent, parseDeployContractVersion, type ParsedDeployEvent }
 export type { ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, BuildPushStartEvent, BuildPushProgressEvent, BuildPushCompleteEvent, TaskDefRegisteredEvent, ECSCompleteEvent, MigrationsStartEvent, MigrationsCompleteEvent, TrailMigrationPhase, TrailMigrationStatus, TrailMigrationPhaseEvent } from "./events.js";
 export { TRAIL_MIGRATION_PHASES, TRAIL_MIGRATION_STATUSES } from "./events.js";
 export type { ApiClientInterface, EntitlementsData } from "./apiClient.js";
-export type { DeployParams, DeployOptions, DatabaseEndpointRestartRequest, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult } from "./params.js";
+export type { DeployParams, DeployOptions, DatabaseEndpointRestartRequest, InfrastructureSource, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, StackLeaseVerdict } from "./params.js";
 export type { ApprovalGate, ApprovalGatePlanDetail, ApprovalRequest, GateResolution } from "./approval.js";
+export { RemediationVerbSchema, REMEDIATION_VERB_GLOSS, DestructionFindingSchema, DestructionTicketResourceSchema, DestructionTicketSchema, DestructionConsentSchema, DestructionOutcomeSchema, DESTRUCTION_FINDINGS, CONSENT_VERDICTS, TICKET_VERDICT_SOURCES, TicketVerdictSourceSchema } from "./destruction.js";
+export type { RemediationVerb, DestructionFinding, DestructionTicketResource, DestructionTicket, DestructionConsent, ConsentVerdict, ConsentVerdictRow, DestructionConsentReport, DestructionConsentRequest, DestructionConsentResolution, DestructionConsentGate, DestructionOutcome, TicketVerdictSource } from "./destruction.js";
+export { DRIFT_VERDICTS, DriftVerdictSchema, DriftSuspectSchema, DriftFindingSchema, DriftJournalRecordSchema, verbsForDriftVerdict } from "./drift.js";
+export type { DriftVerdict, DriftSuspect, DriftFinding, DriftJournalRecord } from "./drift.js";
+export { REMEDIATION_PHASES, RemediationPhaseSchema, RemediationTargetSchema, RemediationFlipProofSchema, RemediationJournalRecordSchema, RemediationVerbWithSurgerySchema, remediationPhaseRank, remediationPlaceholderPhysicalId, isRemediationPlaceholderPhysicalId } from "./remediation.js";
+export type { RemediationPhase, RemediationTarget, RemediationFlipProof, RemediationJournalRecord, RemediationVerbWithSurgery } from "./remediation.js";
 export type { OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession } from "./config/orgConfig.js";
 export type { Entitlements } from "./config/entitlements.js";
 export type { StackOutput, StackOutputsRecord, DeploymentContext, StepOutput, ApplicationDeploymentContext, CallerIdentity } from "./deployment/index.js";
@@ -26,11 +68,9 @@ export type { ParallelDeploymentResult, ParallelDeployGroup, ParallelOperation,
 export { PARALLEL_OPERATION_TYPES } from "./deployment/index.js";
 export type { OpenNextPattern, AppResourceFlags } from "./detection/patternTypes.js";
 export { isOpenNextPattern, OPENNEXT_PATTERNS } from "./detection/patternTypes.js";
-export { deriveResourcesFromManifestStacks } from "./detection/patternDetection.js";
 export { STACK_NOT_FOUND_PATTERN, STACK_FAILED_STATE_PATTERN, CDK_NO_STACKS_MATCH, INFRASTRUCTURE_FILENAME } from "./constants.js";
 export { ApplicationError, wrapApplicationError, type ApplicationErrorType, type StackDeploymentData, type StackDeploymentOptions, type ApplicationDeploymentData, type ApplicationDestructionData } from "./application/index.js";
 export type { FjallStateFile, TemplateHashEntry } from "./config/FjallState.js";
-export { FjallStateFileSchema, readStateFile, writeStateFile, createEmptyState, deleteStateFile, updateTemplateHash, getStateFilePath, regionSuffix } from "./config/FjallState.js";
 export type { FrameworkBuilder, FrameworkDetection, BuildPlan, BuildCommand, BuildCallbacks, DetectionContext, BuildOptions } from "./frameworkBuilder.js";
 export { STEP_IDS, STEP_NAMES, INFRASTRUCTURE_STEP_NAMES, INFRA_STEP_NAME } from "./stepDefinitions.js";
 export type { StepId, InfrastructureStepName, StepDefinition, StepDeploymentType, Operation, StepContext } from "./stepDefinitions.js";

package/dist/src/types/index.js

@@ -1 +1 @@
-import{DeploymentEventSchema as e,DEPLOYMENT_EVENT_TYPES as A,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as S,DEPLOYMENT_EVENT_STATUS_REASON_MAX as T,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as t,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as O,CASCADE_PHASES as P,CASCADE_ACCOUNT_STATUSES as r,toCascadePhase as N}from"./deploymentEventSchema.js";import{isQuarantineDetail as a,isRetainedBucketsDetail as R}from"./callbacks.js";import{DeployEventSchema as p,StepProgressSchema as D,DeployResourceSchema as C,PlanChangeSchema as i,PlanPropertyChangeSchema as l,ChangeCountsSchema as I,DEPLOY_EVENT_CONTRACT as M,DEPLOY_EVENT_CONTRACT_MAJOR as n,DEPLOY_EVENT_CONTRACT_MINOR as m,SUPPORTED_CONTRACT_MARKERS as s,DEPLOY_EVENT_ID_MAX as c,DEPLOY_EVENT_NAME_MAX as Y,DEPLOY_EVENT_MESSAGE_MAX as U,DEPLOY_EVENT_STATUS_REASON_MAX as V,DEPLOY_EVENT_ERROR_MESSAGE_MAX as f,DEPLOY_EVENT_TRAIL_DETAIL_MAX as x,DEPLOY_EVENT_OUTPUT_MAX as g,DEPLOY_EVENT_ARN_MAX as X,DEPLOY_EVENT_URL_MAX as h,STEP_COMPLETE_STATUSES as G,LOG_LEVELS as y,STACK_CLEANUP_PHASES as F,CASCADE_ACCOUNT_PHASES as d,DEPLOY_RESULTS as u,DETECTION_PHASES as K,PHASE_STATUSES as H,BUILDERS as k,CASCADE_OUTCOME_RESULTS as v,PLAN_ACTIONS as w,REPLACEMENT_MODES as B,APPROVAL_KINDS as b,APPROVAL_DECISIONS as j,ALL_PROGRESS_KINDS as J}from"./deployEvent.js";import{createDeployEmitter as q}from"./deployEmitter.js";import{parseDeployEvent as W,parseDeployContractVersion as Z}from"./deployEventParse.js";import{TRAIL_MIGRATION_PHASES as EE,TRAIL_MIGRATION_STATUSES as _E}from"./events.js";import{stubCallerIdentity as AE}from"./deployment/index.js";import{ProgressReporter as TE}from"./ProgressEvent.js";import{APPLICATION_STACKS as OE,ORGANISATION_TYPES as PE,APPLICATION_DEPLOY_ORDER as rE,APPLICATION_DESTROY_ORDER as NE,OPENNEXT_DEPLOY_ORDER as oE,OPENNEXT_DESTROY_ORDER as aE,PARALLEL_DEPLOY_GROUPS as RE,PARALLEL_DESTROY_GROUPS as LE,OPENNEXT_PARALLEL_GROUPS as pE,isApplicationOperation as DE,isOrganisationOperation as CE,getParallelDeployGroups as iE,getParallelDestroyGroups as lE,getApplicationDeployOrder as IE,getApplicationDestroyOrder as ME,getApplicationStackName as nE,getOrganisationStackName as mE,isApplicationStack as sE,getApplicationStepName as cE,getApplicationStepId as YE,toPascalCase as UE}from"./operations.js";import{PARALLEL_OPERATION_TYPES as fE}from"./deployment/index.js";import{isOpenNextPattern as gE,OPENNEXT_PATTERNS as XE}from"./detection/patternTypes.js";import{deriveResourcesFromManifestStacks as GE}from"./detection/patternDetection.js";import{STACK_NOT_FOUND_PATTERN as FE,STACK_FAILED_STATE_PATTERN as dE,CDK_NO_STACKS_MATCH as uE,INFRASTRUCTURE_FILENAME as KE}from"./constants.js";import{ApplicationError as kE,wrapApplicationError as vE}from"./application/index.js";import{FjallStateFileSchema as BE,readStateFile as bE,writeStateFile as jE,createEmptyState as JE,deleteStateFile as QE,updateTemplateHash as qE,getStateFilePath as zE,regionSuffix as WE}from"./config/FjallState.js";import{STEP_IDS as $E,STEP_NAMES as E_,INFRASTRUCTURE_STEP_NAMES as __,INFRA_STEP_NAME as e_}from"./stepDefinitions.js";export{J as ALL_PROGRESS_KINDS,rE as APPLICATION_DEPLOY_ORDER,NE as APPLICATION_DESTROY_ORDER,OE as APPLICATION_STACKS,j as APPROVAL_DECISIONS,b as APPROVAL_KINDS,kE as ApplicationError,k as BUILDERS,d as CASCADE_ACCOUNT_PHASES,r as CASCADE_ACCOUNT_STATUSES,v as CASCADE_OUTCOME_RESULTS,P as CASCADE_PHASES,uE as CDK_NO_STACKS_MATCH,I as ChangeCountsSchema,t as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,S as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,T as DEPLOYMENT_EVENT_STATUS_REASON_MAX,O as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,A as DEPLOYMENT_EVENT_TYPES,X as DEPLOY_EVENT_ARN_MAX,M as DEPLOY_EVENT_CONTRACT,n as DEPLOY_EVENT_CONTRACT_MAJOR,m as DEPLOY_EVENT_CONTRACT_MINOR,f as DEPLOY_EVENT_ERROR_MESSAGE_MAX,c as DEPLOY_EVENT_ID_MAX,U as DEPLOY_EVENT_MESSAGE_MAX,Y as DEPLOY_EVENT_NAME_MAX,g as DEPLOY_EVENT_OUTPUT_MAX,V as DEPLOY_EVENT_STATUS_REASON_MAX,x as DEPLOY_EVENT_TRAIL_DETAIL_MAX,h as DEPLOY_EVENT_URL_MAX,u as DEPLOY_RESULTS,K as DETECTION_PHASES,p as DeployEventSchema,C as DeployResourceSchema,e as DeploymentEventSchema,BE as FjallStateFileSchema,KE as INFRASTRUCTURE_FILENAME,__ as INFRASTRUCTURE_STEP_NAMES,e_ as INFRA_STEP_NAME,y as LOG_LEVELS,oE as OPENNEXT_DEPLOY_ORDER,aE as OPENNEXT_DESTROY_ORDER,pE as OPENNEXT_PARALLEL_GROUPS,XE as OPENNEXT_PATTERNS,PE as ORGANISATION_TYPES,RE as PARALLEL_DEPLOY_GROUPS,LE as PARALLEL_DESTROY_GROUPS,fE as PARALLEL_OPERATION_TYPES,H as PHASE_STATUSES,w as PLAN_ACTIONS,i as PlanChangeSchema,l as PlanPropertyChangeSchema,TE as ProgressReporter,B as REPLACEMENT_MODES,F as STACK_CLEANUP_PHASES,dE as STACK_FAILED_STATE_PATTERN,FE as STACK_NOT_FOUND_PATTERN,G as STEP_COMPLETE_STATUSES,$E as STEP_IDS,E_ as STEP_NAMES,s as SUPPORTED_CONTRACT_MARKERS,D as StepProgressSchema,EE as TRAIL_MIGRATION_PHASES,_E as TRAIL_MIGRATION_STATUSES,q as createDeployEmitter,JE as createEmptyState,QE as deleteStateFile,GE as deriveResourcesFromManifestStacks,IE as getApplicationDeployOrder,ME as getApplicationDestroyOrder,nE as getApplicationStackName,YE as getApplicationStepId,cE as getApplicationStepName,mE as getOrganisationStackName,iE as getParallelDeployGroups,lE as getParallelDestroyGroups,zE as getStateFilePath,DE as isApplicationOperation,sE as isApplicationStack,gE as isOpenNextPattern,CE as isOrganisationOperation,a as isQuarantineDetail,R as isRetainedBucketsDetail,Z as parseDeployContractVersion,W as parseDeployEvent,bE as readStateFile,WE as regionSuffix,AE as stubCallerIdentity,N as toCascadePhase,UE as toPascalCase,qE as updateTemplateHash,vE as wrapApplicationError,jE as writeStateFile};
+import{DeploymentEventSchema as S,DEPLOYMENT_EVENT_TYPES as _,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as T,DEPLOYMENT_EVENT_STATUS_REASON_MAX as A,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as t,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as r,CASCADE_PHASES as o,CASCADE_ACCOUNT_STATUSES as a,toCascadePhase as R}from"./deploymentEventSchema.js";import{isQuarantineDetail as P,isRetainedBucketsDetail as N}from"./callbacks.js";import{DeployEventSchema as D,StepProgressSchema as c,DeployResourceSchema as L,PlanChangeSchema as p,PlanPropertyChangeSchema as C,ChangeCountsSchema as n,DEPLOY_EVENT_CONTRACT as m,DEPLOY_EVENT_CONTRACT_MAJOR as I,DEPLOY_EVENT_CONTRACT_MINOR as s,SUPPORTED_CONTRACT_MARKERS as l,DEPLOY_EVENT_ID_MAX as M,DEPLOY_EVENT_NAME_MAX as h,DEPLOY_EVENT_MESSAGE_MAX as V,DEPLOY_EVENT_STATUS_REASON_MAX as U,DEPLOY_EVENT_ERROR_MESSAGE_MAX as Y,DEPLOY_EVENT_TRAIL_DETAIL_MAX as d,DEPLOY_EVENT_OUTPUT_MAX as f,DEPLOY_EVENT_ARN_MAX as g,DEPLOY_EVENT_URL_MAX as u,STEP_COMPLETE_STATUSES as x,LOG_LEVELS as G,STACK_CLEANUP_PHASES as X,CASCADE_ACCOUNT_PHASES as y,DEPLOY_RESULTS as F,DETECTION_PHASES as K,PHASE_STATUSES as k,BUILDERS as H,CASCADE_OUTCOME_RESULTS as b,PLAN_ACTIONS as v,REPLACEMENT_MODES as B,APPROVAL_KINDS as J,APPROVAL_DECISIONS as w,ALL_PROGRESS_KINDS as Q}from"./deployEvent.js";import{createDeployEmitter as j}from"./deployEmitter.js";import{parseDeployEvent as z,parseDeployContractVersion as Z}from"./deployEventParse.js";import{TRAIL_MIGRATION_PHASES as EE,TRAIL_MIGRATION_STATUSES as eE}from"./events.js";import{RemediationVerbSchema as _E,REMEDIATION_VERB_GLOSS as TE,DestructionFindingSchema as AE,DestructionTicketResourceSchema as tE,DestructionTicketSchema as rE,DestructionConsentSchema as oE,DestructionOutcomeSchema as aE,DESTRUCTION_FINDINGS as RE,CONSENT_VERDICTS as OE,TICKET_VERDICT_SOURCES as PE,TicketVerdictSourceSchema as NE}from"./destruction.js";import{DRIFT_VERDICTS as DE,DriftVerdictSchema as cE,DriftSuspectSchema as LE,DriftFindingSchema as pE,DriftJournalRecordSchema as CE,verbsForDriftVerdict as nE}from"./drift.js";import{REMEDIATION_PHASES as IE,RemediationPhaseSchema as sE,RemediationTargetSchema as lE,RemediationFlipProofSchema as ME,RemediationJournalRecordSchema as hE,RemediationVerbWithSurgerySchema as VE,remediationPhaseRank as UE,remediationPlaceholderPhysicalId as YE,isRemediationPlaceholderPhysicalId as dE}from"./remediation.js";import{stubCallerIdentity as gE}from"./deployment/index.js";import{ProgressReporter as xE}from"./ProgressEvent.js";import{APPLICATION_STACKS as XE,ORGANISATION_TYPES as yE,APPLICATION_DEPLOY_ORDER as FE,APPLICATION_DESTROY_ORDER as KE,OPENNEXT_DEPLOY_ORDER as kE,OPENNEXT_DESTROY_ORDER as HE,PARALLEL_DEPLOY_GROUPS as bE,PARALLEL_DESTROY_GROUPS as vE,OPENNEXT_PARALLEL_GROUPS as BE,isApplicationOperation as JE,isOrganisationOperation as wE,getParallelDeployGroups as QE,getParallelDestroyGroups as WE,getApplicationDeployOrder as jE,getApplicationDestroyOrder as qE,getApplicationStackName as zE,getOrganisationStackName as ZE,isApplicationStack as $E,getApplicationStepName as Ee,getApplicationStepId as ee,toPascalCase as Se}from"./operations.js";import{PARALLEL_OPERATION_TYPES as Te}from"./deployment/index.js";import{isOpenNextPattern as te,OPENNEXT_PATTERNS as re}from"./detection/patternTypes.js";import{STACK_NOT_FOUND_PATTERN as ae,STACK_FAILED_STATE_PATTERN as Re,CDK_NO_STACKS_MATCH as Oe,INFRASTRUCTURE_FILENAME as Pe}from"./constants.js";import{ApplicationError as ie,wrapApplicationError as De}from"./application/index.js";import{STEP_IDS as Le,STEP_NAMES as pe,INFRASTRUCTURE_STEP_NAMES as Ce,INFRA_STEP_NAME as ne}from"./stepDefinitions.js";export{Q as ALL_PROGRESS_KINDS,FE as APPLICATION_DEPLOY_ORDER,KE as APPLICATION_DESTROY_ORDER,XE as APPLICATION_STACKS,w as APPROVAL_DECISIONS,J as APPROVAL_KINDS,ie as ApplicationError,H as BUILDERS,y as CASCADE_ACCOUNT_PHASES,a as CASCADE_ACCOUNT_STATUSES,b as CASCADE_OUTCOME_RESULTS,o as CASCADE_PHASES,Oe as CDK_NO_STACKS_MATCH,OE as CONSENT_VERDICTS,n as ChangeCountsSchema,t as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,T as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,A as DEPLOYMENT_EVENT_STATUS_REASON_MAX,r as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,_ as DEPLOYMENT_EVENT_TYPES,g as DEPLOY_EVENT_ARN_MAX,m as DEPLOY_EVENT_CONTRACT,I as DEPLOY_EVENT_CONTRACT_MAJOR,s as DEPLOY_EVENT_CONTRACT_MINOR,Y as DEPLOY_EVENT_ERROR_MESSAGE_MAX,M as DEPLOY_EVENT_ID_MAX,V as DEPLOY_EVENT_MESSAGE_MAX,h as DEPLOY_EVENT_NAME_MAX,f as DEPLOY_EVENT_OUTPUT_MAX,U as DEPLOY_EVENT_STATUS_REASON_MAX,d as DEPLOY_EVENT_TRAIL_DETAIL_MAX,u as DEPLOY_EVENT_URL_MAX,F as DEPLOY_RESULTS,RE as DESTRUCTION_FINDINGS,K as DETECTION_PHASES,DE as DRIFT_VERDICTS,D as DeployEventSchema,L as DeployResourceSchema,S as DeploymentEventSchema,oE as DestructionConsentSchema,AE as DestructionFindingSchema,aE as DestructionOutcomeSchema,tE as DestructionTicketResourceSchema,rE as DestructionTicketSchema,pE as DriftFindingSchema,CE as DriftJournalRecordSchema,LE as DriftSuspectSchema,cE as DriftVerdictSchema,Pe as INFRASTRUCTURE_FILENAME,Ce as INFRASTRUCTURE_STEP_NAMES,ne as INFRA_STEP_NAME,G as LOG_LEVELS,kE as OPENNEXT_DEPLOY_ORDER,HE as OPENNEXT_DESTROY_ORDER,BE as OPENNEXT_PARALLEL_GROUPS,re as OPENNEXT_PATTERNS,yE as ORGANISATION_TYPES,bE as PARALLEL_DEPLOY_GROUPS,vE as PARALLEL_DESTROY_GROUPS,Te as PARALLEL_OPERATION_TYPES,k as PHASE_STATUSES,v as PLAN_ACTIONS,p as PlanChangeSchema,C as PlanPropertyChangeSchema,xE as ProgressReporter,IE as REMEDIATION_PHASES,TE as REMEDIATION_VERB_GLOSS,B as REPLACEMENT_MODES,ME as RemediationFlipProofSchema,hE as RemediationJournalRecordSchema,sE as RemediationPhaseSchema,lE as RemediationTargetSchema,_E as RemediationVerbSchema,VE as RemediationVerbWithSurgerySchema,X as STACK_CLEANUP_PHASES,Re as STACK_FAILED_STATE_PATTERN,ae as STACK_NOT_FOUND_PATTERN,x as STEP_COMPLETE_STATUSES,Le as STEP_IDS,pe as STEP_NAMES,l as SUPPORTED_CONTRACT_MARKERS,c as StepProgressSchema,PE as TICKET_VERDICT_SOURCES,EE as TRAIL_MIGRATION_PHASES,eE as TRAIL_MIGRATION_STATUSES,NE as TicketVerdictSourceSchema,j as createDeployEmitter,jE as getApplicationDeployOrder,qE as getApplicationDestroyOrder,zE as getApplicationStackName,ee as getApplicationStepId,Ee as getApplicationStepName,ZE as getOrganisationStackName,QE as getParallelDeployGroups,WE as getParallelDestroyGroups,JE as isApplicationOperation,$E as isApplicationStack,te as isOpenNextPattern,wE as isOrganisationOperation,P as isQuarantineDetail,dE as isRemediationPlaceholderPhysicalId,N as isRetainedBucketsDetail,Z as parseDeployContractVersion,z as parseDeployEvent,UE as remediationPhaseRank,YE as remediationPlaceholderPhysicalId,gE as stubCallerIdentity,R as toCascadePhase,Se as toPascalCase,nE as verbsForDriftVerdict,De as wrapApplicationError};

package/dist/src/types/operations.d.ts

@@ -1,6 +1,7 @@
 import { type AppResourceFlags } from "./detection/patternTypes.js";
 import { type StepId } from "./stepDefinitions.js";
 import { toPascalCase } from "@fjall/util";
+import type { PatternType } from "@fjall/generator";
 /**
  * Application infrastructure stacks
  */
@@ -157,7 +158,7 @@ export declare function getParallelDestroyGroups(): ReadonlyArray<(typeof PARALL
  * Options for determining deployment order
  */
 export interface DeployOrderOptions {
-    pattern?: "payload" | "nextjs" | null;
+    pattern?: PatternType | null;
     resources?: AppResourceFlags;
 }
 /**