@fjall/deploy-core 5.0.0 → 7.0.0

package/dist/src/types/destruction.d.ts

@@ -15,6 +15,7 @@ export declare const RemediationVerbSchema: z.ZodEnum<{
     recreate: "recreate";
     pin: "pin";
     repair: "repair";
+    refactor: "refactor";
 }>;
 export type RemediationVerb = z.infer<typeof RemediationVerbSchema>;
 /**
@@ -26,13 +27,23 @@ export type RemediationVerb = z.infer<typeof RemediationVerbSchema>;
  * as a menu consequence and as a `verb (gloss)` parenthetical.
  */
 export declare const REMEDIATION_VERB_GLOSS: Readonly<Record<RemediationVerb, string>>;
-export declare const DESTRUCTION_FINDINGS: readonly ["replacement-required", "pinned-name-replacement", "resource-deleted", "stack-deleted", "data-loss-delete"];
+/**
+ * Slot-swap disambiguation for the identity-pin offer (coupled values, one
+ * home): a deliberate delete-slot-A/create-slot-B swap is structurally
+ * identical to a rename (one deleted + one created subtree), so every surface
+ * offering `pin` on a rename-detected row must state the weld consequence.
+ * Intent lives with the operator; the gate stays fail-closed either way.
+ */
+export declare const IDENTITY_PIN_SLOT_SWAP_GLOSS = "pin freezes the deployed capacity identity (and its data volume) onto the new slot; if you meant to replace the capacity with a fresh slot, abort \u2014 recreate ships in a later release";
+export declare const DESTRUCTION_FINDINGS: readonly ["replacement-required", "pinned-name-replacement", "resource-deleted", "stack-deleted", "data-loss-delete", "rename-detected", "rename-ambiguous"];
 export declare const DestructionFindingSchema: z.ZodEnum<{
     "replacement-required": "replacement-required";
     "pinned-name-replacement": "pinned-name-replacement";
     "resource-deleted": "resource-deleted";
     "stack-deleted": "stack-deleted";
     "data-loss-delete": "data-loss-delete";
+    "rename-detected": "rename-detected";
+    "rename-ambiguous": "rename-ambiguous";
 }>;
 export type DestructionFinding = z.infer<typeof DestructionFindingSchema>;
 /**
@@ -50,6 +61,18 @@ export declare const TicketVerdictSourceSchema: z.ZodEnum<{
     "drift-probe": "drift-probe";
 }>;
 export type TicketVerdictSource = z.infer<typeof TicketVerdictSourceSchema>;
+/**
+ * The {appName, slot} a confirming capacity-identity alias names. Declared
+ * once here — the plan overlay (`plan/types.ts`) re-exports the type, never
+ * redeclares it (coupled discriminated unions share a source at 2
+ * occurrences). Compliant producers copy from manifest aliases whose fields
+ * are `min(1)`, so empty strings are rejected at this boundary too.
+ */
+export declare const RenameSlotHintSchema: z.ZodObject<{
+    appName: z.ZodString;
+    slot: z.ZodString;
+}, z.core.$strict>;
+export type RenameSlotHint = z.infer<typeof RenameSlotHintSchema>;
 export declare const DestructionTicketResourceSchema: z.ZodObject<{
     stack: z.ZodString;
     logicalId: z.ZodString;
@@ -61,6 +84,8 @@ export declare const DestructionTicketResourceSchema: z.ZodObject<{
         "resource-deleted": "resource-deleted";
         "stack-deleted": "stack-deleted";
         "data-loss-delete": "data-loss-delete";
+        "rename-detected": "rename-detected";
+        "rename-ambiguous": "rename-ambiguous";
     }>;
     cause: z.ZodString;
     offendingProperties: z.ZodArray<z.ZodString>;
@@ -78,7 +103,12 @@ export declare const DestructionTicketResourceSchema: z.ZodObject<{
         recreate: "recreate";
         pin: "pin";
         repair: "repair";
+        refactor: "refactor";
     }>>;
+    pinSlotHint: z.ZodOptional<z.ZodObject<{
+        appName: z.ZodString;
+        slot: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type DestructionTicketResource = z.infer<typeof DestructionTicketResourceSchema>;
 export declare const DestructionTicketSchema: z.ZodObject<{
@@ -94,6 +124,8 @@ export declare const DestructionTicketSchema: z.ZodObject<{
             "resource-deleted": "resource-deleted";
             "stack-deleted": "stack-deleted";
             "data-loss-delete": "data-loss-delete";
+            "rename-detected": "rename-detected";
+            "rename-ambiguous": "rename-ambiguous";
         }>;
         cause: z.ZodString;
         offendingProperties: z.ZodArray<z.ZodString>;
@@ -111,7 +143,12 @@ export declare const DestructionTicketSchema: z.ZodObject<{
             recreate: "recreate";
             pin: "pin";
             repair: "repair";
+            refactor: "refactor";
         }>>;
+        pinSlotHint: z.ZodOptional<z.ZodObject<{
+            appName: z.ZodString;
+            slot: z.ZodString;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type DestructionTicket = z.infer<typeof DestructionTicketSchema>;
@@ -124,6 +161,7 @@ export declare const DestructionConsentSchema: z.ZodObject<{
         recreate: "recreate";
         pin: "pin";
         repair: "repair";
+        refactor: "refactor";
     }>;
 }, z.core.$strict>;
 export type DestructionConsent = z.infer<typeof DestructionConsentSchema>;

package/dist/src/types/destruction.js

@@ -1 +1 @@
-import{z as e}from"zod";import{REPLACEMENT_VERDICT_SOURCES as r}from"../orchestration/application/plan/types.js";const t=e.enum(["abort","pin","recreate","forget","repair"]),u={abort:"stop here \u2014 nothing is changed",pin:"accept the live value into your fjall config so the change disappears; non-destructive",recreate:"accept a new physical resource under this name \u2014 data survives only via snapshot or backup (none if the resource is already deleted and no backup exists)",forget:"stop managing the resource \u2014 the physical resource is never touched",repair:"report-only: forensics plus a manual runbook, nothing is mutated"},n=["replacement-required","pinned-name-replacement","resource-deleted","stack-deleted","data-loss-delete"],o=e.enum(n),c=[...r,"drift-probe"],s=e.enum(c),a=e.object({stack:e.string(),logicalId:e.string(),resourceType:e.string(),physicalName:e.string(),finding:o,cause:e.string(),offendingProperties:e.array(e.string()),verdictSource:s,dataLossRisk:e.boolean(),verbs:e.array(t)}).strict(),d=e.object({ticketDigest:e.string(),resources:e.array(a)}).strict(),m=e.object({physicalName:e.string().min(1,"Consent physical name cannot be empty"),verb:t}).strict(),h=["matched","unmatched","wrong-verb"],l=e.enum(["awaiting-consent","declined","consents-invalid","consent-not-executable"]);export{h as CONSENT_VERDICTS,n as DESTRUCTION_FINDINGS,m as DestructionConsentSchema,o as DestructionFindingSchema,l as DestructionOutcomeSchema,a as DestructionTicketResourceSchema,d as DestructionTicketSchema,u as REMEDIATION_VERB_GLOSS,t as RemediationVerbSchema,c as TICKET_VERDICT_SOURCES,s as TicketVerdictSourceSchema};
+import{z as e}from"zod";import{REPLACEMENT_VERDICT_SOURCES as r}from"../orchestration/application/plan/types.js";const t=e.enum(["abort","pin","recreate","forget","repair","refactor"]),d={abort:"stop here \u2014 nothing is changed",pin:"record the live value or deployed identity in your fjall config so the change disappears; non-destructive",recreate:"accept a new physical resource under this name \u2014 data survives only via snapshot or backup (none if the resource is already deleted and no backup exists)",forget:"stop managing the resource \u2014 the physical resource is never touched",repair:"report-only: forensics plus a manual runbook, nothing is mutated",refactor:"move the resource to its new logical ID via CloudFormation stack refactoring \u2014 the physical resource is never replaced"},m="pin freezes the deployed capacity identity (and its data volume) onto the new slot; if you meant to replace the capacity with a fresh slot, abort \u2014 recreate ships in a later release",o=["replacement-required","pinned-name-replacement","resource-deleted","stack-deleted","data-loss-delete","rename-detected","rename-ambiguous"],n=e.enum(o),a=[...r,"drift-probe"],i=e.enum(a),c=e.object({appName:e.string().min(1,"pinSlotHint appName cannot be empty"),slot:e.string().min(1,"pinSlotHint slot cannot be empty")}).strict(),s=e.object({stack:e.string(),logicalId:e.string(),resourceType:e.string(),physicalName:e.string(),finding:n,cause:e.string(),offendingProperties:e.array(e.string()),verdictSource:i,dataLossRisk:e.boolean(),verbs:e.array(t),pinSlotHint:c.optional()}).strict(),u=e.object({ticketDigest:e.string(),resources:e.array(s)}).strict(),h=e.object({physicalName:e.string().min(1,"Consent physical name cannot be empty"),verb:t}).strict(),g=["matched","unmatched","wrong-verb"],S=e.enum(["awaiting-consent","declined","consents-invalid","consent-not-executable"]);export{g as CONSENT_VERDICTS,o as DESTRUCTION_FINDINGS,h as DestructionConsentSchema,n as DestructionFindingSchema,S as DestructionOutcomeSchema,s as DestructionTicketResourceSchema,u as DestructionTicketSchema,m as IDENTITY_PIN_SLOT_SWAP_GLOSS,d as REMEDIATION_VERB_GLOSS,t as RemediationVerbSchema,c as RenameSlotHintSchema,a as TICKET_VERDICT_SOURCES,i as TicketVerdictSourceSchema};

package/dist/src/types/drift.d.ts

@@ -43,6 +43,7 @@ export declare const DriftFindingSchema: z.ZodObject<{
         recreate: "recreate";
         pin: "pin";
         repair: "repair";
+        refactor: "refactor";
     }>>;
     stackName: z.ZodString;
     logicalId: z.ZodString;

package/dist/src/types/index.d.ts

@@ -48,12 +48,12 @@ export { TRAIL_MIGRATION_PHASES, TRAIL_MIGRATION_STATUSES } from "./events.js";
 export type { ApiClientInterface, EntitlementsData } from "./apiClient.js";
 export type { DeployParams, DeployOptions, DatabaseEndpointRestartRequest, InfrastructureSource, DeploymentType, DeployResult, DestroyParams, DestroyOptions, DestroyResult, StackLeaseVerdict } from "./params.js";
 export type { ApprovalGate, ApprovalGatePlanDetail, ApprovalRequest, GateResolution } from "./approval.js";
-export { RemediationVerbSchema, REMEDIATION_VERB_GLOSS, DestructionFindingSchema, DestructionTicketResourceSchema, DestructionTicketSchema, DestructionConsentSchema, DestructionOutcomeSchema, DESTRUCTION_FINDINGS, CONSENT_VERDICTS, TICKET_VERDICT_SOURCES, TicketVerdictSourceSchema } from "./destruction.js";
+export { RemediationVerbSchema, REMEDIATION_VERB_GLOSS, IDENTITY_PIN_SLOT_SWAP_GLOSS, DestructionFindingSchema, DestructionTicketResourceSchema, DestructionTicketSchema, DestructionConsentSchema, DestructionOutcomeSchema, DESTRUCTION_FINDINGS, CONSENT_VERDICTS, TICKET_VERDICT_SOURCES, TicketVerdictSourceSchema } from "./destruction.js";
 export type { RemediationVerb, DestructionFinding, DestructionTicketResource, DestructionTicket, DestructionConsent, ConsentVerdict, ConsentVerdictRow, DestructionConsentReport, DestructionConsentRequest, DestructionConsentResolution, DestructionConsentGate, DestructionOutcome, TicketVerdictSource } from "./destruction.js";
 export { DRIFT_VERDICTS, DriftVerdictSchema, DriftSuspectSchema, DriftFindingSchema, DriftJournalRecordSchema, verbsForDriftVerdict } from "./drift.js";
 export type { DriftVerdict, DriftSuspect, DriftFinding, DriftJournalRecord } from "./drift.js";
-export { REMEDIATION_PHASES, RemediationPhaseSchema, RemediationTargetSchema, RemediationFlipProofSchema, RemediationJournalRecordSchema, RemediationVerbWithSurgerySchema, remediationPhaseRank, remediationPlaceholderPhysicalId, isRemediationPlaceholderPhysicalId } from "./remediation.js";
-export type { RemediationPhase, RemediationTarget, RemediationFlipProof, RemediationJournalRecord, RemediationVerbWithSurgery } from "./remediation.js";
+export { REMEDIATION_PHASES, RemediationPhaseSchema, RemediationTargetSchema, RemediationFlipProofSchema, RemediationJournalRecordSchema, RemediationJournalVerbSchema, RemediationVerbWithSurgerySchema, PinnedSlotRecordSchema, remediationPhaseRank, remediationPlaceholderPhysicalId, isRemediationPlaceholderPhysicalId } from "./remediation.js";
+export type { RemediationPhase, RemediationTarget, RemediationFlipProof, RemediationJournalRecord, RemediationJournalVerb, RemediationVerbWithSurgery, PinnedSlotRecord } from "./remediation.js";
 export type { OrgConfig, ProviderAccount, RootAccessManagementMode, SSOSession } from "./config/orgConfig.js";
 export type { Entitlements } from "./config/entitlements.js";
 export type { StackOutput, StackOutputsRecord, DeploymentContext, StepOutput, ApplicationDeploymentContext, CallerIdentity } from "./deployment/index.js";

package/dist/src/types/index.js

@@ -1 +1 @@
-import{DeploymentEventSchema as S,DEPLOYMENT_EVENT_TYPES as _,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as T,DEPLOYMENT_EVENT_STATUS_REASON_MAX as A,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as t,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as r,DEPLOYMENT_ERROR_MESSAGE_MAX as o,CASCADE_PHASES as a,CASCADE_ACCOUNT_STATUSES as R,toCascadePhase as O,clampDeploymentEventStrings as P,truncateUtf16Safe as N}from"./deploymentEventSchema.js";import{isQuarantineDetail as D,isRetainedBucketsDetail as c}from"./callbacks.js";import{DeployEventSchema as n,StepProgressSchema as p,DeployResourceSchema as m,PlanChangeSchema as C,PlanPropertyChangeSchema as I,ChangeCountsSchema as s,DEPLOY_EVENT_CONTRACT as l,DEPLOY_EVENT_CONTRACT_MAJOR as M,DEPLOY_EVENT_CONTRACT_MINOR as h,SUPPORTED_CONTRACT_MARKERS as V,DEPLOY_EVENT_ID_MAX as U,DEPLOY_EVENT_NAME_MAX as Y,DEPLOY_EVENT_MESSAGE_MAX as d,DEPLOY_EVENT_STATUS_REASON_MAX as f,DEPLOY_EVENT_ERROR_MESSAGE_MAX as g,DEPLOY_EVENT_TRAIL_DETAIL_MAX as u,DEPLOY_EVENT_OUTPUT_MAX as x,DEPLOY_EVENT_ARN_MAX as G,DEPLOY_EVENT_URL_MAX as X,STEP_COMPLETE_STATUSES as y,LOG_LEVELS as F,STACK_CLEANUP_PHASES as K,CASCADE_ACCOUNT_PHASES as k,DEPLOY_RESULTS as H,DETECTION_PHASES as v,PHASE_STATUSES as b,BUILDERS as B,CASCADE_OUTCOME_RESULTS as J,PLAN_ACTIONS as w,REPLACEMENT_MODES as Q,APPROVAL_KINDS as W,APPROVAL_DECISIONS as j,ALL_PROGRESS_KINDS as q}from"./deployEvent.js";import{createDeployEmitter as Z}from"./deployEmitter.js";import{parseDeployEvent as EE,parseDeployContractVersion as eE}from"./deployEventParse.js";import{TRAIL_MIGRATION_PHASES as _E,TRAIL_MIGRATION_STATUSES as TE}from"./events.js";import{RemediationVerbSchema as tE,REMEDIATION_VERB_GLOSS as rE,DestructionFindingSchema as oE,DestructionTicketResourceSchema as aE,DestructionTicketSchema as RE,DestructionConsentSchema as OE,DestructionOutcomeSchema as PE,DESTRUCTION_FINDINGS as NE,CONSENT_VERDICTS as iE,TICKET_VERDICT_SOURCES as DE,TicketVerdictSourceSchema as cE}from"./destruction.js";import{DRIFT_VERDICTS as nE,DriftVerdictSchema as pE,DriftSuspectSchema as mE,DriftFindingSchema as CE,DriftJournalRecordSchema as IE,verbsForDriftVerdict as sE}from"./drift.js";import{REMEDIATION_PHASES as ME,RemediationPhaseSchema as hE,RemediationTargetSchema as VE,RemediationFlipProofSchema as UE,RemediationJournalRecordSchema as YE,RemediationVerbWithSurgerySchema as dE,remediationPhaseRank as fE,remediationPlaceholderPhysicalId as gE,isRemediationPlaceholderPhysicalId as uE}from"./remediation.js";import{stubCallerIdentity as GE}from"./deployment/index.js";import{ProgressReporter as yE}from"./ProgressEvent.js";import{APPLICATION_STACKS as KE,ORGANISATION_TYPES as kE,APPLICATION_DEPLOY_ORDER as HE,APPLICATION_DESTROY_ORDER as vE,OPENNEXT_DEPLOY_ORDER as bE,OPENNEXT_DESTROY_ORDER as BE,PARALLEL_DEPLOY_GROUPS as JE,PARALLEL_DESTROY_GROUPS as wE,OPENNEXT_PARALLEL_GROUPS as QE,isApplicationOperation as WE,isOrganisationOperation as jE,getParallelDeployGroups as qE,getParallelDestroyGroups as zE,getApplicationDeployOrder as ZE,getApplicationDestroyOrder as $E,getApplicationStackName as Ee,getOrganisationStackName as ee,isApplicationStack as Se,getApplicationStepName as _e,getApplicationStepId as Te,toPascalCase as Ae}from"./operations.js";import{PARALLEL_OPERATION_TYPES as re}from"./deployment/index.js";import{isOpenNextPattern as ae,OPENNEXT_PATTERNS as Re}from"./detection/patternTypes.js";import{STACK_NOT_FOUND_PATTERN as Pe,STACK_FAILED_STATE_PATTERN as Ne,CDK_NO_STACKS_MATCH as ie,INFRASTRUCTURE_FILENAME as De}from"./constants.js";import{ApplicationError as Le,wrapApplicationError as ne}from"./application/index.js";import{STEP_IDS as me,STEP_NAMES as Ce,INFRASTRUCTURE_STEP_NAMES as Ie,INFRA_STEP_NAME as se}from"./stepDefinitions.js";export{q as ALL_PROGRESS_KINDS,HE as APPLICATION_DEPLOY_ORDER,vE as APPLICATION_DESTROY_ORDER,KE as APPLICATION_STACKS,j as APPROVAL_DECISIONS,W as APPROVAL_KINDS,Le as ApplicationError,B as BUILDERS,k as CASCADE_ACCOUNT_PHASES,R as CASCADE_ACCOUNT_STATUSES,J as CASCADE_OUTCOME_RESULTS,a as CASCADE_PHASES,ie as CDK_NO_STACKS_MATCH,iE as CONSENT_VERDICTS,s as ChangeCountsSchema,o as DEPLOYMENT_ERROR_MESSAGE_MAX,t as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,T as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,A as DEPLOYMENT_EVENT_STATUS_REASON_MAX,r as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,_ as DEPLOYMENT_EVENT_TYPES,G as DEPLOY_EVENT_ARN_MAX,l as DEPLOY_EVENT_CONTRACT,M as DEPLOY_EVENT_CONTRACT_MAJOR,h as DEPLOY_EVENT_CONTRACT_MINOR,g as DEPLOY_EVENT_ERROR_MESSAGE_MAX,U as DEPLOY_EVENT_ID_MAX,d as DEPLOY_EVENT_MESSAGE_MAX,Y as DEPLOY_EVENT_NAME_MAX,x as DEPLOY_EVENT_OUTPUT_MAX,f as DEPLOY_EVENT_STATUS_REASON_MAX,u as DEPLOY_EVENT_TRAIL_DETAIL_MAX,X as DEPLOY_EVENT_URL_MAX,H as DEPLOY_RESULTS,NE as DESTRUCTION_FINDINGS,v as DETECTION_PHASES,nE as DRIFT_VERDICTS,n as DeployEventSchema,m as DeployResourceSchema,S as DeploymentEventSchema,OE as DestructionConsentSchema,oE as DestructionFindingSchema,PE as DestructionOutcomeSchema,aE as DestructionTicketResourceSchema,RE as DestructionTicketSchema,CE as DriftFindingSchema,IE as DriftJournalRecordSchema,mE as DriftSuspectSchema,pE as DriftVerdictSchema,De as INFRASTRUCTURE_FILENAME,Ie as INFRASTRUCTURE_STEP_NAMES,se as INFRA_STEP_NAME,F as LOG_LEVELS,bE as OPENNEXT_DEPLOY_ORDER,BE as OPENNEXT_DESTROY_ORDER,QE as OPENNEXT_PARALLEL_GROUPS,Re as OPENNEXT_PATTERNS,kE as ORGANISATION_TYPES,JE as PARALLEL_DEPLOY_GROUPS,wE as PARALLEL_DESTROY_GROUPS,re as PARALLEL_OPERATION_TYPES,b as PHASE_STATUSES,w as PLAN_ACTIONS,C as PlanChangeSchema,I as PlanPropertyChangeSchema,yE as ProgressReporter,ME as REMEDIATION_PHASES,rE as REMEDIATION_VERB_GLOSS,Q as REPLACEMENT_MODES,UE as RemediationFlipProofSchema,YE as RemediationJournalRecordSchema,hE as RemediationPhaseSchema,VE as RemediationTargetSchema,tE as RemediationVerbSchema,dE as RemediationVerbWithSurgerySchema,K as STACK_CLEANUP_PHASES,Ne as STACK_FAILED_STATE_PATTERN,Pe as STACK_NOT_FOUND_PATTERN,y as STEP_COMPLETE_STATUSES,me as STEP_IDS,Ce as STEP_NAMES,V as SUPPORTED_CONTRACT_MARKERS,p as StepProgressSchema,DE as TICKET_VERDICT_SOURCES,_E as TRAIL_MIGRATION_PHASES,TE as TRAIL_MIGRATION_STATUSES,cE as TicketVerdictSourceSchema,P as clampDeploymentEventStrings,Z as createDeployEmitter,ZE as getApplicationDeployOrder,$E as getApplicationDestroyOrder,Ee as getApplicationStackName,Te as getApplicationStepId,_e as getApplicationStepName,ee as getOrganisationStackName,qE as getParallelDeployGroups,zE as getParallelDestroyGroups,WE as isApplicationOperation,Se as isApplicationStack,ae as isOpenNextPattern,jE as isOrganisationOperation,D as isQuarantineDetail,uE as isRemediationPlaceholderPhysicalId,c as isRetainedBucketsDetail,eE as parseDeployContractVersion,EE as parseDeployEvent,fE as remediationPhaseRank,gE as remediationPlaceholderPhysicalId,GE as stubCallerIdentity,O as toCascadePhase,Ae as toPascalCase,N as truncateUtf16Safe,sE as verbsForDriftVerdict,ne as wrapApplicationError};
+import{DeploymentEventSchema as S,DEPLOYMENT_EVENT_TYPES as _,DEPLOYMENT_EVENT_RESOURCE_CATEGORIES as T,DEPLOYMENT_EVENT_STATUS_REASON_MAX as A,DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX as t,DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX as r,DEPLOYMENT_ERROR_MESSAGE_MAX as o,CASCADE_PHASES as a,CASCADE_ACCOUNT_STATUSES as R,toCascadePhase as O,clampDeploymentEventStrings as P,truncateUtf16Safe as i}from"./deploymentEventSchema.js";import{isQuarantineDetail as D,isRetainedBucketsDetail as c}from"./callbacks.js";import{DeployEventSchema as L,StepProgressSchema as m,DeployResourceSchema as p,PlanChangeSchema as C,PlanPropertyChangeSchema as I,ChangeCountsSchema as l,DEPLOY_EVENT_CONTRACT as s,DEPLOY_EVENT_CONTRACT_MAJOR as M,DEPLOY_EVENT_CONTRACT_MINOR as h,SUPPORTED_CONTRACT_MARKERS as V,DEPLOY_EVENT_ID_MAX as d,DEPLOY_EVENT_NAME_MAX as U,DEPLOY_EVENT_MESSAGE_MAX as Y,DEPLOY_EVENT_STATUS_REASON_MAX as f,DEPLOY_EVENT_ERROR_MESSAGE_MAX as u,DEPLOY_EVENT_TRAIL_DETAIL_MAX as g,DEPLOY_EVENT_OUTPUT_MAX as x,DEPLOY_EVENT_ARN_MAX as G,DEPLOY_EVENT_URL_MAX as X,STEP_COMPLETE_STATUSES as y,LOG_LEVELS as F,STACK_CLEANUP_PHASES as K,CASCADE_ACCOUNT_PHASES as k,DEPLOY_RESULTS as H,DETECTION_PHASES as b,PHASE_STATUSES as v,BUILDERS as J,CASCADE_OUTCOME_RESULTS as B,PLAN_ACTIONS as W,REPLACEMENT_MODES as w,APPROVAL_KINDS as Q,APPROVAL_DECISIONS as j,ALL_PROGRESS_KINDS as q}from"./deployEvent.js";import{createDeployEmitter as Z}from"./deployEmitter.js";import{parseDeployEvent as EE,parseDeployContractVersion as eE}from"./deployEventParse.js";import{TRAIL_MIGRATION_PHASES as _E,TRAIL_MIGRATION_STATUSES as TE}from"./events.js";import{RemediationVerbSchema as tE,REMEDIATION_VERB_GLOSS as rE,IDENTITY_PIN_SLOT_SWAP_GLOSS as oE,DestructionFindingSchema as aE,DestructionTicketResourceSchema as RE,DestructionTicketSchema as OE,DestructionConsentSchema as PE,DestructionOutcomeSchema as iE,DESTRUCTION_FINDINGS as NE,CONSENT_VERDICTS as DE,TICKET_VERDICT_SOURCES as cE,TicketVerdictSourceSchema as nE}from"./destruction.js";import{DRIFT_VERDICTS as mE,DriftVerdictSchema as pE,DriftSuspectSchema as CE,DriftFindingSchema as IE,DriftJournalRecordSchema as lE,verbsForDriftVerdict as sE}from"./drift.js";import{REMEDIATION_PHASES as hE,RemediationPhaseSchema as VE,RemediationTargetSchema as dE,RemediationFlipProofSchema as UE,RemediationJournalRecordSchema as YE,RemediationJournalVerbSchema as fE,RemediationVerbWithSurgerySchema as uE,PinnedSlotRecordSchema as gE,remediationPhaseRank as xE,remediationPlaceholderPhysicalId as GE,isRemediationPlaceholderPhysicalId as XE}from"./remediation.js";import{stubCallerIdentity as FE}from"./deployment/index.js";import{ProgressReporter as kE}from"./ProgressEvent.js";import{APPLICATION_STACKS as bE,ORGANISATION_TYPES as vE,APPLICATION_DEPLOY_ORDER as JE,APPLICATION_DESTROY_ORDER as BE,OPENNEXT_DEPLOY_ORDER as WE,OPENNEXT_DESTROY_ORDER as wE,PARALLEL_DEPLOY_GROUPS as QE,PARALLEL_DESTROY_GROUPS as jE,OPENNEXT_PARALLEL_GROUPS as qE,isApplicationOperation as zE,isOrganisationOperation as ZE,getParallelDeployGroups as $E,getParallelDestroyGroups as Ee,getApplicationDeployOrder as ee,getApplicationDestroyOrder as Se,getApplicationStackName as _e,getOrganisationStackName as Te,isApplicationStack as Ae,getApplicationStepName as te,getApplicationStepId as re,toPascalCase as oe}from"./operations.js";import{PARALLEL_OPERATION_TYPES as Re}from"./deployment/index.js";import{isOpenNextPattern as Pe,OPENNEXT_PATTERNS as ie}from"./detection/patternTypes.js";import{STACK_NOT_FOUND_PATTERN as De,STACK_FAILED_STATE_PATTERN as ce,CDK_NO_STACKS_MATCH as ne,INFRASTRUCTURE_FILENAME as Le}from"./constants.js";import{ApplicationError as pe,wrapApplicationError as Ce}from"./application/index.js";import{STEP_IDS as le,STEP_NAMES as se,INFRASTRUCTURE_STEP_NAMES as Me,INFRA_STEP_NAME as he}from"./stepDefinitions.js";export{q as ALL_PROGRESS_KINDS,JE as APPLICATION_DEPLOY_ORDER,BE as APPLICATION_DESTROY_ORDER,bE as APPLICATION_STACKS,j as APPROVAL_DECISIONS,Q as APPROVAL_KINDS,pe as ApplicationError,J as BUILDERS,k as CASCADE_ACCOUNT_PHASES,R as CASCADE_ACCOUNT_STATUSES,B as CASCADE_OUTCOME_RESULTS,a as CASCADE_PHASES,ne as CDK_NO_STACKS_MATCH,DE as CONSENT_VERDICTS,l as ChangeCountsSchema,o as DEPLOYMENT_ERROR_MESSAGE_MAX,t as DEPLOYMENT_EVENT_ERROR_MESSAGE_MAX,T as DEPLOYMENT_EVENT_RESOURCE_CATEGORIES,A as DEPLOYMENT_EVENT_STATUS_REASON_MAX,r as DEPLOYMENT_EVENT_TRAIL_DETAIL_MAX,_ as DEPLOYMENT_EVENT_TYPES,G as DEPLOY_EVENT_ARN_MAX,s as DEPLOY_EVENT_CONTRACT,M as DEPLOY_EVENT_CONTRACT_MAJOR,h as DEPLOY_EVENT_CONTRACT_MINOR,u as DEPLOY_EVENT_ERROR_MESSAGE_MAX,d as DEPLOY_EVENT_ID_MAX,Y as DEPLOY_EVENT_MESSAGE_MAX,U as DEPLOY_EVENT_NAME_MAX,x as DEPLOY_EVENT_OUTPUT_MAX,f as DEPLOY_EVENT_STATUS_REASON_MAX,g as DEPLOY_EVENT_TRAIL_DETAIL_MAX,X as DEPLOY_EVENT_URL_MAX,H as DEPLOY_RESULTS,NE as DESTRUCTION_FINDINGS,b as DETECTION_PHASES,mE as DRIFT_VERDICTS,L as DeployEventSchema,p as DeployResourceSchema,S as DeploymentEventSchema,PE as DestructionConsentSchema,aE as DestructionFindingSchema,iE as DestructionOutcomeSchema,RE as DestructionTicketResourceSchema,OE as DestructionTicketSchema,IE as DriftFindingSchema,lE as DriftJournalRecordSchema,CE as DriftSuspectSchema,pE as DriftVerdictSchema,oE as IDENTITY_PIN_SLOT_SWAP_GLOSS,Le as INFRASTRUCTURE_FILENAME,Me as INFRASTRUCTURE_STEP_NAMES,he as INFRA_STEP_NAME,F as LOG_LEVELS,WE as OPENNEXT_DEPLOY_ORDER,wE as OPENNEXT_DESTROY_ORDER,qE as OPENNEXT_PARALLEL_GROUPS,ie as OPENNEXT_PATTERNS,vE as ORGANISATION_TYPES,QE as PARALLEL_DEPLOY_GROUPS,jE as PARALLEL_DESTROY_GROUPS,Re as PARALLEL_OPERATION_TYPES,v as PHASE_STATUSES,W as PLAN_ACTIONS,gE as PinnedSlotRecordSchema,C as PlanChangeSchema,I as PlanPropertyChangeSchema,kE as ProgressReporter,hE as REMEDIATION_PHASES,rE as REMEDIATION_VERB_GLOSS,w as REPLACEMENT_MODES,UE as RemediationFlipProofSchema,YE as RemediationJournalRecordSchema,fE as RemediationJournalVerbSchema,VE as RemediationPhaseSchema,dE as RemediationTargetSchema,tE as RemediationVerbSchema,uE as RemediationVerbWithSurgerySchema,K as STACK_CLEANUP_PHASES,ce as STACK_FAILED_STATE_PATTERN,De as STACK_NOT_FOUND_PATTERN,y as STEP_COMPLETE_STATUSES,le as STEP_IDS,se as STEP_NAMES,V as SUPPORTED_CONTRACT_MARKERS,m as StepProgressSchema,cE as TICKET_VERDICT_SOURCES,_E as TRAIL_MIGRATION_PHASES,TE as TRAIL_MIGRATION_STATUSES,nE as TicketVerdictSourceSchema,P as clampDeploymentEventStrings,Z as createDeployEmitter,ee as getApplicationDeployOrder,Se as getApplicationDestroyOrder,_e as getApplicationStackName,re as getApplicationStepId,te as getApplicationStepName,Te as getOrganisationStackName,$E as getParallelDeployGroups,Ee as getParallelDestroyGroups,zE as isApplicationOperation,Ae as isApplicationStack,Pe as isOpenNextPattern,ZE as isOrganisationOperation,D as isQuarantineDetail,XE as isRemediationPlaceholderPhysicalId,c as isRetainedBucketsDetail,eE as parseDeployContractVersion,EE as parseDeployEvent,xE as remediationPhaseRank,GE as remediationPlaceholderPhysicalId,FE as stubCallerIdentity,O as toCascadePhase,oe as toPascalCase,i as truncateUtf16Safe,sE as verbsForDriftVerdict,Ce as wrapApplicationError};

package/dist/src/types/params.d.ts

@@ -1,5 +1,5 @@
 import type { Result } from "@fjall/generator";
-import type { DeployMode, ServiceArtefact } from "@fjall/util";
+import type { CapacityIdentityConfig, DeployMode, ServiceArtefact } from "@fjall/util";
 import type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter } from "./credentials.js";
 import type { DeployCallbacks } from "./callbacks.js";
 import type { ApiClientInterface } from "./apiClient.js";
@@ -7,6 +7,8 @@ import type { OrgConfig } from "./config/orgConfig.js";
 import type { DockerProvider } from "../orchestration/dockerInterface.js";
 import type { DomainDeployProvider } from "../orchestration/domainInterface.js";
 import type { PinRemediationReport } from "../orchestration/remediation/pinRemediation.js";
+import type { IdentityPinReport } from "../orchestration/remediation/migrateIdentity.js";
+import type { DestructionTicketResource } from "./destruction.js";
 import type { ApprovalGate, ApprovalGatePlanDetail } from "./approval.js";
 import type { DestructionConsent, DestructionConsentGate, DestructionOutcome, DestructionTicket } from "./destruction.js";
 import type { FailureAnalysis } from "@fjall/util/aws";
@@ -89,6 +91,19 @@ export interface DeployParams {
      * flag can disengage the gate; this only changes HOW consent is obtained.
      */
     destructionConsentGate?: DestructionConsentGate;
+    /**
+     * Identity-pin arm runner (D9 Phase 3) — consulted when consented `pin`
+     * verb(s) land on `rename-detected` rows carrying `pinSlotHint`. The
+     * surface owns synth + config machinery, so it injects a closure that
+     * drives `runIdentityPinMigration` (collect → decode → capture → pinned
+     * re-synth → I2 gate → config write) and returns the report. Absent, the
+     * arm degrades to report-only: the deploy still stops, the report names
+     * `fjall migrate identity` as the executing command, nothing is written.
+     * The engine threads `DeployParams.abortSignal` through the second
+     * argument so implementers' CFN probes and re-synth can be interrupted
+     * (optional-capability seam methods carry `abortSignal?` from birth).
+     */
+    identityPinRunner?: (rows: readonly DestructionTicketResource[], abortSignal?: AbortSignal) => Promise<IdentityPinReport>;
     /**
      * The user's fjall infrastructure config source, consumed by the pin arm
      * when a destructive change is consented with `pin`: the engine composes an
@@ -111,6 +126,24 @@ export interface DeployParams {
      * neither omit the field and constructs fall back to explicit props.
      */
     managedDomainBindings?: Record<string, string>;
+    /**
+     * The resolved deploy target name (e.g. "production-use2") this deploy
+     * runs against — the key `capacityIdentity` pins are recorded under in
+     * fjall-config.json. Surfaces that resolve a target MUST populate it;
+     * when absent, no capacity-identity pins ride into synth and a pre-7.0
+     * stack synths unpinned (the deploy-time rename gate then blocks the
+     * resulting identity replacement rather than letting it through).
+     */
+    deployTargetName?: string;
+    /**
+     * The `capacityIdentity` map from fjall-config.json
+     * (`{app: {target: {slot: pin}}}`), verbatim. The engine projects it to
+     * `deployTargetName` via `projectCapacityIdentityToTarget` (@fjall/util)
+     * and threads the result into every synth this deploy runs as
+     * `-c fjall:capacityIdentity=<json>`. Surfaces without a config file
+     * (worker until the Phase 4 webapp bump) omit it.
+     */
+    capacityIdentity?: CapacityIdentityConfig;
     /**
      * Asked before the post-deploy database-endpoint reconcile restarts the
      * application's ECS services (fires only when a deploy replaced the
@@ -419,6 +452,15 @@ export interface DeployResult {
      * --remediate needed" on the re-run when this is non-zero.
      */
     pinDeferredConsents?: number;
+    /**
+     * Identity-pin arm: per-slot outcomes of the pin migration for consented
+     * `rename-detected` rows (D9 Phase 3). Present with `pinPending` when the
+     * ceremony consented identity pins; `pinReport` stays the drift-value
+     * arm's report and both may be present on a mixed consent set. When the
+     * surface injected no `identityPinRunner`, outcomes are report-only and
+     * name `fjall migrate identity`.
+     */
+    identityPinReport?: IdentityPinReport;
 }
 /**
  * Parameters for the destroy entry point.

package/dist/src/types/remediation.d.ts

@@ -77,12 +77,35 @@ export declare const RemediationVerbWithSurgerySchema: z.ZodEnum<{
     recreate: "recreate";
 }>;
 export type RemediationVerbWithSurgery = z.infer<typeof RemediationVerbWithSurgerySchema>;
+/**
+ * The verbs that journal: the two surgery verbs plus `pin` (identity-pin
+ * remediation, D9 Phase 3). Pin journals are TERMINAL audit records — the
+ * operation mutates only fjall-config.json, so they are written once at
+ * phase `done` (success or refusal) and never carry resume state; the
+ * surgery orchestrators' cross-verb guards ignore done records, so a pin
+ * journal can never wedge a later forget/recreate on the same resources.
+ */
+export declare const RemediationJournalVerbSchema: z.ZodEnum<{
+    forget: "forget";
+    recreate: "recreate";
+    pin: "pin";
+}>;
+export type RemediationJournalVerb = z.infer<typeof RemediationJournalVerbSchema>;
+/** One slot the identity-pin operation acted on (pin journal audit trail). */
+export declare const PinnedSlotRecordSchema: z.ZodObject<{
+    appName: z.ZodString;
+    slot: z.ZodString;
+    legacyAnchor: z.ZodString;
+    failureDetail: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type PinnedSlotRecord = z.infer<typeof PinnedSlotRecordSchema>;
 export declare const RemediationJournalRecordSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     opId: z.ZodString;
     verb: z.ZodEnum<{
         forget: "forget";
         recreate: "recreate";
+        pin: "pin";
     }>;
     accountId: z.ZodString;
     region: z.ZodString;
@@ -122,6 +145,12 @@ export declare const RemediationJournalRecordSchema: z.ZodObject<{
     coRemovedLogicalIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
     orphanedResources: z.ZodOptional<z.ZodArray<z.ZodString>>;
     unverifiedRemovals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    pinnedSlots: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        appName: z.ZodString;
+        slot: z.ZodString;
+        legacyAnchor: z.ZodString;
+        failureDetail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
     completedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type RemediationJournalRecord = z.infer<typeof RemediationJournalRecordSchema>;

package/dist/src/types/remediation.js

@@ -1 +1 @@
-var r=Object.defineProperty;var t=(i,n)=>r(i,"name",{value:n,configurable:!0});import{z as e}from"zod";const o=["captured","flip-verified","flip-applied","removal-applied","done"],a=e.enum(o);function g(i){return o.indexOf(i)}t(g,"remediationPhaseRank");const s=e.object({logicalId:e.string().min(1),resourceType:e.string().min(1),physicalId:e.string().min(1)}).strict();function l(i,n){return`${i}/${n}`}t(l,"remediationPlaceholderPhysicalId");function h(i,n){return i.physicalId===l(n,i.logicalId)}t(h,"isRemediationPlaceholderPhysicalId");const c=e.object({diffGuardPassed:e.boolean(),changeSetMetadataOnly:e.boolean(),noChanges:e.boolean(),provenAt:e.string().min(1)}).strict(),m=e.enum(["forget","recreate"]),y=e.object({version:e.literal(1),opId:e.string().min(1),verb:m,accountId:e.string().min(1),region:e.string().min(1),stackName:e.string().min(1),appName:e.string().min(1).optional(),targets:e.array(s).min(1),phase:a,createdAt:e.string().min(1),updatedAt:e.string().min(1),liveTemplateDigest:e.string().min(1).optional(),forensicsPath:e.string().min(1).optional(),proof:c.optional(),consentedPhysicalNames:e.array(e.string()).optional(),retainedByRedeclaration:e.array(e.string().min(1)).optional(),fliplessTargets:e.array(e.string().min(1)).optional(),fliplessByNecessity:e.array(e.string().min(1)).optional(),recreatedResources:e.array(e.string().min(1)).optional(),snapshotPolicies:e.record(e.string().min(1),e.enum(["Snapshot","Delete"])).optional(),coRemovedLogicalIds:e.array(e.string().min(1)).optional(),orphanedResources:e.array(e.string().min(1)).optional(),unverifiedRemovals:e.array(e.string().min(1)).optional(),completedAt:e.string().min(1).optional()}).strict();export{o as REMEDIATION_PHASES,c as RemediationFlipProofSchema,y as RemediationJournalRecordSchema,a as RemediationPhaseSchema,s as RemediationTargetSchema,m as RemediationVerbWithSurgerySchema,h as isRemediationPlaceholderPhysicalId,g as remediationPhaseRank,l as remediationPlaceholderPhysicalId};
+var r=Object.defineProperty;var t=(e,n)=>r(e,"name",{value:n,configurable:!0});import{z as i}from"zod";const o=["captured","flip-verified","flip-applied","removal-applied","done"],a=i.enum(o);function u(e){return o.indexOf(e)}t(u,"remediationPhaseRank");const s=i.object({logicalId:i.string().min(1),resourceType:i.string().min(1),physicalId:i.string().min(1)}).strict();function l(e,n){return`${e}/${n}`}t(l,"remediationPlaceholderPhysicalId");function y(e,n){return e.physicalId===l(n,e.logicalId)}t(y,"isRemediationPlaceholderPhysicalId");const c=i.object({diffGuardPassed:i.boolean(),changeSetMetadataOnly:i.boolean(),noChanges:i.boolean(),provenAt:i.string().min(1)}).strict(),m=i.enum(["forget","recreate"]),p=i.enum([...m.options,"pin"]),d=i.object({appName:i.string().min(1),slot:i.string().min(1),legacyAnchor:i.string().min(1),failureDetail:i.string().min(1).optional()}).strict(),f=i.object({version:i.literal(1),opId:i.string().min(1),verb:p,accountId:i.string().min(1),region:i.string().min(1),stackName:i.string().min(1),appName:i.string().min(1).optional(),targets:i.array(s).min(1),phase:a,createdAt:i.string().min(1),updatedAt:i.string().min(1),liveTemplateDigest:i.string().min(1).optional(),forensicsPath:i.string().min(1).optional(),proof:c.optional(),consentedPhysicalNames:i.array(i.string()).optional(),retainedByRedeclaration:i.array(i.string().min(1)).optional(),fliplessTargets:i.array(i.string().min(1)).optional(),fliplessByNecessity:i.array(i.string().min(1)).optional(),recreatedResources:i.array(i.string().min(1)).optional(),snapshotPolicies:i.record(i.string().min(1),i.enum(["Snapshot","Delete"])).optional(),coRemovedLogicalIds:i.array(i.string().min(1)).optional(),orphanedResources:i.array(i.string().min(1)).optional(),unverifiedRemovals:i.array(i.string().min(1)).optional(),pinnedSlots:i.array(d).min(1).optional(),completedAt:i.string().min(1).optional()}).strict();export{d as PinnedSlotRecordSchema,o as REMEDIATION_PHASES,c as RemediationFlipProofSchema,f as RemediationJournalRecordSchema,p as RemediationJournalVerbSchema,a as RemediationPhaseSchema,s as RemediationTargetSchema,m as RemediationVerbWithSurgerySchema,y as isRemediationPlaceholderPhysicalId,u as remediationPhaseRank,l as remediationPlaceholderPhysicalId};

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "5.0.0",
+  "version": "7.0.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fjall-tech/fjall.git",
+    "directory": "deploy-core"
+  },
   "description": "Shared deployment engine for Fjall — used by CLI and webapp worker",
   "type": "module",
   "main": "dist/src/index.js",
@@ -90,15 +95,15 @@
     "@aws-sdk/client-ssm": "^3.1098.0",
     "@aws-sdk/client-sso-admin": "^3.1098.0",
     "@aws-sdk/client-sts": "^3.1098.0",
-    "@fjall/generator": "^5.0.0",
-    "@fjall/util": "^5.0.0",
+    "@fjall/generator": "^7.0.0",
+    "@fjall/util": "^7.0.0",
     "@smithy/node-http-handler": "^4.9.13",
     "aws-cdk": "^2.1134.0",
     "tsx": "^4.23.1",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@fjall/components-infrastructure": ">=5.0.0 <6.0.0"
+    "@fjall/components-infrastructure": ">=7.0.0 <8.0.0"
   },
   "peerDependenciesMeta": {
     "@fjall/components-infrastructure": {
@@ -109,6 +114,5 @@
     "@types/node": "^26.1.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
-  },
-  "gitHead": "78dded6f582368076e8b5f351399219e5a954659"
+  }
 }