@fjall/deploy-core 6.0.0 → 7.0.0

package/dist/src/orchestration/application/engineCompat.js

@@ -1 +1 @@
-var b=Object.defineProperty;var m=(r,i)=>b(r,"name",{value:i,configurable:!0});import{readFileSync as C}from"node:fs";import{createRequire as E}from"node:module";import{success as f,failure as w}from"@fjall/generator";import{logger as g}from"@fjall/util/logger";import{maskSensitiveOutput as v}from"@fjall/util";import{readEngineCompatEnvelope as k,MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION as V}from"@fjall/util/manifest";import{DEPLOY_CORE_VERSION as $}from"../../version.js";const p="engineCompat",h="FJALL_ALLOW_ENGINE_SKEW",j={ok:"proceed","no-constraint":"proceed","engine-ahead":"warn","engine-too-old":"refuse","cdk-cli-too-old":"refuse","shape-too-new":"refuse","malformed-constraint":"refuse",indeterminate:"refuse"};function l(r){const i=r.trim().replace(/^v/i,"").split(/[-+]/)[0]??"";if(i.length===0)return;const n=i.split(".");if(n.length>3||!n.every(d=>/^\d+$/.test(d)))return;const o=Number(n[0]),a=n.length>1?Number(n[1]):0,e=n.length>2?Number(n[2]):0;return{major:o,minor:a,patch:e}}m(l,"parseEngineVersion");function y(r,i){return r.major!==i.major?r.major-i.major:r.minor!==i.minor?r.minor-i.minor:r.patch-i.patch}m(y,"compareEngineVersions");function s(r,i,n,o){return{kind:r,message:i,engineCompat:n,runningEngineVersion:o}}m(s,"verdict");function A(r){const{envelope:i,runningEngineVersion:n,maxSupportedManifestVersion:o,runningAwsCdkCliVersion:a}=r;if(i.manifestVersion!==void 0&&i.manifestVersion>o)return s("shape-too-new",`This assembly declares manifest schema version ${i.manifestVersion}, but this deploy engine (${n??"unknown"}) reads at most version ${o}. Upgrade fjall to deploy this assembly.`,i.engineCompat,n);if(i.engineCompatPresent&&i.engineCompat===void 0)return s("malformed-constraint","This assembly carries an engine-compatibility block with no usable `minimumEngineVersion`. Cannot verify the deploy engine is compatible. Re-synth with an intact @fjall/components-infrastructure install (reinstall dependencies if this persists).",void 0,n);const e=i.engineCompat;if(e===void 0)return s("no-constraint","Assembly declares no engine-compatibility constraint.",void 0,n);const d=l(e.minimumEngineVersion);if(d===void 0)return s("malformed-constraint",`This assembly declares an unparseable minimum engine version ("${e.minimumEngineVersion}"). Cannot verify compatibility. Re-synth with an intact @fjall/components-infrastructure install (reinstall dependencies if this persists).`,e,n);const t=n===void 0?void 0:l(n);if(t===void 0)return s("indeterminate",`This assembly requires deploy engine >= ${e.minimumEngineVersion}, but the running engine version could not be determined. Cannot verify compatibility. Reinstall the fjall engine if this persists.`,e,n);if(y(t,d)<0)return s("engine-too-old",`This assembly was synthesised by @fjall/components-infrastructure ${e.synthesisedBy||"(unknown version)"} and requires deploy engine >= ${e.minimumEngineVersion}, but the running engine is ${n}. Upgrade the fjall engine to at least ${e.minimumEngineVersion} to deploy this assembly.`,e,n);if(e.minimumAwsCdkCli!==void 0){const u=l(e.minimumAwsCdkCli);if(u===void 0)return s("malformed-constraint",`This assembly declares an unparseable minimum aws-cdk CLI version ("${e.minimumAwsCdkCli}"). Cannot verify compatibility. Re-synth with an intact @fjall/components-infrastructure install (reinstall dependencies if this persists).`,e,n);const c=a===void 0?void 0:l(a);if(c===void 0)return s("indeterminate",`This assembly requires the deploy engine's bundled aws-cdk CLI to be >= ${e.minimumAwsCdkCli}, but the running CLI version could not be determined (the engine's bundled aws-cdk install may be broken). Cannot verify compatibility. Reinstall the fjall engine if this persists.`,e,n);if(y(c,u)<0)return s("cdk-cli-too-old",`This assembly was synthesised by @fjall/components-infrastructure ${e.synthesisedBy||"(unknown version)"} and requires the deploy engine's bundled aws-cdk CLI to be >= ${e.minimumAwsCdkCli}, but it is ${a}. Upgrade the fjall engine (which bundles the aws-cdk CLI) to deploy this assembly.`,e,n)}return e.maximumEngineMajor!==void 0&&t.major>e.maximumEngineMajor?s("engine-ahead",`The running deploy engine (${n}) is a newer major than the maximum (${e.maximumEngineMajor}) this assembly was validated against. Proceeding \u2014 re-verify the deploy if you see unexpected infrastructure changes.`,e,n):s("ok",`Deploy engine ${n} satisfies the assembly's minimum (${e.minimumEngineVersion}).`,e,n)}m(A,"evaluateEngineCompat");function L(){const r=process.env[h];return r!==void 0&&r!==""}m(L,"engineSkewOverrideFromEnv");function O(){try{const r=E(import.meta.url),i=JSON.parse(C(r.resolve("aws-cdk/package.json"),"utf8"));return typeof i.version=="string"&&i.version.length>0?i.version:void 0}catch(r){g.debug(p,"Could not resolve bundled aws-cdk CLI version for the FM1 floor check",{error:v(r instanceof Error?r.message:String(r))});return}}m(O,"resolveRunningAwsCdkCliVersion");function P(r){const{cdkOutPath:i,runningEngineVersion:n=$,runningAwsCdkCliVersion:o=O(),allowEngineSkew:a,onWarning:e}=r,d=k(i),t=A({envelope:d,runningEngineVersion:n,maxSupportedManifestVersion:V,runningAwsCdkCliVersion:o}),u=j[t.kind];return u==="proceed"?f(t):u==="warn"?(g.warn(p,"Engine/assembly compatibility warning",{kind:t.kind,detail:t.message}),e?.(t.message),f(t)):a===!0||L()?(g.warn(p,"Engine/assembly compatibility gate OVERRIDDEN",{kind:t.kind,detail:t.message,via:a===!0?"parameter":h}),e?.(`Engine compatibility gate overridden \u2014 ${t.message}`),f(t)):w(new Error(`${t.message} To override this refusal after verifying the pairing yourself, set ${h}=1 and re-run (audit-logged; deploying across an engine skew can make silently wrong infrastructure changes).`))}m(P,"assertEngineCompatibleWithAssembly");export{P as assertEngineCompatibleWithAssembly,A as evaluateEngineCompat};
+var O=Object.defineProperty;var m=(t,i)=>O(t,"name",{value:i,configurable:!0});import{readFileSync as A}from"node:fs";import{createRequire as S}from"node:module";import{success as u,failure as p}from"@fjall/generator";import{logger as y}from"@fjall/util/logger";import{maskSensitiveOutput as I,CapacityIdentityWireSchema as N}from"@fjall/util";import{readEngineCompatEnvelope as v,readManifestAppNameOutcome as R,MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION as T}from"@fjall/util/manifest";import{DEPLOY_CORE_VERSION as L}from"../../version.js";const h="engineCompat",b="FJALL_ALLOW_ENGINE_SKEW",_={ok:"proceed","no-constraint":"proceed","engine-ahead":"warn","engine-too-old":"refuse","cdk-cli-too-old":"refuse","shape-too-new":"refuse","malformed-constraint":"refuse",indeterminate:"refuse"};function c(t){const i=t.trim().replace(/^v/i,"").split(/[-+]/)[0]??"";if(i.length===0)return;const n=i.split(".");if(n.length>3||!n.every(a=>/^\d+$/.test(a)))return;const r=Number(n[0]),o=n.length>1?Number(n[1]):0,e=n.length>2?Number(n[2]):0;return{major:r,minor:o,patch:e}}m(c,"parseEngineVersion");function E(t,i){return t.major!==i.major?t.major-i.major:t.minor!==i.minor?t.minor-i.minor:t.patch-i.patch}m(E,"compareEngineVersions");function d(t,i,n,r){return{kind:t,message:i,engineCompat:n,runningEngineVersion:r}}m(d,"verdict");function x(t){const{envelope:i,runningEngineVersion:n,maxSupportedManifestVersion:r,runningAwsCdkCliVersion:o}=t;if(i.manifestVersion!==void 0&&i.manifestVersion>r)return d("shape-too-new",`This assembly declares manifest schema version ${i.manifestVersion}, but this deploy engine (${n??"unknown"}) reads at most version ${r}. Upgrade fjall to deploy this assembly.`,i.engineCompat,n);if(i.engineCompatPresent&&i.engineCompat===void 0)return d("malformed-constraint","This assembly carries an engine-compatibility block with no usable `minimumEngineVersion`. Cannot verify the deploy engine is compatible. Re-synth with an intact @fjall/components-infrastructure install (reinstall dependencies if this persists).",void 0,n);const e=i.engineCompat;if(e===void 0)return d("no-constraint","Assembly declares no engine-compatibility constraint.",void 0,n);const a=c(e.minimumEngineVersion);if(a===void 0)return d("malformed-constraint",`This assembly declares an unparseable minimum engine version ("${e.minimumEngineVersion}"). Cannot verify compatibility. Re-synth with an intact @fjall/components-infrastructure install (reinstall dependencies if this persists).`,e,n);const s=n===void 0?void 0:c(n);if(s===void 0)return d("indeterminate",`This assembly requires deploy engine >= ${e.minimumEngineVersion}, but the running engine version could not be determined. Cannot verify compatibility. Reinstall the fjall engine if this persists.`,e,n);if(E(s,a)<0)return d("engine-too-old",`This assembly was synthesised by @fjall/components-infrastructure ${e.synthesisedBy||"(unknown version)"} and requires deploy engine >= ${e.minimumEngineVersion}, but the running engine is ${n}. Upgrade the fjall engine to at least ${e.minimumEngineVersion} to deploy this assembly.`,e,n);if(e.minimumAwsCdkCli!==void 0){const l=c(e.minimumAwsCdkCli);if(l===void 0)return d("malformed-constraint",`This assembly declares an unparseable minimum aws-cdk CLI version ("${e.minimumAwsCdkCli}"). Cannot verify compatibility. Re-synth with an intact @fjall/components-infrastructure install (reinstall dependencies if this persists).`,e,n);const f=o===void 0?void 0:c(o);if(f===void 0)return d("indeterminate",`This assembly requires the deploy engine's bundled aws-cdk CLI to be >= ${e.minimumAwsCdkCli}, but the running CLI version could not be determined (the engine's bundled aws-cdk install may be broken). Cannot verify compatibility. Reinstall the fjall engine if this persists.`,e,n);if(E(f,l)<0)return d("cdk-cli-too-old",`This assembly was synthesised by @fjall/components-infrastructure ${e.synthesisedBy||"(unknown version)"} and requires the deploy engine's bundled aws-cdk CLI to be >= ${e.minimumAwsCdkCli}, but it is ${o}. Upgrade the fjall engine (which bundles the aws-cdk CLI) to deploy this assembly.`,e,n)}return e.maximumEngineMajor!==void 0&&s.major>e.maximumEngineMajor?d("engine-ahead",`The running deploy engine (${n}) is a newer major than the maximum (${e.maximumEngineMajor}) this assembly was validated against. Proceeding \u2014 re-verify the deploy if you see unexpected infrastructure changes.`,e,n):d("ok",`Deploy engine ${n} satisfies the assembly's minimum (${e.minimumEngineVersion}).`,e,n)}m(x,"evaluateEngineCompat");function P(){const t=process.env[b];return t!==void 0&&t!==""}m(P,"engineSkewOverrideFromEnv");function M(){try{const t=S(import.meta.url),i=JSON.parse(A(t.resolve("aws-cdk/package.json"),"utf8"));return typeof i.version=="string"&&i.version.length>0?i.version:void 0}catch(t){y.debug(h,"Could not resolve bundled aws-cdk CLI version for the FM1 floor check",{error:I(t instanceof Error?t.message:String(t))});return}}m(M,"resolveRunningAwsCdkCliVersion");function Y(t){const{cdkOutPath:i,runningEngineVersion:n=L,runningAwsCdkCliVersion:r=M(),allowEngineSkew:o,onWarning:e}=t,a=v(i),s=x({envelope:a,runningEngineVersion:n,maxSupportedManifestVersion:T,runningAwsCdkCliVersion:r}),l=_[s.kind];return l==="proceed"?u(s):l==="warn"?(y.warn(h,"Engine/assembly compatibility warning",{kind:s.kind,detail:s.message}),e?.(s.message),u(s)):o===!0||P()?(y.warn(h,"Engine/assembly compatibility gate OVERRIDDEN",{kind:s.kind,detail:s.message,via:o===!0?"parameter":b}),e?.(`Engine compatibility gate overridden \u2014 ${s.message}`),u(s)):p(new Error(`${s.message} To override this refusal after verifying the pairing yourself, set ${b}=1 and re-run (audit-logged; deploying across an engine skew can make silently wrong infrastructure changes).`))}m(Y,"assertEngineCompatibleWithAssembly");const w=7;function K(t){const{cdkOutPath:i,capacityIdentityWire:n,appName:r}=t;if(n===void 0)return u(void 0);let o;try{o=JSON.parse(n)}catch{o=void 0}const e=N.safeParse(o);if(!e.success)return p(new Error(`The capacity-identity pin context for this deploy could not be parsed, so the pin/constructs compatibility gate cannot verify app "${r}" is safe to deploy. Re-run the deploy; if this persists, validate the capacityIdentity block in fjall-config.json with 'fjall migrate identity'.`));const a=R(i);if(a.status==="unreadable")return p(new Error(`The assembly manifest under "${i}" is present but could not be read, so the pin/constructs compatibility gate cannot verify app "${r}" is safe to deploy (the pin context is keyed by the manifest's app name). Re-synth the assembly; if this persists, validate the capacityIdentity block in fjall-config.json with 'fjall migrate identity'.`));const s=new Set([r.toLowerCase()]);a.status==="ok"&&a.appName!==void 0&&s.add(a.appName.toLowerCase());const l=new Set;for(const[j,$]of Object.entries(e.data))if(s.has(j.toLowerCase()))for(const V of Object.keys($))l.add(V);if(l.size===0)return u(void 0);const g=v(i).engineCompat?.minimumEngineVersion,C=g!==void 0?c(g):void 0;if(C!==void 0&&C.major>=w)return u(void 0);const k=[...l].sort().join(", ");return p(new Error(`App "${r}" carries capacity-identity pins (slot(s): ${k}), but this assembly was synthesised by constructs that predate the pin-consuming anchor model (assembly engine floor: ${g??"none declared"}; pins require >=${w}.0.0). Deploying it would silently ignore the pins and re-derive capacity identity from config, which can plan an unconsented rename of stateful resources. Restore the @fjall/components-infrastructure pin to >=${w}.0.0 and re-synth, or revert the capacity config to its pre-pin values and remove the app's capacityIdentity entries from fjall-config.json.`))}m(K,"assertCapacityPinsSupportedByAssembly");export{w as CAPACITY_PIN_CONSTRUCTS_FLOOR_MAJOR,K as assertCapacityPinsSupportedByAssembly,Y as assertEngineCompatibleWithAssembly,x as evaluateEngineCompat};

package/dist/src/orchestration/application/plan/computeDeployPlan.d.ts

@@ -5,13 +5,22 @@
  * contributes an empty baseline (every resource is a creation).
  */
 import { type Result } from "@fjall/generator";
-import type { CloudFormationError } from "../../../services/infrastructure/CloudFormationService.js";
+import type { ManifestCapacityAlias } from "@fjall/util/manifest";
+import type { CloudFormationError, StackResourceSummaryRow } from "../../../services/infrastructure/CloudFormationService.js";
 import type { CfnRegistrySummaryReader } from "../../../services/infrastructure/CfnRegistryService.js";
 import type { ChangeSetProbeRunner } from "../../../services/infrastructure/changeSetProbe.js";
 import type { DeployPlan } from "./types.js";
 /** The narrow CFN read surface the gate needs — CloudFormationService satisfies it. */
 export interface CfnTemplateReader {
     getTemplate(stackName: string, abortSignal?: AbortSignal): Promise<Result<string, CloudFormationError>>;
+    /**
+     * Optional live resource-listing capability for the rename-detection
+     * overlay's physical-ID anchoring. Absent on adapters that only read
+     * templates (the domain-deploy reader); rename detection then runs
+     * structurally — findings carry no physical IDs and matcher (b) cannot
+     * fire, but detection itself still happens.
+     */
+    listStackResources?(stackName: string, abortSignal?: AbortSignal): Promise<Result<StackResourceSummaryRow[], CloudFormationError>>;
 }
 export interface ComputeDeployPlanStack {
     stackName: string;
@@ -32,6 +41,12 @@ export interface ComputeDeployPlanParams {
      * verdicts stay worst-cased into the ceremony (the sanctioned D2 fallback).
      */
     changeSetProbe?: ChangeSetProbeRunner;
+    /**
+     * The synthesised manifest's capacity-identity aliases, for the
+     * rename-detection overlay's matcher (a). Optional — absent (pre-emitter
+     * assemblies, missing manifest) detection degrades to matchers (b)–(d).
+     */
+    identityAliases?: readonly ManifestCapacityAlias[];
     abortSignal?: AbortSignal;
 }
 export declare function computeDeployPlan(params: ComputeDeployPlanParams): Promise<Result<DeployPlan, Error>>;

package/dist/src/orchestration/application/plan/computeDeployPlan.js

@@ -1 +1 @@
-var f=Object.defineProperty;var l=(e,t)=>f(e,"name",{value:t,configurable:!0});import{success as s,failure as n}from"@fjall/generator";import{maskSensitiveOutput as u}from"@fjall/util";import{isAborted as p}from"../../../aws/organisations/types.js";import{buildDeployPlan as d}from"./buildDeployPlan.js";import{applyChangeSetEscalation as g}from"./changeSetEscalation.js";import{applyRegistryOverlay as m}from"./registryOverlay.js";function y(e){const t=e.trim();if(t==="")return s({});try{return s(JSON.parse(t))}catch(r){return n(new Error(`Failed to parse deployed template: ${u(r instanceof Error?r.message:String(r))}`))}}l(y,"parseTemplateBody");async function E(e){const t=[];for(const i of e.stacks){if(p(e.abortSignal))return n(new Error("Deploy-plan computation aborted"));const o=await e.cfnService.getTemplate(i.stackName,e.abortSignal);let c={};if(o.success){const a=y(o.data);if(!a.success)return n(a.error);c=a.data}else if(o.error.errorType!=="stack_not_found")return n(o.error);t.push({stackName:i.stackName,oldTemplate:c,newTemplate:i.newTemplate})}let r=d(t,e.assemblyDigest);return e.registry!==void 0&&(r=await m({plan:r,registry:e.registry,stacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})),e.changeSetProbe!==void 0&&(r=await g({plan:r,probe:e.changeSetProbe,stacks:t,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})),s(r)}l(E,"computeDeployPlan");export{E as computeDeployPlan};
+var g=Object.defineProperty;var c=(e,r)=>g(e,"name",{value:r,configurable:!0});import{success as l,failure as a}from"@fjall/generator";import{maskSensitiveOutput as d}from"@fjall/util";import{logger as p}from"@fjall/util/logger";import{isAborted as u}from"../../../aws/organisations/types.js";import{buildDeployPlan as m}from"./buildDeployPlan.js";import{applyChangeSetEscalation as y}from"./changeSetEscalation.js";import{applyRegistryOverlay as S}from"./registryOverlay.js";import{applyRenameDetection as b,renameCandidateStackNames as k}from"./renameDetection.js";const w="ComputeDeployPlan";function h(e){const r=e.trim();if(r==="")return l({});try{return l(JSON.parse(r))}catch(t){return a(new Error(`Failed to parse deployed template: ${d(t instanceof Error?t.message:String(t))}`))}}c(h,"parseTemplateBody");async function O(e){const r=[];for(const i of e.stacks){if(u(e.abortSignal))return a(new Error("Deploy-plan computation aborted"));const n=await e.cfnService.getTemplate(i.stackName,e.abortSignal);let o={};if(n.success){const s=h(n.data);if(!s.success)return a(s.error);o=s.data}else if(n.error.errorType!=="stack_not_found")return a(n.error);r.push({stackName:i.stackName,oldTemplate:o,newTemplate:i.newTemplate})}let t=m(r,e.assemblyDigest);e.registry!==void 0&&(t=await S({plan:t,registry:e.registry,stacks:r,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})),e.changeSetProbe!==void 0&&(t=await y({plan:t,probe:e.changeSetProbe,stacks:r,...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}}));const f=k(t);if(f.length>0){const i=new Map;if(e.cfnService.listStackResources!==void 0)for(const n of f){if(u(e.abortSignal))break;const o=await e.cfnService.listStackResources(n,e.abortSignal);o.success?i.set(n,o.data):o.error.errorType!=="stack_not_found"&&p.warn(w,"Stack resource listing unavailable",{stackName:n,error:d(o.error.message)})}t=b({plan:t,stacks:r,physicalResources:i,...e.identityAliases!==void 0?{identityAliases:e.identityAliases}:{}})}return l(t)}c(O,"computeDeployPlan");export{O as computeDeployPlan};

package/dist/src/orchestration/application/plan/loadDeployPlan.js

@@ -1 +1 @@
-var a=Object.defineProperty;var o=(e,t)=>a(e,"name",{value:t,configurable:!0});import{join as l}from"node:path";import{readFile as s}from"node:fs/promises";import{failure as f}from"@fjall/generator";import{maskSensitiveOutput as d}from"@fjall/util";import{computeDeployPlan as u}from"./computeDeployPlan.js";async function g(e){const t=[];for(const r of e.changedStacks){const c=l(e.cdkOutPath,`${r}.template.json`);let i;try{i=JSON.parse(await s(c,"utf8"))}catch(n){return f(new Error(d(`Failed to read synthesised template for ${r}: ${n instanceof Error?n.message:String(n)}`)))}t.push({stackName:r,newTemplate:i})}return u({cfnService:e.cfnService,stacks:t,assemblyDigest:e.assemblyDigest,...e.registry!==void 0?{registry:e.registry}:{},...e.changeSetProbe!==void 0?{changeSetProbe:e.changeSetProbe}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})}o(g,"loadDeployPlan");function P(e){let t;return()=>(t??=g(e),t)}o(P,"createMemoisedPlanLoader");export{P as createMemoisedPlanLoader,g as loadDeployPlan};
+var s=Object.defineProperty;var i=(e,t)=>s(e,"name",{value:t,configurable:!0});import{join as f}from"node:path";import{readFile as l}from"node:fs/promises";import{failure as d}from"@fjall/generator";import{maskSensitiveOutput as u}from"@fjall/util";import{readManifestFile as m}from"@fjall/util/manifest";import{computeDeployPlan as g}from"./computeDeployPlan.js";async function y(e){const t=[];for(const n of e.changedStacks){const c=f(e.cdkOutPath,`${n}.template.json`);let a;try{a=JSON.parse(await l(c,"utf8"))}catch(r){return d(new Error(u(`Failed to read synthesised template for ${n}: ${r instanceof Error?r.message:String(r)}`)))}t.push({stackName:n,newTemplate:a})}const o=(await m(e.cdkOutPath))?.identityAliases;return g({cfnService:e.cfnService,stacks:t,assemblyDigest:e.assemblyDigest,...o!==void 0?{identityAliases:o}:{},...e.registry!==void 0?{registry:e.registry}:{},...e.changeSetProbe!==void 0?{changeSetProbe:e.changeSetProbe}:{},...e.abortSignal!==void 0?{abortSignal:e.abortSignal}:{}})}i(y,"loadDeployPlan");function O(e){let t;return()=>(t??=y(e),t)}i(O,"createMemoisedPlanLoader");export{O as createMemoisedPlanLoader,y as loadDeployPlan};

package/dist/src/orchestration/application/plan/renameDetection.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Rename-detection overlay — the third plan overlay (after the registry
+ * verdict overlay and the change-set escalation), applied by
+ * `computeDeployPlan`. It recognises identity-caused replacements: a
+ * DELETE+CREATE pair (or subtree of pairs) that is really ONE resource whose
+ * logical identity changed, so deploying unremediated would orphan/delete the
+ * live resource and boot the app against a fresh empty twin (the D9 class).
+ *
+ * Candidacy is structural; confirmation is evidential — two separate steps:
+ *
+ * **Candidacy.** Same-resource-type DELETE and CREATE rows whose hash-stripped
+ * logical IDs differ in exactly one contiguous middle segment become a residue
+ * hypothesis `(oldResidue → newResidue)`. Applying the substitution to every
+ * delete-side ID that carries the residue must reproduce a create-side ID of
+ * the same type, role-for-role — the rows so paired form a candidate SUBTREE.
+ * Each ID pair hypothesises both the minimal middle and a suffix-expanded
+ * variant ({@link deriveResiduePairs}); the survivor is selected by the
+ * pair-set dedupe, subsumption (long-middle derivations from deep descendant
+ * pairs collapse into the root hypothesis) and the cross-role noise drop.
+ * Descendants whose IDs carry the residue mid-string (the
+ * GracefulTermination / PersistentDataVolume members) ride the same
+ * substitution with no separate pass. Role-matching is truncation-aware
+ * ({@link substitutionReproducesId}): a delete-side ID sitting at CDK's
+ * 240-char human-prefix clip matches by prefix, because a rename that
+ * shortens the path un-clips the create side — exact equality is
+ * structurally impossible for those members (the live Analytics stack
+ * carries 15 such IDs).
+ *
+ * **Confirmation matchers, precedence order:**
+ *   (a) identity-alias testimony — the synthesised manifest's
+ *       `identityAliases` entries are the emitter's own statement of the
+ *       legacy→current anchor substitution it performed. A hypothesis
+ *       confirms when one alias's substitution reproduces EVERY pair in the
+ *       subtree (each delete-side ID carries the legacy anchor and replacing
+ *       it yields the create-side ID, truncation-aware). Pinned aliases
+ *       (anchor frozen to the legacy anchor) assert "identity unchanged" and
+ *       confirm nothing.
+ *   (b) physical-ID anchoring — the delete row's live physical ID (from the
+ *       stack resource list) is reproduced inside the create row's template
+ *       properties (the general stateful-rename shape, e.g. an Aurora restore
+ *       carrying the old cluster identifier).
+ *   (c) property digest — the delete row's properties, with references to
+ *       paired logical IDs remapped, deep-equal the create row's properties
+ *       (rename-only refactors).
+ *   (d) singleton subtree — a MULTI-member candidate subtree with no
+ *       contending pairing in the stack confirms by itself: no alternative
+ *       pairing exists. This is the matcher that carries the D9 class, where
+ *       a config-derived rename changes properties on every member so (c) can
+ *       never match and (b) never holds for capacity resources.
+ *
+ * **Failure shapes fail closed.** Contending hypotheses that no evidential
+ * matcher disambiguates → `rename-ambiguous` per touched delete row, no pin
+ * offer. A candidate subtree with a member that cannot be role-matched
+ * (ID-truncation boundary or otherwise) taints its whole contention component
+ * to `rename-ambiguous` rather than leaving that member — possibly a Retain
+ * volume — on its old classification. When a hypothesis in a contended
+ * component IS evidentially confirmed, its rows are consumed and the
+ * survivors re-resolved on their own merits (a disjoint second rename
+ * re-confirms or fails closed — never a silent drop). Multiple confirmed
+ * hypotheses escalate to `rename-ambiguous` only when they CONTEST a row:
+ * disjoint confirmed renames (a multi-slot migration) are bridged into one
+ * component only by unconfirmed cross-pairings and each wins independently
+ * via the peel. A lone same-type delete+create with no evidential
+ * confirmation is NOT a pair and keeps its existing classification.
+ *
+ * Pure module — no IO. `computeDeployPlan` prefetches the per-stack physical
+ * resource lists (via the optional `listStackResources` capability) and the
+ * template pairs; same-stack pairing only in this release.
+ */
+import type { ManifestCapacityAlias } from "@fjall/util/manifest";
+import type { StackResourceSummaryRow } from "../../../services/infrastructure/CloudFormationService.js";
+import type { StackTemplatePair } from "./buildDeployPlan.js";
+import type { DeployPlan } from "./types.js";
+/**
+ * One live physical resource row — the overlay-facing name for the
+ * CloudFormation service's listing row (coupled shapes, single declaration).
+ */
+export type StackPhysicalResource = StackResourceSummaryRow;
+/**
+ * Strip the trailing 8-hex CDK path hash. Uniform on both sides — the hash
+ * changes exactly when the construct path changes, which is the signal the
+ * residue grammar must ignore. Single-component IDs carry no hash and pass
+ * through unchanged (they also never match 8 trailing uppercase hex).
+ */
+export declare function stripTrailingHash(logicalId: string): string;
+/**
+ * CDK's `makeUniqueId` clips the human-readable prefix of a logical ID to
+ * 240 characters (the 8-hex hash rides on top, giving the 248-char IDs in
+ * live capacity stacks). An identity rename that SHORTENS the path — a
+ * 46-char config-derived anchor collapsing to `Primary` — undoes the clip on
+ * the create side: the delete-side ID is a truncated spelling of a path
+ * whose renamed twin is complete, so exact substitution equality can never
+ * hold for such pairs.
+ */
+export declare const CDK_LOGICAL_ID_HUMAN_CLIP_LENGTH = 240;
+/**
+ * Does substituting `oldToken` → `newToken` throughout `oldStripped`
+ * reproduce `newStripped`? Exact equality short-circuits; when either side
+ * sits at the CDK human-prefix clip the comparison downgrades to prefix
+ * containment, after trimming a trailing partial token occurrence from the
+ * clipped side. Prefix semantics are sound here because the clip only ever
+ * removes a suffix: the substituted spelling of everything the clipped side
+ * still shows must open the complete twin verbatim. Each containment
+ * direction is licensed ONLY by its own side's clip — a clipped old ID may
+ * be extended by the twin (the twin restores the cut suffix), and a clipped
+ * new ID may stop short of the reconstruction; without that gating, any
+ * short junk twin that happens to open the reconstruction would pass.
+ */
+export declare function substitutionReproducesId(oldStripped: string, newStripped: string, oldToken: string, newToken: string): boolean;
+interface ResiduePair {
+    oldResidue: string;
+    newResidue: string;
+}
+/**
+ * Derive the residue-pair hypotheses from two hash-stripped IDs: longest
+ * common prefix, then longest common suffix of the remainders, leaving one
+ * contiguous differing middle per side. Both middles must be non-empty (an
+ * identity segment added from nothing is not a rename).
+ *
+ * TWO variants are hypothesised when they differ: the minimal middle, and a
+ * suffix-expanded one (both sides gain the SAME characters, so substitution
+ * semantics on true members are unchanged). The minimal variant unifies a
+ * subtree whose identity segment is short relative to the role text that
+ * follows it (expansion would swallow role characters and fragment the
+ * subtree into per-role singles); the expanded variant survives when the
+ * minimal middle over-captures unrelated rows and taints itself. The
+ * pair-set dedupe (prefers tainted — fail closed), subsumption and noise
+ * drops in `resolveStack` select the survivor.
+ */
+export declare function deriveResiduePairs(oldId: string, newId: string): ResiduePair[];
+/**
+ * Pure structural pre-check: the stacks that carry at least one same-type
+ * DELETE+CREATE residue pair. `computeDeployPlan` fetches physical resource
+ * lists only for these, so a rename-free deploy issues zero extra calls.
+ */
+export declare function renameCandidateStackNames(plan: DeployPlan): string[];
+export interface ApplyRenameDetectionParams {
+    plan: DeployPlan;
+    /** The diffed template pairs — matchers (b) and (c) read Properties. */
+    stacks: readonly StackTemplatePair[];
+    /**
+     * Live physical resources per stack name. Missing or empty entries degrade
+     * gracefully: matcher (b) cannot fire and findings carry no physical ID,
+     * but structural detection ((c)/(d)) still runs.
+     */
+    physicalResources: ReadonlyMap<string, readonly StackPhysicalResource[]>;
+    /**
+     * Matcher (a) input: the synthesised manifest's capacity-identity aliases
+     * (emitter testimony). Optional — when absent (pre-emitter manifests, a
+     * missing/corrupt manifest) the matcher never fires and (b)/(c)/(d) carry
+     * detection alone.
+     */
+    identityAliases?: readonly ManifestCapacityAlias[];
+}
+/**
+ * Apply the rename-detection overlay. Pure; never fails the plan. Actions and
+ * counts are unchanged — only the rename annotations, the destructive flag
+ * and data-loss risk on escalated delete rows, and the derived summary move.
+ */
+export declare function applyRenameDetection(params: ApplyRenameDetectionParams): DeployPlan;
+export {};

package/dist/src/orchestration/application/plan/renameDetection.js

@@ -0,0 +1,3 @@
+var v=Object.defineProperty;var u=(e,t)=>v(e,"name",{value:t,configurable:!0});import{isStatefulResourceType as z}from"./classify.js";import{resourcePropertiesFromTemplate as D}from"./pinnedNames.js";import{renderPlanSummary as G}from"./renderDeployPlan.js";const J=8,W=8,U=/[0-9A-F]{8}$/;function b(e){return e.length<=8?e:U.test(e.slice(-8))?e.slice(0,-8):e}u(b,"stripTrailingHash");const L=240;function O(e,t){for(let n=Math.min(t.length-1,e.length);n>=1;n--)if(t.startsWith(e.slice(-n)))return e.slice(0,-n);return e}u(O,"trimTrailingTokenFragment");function I(e,t,n,r){const a=e.split(n).join(r);if(a===t)return!0;const m=e.length>=L,h=t.length>=L;if(!m&&!h)return!1;const l=m?O(a,n):a,i=h?O(t,r):t;return l===""||i===""?!1:m&&i.startsWith(l)?!0:h&&l.startsWith(i)}u(I,"substitutionReproducesId");function B(e,t){if(e===t)return[];let n=0;const r=Math.min(e.length,t.length);for(;n<r&&e[n]===t[n];)n+=1;let a=0;const m=Math.min(e.length,t.length)-n;for(;a<m&&e[e.length-1-a]===t[t.length-1-a];)a+=1;const h=e.slice(n,e.length-a),l=t.slice(n,t.length-a);if(h===""||l==="")return[];const i={oldResidue:h,newResidue:l},g=Math.min(h.length,l.length),A=Math.min(Math.max(0,J-g),a);if(A===0)return[i];const f=e.slice(e.length-a,e.length-a+A);return[i,{oldResidue:h+f,newResidue:l+f}]}u(B,"deriveResiduePairs");function V(e,t,n,r){const a=t.filter(y=>b(y.address).includes(e.oldResidue)),m=n.filter(y=>b(y.address).includes(e.newResidue)),h=[],l=new Set,i=u(y=>m.filter(S=>S.resourceType===y.resourceType&&I(b(y.address),b(S.address),e.oldResidue,e.newResidue)&&!l.has(S.address)),"candidatesFor"),g=new Map,A=new Map,f=u((y,S,s)=>{const d=y.get(s);if(d!==void 0)return d;const o=[],c=D(S,s);return c!==void 0&&H(c,o),y.set(s,o),o},"stringsOf"),P=u((y,S)=>{let s=!1;const d=f(g,r?.oldTemplate,y.address),o=f(A,r?.newTemplate,S.address);for(const c of h)if(f(g,r?.oldTemplate,c.deleteChange.address).some(C=>C.includes(y.address))&&(s=!0,!f(A,r?.newTemplate,c.createChange.address).some(w=>w.includes(S.address)))||d.some(C=>C.includes(c.deleteChange.address))&&(s=!0,!o.some(C=>C.includes(c.createChange.address))))return!1;return s},"candidateAgrees");let N=[...a],k=!0;for(;k;){k=!1;for(const y of[...N]){const S=i(y);let s;if(S.length===1)s=S[0];else if(S.length>1){const d=S.filter(o=>P(y,o));d.length===1&&(s=d[0])}s!==void 0&&(l.add(s.address),h.push({deleteChange:y,createChange:s}),N=N.filter(d=>d!==y),k=!0)}}const x=N.length>0||l.size!==m.length;return{...e,pairs:h,touchedDeletes:a,integrityFailed:x}}u(V,"coverHypothesis");function X(e){return e.pairs.map(t=>`${t.deleteChange.address} ${t.createChange.address}`).sort().join(`
+`)}u(X,"pairSetKey");function Y(e){const t=e.touchedDeletes.map(n=>n.address).sort().join(`
+`);return`${X(e)}::${t}`}u(Y,"hypothesisKey");function q(e,t){if(e.pairs.length===0||e.pairs.length>=t.pairs.length)return!1;const n=new Set(t.pairs.map(r=>`${r.deleteChange.address} ${r.createChange.address}`));return e.pairs.every(r=>n.has(`${r.deleteChange.address} ${r.createChange.address}`))}u(q,"isSubsumedBy");function Q(e,t){if(e.pairs.length>=t.pairs.length)return!1;const n=new Set(t.pairs.map(a=>a.deleteChange.address)),r=new Set(t.pairs.map(a=>a.createChange.address));return e.touchedDeletes.every(a=>n.has(a.address))&&e.pairs.every(a=>r.has(a.createChange.address))}u(Q,"isNoiseAgainst");function H(e,t){if(typeof e=="string"){t.push(e);return}if(Array.isArray(e)){for(const n of e)H(n,t);return}if(typeof e=="object"&&e!==null)for(const n of Object.values(e))H(n,t)}u(H,"deepStrings");function Z(e,t,n,r){const a=t.get(e.deleteChange.address);if(a===void 0||a.length<W)return!1;const m=D(r,e.createChange.address);if(m===void 0)return!1;const h=[];if(H(m,h),!h.some(g=>g.includes(a)))return!1;const l=D(n,e.deleteChange.address);if(l===void 0)return!0;const i=[];return H(l,i),!i.some(g=>g.includes(a))}u(Z,"physicalIdAnchors");function E(e,t){const n=t.get(e);if(n!==void 0)return n;let r=e;for(const[a,m]of t)r.includes(a)&&(r=r.split(a).join(m));return r}u(E,"remapString");function j(e,t){if(typeof e=="string")return E(e,t);if(Array.isArray(e))return e.map(n=>j(n,t));if(typeof e=="object"&&e!==null){const n={};for(const[r,a]of Object.entries(e))n[E(r,t)]=j(a,t);return n}return e}u(j,"remapValue");function _(e){return Array.isArray(e)?`[${e.map(_).join(",")}]`:typeof e=="object"&&e!==null?`{${Object.entries(e).sort(([n],[r])=>n<r?-1:n>r?1:0).map(([n,r])=>`${JSON.stringify(n)}:${_(r)}`).join(",")}}`:JSON.stringify(e)??"null"}u(_,"canonicalJson");function ee(e,t,n){const r=new Map(e.pairs.map(a=>[a.deleteChange.address,a.createChange.address]));return e.pairs.every(a=>{const m=D(t,a.deleteChange.address),h=D(n,a.createChange.address);return m===void 0||h===void 0?!1:_(j(m,r))===_(h)})}u(ee,"propertyDigestMatches");const te={"identity-alias":"the synthesised manifest's capacity-identity alias names this rename","physical-id":"the new resource's properties reproduce the live physical ID","property-digest":"properties are unchanged apart from the renamed identity",singleton:"the only renamed subtree in the stack"};function se(e,t){return t.find(n=>n.legacyAnchor===n.anchor?!1:e.pairs.every(r=>{const a=b(r.deleteChange.address),m=b(r.createChange.address);return a.includes(n.legacyAnchor)&&I(a,m,n.legacyAnchor,n.anchor)}))}u(se,"confirmingAlias");function K(e,t,n){const r=n>1?` (subtree of ${n} resources)`:"";return`logical identity renamed to ${e.createChange.address} \u2014 ${te[t]}${r}; deploying without remediation deletes or orphans the live resource and recreates a fresh twin under the new identity`}u(K,"detectedCause");function ne(e){const t=e.slice(0,3).join(", "),n=e.length>3?` and ${e.length-3} more`:"";return e.length>0?`identity rename suspected but ambiguous \u2014 candidate new identities: ${t}${n}; no matcher could disambiguate, and remediating against the wrong identity is worse than aborting`:"identity rename suspected but ambiguous \u2014 a renamed subtree member could not be role-matched (possible ID truncation); failing closed"}u(ne,"ambiguousCause");function re(e){const t=new Set(e.changes.map(r=>r.stack)),n=[];for(const r of t){const a=e.changes.filter(l=>l.stack===r&&l.action==="delete"),m=e.changes.filter(l=>l.stack===r&&l.action==="create");a.some(l=>m.some(i=>i.resourceType===l.resourceType&&B(b(l.address),b(i.address)).length>0))&&n.push(r)}return n}u(re,"renameCandidateStackNames");function ae(e){const{deletes:t,creates:n,pair:r,physicalIdByLogicalId:a,identityAliases:m}=e,h=new Map,l=new Map;for(const s of t)for(const d of n){if(d.resourceType!==s.resourceType)continue;const o=B(b(s.address),b(d.address));for(const c of o)l.set(`${c.oldResidue} ${c.newResidue}`,c)}if(l.size===0)return h;let i=[...l.values()].map(s=>V(s,t,n,r)).filter(s=>s.pairs.length>0||s.integrityFailed&&s.touchedDeletes.length>=2);const g=new Map;for(const s of i){const d=Y(s),o=g.get(d);(o===void 0||!o.integrityFailed&&s.integrityFailed)&&g.set(d,s)}i=[...g.values()];const A=i;i=A.filter(s=>!A.some(d=>d!==s&&(q(s,d)||Q(s,d))));const f=new Map,P=new Map;for(const s of i){if(s.integrityFailed){f.set(s,void 0);continue}const d=se(s,m);if(d!==void 0){f.set(s,"identity-alias"),P.set(s,d);continue}if(s.pairs.some(c=>Z(c,a,r?.oldTemplate,r?.newTemplate))){f.set(s,"physical-id");continue}if(ee(s,r?.oldTemplate,r?.newTemplate)){f.set(s,"property-digest");continue}f.set(s,void 0)}const N=u(s=>{const d=[],o=new Set;for(const c of s){if(o.has(c))continue;const p=[c];o.add(c);let C=!0;for(;C;){C=!1;const w=new Set(p.flatMap($=>[...$.pairs.flatMap(M=>[`d:${M.deleteChange.address}`,`c:${M.createChange.address}`]),...$.touchedDeletes.map(M=>`d:${M.address}`)]));for(const $ of s){if(o.has($))continue;($.pairs.some(T=>w.has(`d:${T.deleteChange.address}`)||w.has(`c:${T.createChange.address}`))||$.touchedDeletes.some(T=>w.has(`d:${T.address}`)))&&(p.push($),o.add($),C=!0)}}d.push(p)}return d},"splitComponents"),k=u((s,d)=>{const o=P.get(s),c=o!==void 0?{pinSlotHint:{appName:o.appName,slot:o.slot}}:{};for(const p of s.pairs)h.set(p.deleteChange.address,{finding:"rename-detected",pairedAddress:p.createChange.address,cause:K(p,d,s.pairs.length),...c}),h.set(p.createChange.address,{finding:"rename-detected",pairedAddress:p.deleteChange.address,cause:K(p,d,s.pairs.length),...c})},"markDetected"),x=u(s=>{const d=new Map,o=new Map;for(const c of s){for(const p of c.pairs){o.set(p.deleteChange.address,p.deleteChange);const C=d.get(p.deleteChange.address)??new Set;C.add(p.createChange.address),d.set(p.deleteChange.address,C)}for(const p of c.touchedDeletes)o.set(p.address,p)}for(const[c]of o){const p=[...d.get(c)??[]].sort();h.set(c,{finding:"rename-ambiguous",cause:ne(p)})}},"markAmbiguous"),y=u((s,d)=>{const o=new Set(s.pairs.flatMap(c=>[`d:${c.deleteChange.address}`,`c:${c.createChange.address}`]));return d.pairs.some(c=>o.has(`d:${c.deleteChange.address}`)||o.has(`c:${c.createChange.address}`))},"hypothesesShareRow"),S=u(s=>{const d=s.some(w=>w.integrityFailed),o=s.filter(w=>f.get(w)!==void 0&&!w.integrityFailed);if(o.some((w,$)=>o.some((M,T)=>T>$&&y(w,M)))||d){x(s);return}const p=o[0];if(p!==void 0){const w=f.get(p);w!==void 0&&k(p,w);const $=new Set(p.pairs.map(R=>R.deleteChange.address)),M=new Set(p.pairs.map(R=>R.createChange.address)),T=s.filter(R=>R!==p&&!R.pairs.some(F=>$.has(F.deleteChange.address)||M.has(F.createChange.address)));for(const R of N(T))S(R);return}const C=s[0];if(s.length===1&&C!==void 0&&C.pairs.length>=2){k(C,"singleton");return}s.length>1&&s.some(w=>w.pairs.length>=2)&&x(s)},"resolveComponent");for(const s of N(i))S(s);return h}u(ae,"resolveStack");function le(e){const{plan:t,stacks:n,physicalResources:r,identityAliases:a}=e,m=new Map(n.map(i=>[i.stackName,i])),h=new Map;for(const i of re(t)){const g=new Map;for(const f of r.get(i)??[])f.physicalId!==void 0&&f.physicalId!==""&&g.set(f.logicalId,f.physicalId);const A=ae({deletes:t.changes.filter(f=>f.stack===i&&f.action==="delete"),creates:t.changes.filter(f=>f.stack===i&&f.action==="create"),pair:m.get(i),physicalIdByLogicalId:g,identityAliases:a??[]});A.size>0&&h.set(i,A)}if(h.size===0)return t;const l=t.changes.map(i=>{const g=h.get(i.stack)?.get(i.address);if(g===void 0)return i;if(i.action==="create")return g.pairedAddress===void 0?i:{...i,renamePairedAddress:g.pairedAddress,renameCause:g.cause,...g.pinSlotHint!==void 0?{renameSlotHint:g.pinSlotHint}:{}};if(i.action!=="delete")return i;const A=r.get(i.stack)?.find(f=>f.logicalId===i.address&&f.physicalId!==void 0&&f.physicalId!=="")?.physicalId;return{...i,renameFinding:g.finding,...g.pairedAddress!==void 0?{renamePairedAddress:g.pairedAddress}:{},...A!==void 0?{renamePhysicalId:A}:{},...g.pinSlotHint!==void 0?{renameSlotHint:g.pinSlotHint}:{},renameCause:g.cause,destructive:!0,dataLoss:z(i.resourceType)}});return{...t,changes:l,hasDestructiveChanges:l.some(i=>i.destructive),summary:G({counts:t.counts,changes:l})}}u(le,"applyRenameDetection");export{L as CDK_LOGICAL_ID_HUMAN_CLIP_LENGTH,le as applyRenameDetection,B as deriveResiduePairs,re as renameCandidateStackNames,b as stripTrailingHash,I as substitutionReproducesId};

package/dist/src/orchestration/application/plan/renderDeployPlan.js

@@ -1 +1 @@
-var p=Object.defineProperty;var n=(a,e)=>p(a,"name",{value:e,configurable:!0});const c={create:0,update:1,replace:2,delete:3,read:4,"no-op":5},u={create:"+",update:"~",replace:"\xB1",delete:"-",read:">","no-op":" "};function h(a){const{counts:e}=a,t=[];if(e.create>0&&t.push(`${e.create} to create`),e.update>0&&t.push(`${e.update} to update`),e.replace>0&&t.push(`${e.replace} to replace`),e.delete>0&&t.push(`${e.delete} to destroy`),e.read>0&&t.push(`${e.read} to read`),t.length===0)return"No changes";const s=a.changes.filter(o=>o.destructive).length,d=a.changes.filter(o=>o.dataLoss).length,r=[];s>0&&r.push(`${s} destructive`),d>0&&r.push(`${d} with data loss`);const i=t.join(", ");return r.length>0?`${i} (${r.join(", ")})`:i}n(h,"renderPlanSummary");function f(a){return a.changes.slice().sort((e,t)=>c[e.action]-c[t.action]||`${e.stack}/${e.address}`.localeCompare(`${t.stack}/${t.address}`)).map(e=>{const t=[];e.replacementMode==="may"&&t.push("may replace"),e.replacementMode==="conditional"&&t.push("conditional replace"),e.dataLoss&&t.push("data loss"),e.retained&&t.push("retained"),(e.verdictSource==="cdk-spec (unverified)"||e.verdictSource==="registry (change-set unverified)")&&t.push("unverified");const s=t.length>0?` (${t.join(", ")})`:"";return`${u[e.action]} ${e.action.padEnd(7)} ${e.resourceType}  ${e.stack}/${e.address}${s}`})}n(f,"renderPlanLines");function $(a){return a.changes.map(e=>({address:e.address,resourceType:e.resourceType,action:e.action,stack:e.stack,replacementMode:e.replacementMode,dataLoss:e.dataLoss,...e.propertyChanges.length>0&&{propertyChanges:e.propertyChanges}}))}n($,"toWirePlanChanges");export{f as renderPlanLines,h as renderPlanSummary,$ as toWirePlanChanges};
+var p=Object.defineProperty;var n=(a,e)=>p(a,"name",{value:e,configurable:!0});const u={create:0,update:1,replace:2,delete:3,read:4,"no-op":5},c={create:"+",update:"~",replace:"\xB1",delete:"-",read:">","no-op":" "};function h(a){const{counts:e}=a,t=[];if(e.create>0&&t.push(`${e.create} to create`),e.update>0&&t.push(`${e.update} to update`),e.replace>0&&t.push(`${e.replace} to replace`),e.delete>0&&t.push(`${e.delete} to destroy`),e.read>0&&t.push(`${e.read} to read`),t.length===0)return"No changes";const r=a.changes.filter(d=>d.destructive).length,o=a.changes.filter(d=>d.dataLoss).length,s=[];r>0&&s.push(`${r} destructive`),o>0&&s.push(`${o} with data loss`);const i=t.join(", ");return s.length>0?`${i} (${s.join(", ")})`:i}n(h,"renderPlanSummary");function f(a){return a.changes.slice().sort((e,t)=>u[e.action]-u[t.action]||`${e.stack}/${e.address}`.localeCompare(`${t.stack}/${t.address}`)).map(e=>{const t=[];e.replacementMode==="may"&&t.push("may replace"),e.replacementMode==="conditional"&&t.push("conditional replace"),e.renameFinding==="rename-detected"&&t.push(e.renamePairedAddress!==void 0?`renamed to ${e.renamePairedAddress}`:"rename detected"),e.renameFinding==="rename-ambiguous"&&t.push("rename ambiguous"),e.action==="create"&&e.renamePairedAddress!==void 0&&t.push(`renamed from ${e.renamePairedAddress}`),e.dataLoss&&t.push("data loss"),e.retained&&t.push("retained"),(e.verdictSource==="cdk-spec (unverified)"||e.verdictSource==="registry (change-set unverified)")&&t.push("unverified");const r=t.length>0?` (${t.join(", ")})`:"";return`${c[e.action]} ${e.action.padEnd(7)} ${e.resourceType}  ${e.stack}/${e.address}${r}`})}n(f,"renderPlanLines");function m(a){return a.changes.map(e=>({address:e.address,resourceType:e.resourceType,action:e.action,stack:e.stack,replacementMode:e.replacementMode,dataLoss:e.dataLoss,...e.propertyChanges.length>0&&{propertyChanges:e.propertyChanges}}))}n(m,"toWirePlanChanges");export{f as renderPlanLines,h as renderPlanSummary,m as toWirePlanChanges};

package/dist/src/orchestration/application/plan/types.d.ts

@@ -8,6 +8,14 @@
  * maps a DeployPlan down to the wire shape.
  */
 import type { ChangeCounts, PlanAction, PlanPropertyChange, ReplacementMode } from "../../../types/deployEvent.js";
+import type { DestructionFinding, RenameSlotHint } from "../../../types/destruction.js";
+export type { RenameSlotHint };
+/**
+ * The rename-detection overlay's verdict vocabulary — a deliberate
+ * `Extract<>` narrowing of the canonical {@link DestructionFinding} union
+ * (coupled-union rule: re-derive, never redeclare).
+ */
+export type RenameFinding = Extract<DestructionFinding, "rename-detected" | "rename-ambiguous">;
 /**
  * Which oracle layer produced a row's replacement verdict. Precedence:
  * change-set > registry > cdk-spec. `"change-set"` rows carry the
@@ -59,6 +67,36 @@ export interface DeployPlanResourceChange {
      * ("cannot update a stack when a custom-named resource requires replacing").
      */
     pinnedPhysicalName?: string;
+    /**
+     * Rename-detection overlay verdict, set on the DELETE side of a confirmed
+     * (`rename-detected`) or contested (`rename-ambiguous`) identity-rename
+     * pair. The destruction gate mints the finding from this field ahead of
+     * every other branch — including the retained branch, so a Retain-policy
+     * volume in a renamed subtree still tickets (the D9 escalation).
+     */
+    renameFinding?: RenameFinding;
+    /**
+     * The other side of a CONFIRMED rename pair: the create-side logical ID on
+     * delete rows, the delete-side logical ID on create rows. Absent on
+     * `rename-ambiguous` rows — ambiguity means the pairing is unknown; the
+     * candidates are named in {@link renameCause} instead.
+     */
+    renamePairedAddress?: string;
+    /**
+     * Live physical resource ID from the stack's resource list (delete side
+     * only). The destruction ticket uses it as the consent `physicalName` so
+     * the operator confirms the actual resource (e.g. the EBS volume ID).
+     */
+    renamePhysicalId?: string;
+    /** Human attribution for the ticket cause and the plan renderer. */
+    renameCause?: string;
+    /**
+     * The {appName, slot} the confirming capacity-identity alias named — set
+     * only when matcher (a) confirmed the rename. Present ⇔ the row is
+     * pinnable by the identity-pin remediation; the destruction ticket copies
+     * it so the gate can advertise `pin` for exactly these rows.
+     */
+    renameSlotHint?: RenameSlotHint;
 }
 /** A fully computed deploy plan, ready to render and to gate on. */
 export interface DeployPlan {

package/dist/src/orchestration/contextHelpers.d.ts

@@ -1,4 +1,5 @@
 import { type Result } from "@fjall/generator";
+import { type CapacityIdentityConfig } from "@fjall/util";
 import type { TrailLifecycleState } from "@fjall/util/config";
 import type { ResourceEvent } from "@fjall/util/aws";
 import type { OrgConfig } from "../types/config/orgConfig.js";
@@ -40,6 +41,19 @@ export declare function buildParamsContext(params: {
     fjallAccountGlobalsConfigured?: boolean;
     fjallAccountTrailState?: string;
 };
+/**
+ * Project the surface-supplied capacity-identity pins to this deploy's
+ * target and serialise them for the `-c fjall:capacityIdentity=<json>`
+ * channel. Empty when either half is absent — an unpinned synth of a
+ * pre-7.0 stack renames its capacity resources, which the deploy-time
+ * rename gate blocks rather than this helper guessing a target.
+ */
+export declare function buildCapacityIdentityContext(params: {
+    capacityIdentity?: CapacityIdentityConfig;
+    deployTargetName?: string;
+}): {
+    capacityIdentity?: string;
+};
 /**
  * Effective `skipOidc` for the single-component (platform/account) deploy path.
  *

package/dist/src/orchestration/contextHelpers.js

@@ -1 +1 @@
-var R=Object.defineProperty;var n=(e,r)=>R(e,"name",{value:r,configurable:!0});import{join as w}from"path";import{success as p,failure as i}from"@fjall/generator";import{getErrorMessage as y,maskSensitiveOutput as a,sleep as E}from"@fjall/util";import{logger as S}from"@fjall/util/logger";import{IAMClient as b}from"@aws-sdk/client-iam";import{hasOrganisationTierAccount as h}from"../aws/organisations/accountGlobals.js";import{reconcileOidcProviderAfterDeploy as T}from"../aws/organisations/oidcProvider.js";import{SimpleAwsProvider as _}from"../aws/SimpleAwsProvider.js";import{assertEngineCompatibleWithAssembly as $}from"./application/engineCompat.js";const v={account:"active",draining:"draining",org:"removed"};function K(e,r){return e!==void 0&&e!==""&&r!==void 0&&r!==""&&e!==r}n(K,"targetsNonPrimaryRegion");function J(e){const r=K(e.region,e.primaryRegion);return{...e.orgConfig!==void 0?{orgConfig:JSON.stringify(e.orgConfig)}:{},...e.identity!==void 0?{fjallOrgId:e.identity.fjallOrgId}:{},...e.skipOidc?{fjallOidcConfigured:!0}:{},...r?{fjallAccountGlobalsConfigured:!0}:{},...e.trailLifecycle!==void 0?{fjallAccountTrailState:v[e.trailLifecycle]}:{}}}n(J,"buildParamsContext");function X(e,r,t,o){if(t!==void 0)return t;if(e==="account")return h(r?.providerAccounts)?o===!0:!0}n(X,"resolveAccountBootstrapSkipOidc");function j(e){return e.fjallOrgId!==void 0&&e.fjallOrgId!==""&&e.fjallOidcConfigured!==!0&&e.fjallAccountGlobalsConfigured!==!0}n(j,"synthCarriedOidcConnector");async function q(e,r,t,o){j(e)&&await T(r.getClient(b),t,o)}n(q,"reconcileOidcProviderIfCarried");function M(e){return r=>e.onOutput?.(r)}n(M,"forwardOutput");function H(e){return r=>e.onResourceProgress?.(r)}n(H,"forwardResourceProgress");function Q(e){if(!e.success||e.data.length===0)return;const r={};for(const t of e.data)t.OutputKey&&t.OutputValue!==void 0&&(r[t.OutputKey]=t.OutputValue);return Object.keys(r).length>0?r:void 0}n(Q,"collectStackOutputs");const C="OrganizationAccountAccessRole",m=5,x=5e3,D=3e4;function L(e){return`arn:aws:iam::${e}:role/${C}`}n(L,"buildCascadeRoleArn");function P(e,r){return r===void 0?E(e):r.aborted?Promise.resolve():new Promise(t=>{const o=n(()=>{t()},"onAbort");r.addEventListener("abort",o,{once:!0}),E(e).then(()=>{r.removeEventListener("abort",o),t()})})}n(P,"sleepAbortable");async function Z(e,r,t,o,u){if(!e.assumeRole)return i(new Error("AwsProvider does not support assumeRole"));const d=L(r),s=e.assumeRole.bind(e);let c;for(let f=0;f<=m;f++)try{c=await s(d,o);break}catch(l){const A=l instanceof Error?l.name:void 0;if(A==="AccessDenied"||A==="AccessDeniedException")return i(new Error(`Access denied assuming ${C} in account ${r}. The role may not exist or may not trust the management account.`));if(f<m){const g=Math.min(x*2**f,D);if(S.debug("assumeCascadeRole",`Attempt ${f+1} failed for account ${r}, retrying in ${Math.round(g/1e3)}s`,{error:a(y(l))}),await P(g,u),u?.aborted)return i(new Error(`Aborted while retrying assume-role for account ${r}`));continue}return i(new Error(`Failed to assume role in account ${r} after ${m+1} attempts: ${a(y(l))}`))}if(!c)return i(new Error(`Failed to assume role in account ${r}`));const O=new _({accessKeyId:c.accessKeyId,secretAccessKey:c.secretAccessKey,sessionToken:c.sessionToken,region:t,accountId:r});return p({provider:O,credentials:{accessKeyId:c.accessKeyId,secretAccessKey:c.secretAccessKey,sessionToken:c.sessionToken}})}n(Z,"assumeCascadeRole");function k(e,r){const t=$({cdkOutPath:e,onWarning:n(o=>r.onLog?.(o,"warn"),"onWarning")});return t.success?p(void 0):i(new Error(a(t.error.message)))}n(k,"assertAssemblyEngineCompat");async function ee(e,r,t,o){const u=await e.cdkService.runCdkSynth(r,s=>t.onCdkOutput?.(s,"synth"));if(!u.success){const s=new Error(a(`${o}: ${u.error}`));return t.onError?.(s),i(s)}const d=k(r.assemblyDir??w(r.path,"cdk.out"),t);if(!d.success){const s=new Error(a(d.error.message));return t.onError?.(s),i(s)}return p(void 0)}n(ee,"synthOrFail");async function re(e,r,t,o){t.onCDKBootstrap?.("bootstrapping");const u=await e.cdkService.runCdkBootstrap(r,M(t),void 0,void 0,o);if(!u.success){t.onCDKBootstrap?.("failed");const d=new Error(a(`Bootstrap failed: ${u.error}`));return t.onError?.(d),i(d)}return t.onCDKBootstrap?.("complete"),p(void 0)}n(re,"bootstrapOrFail");export{k as assertAssemblyEngineCompat,Z as assumeCascadeRole,re as bootstrapOrFail,L as buildCascadeRoleArn,J as buildParamsContext,Q as collectStackOutputs,M as forwardOutput,H as forwardResourceProgress,q as reconcileOidcProviderIfCarried,X as resolveAccountBootstrapSkipOidc,j as synthCarriedOidcConnector,ee as synthOrFail,K as targetsNonPrimaryRegion};
+var w=Object.defineProperty;var n=(e,r)=>w(e,"name",{value:r,configurable:!0});import{join as R}from"path";import{success as p,failure as s}from"@fjall/generator";import{getErrorMessage as A,maskSensitiveOutput as a,projectCapacityIdentityToTarget as S,sleep as E}from"@fjall/util";import{logger as T}from"@fjall/util/logger";import{IAMClient as b}from"@aws-sdk/client-iam";import{hasOrganisationTierAccount as h}from"../aws/organisations/accountGlobals.js";import{reconcileOidcProviderAfterDeploy as _}from"../aws/organisations/oidcProvider.js";import{SimpleAwsProvider as $}from"../aws/SimpleAwsProvider.js";import{assertEngineCompatibleWithAssembly as v}from"./application/engineCompat.js";const K={account:"active",draining:"draining",org:"removed"};function j(e,r){return e!==void 0&&e!==""&&r!==void 0&&r!==""&&e!==r}n(j,"targetsNonPrimaryRegion");function X(e){const r=j(e.region,e.primaryRegion);return{...e.orgConfig!==void 0?{orgConfig:JSON.stringify(e.orgConfig)}:{},...e.identity!==void 0?{fjallOrgId:e.identity.fjallOrgId}:{},...e.skipOidc?{fjallOidcConfigured:!0}:{},...r?{fjallAccountGlobalsConfigured:!0}:{},...e.trailLifecycle!==void 0?{fjallAccountTrailState:K[e.trailLifecycle]}:{}}}n(X,"buildParamsContext");function q(e){if(e.capacityIdentity===void 0||e.deployTargetName===void 0)return{};const r=S(e.capacityIdentity,e.deployTargetName);return r!==void 0?{capacityIdentity:JSON.stringify(r)}:{}}n(q,"buildCapacityIdentityContext");function H(e,r,t,o){if(t!==void 0)return t;if(e==="account")return h(r?.providerAccounts)?o===!0:!0}n(H,"resolveAccountBootstrapSkipOidc");function x(e){return e.fjallOrgId!==void 0&&e.fjallOrgId!==""&&e.fjallOidcConfigured!==!0&&e.fjallAccountGlobalsConfigured!==!0}n(x,"synthCarriedOidcConnector");async function Q(e,r,t,o){x(e)&&await _(r.getClient(b),t,o)}n(Q,"reconcileOidcProviderIfCarried");function I(e){return r=>e.onOutput?.(r)}n(I,"forwardOutput");function Z(e){return r=>e.onResourceProgress?.(r)}n(Z,"forwardResourceProgress");function ee(e){if(!e.success||e.data.length===0)return;const r={};for(const t of e.data)t.OutputKey&&t.OutputValue!==void 0&&(r[t.OutputKey]=t.OutputValue);return Object.keys(r).length>0?r:void 0}n(ee,"collectStackOutputs");const C="OrganizationAccountAccessRole",y=5,M=5e3,D=3e4;function L(e){return`arn:aws:iam::${e}:role/${C}`}n(L,"buildCascadeRoleArn");function P(e,r){return r===void 0?E(e):r.aborted?Promise.resolve():new Promise(t=>{const o=n(()=>{t()},"onAbort");r.addEventListener("abort",o,{once:!0}),E(e).then(()=>{r.removeEventListener("abort",o),t()})})}n(P,"sleepAbortable");async function re(e,r,t,o,u){if(!e.assumeRole)return s(new Error("AwsProvider does not support assumeRole"));const d=L(r),i=e.assumeRole.bind(e);let c;for(let f=0;f<=y;f++)try{c=await i(d,o);break}catch(l){const m=l instanceof Error?l.name:void 0;if(m==="AccessDenied"||m==="AccessDeniedException")return s(new Error(`Access denied assuming ${C} in account ${r}. The role may not exist or may not trust the management account.`));if(f<y){const g=Math.min(M*2**f,D);if(T.debug("assumeCascadeRole",`Attempt ${f+1} failed for account ${r}, retrying in ${Math.round(g/1e3)}s`,{error:a(A(l))}),await P(g,u),u?.aborted)return s(new Error(`Aborted while retrying assume-role for account ${r}`));continue}return s(new Error(`Failed to assume role in account ${r} after ${y+1} attempts: ${a(A(l))}`))}if(!c)return s(new Error(`Failed to assume role in account ${r}`));const O=new $({accessKeyId:c.accessKeyId,secretAccessKey:c.secretAccessKey,sessionToken:c.sessionToken,region:t,accountId:r});return p({provider:O,credentials:{accessKeyId:c.accessKeyId,secretAccessKey:c.secretAccessKey,sessionToken:c.sessionToken}})}n(re,"assumeCascadeRole");function k(e,r){const t=v({cdkOutPath:e,onWarning:n(o=>r.onLog?.(o,"warn"),"onWarning")});return t.success?p(void 0):s(new Error(a(t.error.message)))}n(k,"assertAssemblyEngineCompat");async function te(e,r,t,o){const u=await e.cdkService.runCdkSynth(r,i=>t.onCdkOutput?.(i,"synth"));if(!u.success){const i=new Error(a(`${o}: ${u.error}`));return t.onError?.(i),s(i)}const d=k(r.assemblyDir??R(r.path,"cdk.out"),t);if(!d.success){const i=new Error(a(d.error.message));return t.onError?.(i),s(i)}return p(void 0)}n(te,"synthOrFail");async function ne(e,r,t,o){t.onCDKBootstrap?.("bootstrapping");const u=await e.cdkService.runCdkBootstrap(r,I(t),void 0,void 0,o);if(!u.success){t.onCDKBootstrap?.("failed");const d=new Error(a(`Bootstrap failed: ${u.error}`));return t.onError?.(d),s(d)}return t.onCDKBootstrap?.("complete"),p(void 0)}n(ne,"bootstrapOrFail");export{k as assertAssemblyEngineCompat,re as assumeCascadeRole,ne as bootstrapOrFail,q as buildCapacityIdentityContext,L as buildCascadeRoleArn,X as buildParamsContext,ee as collectStackOutputs,I as forwardOutput,Z as forwardResourceProgress,Q as reconcileOidcProviderIfCarried,H as resolveAccountBootstrapSkipOidc,x as synthCarriedOidcConnector,te as synthOrFail,j as targetsNonPrimaryRegion};

package/dist/src/orchestration/index.d.ts

@@ -68,5 +68,7 @@ export { deriveRemovalTemplate, findRemovalDeletionFailures, findResourcesPresen
 export { advertisableDriftVerbs, buildDriftRepairTicket, runDriftRepairGate, type DriftRepairGateOutcome, type RunDriftRepairGateParams } from "./remediation/driftRepairGate.js";
 export { formatPinOutcomeDetail, pinProbeCoverage, renderPinReportLines, runPinRemediation, type PinnedProperty, type PinProbeCoverage, type PinRemediationReport, type PinReportOnlyReason, type PinResourceOutcome, type PinTarget, type RunPinRemediationParams } from "./remediation/pinRemediation.js";
 export { composePostFailureRepairOffer, formatDriftRepairOffer, DriftRepairAvailableError, type ComposePostFailureRepairOfferParams } from "./remediation/postFailureRepairOffer.js";
+export { captureLegacySurfaces, decodeLegacyAnchor, runIdentitySurfaceGate, type CapturedLegacySurfaces, type IdentitySurfaceGateParams, type IdentitySurfaceGateReport, type PinnableRenamePair } from "./remediation/pinIdentity.js";
+export { collectIdentityPinCandidates, degradedIdentityPinOutcomes, renderIdentityPinReportLines, runIdentityPinMigration, type IdentityPinCandidate, type IdentityPinReport, type IdentityPinSlotOutcome, type IdentityPinVerifiedSlot, type LiveTemplateLookup, type RunIdentityPinMigrationParams } from "./remediation/migrateIdentity.js";
 export { checkDeployPathStackAvailability, isDeployPathBlockingStatus, StackUnavailableError } from "./activeDeploymentGuard.js";
 export { assertLeaseBeforeStack, LeaseDeniedError } from "./application/leaseGate.js";

package/dist/src/orchestration/index.js

@@ -1 +1 @@
-import{deploy as t}from"./deploy.js";import{destroy as i}from"./destroy.js";import{restart as n,probeSecretsDrift as s}from"./restart/restartApplication.js";import{computeSecretsDrift as p,deriveStaleParameters as c,extractConsumedSsmParameters as m,ssmParameterNameFromValueFrom as u}from"./restart/secretsDrift.js";import{deployOrganisation as d}from"./organisation/organisationDeploy.js";import{destroyOrganisation as T}from"./organisation/organisationDestroy.js";import{cleanupFailedStack as x,emptyS3Bucket as P,preEmptyStackBuckets as A,formatQuarantineSuspectedMessage as E,formatRetainedBucketsMessage as D,isQuarantineDetail as y,isRetainedBucketsDetail as _,PRE_EMPTY_TAG_KEYS as g,isCleanableState as O,SAFE_CLEANUP_STATES as v}from"./stackCleanup.js";import{partitionAccounts as k,buildRegionList as B,buildAccountRegionPairs as b,cascadeHomeRegion as C,cascadeOperationKey as L}from"./organisation/cascadeHelpers.js";import{projectScalarSummary as I,projectAccountRows as h}from"./organisation/cascadeSummary.js";import{reconcileProviderAccounts as G,mergeReconciledProviderAccounts as K}from"./organisation/reconcileProviderAccounts.js";import{decideNextTransition as Y,reconcileTrailMigration as V,ORG_TRAIL_BUCKET_OUTPUT_KEY as J,TRAIL_BUCKET_OUTPUT_KEY as H,TRAIL_KEY_ARN_OUTPUT_KEY as Q}from"./trailMigration/trailMigration.js";import{decommissionMemberTrailStorage as j}from"./trailMigration/memberTrailCleanup.js";import{unlockBucket as q}from"./unlock/unlockBucket.js";import{unlockQueue as X}from"./unlock/unlockQueue.js";import{triageBucketPolicy as $,isEnforceSslStatement as ee}from"./unlock/bucketPolicyTriage.js";import{toResourcePolicyStatements as te}from"./unlock/toResourcePolicyStatements.js";import{restoreBucketPolicy as ie,synthesiseEnforceSslDocument as ae,ensureEnforceSsl as ne}from"./unlock/restoreBucketPolicy.js";import{restoreAndReconcileQuarantinedBucket as le}from"./unlock/restoreAndReconcileQuarantinedBucket.js";import{parseAccountsConfiguration as ce,flattenAccountsToEnvironments as me,extractAllAccountNames as ue,accountsConfigToOUTree as fe,isStringArray as de,isAccountsConfig as Re,isOuOnlyAccountBucket as Te,OU_ONLY_ACCOUNT_BUCKETS as Se}from"./organisation/accountsConfig.js";import{resolveBuildSecrets as Pe,resolveSecretRefValue as Ae,resolveBuildSecretSessionProvider as Ee,sourcedRefsFromBuildArgs as De}from"./application/buildSecretResolver.js";import{buildBuildSecretSessionPolicy as _e,partitionForRegion as ge}from"./application/buildSecretSession.js";import{buildDeploySessionPolicy as ve}from"./application/deploySessionPolicy.js";import{resolveBuildArgs as ke}from"./application/buildArgResolver.js";import{validateBuildGroup as be}from"./application/buildGroupValidator.js";export*from"./domain/index.js";import{runOpenNextBuild as Ue}from"./application/openNextBuild.js";import{runOrganisationSetup as he,ORG_SETUP_PHASES as Ne}from"./organisation/organisationSetup.js";export*from"./builders/index.js";import{buildDeployPlan as Me,computeDeployPlan as Ye,computeAssemblyDigest as Ve,digestHead as Je,classifyImpact as He,derivePropertyChanges as Qe,isDataLoss as we,isStatefulResourceType as je,renderPlanSummary as We,renderPlanLines as qe,toWirePlanChanges as ze,signApprovalToken as Xe,verifyApprovalToken as Ze,DEFAULT_APPROVAL_TTL_MS as $e,APPROVAL_TOKEN_PATTERN as er}from"./application/plan/index.js";import{runApprovalGate as tr,approvalRefusalReason as or}from"./application/approvalGate.js";import{runDestructionGate as ar,buildDestructionTicket as nr,evaluateDestructionConsents as sr,computeTicketDigest as lr,legalRemediationVerbs as pr,executableRemediationVerbs as cr,advertisableRemediationVerbs as mr,renderDestructionTicketLines as ur,renderConsentVerdictLines as fr}from"./application/destructionGate.js";import{loadDeployPlan as Rr,createMemoisedPlanLoader as Tr}from"./application/plan/loadDeployPlan.js";import{classifyDriftFailure as xr,fetchLastOperationEvents as Pr}from"./drift/classifyDriftFailure.js";import{DriftProbe as Er}from"./drift/driftProbe.js";import{clearDriftSuspects as yr,defaultDriftJournalDir as _r,readDriftSuspects as gr,recordDriftSuspects as Or}from"./drift/driftSuspectJournal.js";import{detectStackDrift as Fr}from"./drift/detectStackDrift.js";import{runDriftPreFlight as Br,formatDriftPreFlightBlock as br,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Cr,DRIFT_PREFLIGHT_BUDGET_MS as Lr}from"./drift/driftPreFlight.js";import{runRoute53RecordPreflight as Ir}from"./drift/route53RecordPreflight.js";import{archiveCompletedRemediationJournal as Nr,computeRemediationOpId as Gr,defaultRemediationJournalDir as Kr,findRemediationJournalByOpId as Mr,listActiveRemediationOps as Yr,listActiveRemediationOpsForContext as Vr,readRemediationJournal as Jr,sweepExpiredRemediationJournals as Hr,writeRemediationJournal as Qr,REMEDIATION_JOURNAL_RETENTION_DAYS as wr}from"./remediation/remediationJournal.js";import{captureRemediationForensics as Wr,defaultRemediationForensicsDir as qr}from"./remediation/forensicsCapture.js";import{applyRetainFlip as Xr,composeFlipCapabilities as Zr,computeTemplateDigest as $r,deriveRetainFlipTemplate as et,findMarkedResourcesByOpId as rt,proveFlipMetadataOnly as tt,readRetainFlipState as ot,verifyRetainFlipDiff as it,FORGET_MARKER_KEY as at,FORGET_FLIP_SPEC as nt,RECREATE_MARKER_KEY as st}from"./remediation/retainFlip.js";import{assessForgetResumability as pt,completeForgetAfterConverge as ct,completeForgetAfterDeploy as mt,formatRecreateInFlightCures as ut,partitionPreFlightByRemediation as ft,runForgetSurgery as dt,synthTemplateDeclaresResource as Rt}from"./remediation/forgetResource.js";import{runRecreateSurgery as St,snapshotPolicyForType as xt,SNAPSHOT_CAPABLE_RESOURCE_TYPES as Pt}from"./remediation/recreateResource.js";import{runRecreatePreFlight as Et}from"./remediation/recreatePreFlight.js";import{deriveRemovalTemplate as yt,findRemovalDeletionFailures as _t,findResourcesPresent as gt,proveRemovalTargetsOnly as Ot}from"./remediation/removalUpdate.js";import{advertisableDriftVerbs as Ft,buildDriftRepairTicket as kt,runDriftRepairGate as Bt}from"./remediation/driftRepairGate.js";import{formatPinOutcomeDetail as Ct,pinProbeCoverage as Lt,renderPinReportLines as Ut,runPinRemediation as It}from"./remediation/pinRemediation.js";import{composePostFailureRepairOffer as Nt,formatDriftRepairOffer as Gt,DriftRepairAvailableError as Kt}from"./remediation/postFailureRepairOffer.js";import{checkDeployPathStackAvailability as Yt,isDeployPathBlockingStatus as Vt,StackUnavailableError as Jt}from"./activeDeploymentGuard.js";import{assertLeaseBeforeStack as Qt,LeaseDeniedError as wt}from"./application/leaseGate.js";export{er as APPROVAL_TOKEN_PATTERN,$e as DEFAULT_APPROVAL_TTL_MS,Lr as DRIFT_PREFLIGHT_BUDGET_MS,Cr as DRIFT_PREFLIGHT_TRIGGER_STATUSES,Er as DriftProbe,Kt as DriftRepairAvailableError,nt as FORGET_FLIP_SPEC,at as FORGET_MARKER_KEY,wt as LeaseDeniedError,Ne as ORG_SETUP_PHASES,J as ORG_TRAIL_BUCKET_OUTPUT_KEY,Se as OU_ONLY_ACCOUNT_BUCKETS,g as PRE_EMPTY_TAG_KEYS,st as RECREATE_MARKER_KEY,wr as REMEDIATION_JOURNAL_RETENTION_DAYS,v as SAFE_CLEANUP_STATES,Pt as SNAPSHOT_CAPABLE_RESOURCE_TYPES,Jt as StackUnavailableError,H as TRAIL_BUCKET_OUTPUT_KEY,Q as TRAIL_KEY_ARN_OUTPUT_KEY,fe as accountsConfigToOUTree,Ft as advertisableDriftVerbs,mr as advertisableRemediationVerbs,Xr as applyRetainFlip,or as approvalRefusalReason,Nr as archiveCompletedRemediationJournal,Qt as assertLeaseBeforeStack,pt as assessForgetResumability,b as buildAccountRegionPairs,_e as buildBuildSecretSessionPolicy,Me as buildDeployPlan,ve as buildDeploySessionPolicy,nr as buildDestructionTicket,kt as buildDriftRepairTicket,B as buildRegionList,Wr as captureRemediationForensics,C as cascadeHomeRegion,L as cascadeOperationKey,Yt as checkDeployPathStackAvailability,xr as classifyDriftFailure,He as classifyImpact,x as cleanupFailedStack,yr as clearDriftSuspects,ct as completeForgetAfterConverge,mt as completeForgetAfterDeploy,Zr as composeFlipCapabilities,Nt as composePostFailureRepairOffer,Ve as computeAssemblyDigest,Ye as computeDeployPlan,Gr as computeRemediationOpId,p as computeSecretsDrift,$r as computeTemplateDigest,lr as computeTicketDigest,Tr as createMemoisedPlanLoader,Y as decideNextTransition,j as decommissionMemberTrailStorage,_r as defaultDriftJournalDir,qr as defaultRemediationForensicsDir,Kr as defaultRemediationJournalDir,t as deploy,d as deployOrganisation,Qe as derivePropertyChanges,yt as deriveRemovalTemplate,et as deriveRetainFlipTemplate,c as deriveStaleParameters,i as destroy,T as destroyOrganisation,Fr as detectStackDrift,Je as digestHead,P as emptyS3Bucket,ne as ensureEnforceSsl,sr as evaluateDestructionConsents,cr as executableRemediationVerbs,ue as extractAllAccountNames,m as extractConsumedSsmParameters,Pr as fetchLastOperationEvents,rt as findMarkedResourcesByOpId,Mr as findRemediationJournalByOpId,_t as findRemovalDeletionFailures,gt as findResourcesPresent,me as flattenAccountsToEnvironments,br as formatDriftPreFlightBlock,Gt as formatDriftRepairOffer,Ct as formatPinOutcomeDetail,E as formatQuarantineSuspectedMessage,ut as formatRecreateInFlightCures,D as formatRetainedBucketsMessage,Re as isAccountsConfig,O as isCleanableState,we as isDataLoss,Vt as isDeployPathBlockingStatus,ee as isEnforceSslStatement,Te as isOuOnlyAccountBucket,y as isQuarantineDetail,_ as isRetainedBucketsDetail,je as isStatefulResourceType,de as isStringArray,pr as legalRemediationVerbs,Yr as listActiveRemediationOps,Vr as listActiveRemediationOpsForContext,Rr as loadDeployPlan,K as mergeReconciledProviderAccounts,ce as parseAccountsConfiguration,k as partitionAccounts,ge as partitionForRegion,ft as partitionPreFlightByRemediation,Lt as pinProbeCoverage,A as preEmptyStackBuckets,s as probeSecretsDrift,h as projectAccountRows,I as projectScalarSummary,tt as proveFlipMetadataOnly,Ot as proveRemovalTargetsOnly,gr as readDriftSuspects,Jr as readRemediationJournal,ot as readRetainFlipState,G as reconcileProviderAccounts,V as reconcileTrailMigration,Or as recordDriftSuspects,fr as renderConsentVerdictLines,ur as renderDestructionTicketLines,Ut as renderPinReportLines,qe as renderPlanLines,We as renderPlanSummary,ke as resolveBuildArgs,Ee as resolveBuildSecretSessionProvider,Pe as resolveBuildSecrets,Ae as resolveSecretRefValue,n as restart,le as restoreAndReconcileQuarantinedBucket,ie as restoreBucketPolicy,tr as runApprovalGate,ar as runDestructionGate,Br as runDriftPreFlight,Bt as runDriftRepairGate,dt as runForgetSurgery,Ue as runOpenNextBuild,he as runOrganisationSetup,It as runPinRemediation,Et as runRecreatePreFlight,St as runRecreateSurgery,Ir as runRoute53RecordPreflight,Xe as signApprovalToken,xt as snapshotPolicyForType,De as sourcedRefsFromBuildArgs,u as ssmParameterNameFromValueFrom,Hr as sweepExpiredRemediationJournals,Rt as synthTemplateDeclaresResource,ae as synthesiseEnforceSslDocument,te as toResourcePolicyStatements,ze as toWirePlanChanges,$ as triageBucketPolicy,q as unlockBucket,X as unlockQueue,be as validateBuildGroup,Ze as verifyApprovalToken,it as verifyRetainFlipDiff,Qr as writeRemediationJournal};
+import{deploy as t}from"./deploy.js";import{destroy as i}from"./destroy.js";import{restart as n,probeSecretsDrift as s}from"./restart/restartApplication.js";import{computeSecretsDrift as l,deriveStaleParameters as p,extractConsumedSsmParameters as m,ssmParameterNameFromValueFrom as u}from"./restart/secretsDrift.js";import{deployOrganisation as d}from"./organisation/organisationDeploy.js";import{destroyOrganisation as S}from"./organisation/organisationDestroy.js";import{cleanupFailedStack as P,emptyS3Bucket as T,preEmptyStackBuckets as A,formatQuarantineSuspectedMessage as y,formatRetainedBucketsMessage as E,isQuarantineDetail as D,isRetainedBucketsDetail as g,PRE_EMPTY_TAG_KEYS as _,isCleanableState as O,SAFE_CLEANUP_STATES as v}from"./stackCleanup.js";import{partitionAccounts as k,buildRegionList as B,buildAccountRegionPairs as L,cascadeHomeRegion as C,cascadeOperationKey as b}from"./organisation/cascadeHelpers.js";import{projectScalarSummary as U,projectAccountRows as h}from"./organisation/cascadeSummary.js";import{reconcileProviderAccounts as N,mergeReconciledProviderAccounts as K}from"./organisation/reconcileProviderAccounts.js";import{decideNextTransition as Y,reconcileTrailMigration as V,ORG_TRAIL_BUCKET_OUTPUT_KEY as J,TRAIL_BUCKET_OUTPUT_KEY as H,TRAIL_KEY_ARN_OUTPUT_KEY as Q}from"./trailMigration/trailMigration.js";import{decommissionMemberTrailStorage as j}from"./trailMigration/memberTrailCleanup.js";import{unlockBucket as q}from"./unlock/unlockBucket.js";import{unlockQueue as X}from"./unlock/unlockQueue.js";import{triageBucketPolicy as $,isEnforceSslStatement as ee}from"./unlock/bucketPolicyTriage.js";import{toResourcePolicyStatements as te}from"./unlock/toResourcePolicyStatements.js";import{restoreBucketPolicy as ie,synthesiseEnforceSslDocument as ae,ensureEnforceSsl as ne}from"./unlock/restoreBucketPolicy.js";import{restoreAndReconcileQuarantinedBucket as ce}from"./unlock/restoreAndReconcileQuarantinedBucket.js";import{parseAccountsConfiguration as pe,flattenAccountsToEnvironments as me,extractAllAccountNames as ue,accountsConfigToOUTree as fe,isStringArray as de,isAccountsConfig as Re,isOuOnlyAccountBucket as Se,OU_ONLY_ACCOUNT_BUCKETS as xe}from"./organisation/accountsConfig.js";import{resolveBuildSecrets as Te,resolveSecretRefValue as Ae,resolveBuildSecretSessionProvider as ye,sourcedRefsFromBuildArgs as Ee}from"./application/buildSecretResolver.js";import{buildBuildSecretSessionPolicy as ge,partitionForRegion as _e}from"./application/buildSecretSession.js";import{buildDeploySessionPolicy as ve}from"./application/deploySessionPolicy.js";import{resolveBuildArgs as ke}from"./application/buildArgResolver.js";import{validateBuildGroup as Le}from"./application/buildGroupValidator.js";export*from"./domain/index.js";import{runOpenNextBuild as Ie}from"./application/openNextBuild.js";import{runOrganisationSetup as he,ORG_SETUP_PHASES as Ge}from"./organisation/organisationSetup.js";export*from"./builders/index.js";import{buildDeployPlan as Me,computeDeployPlan as Ye,computeAssemblyDigest as Ve,digestHead as Je,classifyImpact as He,derivePropertyChanges as Qe,isDataLoss as we,isStatefulResourceType as je,renderPlanSummary as We,renderPlanLines as qe,toWirePlanChanges as ze,signApprovalToken as Xe,verifyApprovalToken as Ze,DEFAULT_APPROVAL_TTL_MS as $e,APPROVAL_TOKEN_PATTERN as er}from"./application/plan/index.js";import{runApprovalGate as tr,approvalRefusalReason as or}from"./application/approvalGate.js";import{runDestructionGate as ar,buildDestructionTicket as nr,evaluateDestructionConsents as sr,computeTicketDigest as cr,legalRemediationVerbs as lr,executableRemediationVerbs as pr,advertisableRemediationVerbs as mr,renderDestructionTicketLines as ur,renderConsentVerdictLines as fr}from"./application/destructionGate.js";import{loadDeployPlan as Rr,createMemoisedPlanLoader as Sr}from"./application/plan/loadDeployPlan.js";import{classifyDriftFailure as Pr,fetchLastOperationEvents as Tr}from"./drift/classifyDriftFailure.js";import{DriftProbe as yr}from"./drift/driftProbe.js";import{clearDriftSuspects as Dr,defaultDriftJournalDir as gr,readDriftSuspects as _r,recordDriftSuspects as Or}from"./drift/driftSuspectJournal.js";import{detectStackDrift as Fr}from"./drift/detectStackDrift.js";import{runDriftPreFlight as Br,formatDriftPreFlightBlock as Lr,DRIFT_PREFLIGHT_TRIGGER_STATUSES as Cr,DRIFT_PREFLIGHT_BUDGET_MS as br}from"./drift/driftPreFlight.js";import{runRoute53RecordPreflight as Ur}from"./drift/route53RecordPreflight.js";import{archiveCompletedRemediationJournal as Gr,computeRemediationOpId as Nr,defaultRemediationJournalDir as Kr,findRemediationJournalByOpId as Mr,listActiveRemediationOps as Yr,listActiveRemediationOpsForContext as Vr,readRemediationJournal as Jr,sweepExpiredRemediationJournals as Hr,writeRemediationJournal as Qr,REMEDIATION_JOURNAL_RETENTION_DAYS as wr}from"./remediation/remediationJournal.js";import{captureRemediationForensics as Wr,defaultRemediationForensicsDir as qr}from"./remediation/forensicsCapture.js";import{applyRetainFlip as Xr,composeFlipCapabilities as Zr,computeTemplateDigest as $r,deriveRetainFlipTemplate as et,findMarkedResourcesByOpId as rt,proveFlipMetadataOnly as tt,readRetainFlipState as ot,verifyRetainFlipDiff as it,FORGET_MARKER_KEY as at,FORGET_FLIP_SPEC as nt,RECREATE_MARKER_KEY as st}from"./remediation/retainFlip.js";import{assessForgetResumability as lt,completeForgetAfterConverge as pt,completeForgetAfterDeploy as mt,formatRecreateInFlightCures as ut,partitionPreFlightByRemediation as ft,runForgetSurgery as dt,synthTemplateDeclaresResource as Rt}from"./remediation/forgetResource.js";import{runRecreateSurgery as xt,snapshotPolicyForType as Pt,SNAPSHOT_CAPABLE_RESOURCE_TYPES as Tt}from"./remediation/recreateResource.js";import{runRecreatePreFlight as yt}from"./remediation/recreatePreFlight.js";import{deriveRemovalTemplate as Dt,findRemovalDeletionFailures as gt,findResourcesPresent as _t,proveRemovalTargetsOnly as Ot}from"./remediation/removalUpdate.js";import{advertisableDriftVerbs as Ft,buildDriftRepairTicket as kt,runDriftRepairGate as Bt}from"./remediation/driftRepairGate.js";import{formatPinOutcomeDetail as Ct,pinProbeCoverage as bt,renderPinReportLines as It,runPinRemediation as Ut}from"./remediation/pinRemediation.js";import{composePostFailureRepairOffer as Gt,formatDriftRepairOffer as Nt,DriftRepairAvailableError as Kt}from"./remediation/postFailureRepairOffer.js";import{captureLegacySurfaces as Yt,decodeLegacyAnchor as Vt,runIdentitySurfaceGate as Jt}from"./remediation/pinIdentity.js";import{collectIdentityPinCandidates as Qt,degradedIdentityPinOutcomes as wt,renderIdentityPinReportLines as jt,runIdentityPinMigration as Wt}from"./remediation/migrateIdentity.js";import{checkDeployPathStackAvailability as zt,isDeployPathBlockingStatus as Xt,StackUnavailableError as Zt}from"./activeDeploymentGuard.js";import{assertLeaseBeforeStack as eo,LeaseDeniedError as ro}from"./application/leaseGate.js";export{er as APPROVAL_TOKEN_PATTERN,$e as DEFAULT_APPROVAL_TTL_MS,br as DRIFT_PREFLIGHT_BUDGET_MS,Cr as DRIFT_PREFLIGHT_TRIGGER_STATUSES,yr as DriftProbe,Kt as DriftRepairAvailableError,nt as FORGET_FLIP_SPEC,at as FORGET_MARKER_KEY,ro as LeaseDeniedError,Ge as ORG_SETUP_PHASES,J as ORG_TRAIL_BUCKET_OUTPUT_KEY,xe as OU_ONLY_ACCOUNT_BUCKETS,_ as PRE_EMPTY_TAG_KEYS,st as RECREATE_MARKER_KEY,wr as REMEDIATION_JOURNAL_RETENTION_DAYS,v as SAFE_CLEANUP_STATES,Tt as SNAPSHOT_CAPABLE_RESOURCE_TYPES,Zt as StackUnavailableError,H as TRAIL_BUCKET_OUTPUT_KEY,Q as TRAIL_KEY_ARN_OUTPUT_KEY,fe as accountsConfigToOUTree,Ft as advertisableDriftVerbs,mr as advertisableRemediationVerbs,Xr as applyRetainFlip,or as approvalRefusalReason,Gr as archiveCompletedRemediationJournal,eo as assertLeaseBeforeStack,lt as assessForgetResumability,L as buildAccountRegionPairs,ge as buildBuildSecretSessionPolicy,Me as buildDeployPlan,ve as buildDeploySessionPolicy,nr as buildDestructionTicket,kt as buildDriftRepairTicket,B as buildRegionList,Yt as captureLegacySurfaces,Wr as captureRemediationForensics,C as cascadeHomeRegion,b as cascadeOperationKey,zt as checkDeployPathStackAvailability,Pr as classifyDriftFailure,He as classifyImpact,P as cleanupFailedStack,Dr as clearDriftSuspects,Qt as collectIdentityPinCandidates,pt as completeForgetAfterConverge,mt as completeForgetAfterDeploy,Zr as composeFlipCapabilities,Gt as composePostFailureRepairOffer,Ve as computeAssemblyDigest,Ye as computeDeployPlan,Nr as computeRemediationOpId,l as computeSecretsDrift,$r as computeTemplateDigest,cr as computeTicketDigest,Sr as createMemoisedPlanLoader,Y as decideNextTransition,Vt as decodeLegacyAnchor,j as decommissionMemberTrailStorage,gr as defaultDriftJournalDir,qr as defaultRemediationForensicsDir,Kr as defaultRemediationJournalDir,wt as degradedIdentityPinOutcomes,t as deploy,d as deployOrganisation,Qe as derivePropertyChanges,Dt as deriveRemovalTemplate,et as deriveRetainFlipTemplate,p as deriveStaleParameters,i as destroy,S as destroyOrganisation,Fr as detectStackDrift,Je as digestHead,T as emptyS3Bucket,ne as ensureEnforceSsl,sr as evaluateDestructionConsents,pr as executableRemediationVerbs,ue as extractAllAccountNames,m as extractConsumedSsmParameters,Tr as fetchLastOperationEvents,rt as findMarkedResourcesByOpId,Mr as findRemediationJournalByOpId,gt as findRemovalDeletionFailures,_t as findResourcesPresent,me as flattenAccountsToEnvironments,Lr as formatDriftPreFlightBlock,Nt as formatDriftRepairOffer,Ct as formatPinOutcomeDetail,y as formatQuarantineSuspectedMessage,ut as formatRecreateInFlightCures,E as formatRetainedBucketsMessage,Re as isAccountsConfig,O as isCleanableState,we as isDataLoss,Xt as isDeployPathBlockingStatus,ee as isEnforceSslStatement,Se as isOuOnlyAccountBucket,D as isQuarantineDetail,g as isRetainedBucketsDetail,je as isStatefulResourceType,de as isStringArray,lr as legalRemediationVerbs,Yr as listActiveRemediationOps,Vr as listActiveRemediationOpsForContext,Rr as loadDeployPlan,K as mergeReconciledProviderAccounts,pe as parseAccountsConfiguration,k as partitionAccounts,_e as partitionForRegion,ft as partitionPreFlightByRemediation,bt as pinProbeCoverage,A as preEmptyStackBuckets,s as probeSecretsDrift,h as projectAccountRows,U as projectScalarSummary,tt as proveFlipMetadataOnly,Ot as proveRemovalTargetsOnly,_r as readDriftSuspects,Jr as readRemediationJournal,ot as readRetainFlipState,N as reconcileProviderAccounts,V as reconcileTrailMigration,Or as recordDriftSuspects,fr as renderConsentVerdictLines,ur as renderDestructionTicketLines,jt as renderIdentityPinReportLines,It as renderPinReportLines,qe as renderPlanLines,We as renderPlanSummary,ke as resolveBuildArgs,ye as resolveBuildSecretSessionProvider,Te as resolveBuildSecrets,Ae as resolveSecretRefValue,n as restart,ce as restoreAndReconcileQuarantinedBucket,ie as restoreBucketPolicy,tr as runApprovalGate,ar as runDestructionGate,Br as runDriftPreFlight,Bt as runDriftRepairGate,dt as runForgetSurgery,Wt as runIdentityPinMigration,Jt as runIdentitySurfaceGate,Ie as runOpenNextBuild,he as runOrganisationSetup,Ut as runPinRemediation,yt as runRecreatePreFlight,xt as runRecreateSurgery,Ur as runRoute53RecordPreflight,Xe as signApprovalToken,Pt as snapshotPolicyForType,Ee as sourcedRefsFromBuildArgs,u as ssmParameterNameFromValueFrom,Hr as sweepExpiredRemediationJournals,Rt as synthTemplateDeclaresResource,ae as synthesiseEnforceSslDocument,te as toResourcePolicyStatements,ze as toWirePlanChanges,$ as triageBucketPolicy,q as unlockBucket,X as unlockQueue,Le as validateBuildGroup,Ze as verifyApprovalToken,it as verifyRetainFlipDiff,Qr as writeRemediationJournal};