@fjall/deploy-core 6.0.0 → 7.0.0

package/dist/src/types/params.d.ts

@@ -1,5 +1,5 @@
 import type { Result } from "@fjall/generator";
-import type { DeployMode, ServiceArtefact } from "@fjall/util";
+import type { CapacityIdentityConfig, DeployMode, ServiceArtefact } from "@fjall/util";
 import type { AwsCredentials, DeployIdentity, ScopedBuildSecretSessionMinter } from "./credentials.js";
 import type { DeployCallbacks } from "./callbacks.js";
 import type { ApiClientInterface } from "./apiClient.js";
@@ -7,6 +7,8 @@ import type { OrgConfig } from "./config/orgConfig.js";
 import type { DockerProvider } from "../orchestration/dockerInterface.js";
 import type { DomainDeployProvider } from "../orchestration/domainInterface.js";
 import type { PinRemediationReport } from "../orchestration/remediation/pinRemediation.js";
+import type { IdentityPinReport } from "../orchestration/remediation/migrateIdentity.js";
+import type { DestructionTicketResource } from "./destruction.js";
 import type { ApprovalGate, ApprovalGatePlanDetail } from "./approval.js";
 import type { DestructionConsent, DestructionConsentGate, DestructionOutcome, DestructionTicket } from "./destruction.js";
 import type { FailureAnalysis } from "@fjall/util/aws";
@@ -89,6 +91,19 @@ export interface DeployParams {
      * flag can disengage the gate; this only changes HOW consent is obtained.
      */
     destructionConsentGate?: DestructionConsentGate;
+    /**
+     * Identity-pin arm runner (D9 Phase 3) — consulted when consented `pin`
+     * verb(s) land on `rename-detected` rows carrying `pinSlotHint`. The
+     * surface owns synth + config machinery, so it injects a closure that
+     * drives `runIdentityPinMigration` (collect → decode → capture → pinned
+     * re-synth → I2 gate → config write) and returns the report. Absent, the
+     * arm degrades to report-only: the deploy still stops, the report names
+     * `fjall migrate identity` as the executing command, nothing is written.
+     * The engine threads `DeployParams.abortSignal` through the second
+     * argument so implementers' CFN probes and re-synth can be interrupted
+     * (optional-capability seam methods carry `abortSignal?` from birth).
+     */
+    identityPinRunner?: (rows: readonly DestructionTicketResource[], abortSignal?: AbortSignal) => Promise<IdentityPinReport>;
     /**
      * The user's fjall infrastructure config source, consumed by the pin arm
      * when a destructive change is consented with `pin`: the engine composes an
@@ -111,6 +126,24 @@ export interface DeployParams {
      * neither omit the field and constructs fall back to explicit props.
      */
     managedDomainBindings?: Record<string, string>;
+    /**
+     * The resolved deploy target name (e.g. "production-use2") this deploy
+     * runs against — the key `capacityIdentity` pins are recorded under in
+     * fjall-config.json. Surfaces that resolve a target MUST populate it;
+     * when absent, no capacity-identity pins ride into synth and a pre-7.0
+     * stack synths unpinned (the deploy-time rename gate then blocks the
+     * resulting identity replacement rather than letting it through).
+     */
+    deployTargetName?: string;
+    /**
+     * The `capacityIdentity` map from fjall-config.json
+     * (`{app: {target: {slot: pin}}}`), verbatim. The engine projects it to
+     * `deployTargetName` via `projectCapacityIdentityToTarget` (@fjall/util)
+     * and threads the result into every synth this deploy runs as
+     * `-c fjall:capacityIdentity=<json>`. Surfaces without a config file
+     * (worker until the Phase 4 webapp bump) omit it.
+     */
+    capacityIdentity?: CapacityIdentityConfig;
     /**
      * Asked before the post-deploy database-endpoint reconcile restarts the
      * application's ECS services (fires only when a deploy replaced the
@@ -419,6 +452,15 @@ export interface DeployResult {
      * --remediate needed" on the re-run when this is non-zero.
      */
     pinDeferredConsents?: number;
+    /**
+     * Identity-pin arm: per-slot outcomes of the pin migration for consented
+     * `rename-detected` rows (D9 Phase 3). Present with `pinPending` when the
+     * ceremony consented identity pins; `pinReport` stays the drift-value
+     * arm's report and both may be present on a mixed consent set. When the
+     * surface injected no `identityPinRunner`, outcomes are report-only and
+     * name `fjall migrate identity`.
+     */
+    identityPinReport?: IdentityPinReport;
 }
 /**
  * Parameters for the destroy entry point.

package/dist/src/types/remediation.d.ts

@@ -77,12 +77,35 @@ export declare const RemediationVerbWithSurgerySchema: z.ZodEnum<{
     recreate: "recreate";
 }>;
 export type RemediationVerbWithSurgery = z.infer<typeof RemediationVerbWithSurgerySchema>;
+/**
+ * The verbs that journal: the two surgery verbs plus `pin` (identity-pin
+ * remediation, D9 Phase 3). Pin journals are TERMINAL audit records — the
+ * operation mutates only fjall-config.json, so they are written once at
+ * phase `done` (success or refusal) and never carry resume state; the
+ * surgery orchestrators' cross-verb guards ignore done records, so a pin
+ * journal can never wedge a later forget/recreate on the same resources.
+ */
+export declare const RemediationJournalVerbSchema: z.ZodEnum<{
+    forget: "forget";
+    recreate: "recreate";
+    pin: "pin";
+}>;
+export type RemediationJournalVerb = z.infer<typeof RemediationJournalVerbSchema>;
+/** One slot the identity-pin operation acted on (pin journal audit trail). */
+export declare const PinnedSlotRecordSchema: z.ZodObject<{
+    appName: z.ZodString;
+    slot: z.ZodString;
+    legacyAnchor: z.ZodString;
+    failureDetail: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type PinnedSlotRecord = z.infer<typeof PinnedSlotRecordSchema>;
 export declare const RemediationJournalRecordSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     opId: z.ZodString;
     verb: z.ZodEnum<{
         forget: "forget";
         recreate: "recreate";
+        pin: "pin";
     }>;
     accountId: z.ZodString;
     region: z.ZodString;
@@ -122,6 +145,12 @@ export declare const RemediationJournalRecordSchema: z.ZodObject<{
     coRemovedLogicalIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
     orphanedResources: z.ZodOptional<z.ZodArray<z.ZodString>>;
     unverifiedRemovals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    pinnedSlots: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        appName: z.ZodString;
+        slot: z.ZodString;
+        legacyAnchor: z.ZodString;
+        failureDetail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
     completedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type RemediationJournalRecord = z.infer<typeof RemediationJournalRecordSchema>;

package/dist/src/types/remediation.js

@@ -1 +1 @@
-var r=Object.defineProperty;var t=(i,n)=>r(i,"name",{value:n,configurable:!0});import{z as e}from"zod";const o=["captured","flip-verified","flip-applied","removal-applied","done"],a=e.enum(o);function g(i){return o.indexOf(i)}t(g,"remediationPhaseRank");const s=e.object({logicalId:e.string().min(1),resourceType:e.string().min(1),physicalId:e.string().min(1)}).strict();function l(i,n){return`${i}/${n}`}t(l,"remediationPlaceholderPhysicalId");function h(i,n){return i.physicalId===l(n,i.logicalId)}t(h,"isRemediationPlaceholderPhysicalId");const c=e.object({diffGuardPassed:e.boolean(),changeSetMetadataOnly:e.boolean(),noChanges:e.boolean(),provenAt:e.string().min(1)}).strict(),m=e.enum(["forget","recreate"]),y=e.object({version:e.literal(1),opId:e.string().min(1),verb:m,accountId:e.string().min(1),region:e.string().min(1),stackName:e.string().min(1),appName:e.string().min(1).optional(),targets:e.array(s).min(1),phase:a,createdAt:e.string().min(1),updatedAt:e.string().min(1),liveTemplateDigest:e.string().min(1).optional(),forensicsPath:e.string().min(1).optional(),proof:c.optional(),consentedPhysicalNames:e.array(e.string()).optional(),retainedByRedeclaration:e.array(e.string().min(1)).optional(),fliplessTargets:e.array(e.string().min(1)).optional(),fliplessByNecessity:e.array(e.string().min(1)).optional(),recreatedResources:e.array(e.string().min(1)).optional(),snapshotPolicies:e.record(e.string().min(1),e.enum(["Snapshot","Delete"])).optional(),coRemovedLogicalIds:e.array(e.string().min(1)).optional(),orphanedResources:e.array(e.string().min(1)).optional(),unverifiedRemovals:e.array(e.string().min(1)).optional(),completedAt:e.string().min(1).optional()}).strict();export{o as REMEDIATION_PHASES,c as RemediationFlipProofSchema,y as RemediationJournalRecordSchema,a as RemediationPhaseSchema,s as RemediationTargetSchema,m as RemediationVerbWithSurgerySchema,h as isRemediationPlaceholderPhysicalId,g as remediationPhaseRank,l as remediationPlaceholderPhysicalId};
+var r=Object.defineProperty;var t=(e,n)=>r(e,"name",{value:n,configurable:!0});import{z as i}from"zod";const o=["captured","flip-verified","flip-applied","removal-applied","done"],a=i.enum(o);function u(e){return o.indexOf(e)}t(u,"remediationPhaseRank");const s=i.object({logicalId:i.string().min(1),resourceType:i.string().min(1),physicalId:i.string().min(1)}).strict();function l(e,n){return`${e}/${n}`}t(l,"remediationPlaceholderPhysicalId");function y(e,n){return e.physicalId===l(n,e.logicalId)}t(y,"isRemediationPlaceholderPhysicalId");const c=i.object({diffGuardPassed:i.boolean(),changeSetMetadataOnly:i.boolean(),noChanges:i.boolean(),provenAt:i.string().min(1)}).strict(),m=i.enum(["forget","recreate"]),p=i.enum([...m.options,"pin"]),d=i.object({appName:i.string().min(1),slot:i.string().min(1),legacyAnchor:i.string().min(1),failureDetail:i.string().min(1).optional()}).strict(),f=i.object({version:i.literal(1),opId:i.string().min(1),verb:p,accountId:i.string().min(1),region:i.string().min(1),stackName:i.string().min(1),appName:i.string().min(1).optional(),targets:i.array(s).min(1),phase:a,createdAt:i.string().min(1),updatedAt:i.string().min(1),liveTemplateDigest:i.string().min(1).optional(),forensicsPath:i.string().min(1).optional(),proof:c.optional(),consentedPhysicalNames:i.array(i.string()).optional(),retainedByRedeclaration:i.array(i.string().min(1)).optional(),fliplessTargets:i.array(i.string().min(1)).optional(),fliplessByNecessity:i.array(i.string().min(1)).optional(),recreatedResources:i.array(i.string().min(1)).optional(),snapshotPolicies:i.record(i.string().min(1),i.enum(["Snapshot","Delete"])).optional(),coRemovedLogicalIds:i.array(i.string().min(1)).optional(),orphanedResources:i.array(i.string().min(1)).optional(),unverifiedRemovals:i.array(i.string().min(1)).optional(),pinnedSlots:i.array(d).min(1).optional(),completedAt:i.string().min(1).optional()}).strict();export{d as PinnedSlotRecordSchema,o as REMEDIATION_PHASES,c as RemediationFlipProofSchema,f as RemediationJournalRecordSchema,p as RemediationJournalVerbSchema,a as RemediationPhaseSchema,s as RemediationTargetSchema,m as RemediationVerbWithSurgerySchema,y as isRemediationPlaceholderPhysicalId,u as remediationPhaseRank,l as remediationPlaceholderPhysicalId};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "6.0.0",
+  "version": "7.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -95,15 +95,15 @@
     "@aws-sdk/client-ssm": "^3.1098.0",
     "@aws-sdk/client-sso-admin": "^3.1098.0",
     "@aws-sdk/client-sts": "^3.1098.0",
-    "@fjall/generator": "^6.0.0",
-    "@fjall/util": "^6.0.0",
+    "@fjall/generator": "^7.0.0",
+    "@fjall/util": "^7.0.0",
     "@smithy/node-http-handler": "^4.9.13",
     "aws-cdk": "^2.1134.0",
     "tsx": "^4.23.1",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@fjall/components-infrastructure": ">=6.0.0 <7.0.0"
+    "@fjall/components-infrastructure": ">=7.0.0 <8.0.0"
   },
   "peerDependenciesMeta": {
     "@fjall/components-infrastructure": {
@@ -114,6 +114,5 @@
     "@types/node": "^26.1.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
-  },
-  "gitHead": "7620fc7c93bbef1046580d6568546afe3cd450a7"
+  }
 }