@planu/cli 4.13.0 → 5.0.0

package/dist/types/infrastructure.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
 // types/infrastructure.ts — Types for generate_infrastructure tool (SPEC-171)
 export {};
 //# sourceMappingURL=infrastructure.js.map

package/dist/types/kiro-integration.d.ts

@@ -9,12 +9,6 @@ export interface KiroSteeringOptions {
     }[];
     architectureStyle?: string;
 }
-export interface KiroHookDefinition {
-    id: string;
-    event: 'agentSpawn' | 'userPromptSubmit' | 'preToolUse' | 'postToolUse' | 'stop';
-    description: string;
-    script: string;
-}
 export interface KiroSpecFormat {
     id: string;
     title: string;

package/dist/types/lifecycle.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical type union (framework names enumerated for type safety)
-// — these literals ARE the canonical contract; no runtime detection logic to migrate.
 // types/lifecycle.ts — Dev lifecycle types (SPEC-026a)
 // CI/CD detection, deployment targets, observability stack, DX health scores
 export {};

package/dist/types/migration/canonical-storage.d.ts

@@ -0,0 +1,37 @@
+export type CanonicalMigrationStatus = 'noop' | 'planned' | 'migrated' | 'resumed' | 'rolled-back' | 'error';
+export interface CanonicalMigrationFile {
+    readonly relativePath: string;
+    readonly size: number;
+    readonly sha256: string;
+}
+export interface CanonicalMigrationInventory {
+    readonly root: string;
+    readonly files: readonly CanonicalMigrationFile[];
+    readonly totalBytes: number;
+    readonly digest: string;
+}
+export interface CanonicalMigrationCollision {
+    readonly relativePath: string;
+    readonly sourcePath: string;
+    readonly destinationPath: string;
+    readonly archivedPath?: string;
+    readonly resolution: 'destination-newer' | 'source-newer' | 'destination-preserved' | 'source-archived';
+}
+export interface CanonicalMigrationInput {
+    /** Explicit absolute legacy roots. No CWD discovery is performed. */
+    readonly legacyRoots: readonly string[];
+    /** Explicit absolute canonical project-data directory. */
+    readonly destinationRoot: string;
+    readonly dryRun?: boolean;
+}
+export interface CanonicalMigrationResult {
+    readonly status: CanonicalMigrationStatus;
+    readonly destinationRoot: string;
+    readonly journalPath: string;
+    readonly sourceInventories: readonly CanonicalMigrationInventory[];
+    readonly destinationInventory: CanonicalMigrationInventory | null;
+    readonly collisions: readonly CanonicalMigrationCollision[];
+    readonly resumed: boolean;
+    readonly reason?: string;
+}
+//# sourceMappingURL=canonical-storage.d.ts.map

package/dist/types/migration/canonical-storage.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=canonical-storage.js.map

package/dist/types/migration/index.d.ts

@@ -2,5 +2,5 @@ export type { MigrationStrategy, MigrationRisk, EquivalenceStatus, ComponentTemp
 export type { MigrationSpec, CircularDependency, MigrationPhase, MigrationPlan, StranglerFigProxy, ProxyRoutingRule, ParallelRunComparator, MigrationStrategyResult, ParityCheckItem, ContractTest, ParityValidationResult, EquivalenceEntry, SortResult, StrategyInput, } from './planning.js';
 export type { DbMigrationType, DbSchema, DbTableInfo, DbColumnInfo, DbTypeMapping, DbMigrationMap, DbMigrationPhase, DualWriteStrategy, DbMigrationPlan, TypeMappingEntry, } from './database.js';
 export type { MigrateTechAction, MigrateTechInput, MigrateTechResult } from './io.js';
-export type { CwdMigrationStatus, CwdMigrationResult } from './cwd-to-absolute.js';
+export type { CanonicalMigrationStatus, CanonicalMigrationFile, CanonicalMigrationInventory, CanonicalMigrationCollision, CanonicalMigrationInput, CanonicalMigrationResult, } from './canonical-storage.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/native-worker.d.ts

@@ -0,0 +1,48 @@
+import type { Worker } from 'node:worker_threads';
+export type NativeWorkerOperation = 'scan-and-hash-files' | 'scan-project-metadata' | 'scan-spec-annotations' | 'detect-drift' | 'scan-specs' | 'find-relevant-files' | 'scan-project-graph-sources';
+export interface NativeWorkerHandshake {
+    readonly kind: 'handshake';
+    readonly protocolAbi: number;
+    readonly capabilityAbi: number;
+    readonly storageSchema: number;
+    readonly schemaHash: string;
+    readonly capabilities: readonly NativeWorkerOperation[];
+    readonly engineVersion: string | null;
+    readonly target: string | null;
+    readonly artifactHash: string | null;
+    readonly compatible: boolean;
+}
+export interface NativeWorkerRequest {
+    readonly kind: 'request';
+    readonly secret: string;
+    readonly requestId: string;
+    readonly projectId: string;
+    readonly deadlineAt: number;
+    readonly cancellationId: string;
+    readonly operation: NativeWorkerOperation;
+    readonly payload: Readonly<Record<string, unknown>>;
+}
+export type NativeWorkerResponse = {
+    readonly kind: 'result';
+    readonly requestId: string;
+    readonly value: unknown;
+} | {
+    readonly kind: 'error';
+    readonly requestId: string;
+    readonly message: string;
+};
+export interface NativeWorkerCall {
+    readonly projectId: string;
+    readonly operation: NativeWorkerOperation;
+    readonly payload: Readonly<Record<string, unknown>>;
+    readonly deadlineAt: number;
+    readonly requestId?: string;
+    readonly cancellationId?: string;
+    readonly signal?: AbortSignal;
+}
+export type NativeWorkerFactory = (url: URL, options: {
+    workerData: {
+        secret: string;
+    };
+}) => Worker;
+//# sourceMappingURL=native-worker.d.ts.map

package/dist/types/native-worker.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=native-worker.js.map

package/dist/types/network-policy.d.ts

@@ -0,0 +1,12 @@
+export type NetworkPurpose = 'dependency-audit' | 'feedback' | 'integration' | 'oauth' | 'registry' | 'telemetry' | 'updates';
+export type NetworkRequestPurpose = NetworkPurpose | 'unclassified';
+export interface NetworkConsentReceipt {
+    readonly purpose: NetworkPurpose;
+    readonly version: number;
+    readonly token: symbol;
+}
+export interface NetworkConsentScope {
+    readonly purposes: ReadonlySet<NetworkPurpose>;
+    readonly version: number;
+}
+//# sourceMappingURL=network-policy.d.ts.map

package/dist/types/network-policy.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=network-policy.js.map

package/dist/types/oauth.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical type union (framework names enumerated for type safety)
-// — these literals ARE the canonical contract; no runtime detection logic to migrate.
 // src/types/oauth.ts — OAuth 2.1 Bearer token types (SPEC-161) + OAuth integration types (SPEC-440).
 export {};
 //# sourceMappingURL=oauth.js.map

package/dist/types/observability.d.ts

@@ -60,6 +60,38 @@ export interface SpanContext {
     status: SpanStatus;
     errorMessage?: string;
 }
+export interface LocalExecutionSpanEvent {
+    readonly kind: 'start' | 'complete' | 'timeout' | 'late-completion';
+    readonly occurredAt: string;
+    readonly requestId: string;
+    readonly operationId: string;
+    readonly operation: string;
+    readonly phase: string;
+    readonly deadlineAt: number;
+    readonly lockWaitMs: number;
+    readonly files: number;
+    readonly bytes: number;
+    readonly subprocess: boolean;
+    readonly cancelled: boolean;
+    readonly commitState: string;
+    readonly lateCompletion: boolean;
+}
+export interface LocalExecutionSpanInput {
+    readonly requestId: string;
+    readonly operationId: string;
+    readonly operation: string;
+    readonly deadlineAt: number;
+    readonly lockWaitMs?: number;
+    readonly files?: number;
+    readonly bytes?: number;
+    readonly subprocess?: boolean;
+}
+export interface LocalExecutionMeasurements {
+    readonly lockWaitMs: number;
+    readonly files: number;
+    readonly bytes: number;
+    readonly subprocess: boolean;
+}
 /** Handle for a started span. Implementations must be safe to call after end(). */
 export interface SpanHandle {
     /** Set an attribute on the span. No-op after end(). */

package/dist/types/outbox-worker.d.ts

@@ -0,0 +1,35 @@
+export interface OutboxDeliveryContext {
+    readonly deliveryKey: string;
+    readonly fencingToken: number;
+    readonly topic: string;
+    readonly payload: unknown;
+}
+export interface OutboxFenceRecord {
+    readonly schemaVersion: 1;
+    readonly workerId: string;
+    readonly fencingToken: number;
+    readonly leaseExpiresAt: string;
+    readonly state: 'leased' | 'failed' | 'dead-letter' | 'delivered';
+    readonly attempts?: number;
+    readonly lastError?: string;
+}
+export declare const SPEC_CREATED_POST_COMMIT_TASKS: readonly ['git-setup', 'analysis', 'quality-score', 'duplicate-detection', 'complexity-advice', 'prior-decisions', 'suggestions', 'challenge-readiness'];
+export type SpecCreatedPostCommitTask = (typeof SPEC_CREATED_POST_COMMIT_TASKS)[number];
+export interface SpecCreatedPayload {
+    readonly schemaVersion: 1;
+    readonly specId: string;
+    readonly projectId: string;
+    readonly projectPath: string;
+    readonly postCommitTasks: readonly SpecCreatedPostCommitTask[];
+}
+export interface SpecCreatedTaskContext {
+    readonly deliveryKey: string;
+    readonly payload: SpecCreatedPayload;
+}
+export interface SpecCreatedTaskOutcome {
+    readonly status?: 'completed' | 'skipped';
+    readonly reason?: string;
+}
+export type SpecCreatedTaskHandler = (context: SpecCreatedTaskContext) => Promise<SpecCreatedTaskOutcome | undefined>;
+export type SpecCreatedTaskHandlers = Readonly<Record<SpecCreatedPostCommitTask, SpecCreatedTaskHandler>>;
+//# sourceMappingURL=outbox-worker.d.ts.map

package/dist/types/outbox-worker.js

@@ -0,0 +1,11 @@
+export const SPEC_CREATED_POST_COMMIT_TASKS = [
+    'git-setup',
+    'analysis',
+    'quality-score',
+    'duplicate-detection',
+    'complexity-advice',
+    'prior-decisions',
+    'suggestions',
+    'challenge-readiness',
+];
+//# sourceMappingURL=outbox-worker.js.map

package/dist/types/permissions-config.d.ts

@@ -7,33 +7,6 @@ export interface DenyRulesRegistry {
         patterns: string[];
     }[];
 }
-/** Schema of src/config/detection-signals.json — loaded by stack-detectors. */
-export interface DetectionSignalsRegistry {
-    schemaVersion: number;
-    signals: {
-        frameworkId: string;
-        ecosystem: string;
-        type: string;
-        pattern: string;
-        manager?: string;
-    }[];
-    deployTargets: {
-        id: string;
-        type: string;
-        pattern: string;
-        additionalMatch?: string;
-    }[];
-    databases: {
-        id: string;
-        type: string;
-        pattern: string;
-        manager?: string;
-    }[];
-    aliases?: {
-        alias: string;
-        canonical: string;
-    }[];
-}
 /** Permission configuration mode:
  * - minimal: only mcp__planu__* + always-on deny rules
  * - recommended: above + family allowlists + stack-specific deny

package/dist/types/permissions-config.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical type union (framework names enumerated for type safety)
-// — these literals ARE the canonical contract; no runtime detection logic to migrate.
 // types/permissions-config.ts — Types for SPEC-594 + SPEC-597 (registry-driven discovery)
 export {};
 //# sourceMappingURL=permissions-config.js.map

package/dist/types/plugin-install.d.ts

@@ -107,17 +107,6 @@ export interface InstallOutcome {
 export interface PluginCatalog {
     plugins: PluginRecommendation[];
 }
-/** Schema of src/config/framework-registry/index.json — canonical framework catalog. */
-export interface FrameworkRegistryIndex {
-    frameworks: {
-        id: string;
-        displayName: string;
-        ecosystem: string;
-        frameworkVersion: string;
-        lastUpdated: string;
-        file: string;
-    }[];
-}
 /** Alias lookup map: raw-name-lowercased → canonical framework/target id. */
 export type StackMatcherAliasMap = Record<string, string>;
 //# sourceMappingURL=plugin-install.d.ts.map

package/dist/types/plugin-install.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical type union (framework names enumerated for type safety)
-// — these literals ARE the canonical contract; no runtime detection logic to migrate.
 // types/plugin-install.ts — Domain types for SPEC-596 plugin installation
 import { z } from 'zod';
 // ---------------------------------------------------------------------------

package/dist/types/portal.d.ts

@@ -113,6 +113,7 @@ export interface StackEntry {
     value: string | null;
 }
 export type PortalPage = 'index' | 'executive-summary' | 'analytics' | 'roadmap' | 'risks' | 'decisions' | 'architecture' | 'changelog';
+export type RegeneratedPortalPage = Extract<PortalPage, 'index' | 'roadmap'>;
 export type StoreType = 'specs' | 'metrics' | 'risks' | 'decisions' | 'knowledge';
 export interface PerSpecHtmlOptions {
     /** Active page key for navbar (defaults to 'dashboard' — reports are reached from dashboard) */

package/dist/types/product-public.d.ts

@@ -0,0 +1,75 @@
+export interface ProductPublicNavItem {
+    text: string;
+    path: string;
+}
+export interface ProductPublicChrome {
+    footerLead: string;
+    support: string;
+    changelog: string;
+    reportBug: string;
+    appearance: string;
+    lightTheme: string;
+    darkTheme: string;
+    sidebar: string;
+    top: string;
+    language: string;
+    skip: string;
+    outline: string;
+    previous: string;
+    next: string;
+    search: string;
+    noResults: string;
+}
+export interface ProductPublicLocale {
+    id: string;
+    contentLocale: 'en' | 'es' | 'pt' | 'fr' | 'de' | 'zh';
+    label: string;
+    lang: string;
+    hreflang: string;
+    ogLocale: string;
+    nav: ProductPublicNavItem[];
+    chrome: ProductPublicChrome;
+}
+export interface ProductPublicDonation {
+    id: 'btc' | 'eth' | 'sol';
+    symbol: string;
+    network: string;
+    address: string;
+    qrPath: string;
+    walletUri: string | null;
+}
+export interface ProductPublicManifest {
+    schemaVersion: 1;
+    website: {
+        baseUrl: string;
+        defaultLocale: string;
+        theme: {
+            defaultAppearance: 'system';
+            allowUserToggle: boolean;
+        };
+        disabledRouteSegments: string[];
+        locales: ProductPublicLocale[];
+        newsletter: {
+            enabled: boolean;
+            provider: 'none';
+            signupUrl: string | null;
+        };
+        sponsors: {
+            enabled: boolean;
+            pagePath: string;
+            githubUrl: string;
+            contactEmail: string;
+        };
+    };
+    donations: ProductPublicDonation[];
+    claims: {
+        installCommand: string;
+        publicToolInventory: string[];
+        registryReadmeBaseline: {
+            package: '@planu/cli';
+            version: string;
+            sha256: string;
+        };
+    };
+}
+//# sourceMappingURL=product-public.d.ts.map

package/dist/types/product-public.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=product-public.js.map

package/dist/types/project/inputs.d.ts

@@ -26,6 +26,8 @@ export interface InitProjectInput {
     userProfile?: 'developer' | 'product-owner' | 'designer' | 'non-technical';
     /** SPEC-185: When false, skip auto-install of recommended skills (default: true). */
     autoInstallSkills?: boolean;
+    /** Explicit authorization for repository-content migrations during an update. */
+    authorizedMigrations?: 'planu-spec-format-v1'[];
     /** SPEC-313: Preferred interaction style — guided (step-by-step hints), standard, expert (concise). */
     workMode?: WorkMode;
     /** SPEC-584: Answers to pending interactiveQuestions from a previous init_project call. */

package/dist/types/project/lint-scaffolder.d.ts

@@ -1,4 +1,4 @@
-export interface ScaffoldResult {
+export interface LintScaffoldResult {
     eslintCreated: boolean;
     prettierCreated: boolean;
     suggestions: string[];

package/dist/types/project/mfe-detection.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical type union (framework names enumerated for type safety)
-// — these literals ARE the canonical contract; no runtime detection logic to migrate.
 // Planu — Micro-frontend / Islands / Signals detection types (SPEC-017 tech-debt)
 export {};
 //# sourceMappingURL=mfe-detection.js.map

package/dist/types/project/platform-mobile.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
 // Planu — Mobile platform types (SPEC-013)
 export {};
 //# sourceMappingURL=platform-mobile.js.map

package/dist/types/project/platform-specialty.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical type union (framework names enumerated for type safety)
-// — these literals ARE the canonical contract; no runtime detection logic to migrate.
 // Planu — Specialty platform types (SPEC-014a, SPEC-014b, SPEC-015a, SPEC-015b)
 export {};
 //# sourceMappingURL=platform-specialty.js.map

package/dist/types/project-knowledge-graph.d.ts

@@ -157,6 +157,13 @@ export interface ProjectGraphFreshness {
     generatedAt?: string;
     changedSources: string[];
 }
+export interface ProjectGraphFreshnessProjection {
+    readonly schemaVersion: 1;
+    readonly state: 'fresh' | 'invalidated';
+    readonly generatedAt?: string;
+    readonly reason?: 'source_changed' | 'corrupt';
+    readonly changedSourceCount: number;
+}
 export interface ProjectGraphSlice {
     graphVersion: string;
     generatedAt: string;

package/dist/types/runtime-database.d.ts

@@ -0,0 +1,10 @@
+export interface RuntimeRecordRow {
+    readonly project_id: string;
+    readonly workspace_id: string;
+    readonly kind: 'mutation' | 'index' | 'audit-state';
+    readonly record_key: string;
+    readonly value_json: string;
+    readonly source_digest: string | null;
+    readonly updated_at: string;
+}
+//# sourceMappingURL=runtime-database.d.ts.map

package/dist/types/runtime-database.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runtime-database.js.map

package/dist/types/runtime-policy.d.ts

@@ -0,0 +1,51 @@
+export interface BoundedDurationPolicy {
+    defaultTimeoutMs: number;
+    minimumTimeoutMs: number;
+    maximumTimeoutMs: number;
+}
+export interface RuntimePolicy {
+    acknowledgementBudgetMs: number;
+    toolExecution: BoundedDurationPolicy & {
+        safetyMarginRatio: number;
+        safetyMarginMaximumMs: number;
+    };
+    qualityAssurance: BoundedDurationPolicy & {
+        maximumOutputBufferBytes: number;
+    };
+    lintValidation: BoundedDurationPolicy;
+    createSpec: {
+        criticalTimeoutMs: number;
+        inlineAnalysisBudgetMs: number;
+        idempotencyClaimStaleMs: number;
+        idempotencyClaimWaitMs: number;
+        idempotencyClaimPollMs: number;
+        idempotencyMatchWindowMs: number;
+    };
+    validation: {
+        defaultDeadlineMs: number;
+        durableLintTimeoutMs: number;
+        complianceCommandTimeoutMs: number;
+        noProgressTimeoutMs: number;
+        submissionLockWaitMs: number;
+        submissionLockPollMs: number;
+        workerLeaseMs: number;
+        workerHeartbeatMs: number;
+        workerConcurrency: number;
+        heartbeatStartupTimeoutMs: number;
+        heartbeatShutdownTimeoutMs: number;
+        heartbeatDatabaseBusyTimeoutMs: number;
+        freshnessLeaseTtlMs: number;
+        freshnessInvalidationCoalesceMs: number;
+        receiptPublicationDeadlineMs: number;
+        receiptCheckpointLogMaxBytes: number;
+        receiptCheckpointResultMaxBytes: number;
+    };
+    postCommit: {
+        defaultTaskTimeoutMs: number;
+        minimumLeaseMs: number;
+        leaseMultiplier: number;
+        maximumRememberedTransitions: number;
+        minimumHeartbeatMs: number;
+    };
+}
+//# sourceMappingURL=runtime-policy.d.ts.map

package/dist/types/runtime-policy.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runtime-policy.js.map

package/dist/types/safety.d.ts

@@ -16,15 +16,14 @@ export interface SafetyError {
  */
 export interface FileMutexLockHandle {
     resource: string;
+    resourceId: string;
+    scopeId: string;
+    lockId: string;
+    fencingToken: number;
     lockPath: string;
     pid: number;
     acquiredAt: string;
 }
-export interface LockFileContent {
-    pid: number;
-    timestamp: string;
-    resource: string;
-}
 export type CircuitState = 'closed' | 'open' | 'half-open';
 export interface SafetyCircuitConfig {
     maxFailures: number;

package/dist/types/schema-registry.d.ts

@@ -0,0 +1,12 @@
+export interface CriticalSchema<T> {
+    readonly name: string;
+    readonly currentVersion: number;
+    readonly createDefault: () => T;
+    readonly validate: (value: unknown) => value is T;
+    readonly migrate?: (value: unknown, fromVersion: number) => T;
+}
+export interface VersionedDocument<T> {
+    readonly schemaVersion: number;
+    readonly data: T;
+}
+//# sourceMappingURL=schema-registry.d.ts.map

package/dist/types/schema-registry.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema-registry.js.map

package/dist/types/security.d.ts

@@ -96,4 +96,56 @@ export interface SecurityPatternsConfig {
     }[]>;
     complianceCriteria: Record<string, string[]>;
 }
+export type SecretStoreKind = 'macos-keychain' | 'linux-secret-service' | 'windows-credential-manager' | 'environment';
+export interface MacOSKeychainNativePort {
+    set(account: string, secret: Buffer): Promise<void>;
+    get(account: string): Promise<Buffer | null>;
+    delete(account: string): Promise<void>;
+}
+export type MacOSKeychainOperation = 'get' | 'set' | 'delete';
+export interface MacOSKeychainPendingOperation {
+    readonly fence: number;
+    readonly settled: Promise<void>;
+}
+export type SecretPurpose = 'license' | 'oauth-access' | 'oauth-refresh' | 'registry-pat' | 'figma-pat' | 'supabase-service-role' | 'supabase-anon' | 'sentry-auth' | 'slack-webhook' | 'validation-signing';
+export interface SecretReference {
+    readonly schemaVersion: 1;
+    readonly provider: SecretStoreKind;
+    readonly id: string;
+    readonly purpose: SecretPurpose;
+}
+export interface SecretStoreAdapter {
+    readonly kind: SecretStoreKind;
+    get(id: string): Promise<string | null>;
+    set(id: string, value: string): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+export interface SecretMigrationBinding {
+    readonly jsonPath: readonly string[];
+    readonly secretId: string;
+    readonly purpose: SecretPurpose;
+}
+export interface SecretMigrationTarget {
+    readonly sourcePath: string;
+    readonly bindings: readonly SecretMigrationBinding[];
+}
+export interface SecretMigrationFinding {
+    readonly sourcePath: string;
+    readonly destination: string;
+    readonly jsonPath: string;
+    readonly state: 'pending' | 'migrated' | 'already-secure' | 'missing';
+}
+export interface SecretMigrationReport {
+    readonly schemaVersion: 1;
+    readonly mode: 'dry-run' | 'apply';
+    readonly findings: readonly SecretMigrationFinding[];
+}
+export interface SecretMigrationOptions {
+    readonly mode: 'dry-run' | 'apply';
+    readonly provider: {
+        reference(id: string, purpose: SecretPurpose): SecretReference;
+        store(reference: SecretReference, value: string): Promise<void>;
+    };
+    readonly journalPath: string;
+}
 //# sourceMappingURL=security.d.ts.map