@codedrifters/configulator 0.0.403 → 0.0.404

package/lib/index.mjs

@@ -5556,6 +5556,409 @@ function buildBcmWriterBundle(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAU
 }
 var bcmWriterBundle = buildBcmWriterBundle();
 
+// src/turbo/turbo-repo.ts
+import {
+  Component as Component2,
+  FileBase,
+  JsonFile,
+  SampleDir,
+  SampleFile
+} from "projen/lib";
+import { JobPermission } from "projen/lib/github/workflows-model";
+
+// src/turbo/turbo-repo-task.ts
+import { Component } from "projen/lib";
+var TurboRepoTask = class extends Component {
+  constructor(project, options) {
+    super(project);
+    this.project = project;
+    this.name = options.name;
+    this.dependsOn = options.dependsOn ?? [];
+    this.env = options.env ?? [];
+    this.passThroughEnv = options.passThroughEnv ?? [];
+    this.outputs = options.outputs ?? [];
+    this.cache = options.cache ?? true;
+    this.inputs = [
+      ...options.inputs ?? [],
+      // rerun if projen config changes
+      ".projen/**",
+      // ignore mac files
+      "!.DS_Store",
+      "!**/.DS_Store"
+    ];
+    this.outputLogs = options.outputLogs ?? "new-only";
+    this.persistent = options.persistent ?? false;
+    this.interactive = options.interactive ?? false;
+    this.isActive = true;
+  }
+  taskConfig() {
+    return {
+      dependsOn: this.dependsOn,
+      env: this.env,
+      passThroughEnv: this.passThroughEnv,
+      outputs: this.outputs,
+      cache: this.cache,
+      inputs: this.inputs,
+      outputLogs: this.outputLogs,
+      persistent: this.persistent,
+      interactive: this.interactive
+    };
+  }
+};
+
+// src/turbo/turbo-repo.ts
+var ROOT_TURBO_TASK_NAME = "turbo:build";
+var ROOT_CI_TASK_NAME = "build:all";
+var _TurboRepo = class _TurboRepo extends Component2 {
+  constructor(project, options = {}) {
+    super(project);
+    this.project = project;
+    /**
+     * Sub-Tasks to run
+     */
+    this.tasks = [];
+    this.turboVersion = options.turboVersion ?? "catalog:";
+    this.isRootProject = project === project.root;
+    if (this.isRootProject) {
+      project.addDevDeps(`turbo@${this.turboVersion}`);
+    }
+    project.gitignore.addPatterns("/.turbo");
+    project.npmignore?.addPatterns("/.turbo/");
+    this.extends = options.extends ?? (this.isRootProject ? [] : ["//"]);
+    this.globalDependencies = options.globalDependencies ?? [];
+    this.globalEnv = options.globalEnv ?? [];
+    this.globalPassThroughEnv = options.globalPassThroughEnv ?? [];
+    this.ui = options.ui ?? "stream";
+    this.dangerouslyDisablePackageManagerCheck = options.dangerouslyDisablePackageManagerCheck ?? false;
+    this.cacheDir = options.cacheDir ?? ".turbo/cache";
+    this.daemon = options.daemon ?? true;
+    this.envMode = options.envMode ?? "strict";
+    this.runOptions = {
+      ...options.runOptions,
+      summarize: options.runOptions?.summarize ?? true,
+      concurrency: options.runOptions?.concurrency ?? 10
+    };
+    this.remoteCacheOptions = options.remoteCacheOptions;
+    this.buildAllTaskEnvVars = options.buildAllTaskEnvVars ?? {};
+    this.buildTask = new TurboRepoTask(this.project, {
+      name: ROOT_TURBO_TASK_NAME,
+      dependsOn: this.isRootProject ? [`^${ROOT_TURBO_TASK_NAME}`] : []
+    });
+    if (this.isRootProject) {
+      this.buildAllTask = this.project.tasks.addTask(ROOT_CI_TASK_NAME, {
+        description: "Root build followed by sub-project builds. Mimics the CI build process in one step."
+      });
+      this.buildAllTask.exec("turbo telemetry disable");
+      if (this.buildAllTaskEnvVars) {
+        Object.entries(this.buildAllTaskEnvVars).forEach(([name, value]) => {
+          this.addGlobalEnvVar(name, value);
+        });
+      }
+      if (!this.remoteCacheOptions) {
+        this.buildAllTask.exec(
+          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(false)}`
+        );
+      } else {
+        this.buildAllTask.exec(
+          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
+          {
+            condition: '[ ! -n "$CI" ]',
+            env: {
+              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`,
+              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`
+            }
+          }
+        );
+        this.buildAllTask.exec(
+          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
+          {
+            condition: '[ -n "$CI" ]',
+            env: {
+              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text)`,
+              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text)`
+            }
+          }
+        );
+      }
+    }
+    if (!this.isRootProject) {
+      this.preCompileTask = new TurboRepoTask(project, {
+        name: options.preCompileTask?.name ?? "pre-compile",
+        inputs: ["src/**"]
+      });
+      this.compileTask = new TurboRepoTask(project, {
+        name: options.compileTask?.name ?? "compile",
+        inputs: ["src/**"]
+      });
+      this.postCompileTask = new TurboRepoTask(project, {
+        name: options.postCompileTask?.name ?? "post-compile",
+        inputs: ["src/**"]
+      });
+      this.testTask = new TurboRepoTask(project, {
+        name: options.testTask?.name ?? "test"
+      });
+      this.packageTask = new TurboRepoTask(project, {
+        name: options.packageTask?.name ?? "package",
+        inputs: [".npmignore"]
+      });
+      this.tasks.push(
+        this.preCompileTask,
+        this.compileTask,
+        this.postCompileTask,
+        this.testTask,
+        this.packageTask
+      );
+    }
+  }
+  /**
+   * Static method to discovert turbo in a project.
+   */
+  static of(project) {
+    const isDefined = (c) => c instanceof _TurboRepo;
+    return project.components.find(isDefined);
+  }
+  /**
+   * Render the `turbo run` CLI flag string for the `build:all` / `reset:all`
+   * task commands from {@link runOptions}. With no `runOptions` configured the
+   * output matches the historically hard-coded flags exactly.
+   *
+   * @param remote - when `true`, also emit the remote-cache flags
+   * (`--cache=remote:rw` plus `--api` / `--token` / `--team` derived from
+   * {@link remoteCacheOptions}). The remote-cache `build:all` variant passes
+   * `true`; `reset:all` and the local `build:all` variant pass `false`.
+   */
+  renderRunArgs(remote) {
+    const run = this.runOptions;
+    const args = [];
+    if (run.summarize) {
+      args.push("--summarize");
+    }
+    args.push(`--concurrency=${run.concurrency}`);
+    if (run.force) {
+      args.push("--force");
+    }
+    if (run.noCache) {
+      args.push("--no-cache");
+    }
+    if (run.only) {
+      args.push("--only");
+    }
+    if (run.affected) {
+      args.push("--affected");
+    }
+    if (run.cacheWorkers !== void 0) {
+      args.push(`--cache-workers=${run.cacheWorkers}`);
+    }
+    if (run.continueOn !== void 0) {
+      args.push(`--continue=${run.continueOn}`);
+    }
+    if (run.frameworkInference !== void 0) {
+      args.push(`--framework-inference=${run.frameworkInference}`);
+    }
+    for (const filter of run.filter ?? []) {
+      args.push(`--filter=${filter}`);
+    }
+    if (run.outputLogs !== void 0) {
+      args.push(`--output-logs=${run.outputLogs}`);
+    }
+    if (run.logOrder !== void 0) {
+      args.push(`--log-order=${run.logOrder}`);
+    }
+    if (run.logPrefix !== void 0) {
+      args.push(`--log-prefix=${run.logPrefix}`);
+    }
+    if (run.dryRun !== void 0) {
+      args.push(`--dry-run=${run.dryRun}`);
+    }
+    const cache = run.cache ?? (remote ? "remote:rw" : void 0);
+    if (cache !== void 0) {
+      args.push(`--cache=${cache}`);
+    }
+    if (remote && this.remoteCacheOptions) {
+      args.push(
+        "--api=$TURBO_ENDPOINT",
+        "--token=$TURBO_TOKEN",
+        `--team=${this.remoteCacheOptions.teamName}`
+      );
+    }
+    if (run.additionalArgs) {
+      args.push(...run.additionalArgs);
+    }
+    return args.join(" ");
+  }
+  /**
+   * Add an env var to the global env vars for all tasks.
+   * This will also become an input for the build:all task cache at the root.
+   */
+  addGlobalEnvVar(name, value) {
+    this.buildAllTask?.env(name, value);
+    if (this.isRootProject) {
+      this.globalEnv.push(name);
+    }
+  }
+  activateBranchNameEnvVar(options) {
+    const value = '$([ -n "$GIT_BRANCH_NAME" ] && echo "$GIT_BRANCH_NAME" || git rev-parse --abbrev-ref HEAD)';
+    if (options === void 0) {
+      this.project.logger.warn(
+        "TurboRepo.activateBranchNameEnvVar() with no arguments is deprecated. It writes GIT_BRANCH_NAME to the root `globalEnv`, which forces every task in the monorepo to miss cache on every branch switch. Pass `{ tasks: [...] }` and name only the tasks that actually consume the branch (e.g. CDK synth/package) to preserve cross-branch cache hits for everything else."
+      );
+      this.addGlobalEnvVar("GIT_BRANCH_NAME", value);
+      return;
+    }
+    const knownTaskNames = this.tasks.map((task) => task.name);
+    const unknown = options.tasks.filter(
+      (name) => !knownTaskNames.includes(name)
+    );
+    if (unknown.length > 0) {
+      throw new Error(
+        `TurboRepo.activateBranchNameEnvVar: unknown task name(s) ${JSON.stringify(
+          unknown
+        )}. Known tasks on this TurboRepo: ${JSON.stringify(knownTaskNames)}.`
+      );
+    }
+    for (const name of options.tasks) {
+      const task = this.tasks.find((t) => t.name === name);
+      if (task && !task.env.includes("GIT_BRANCH_NAME")) {
+        task.env.push("GIT_BRANCH_NAME");
+      }
+    }
+  }
+  /**
+   * Paths of all generated files in the project, deduped, for use as task
+   * inputs so the compile cache invalidates when they change. Includes
+   * projen-managed `FileBase` files plus generated-once `SampleFile` /
+   * `SampleDir` — whose paths projen keeps private, so they are read defensively
+   * and skipped if that internal shape ever changes. Computed at synth time so
+   * files added after this component (e.g. a subclass's SampleFiles) are seen.
+   */
+  generatedFileInputs() {
+    const inputs = /* @__PURE__ */ new Set();
+    for (const component of this.project.components) {
+      if (component instanceof FileBase) {
+        inputs.add(component.path);
+      } else if (component instanceof SampleFile) {
+        const filePath = component.filePath;
+        if (typeof filePath === "string") {
+          inputs.add(filePath);
+        }
+      } else if (component instanceof SampleDir) {
+        const dir = component.dir;
+        if (typeof dir === "string") {
+          inputs.add(`${dir}/**`);
+        }
+      }
+    }
+    return Array.from(inputs);
+  }
+  preSynthesize() {
+    let nextDependsOn = this.project.deps.all.filter((d) => d.version === "workspace:*").map((d) => [d.name, ROOT_TURBO_TASK_NAME].join("#"));
+    if (!this.isRootProject) {
+      [
+        [this.project.preCompileTask, this.preCompileTask],
+        [this.project.compileTask, this.compileTask],
+        [this.project.postCompileTask, this.postCompileTask],
+        [this.project.testTask, this.testTask],
+        [this.project.packageTask, this.packageTask]
+      ].forEach(([pjTask, turboTask]) => {
+        if (pjTask && turboTask && pjTask.steps.length > 0) {
+          if (nextDependsOn.length > 0) {
+            turboTask.dependsOn.push(...nextDependsOn);
+          }
+          nextDependsOn = [turboTask.name];
+        } else {
+          turboTask.isActive = false;
+        }
+      });
+      this.buildTask.dependsOn.push(...nextDependsOn);
+    }
+    const generatedInputs = this.generatedFileInputs();
+    const appendGeneratedInputs = (task) => {
+      if (!task) {
+        return;
+      }
+      for (const input of generatedInputs) {
+        if (!task.inputs.includes(input)) {
+          task.inputs.push(input);
+        }
+      }
+    };
+    if (this.isRootProject) {
+      appendGeneratedInputs(this.buildTask);
+    } else {
+      appendGeneratedInputs(this.preCompileTask);
+      appendGeneratedInputs(this.compileTask);
+      appendGeneratedInputs(this.postCompileTask);
+    }
+    const fileName = "turbo.json";
+    this.project.addPackageIgnore(fileName);
+    new JsonFile(this.project, fileName, {
+      obj: {
+        extends: this.extends.length ? this.extends : void 0,
+        globalDependencies: this.isRootProject && this.globalDependencies.length ? this.globalDependencies : void 0,
+        globalEnv: this.isRootProject && this.globalEnv.length ? this.globalEnv : void 0,
+        globalPassThroughEnv: this.isRootProject && this.globalPassThroughEnv.length ? this.globalPassThroughEnv : void 0,
+        ui: this.isRootProject ? this.ui : void 0,
+        dangerouslyDisablePackageManagerCheck: this.isRootProject ? this.dangerouslyDisablePackageManagerCheck : void 0,
+        cacheDir: this.isRootProject ? this.cacheDir : void 0,
+        envMode: this.isRootProject ? this.envMode : void 0,
+        /**
+         * All tasks
+         */
+        tasks: this.tasks.filter((task) => task.isActive).reduce(
+          (acc, task) => {
+            acc[task.name] = {
+              ...task.taskConfig()
+            };
+            return acc;
+          },
+          {
+            [this.buildTask.name]: { ...this.buildTask.taskConfig() }
+          }
+        )
+      }
+    });
+    super.preSynthesize();
+  }
+};
+_TurboRepo.buildWorkflowOptions = (remoteCacheOptions) => {
+  return {
+    env: {
+      GIT_BRANCH_NAME: "${{ github.head_ref || github.ref_name }}"
+    },
+    permissions: {
+      contents: JobPermission.WRITE,
+      idToken: JobPermission.WRITE
+    },
+    preBuildSteps: [
+      {
+        name: "AWS Creds for SSM",
+        uses: "aws-actions/configure-aws-credentials@v6",
+        with: {
+          ["role-to-assume"]: remoteCacheOptions.oidcRole,
+          ["aws-region"]: "us-east-1",
+          ["role-duration-seconds"]: "900"
+        }
+      }
+    ]
+  };
+};
+var TurboRepo = _TurboRepo;
+
+// src/agent/bundles/build-policy.ts
+var DEFAULT_BUILD_POLICY = {
+  remoteCacheEnabled: false
+};
+function resolveBuildPolicy(project) {
+  const remoteCacheOptions = TurboRepo.of(project)?.remoteCacheOptions;
+  if (!remoteCacheOptions) {
+    return DEFAULT_BUILD_POLICY;
+  }
+  return {
+    remoteCacheEnabled: true,
+    awsProfileName: remoteCacheOptions.profileName
+  };
+}
+
 // src/agent/bundles/business-models.ts
 var TEMPLATE_CANVAS = `---
 title: "Business Model: <Segment Name>"
@@ -10494,188 +10897,210 @@ var cleanMergedBranchesSkill = {
     }
   ]
 };
-var githubWorkflowBundle = {
-  name: "github-workflow",
-  description: "GitHub issue and PR workflow automation patterns",
-  appliesWhen: (project) => hasComponent(project, GitHub),
-  rules: [
-    {
-      name: "issue-workflow",
-      description: "Automated workflow for starting work on a GitHub issue",
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# Issue Workflow",
-        "",
-        '## "Work on issue X" Automation',
-        "",
-        "When the user says **work on issue X** (or similar), invoke the `issue-worker` agent in interactive mode, passing the issue number in the prompt. Do not perform the branch creation, issue fetching, or planning steps yourself \u2014 the agent handles the full workflow (claim, branch, plan, implement, PR) and will pause for your approval at the appropriate checkpoints."
-      ].join("\n"),
-      tags: ["workflow"]
-    },
-    {
-      name: "create-issue-workflow",
-      description: "Automated workflow for creating a new GitHub issue",
-      // ALWAYS scope: users invoke "create an issue" from any
-      // context, not only when editing agent / skill / bundle source.
-      // Consumers that want to narrow the load can override via
-      // `agentConfig.additionalRulePaths` or `excludeRules`.
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# Create Issue Workflow",
-        "",
-        '## "Create an issue" Automation',
-        "",
-        "When the user says **create an issue** (or similar), follow these steps exactly:",
-        "",
-        "1. **Determine the issue type prefix** from the user's description:",
-        "   - `epic:` \u2014 Large initiatives spanning multiple child issues",
-        "   - `feat:` \u2014 New features or functionality",
-        "   - `fix:` \u2014 Bug fixes",
-        "   - `chore:` \u2014 Maintenance: deps, tooling, config",
-        "   - `docs:` \u2014 Documentation-only work",
-        "   - `refactor:` \u2014 Code restructure, no behavior change",
-        "   - `release:` \u2014 Release preparation, version bumps",
-        "   - `hotfix:` \u2014 Urgent production fixes",
-        "   - If unclear, ask the user which type applies",
-        "2. **Compose the issue title** in the format: `<type>: <short description>`",
-        "3. **Determine the GitHub issue type** based on the prefix:",
-        "   - `epic:` \u2192 Epic",
-        "   - `feat:` \u2192 Feature",
-        "   - `fix:` \u2192 Bug",
-        "   - `chore:`, `docs:`, `refactor:`, `release:`, `hotfix:` \u2192 Task",
-        "4. **Identify prerequisite issues** \u2014 if the user mentions dependencies or blockers, include a **Dependencies** section in the body with `Depends on: #<issue-number>`",
-        "5. **Determine labels** \u2014 every issue must be created with the following labels:",
-        "   - **`type:*`** \u2014 derived from the issue title prefix:",
-        "     - `epic:` \u2192 `type:feat`",
-        "     - `feat:` \u2192 `type:feat`",
-        "     - `fix:` \u2192 `type:fix`",
-        "     - `chore:` \u2192 `type:chore`",
-        "     - `docs:` \u2192 `type:docs`",
-        "     - `refactor:` \u2192 `type:refactor`",
-        "     - `release:` \u2192 `type:release`",
-        "     - `hotfix:` \u2192 `type:hotfix`",
-        '   - **`priority:*`** \u2014 infer from the user\'s description when possible (e.g., "urgent"/"critical" \u2192 `priority:critical`, "important" \u2192 `priority:high`, "minor"/"low priority" \u2192 `priority:low`). If the priority is unclear, ask the user before creating the issue. Valid values: `priority:critical`, `priority:high`, `priority:medium`, `priority:low`, `priority:trivial`',
-        "   - **`status:ready`** \u2014 always add unless the issue has dependencies or blockers, in which case use `status:blocked`",
-        "6. **Create the issue** using `gh issue create`:",
-        "   - `--title '<type>: <description>'`",
-        "   - `--body '<issue body>'`",
-        "   - `--label '<type-label>' --label '<priority-label>' --label '<status-label>'`",
-        "7. **Set the GitHub issue type** by invoking the `set-issue-type.sh` helper (shipped with this bundle):",
-        "",
-        "   ```sh",
-        "   .claude/procedures/set-issue-type.sh <issue-number> <Feature|Task|Epic|Bug>",
-        "   ```",
-        "",
-        "   The helper resolves owner/repo, looks up the issue type node ID, looks up the issue node ID, and applies the `updateIssueIssueType` mutation in one step. It exits non-zero with a clear diagnostic on any error and lists available types if the type name is not recognised.",
-        "",
-        "   **Under the hood** (documented fallback if the helper is unavailable): the helper performs a two-step GraphQL flow \u2014 first a `repository(...).issueTypes` query to map the human-readable type name to a node ID, then the `updateIssueIssueType` mutation. The canonical queries are:",
-        "",
-        "   ```sh",
-        "   gh api graphql -f query='query($owner:String!,$repo:String!){repository(owner:$owner,name:$repo){issueTypes(first:50){nodes{id name}}}}' -f owner=<owner> -f repo=<repo>",
-        "   gh api graphql -f query='mutation($issueId:ID!,$typeId:ID!){updateIssueIssueType(input:{issueId:$issueId,issueTypeId:$typeId}){issue{number issueType{name}}}}' -f issueId=<issue-node-id> -f typeId=<issue-type-node-id>",
-        "   ```",
-        "",
-        "### Issue Body Template",
-        "",
-        "```markdown",
-        "## Summary",
-        "",
-        "<1-3 sentences describing the issue>",
-        "",
-        "## Details",
-        "",
-        "<Detailed description, acceptance criteria, or reproduction steps as appropriate>",
-        "",
-        "## Dependencies",
-        "",
-        "Depends on: #<issue-number> (if any, otherwise omit this section)",
-        "```",
-        "",
-        "### Important",
-        "",
-        "- Always use the conventional prefix in the issue title",
-        "- Always assign the correct GitHub issue type via the `set-issue-type.sh` helper (step 7) \u2014 never via `gh issue create --type`",
-        "- Always include `type:*`, `priority:*`, and `status:*` labels",
-        "- If the user does not specify a type, ask before creating the issue",
-        "- If the priority cannot be inferred from the description, ask the user before creating the issue",
-        "- Keep titles concise and descriptive"
-      ].join("\n"),
-      tags: ["workflow"]
-    },
-    {
-      name: "pr-workflow",
-      description: "Automated workflow for opening a pull request",
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# PR Workflow",
-        "",
-        '## "Open a PR" Automation',
-        "",
-        "When the user says **open a PR** (or similar), follow these steps exactly:",
-        "",
-        "1. **Regenerate project files** \u2014 run the three-step regen sequence (`pnpm i`, then `pnpm exec projen`, then `pnpm i` again) to ensure all generated files are up to date. The leading `pnpm i` is required because `pnpm exec projen` synthesises against whatever version of configulator (and projen, and any projen plugins) is currently resolved in `node_modules`; if the lockfile has moved past `node_modules` (typically right after `git pull` lands a dependency upgrade, or on a fresh checkout), synth runs against stale templates and produces phantom drift in `.claude/`, `.github/labels.yml`, `CLAUDE.md`, and other generated files. The trailing `pnpm i` picks up any dependency changes projen wrote into `package.json` during synth. Check `git diff` after the third step \u2014 if there are changes, commit them before proceeding.",
-        "2. **Run the full monorepo build** \u2014 run `pnpm build:all` to compile, lint, and test all packages (mirrors the CI pipeline). This command requires the user to be authenticated to AWS on the prod account used for Turborepo remote caching (`readonlyaccess-prod-525259625215-us-east-1` profile). If the command fails due to AWS credentials, ask the user to authenticate first. If the build produces changes to turbo inputs (typically snapshot files or ESLint auto-fixes), commit those changes and run `pnpm build:all` again \u2014 the build must complete cleanly with no uncommitted changes.",
-        "3. **Check for uncommitted changes** \u2014 if any exist, commit them with a conventional commit message",
-        "4. **Pull and rebase from the default branch** \u2014 run `git pull origin {{repository.defaultBranch}} --rebase` to incorporate the latest changes and resolve any conflicts before pushing",
-        "5. **Push the branch** to origin: `git push -u origin <branch>`",
-        "6. **Create the PR** using `gh pr create`:",
-        "   - **Title**: use a conventional commit style title (e.g., `feat(scope): short description`)",
-        "   - **Body**: include `Closes #<issue-number>` (derived from the branch name) and a brief summary of changes",
-        "7. **Delegate review and merge to the `pr-reviewer` sub-agent.** After the PR is created, invoke the `/review-pr <pr-number>` skill (or otherwise hand the new PR number to the `pr-reviewer` sub-agent). The reviewer verifies the diff against the linked issue's acceptance criteria and enables squash auto-merge when all checks pass. Do **not** run `gh pr merge --auto` yourself \u2014 review/merge policy lives solely in the `pr-reviewer` agent.",
-        "",
-        "### PR Body Template",
-        "",
-        "```markdown",
-        "## Summary",
-        "",
-        "<1-3 bullet points describing what changed and why>",
-        "",
-        "Closes #<issue-number>",
-        "",
-        "## Test Plan",
-        "",
-        "- [ ] Tests pass locally",
-        "- [ ] Relevant changes have been reviewed",
-        "```",
-        "",
-        "### Important",
-        "",
-        "- Always derive the issue number from the branch name (e.g., `feat/42-add-login` \u2192 `#42`)",
-        "- Use conventional commit format for the PR title",
-        "- Delegate merge to the `pr-reviewer` sub-agent \u2014 do not merge manually and do not enable auto-merge directly"
-      ].join("\n"),
-      tags: ["workflow"]
-    },
-    {
-      name: "branch-cleanup",
-      description: "Local-branch hygiene helpers shipped with the github-workflow bundle, including the /clean-merged-branches skill for safely force-deleting branches whose content has already merged into the base (handles squash merges).",
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# Branch Cleanup",
-        "",
-        "Local branches accumulate after every merged PR. In squash-merge",
-        "repositories `git branch -d` refuses to delete them because the",
-        "commit hash on the base differs, even when the branch content is",
-        "fully merged. The `github-workflow` bundle ships two affordances",
-        "that use content-equality (not commit-graph reachability) to",
-        "identify branches safe to force-delete:",
-        "",
-        "- `/clean-merged-branches` \u2014 interactive slash-command skill that",
-        "  classifies every local branch, prompts for confirmation, then",
-        "  runs `git branch -D` on the confirmed list. See",
-        "  `.claude/skills/clean-merged-branches/SKILL.md` for usage,",
-        "  output format, and the squash-merge verification algorithm.",
-        "- `.claude/procedures/clean-merged-branches.sh` \u2014 analysis-only",
-        "  procedure for non-interactive agent use (orchestrator,",
-        "  maintenance-audit). NEVER deletes \u2014 only reports `MERGED` /",
-        "  `UNMERGED` / `EMPTY` / `SKIP_WORKTREE` lines."
-      ].join("\n"),
-      tags: ["workflow"]
-    }
-  ],
-  skills: [cleanMergedBranchesSkill],
-  procedures: [setIssueTypeProcedure, cleanMergedBranchesProcedure]
-};
+function renderPrWorkflowBuildStep(policy) {
+  const lines = [
+    "2. **Run the build \u2014 scoped to what changed.**",
+    "",
+    "   - **Documentation-only changes** \u2014 a diff confined to documentation content (markdown pages, no source, config, or projen inputs) does **not** require `pnpm build:all`. There is nothing to compile, and CI is the authoritative content gate. Commit the content and proceed to the next step.",
+    "   - **Everything else** \u2014 when the change touches build inputs (source code, `.projenrc.ts`, `projenrc/**`, or any other projen-generated config), run `pnpm build:all` to compile, lint, and test all packages (mirrors the CI pipeline). If the build produces changes to turbo inputs (typically snapshot files or ESLint auto-fixes), commit those changes and run `pnpm build:all` again \u2014 the build must complete cleanly with no uncommitted changes."
+  ];
+  if (policy.remoteCacheEnabled && policy.awsProfileName) {
+    lines.push(
+      "",
+      `   \`pnpm build:all\` uses the Turborepo **remote cache**, which requires the user to be authenticated to AWS on the \`${policy.awsProfileName}\` profile. If the command fails due to AWS credentials, ask the user to authenticate first.`
+    );
+  }
+  lines.push(
+    "",
+    "   **Never background a long build and end the turn.** If you run a build, run it in the **foreground** to completion before committing, pushing, or opening the PR. Launching `pnpm build:all` as a background process and ending your turn while it is still running strands the deliverable uncommitted \u2014 that work is lost. This is the documented root cause of autonomous worker-stall incidents."
+  );
+  return lines;
+}
+function buildGithubWorkflowBundle(buildPolicy = DEFAULT_BUILD_POLICY) {
+  return {
+    name: "github-workflow",
+    description: "GitHub issue and PR workflow automation patterns",
+    appliesWhen: (project) => hasComponent(project, GitHub),
+    rules: [
+      {
+        name: "issue-workflow",
+        description: "Automated workflow for starting work on a GitHub issue",
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# Issue Workflow",
+          "",
+          '## "Work on issue X" Automation',
+          "",
+          "When the user says **work on issue X** (or similar), invoke the `issue-worker` agent in interactive mode, passing the issue number in the prompt. Do not perform the branch creation, issue fetching, or planning steps yourself \u2014 the agent handles the full workflow (claim, branch, plan, implement, PR) and will pause for your approval at the appropriate checkpoints."
+        ].join("\n"),
+        tags: ["workflow"]
+      },
+      {
+        name: "create-issue-workflow",
+        description: "Automated workflow for creating a new GitHub issue",
+        // ALWAYS scope: users invoke "create an issue" from any
+        // context, not only when editing agent / skill / bundle source.
+        // Consumers that want to narrow the load can override via
+        // `agentConfig.additionalRulePaths` or `excludeRules`.
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# Create Issue Workflow",
+          "",
+          '## "Create an issue" Automation',
+          "",
+          "When the user says **create an issue** (or similar), follow these steps exactly:",
+          "",
+          "1. **Determine the issue type prefix** from the user's description:",
+          "   - `epic:` \u2014 Large initiatives spanning multiple child issues",
+          "   - `feat:` \u2014 New features or functionality",
+          "   - `fix:` \u2014 Bug fixes",
+          "   - `chore:` \u2014 Maintenance: deps, tooling, config",
+          "   - `docs:` \u2014 Documentation-only work",
+          "   - `refactor:` \u2014 Code restructure, no behavior change",
+          "   - `release:` \u2014 Release preparation, version bumps",
+          "   - `hotfix:` \u2014 Urgent production fixes",
+          "   - If unclear, ask the user which type applies",
+          "2. **Compose the issue title** in the format: `<type>: <short description>`",
+          "3. **Determine the GitHub issue type** based on the prefix:",
+          "   - `epic:` \u2192 Epic",
+          "   - `feat:` \u2192 Feature",
+          "   - `fix:` \u2192 Bug",
+          "   - `chore:`, `docs:`, `refactor:`, `release:`, `hotfix:` \u2192 Task",
+          "4. **Identify prerequisite issues** \u2014 if the user mentions dependencies or blockers, include a **Dependencies** section in the body with `Depends on: #<issue-number>`",
+          "5. **Determine labels** \u2014 every issue must be created with the following labels:",
+          "   - **`type:*`** \u2014 derived from the issue title prefix:",
+          "     - `epic:` \u2192 `type:feat`",
+          "     - `feat:` \u2192 `type:feat`",
+          "     - `fix:` \u2192 `type:fix`",
+          "     - `chore:` \u2192 `type:chore`",
+          "     - `docs:` \u2192 `type:docs`",
+          "     - `refactor:` \u2192 `type:refactor`",
+          "     - `release:` \u2192 `type:release`",
+          "     - `hotfix:` \u2192 `type:hotfix`",
+          '   - **`priority:*`** \u2014 infer from the user\'s description when possible (e.g., "urgent"/"critical" \u2192 `priority:critical`, "important" \u2192 `priority:high`, "minor"/"low priority" \u2192 `priority:low`). If the priority is unclear, ask the user before creating the issue. Valid values: `priority:critical`, `priority:high`, `priority:medium`, `priority:low`, `priority:trivial`',
+          "   - **`status:ready`** \u2014 always add unless the issue has dependencies or blockers, in which case use `status:blocked`",
+          "6. **Create the issue** using `gh issue create`:",
+          "   - `--title '<type>: <description>'`",
+          "   - `--body '<issue body>'`",
+          "   - `--label '<type-label>' --label '<priority-label>' --label '<status-label>'`",
+          "7. **Set the GitHub issue type** by invoking the `set-issue-type.sh` helper (shipped with this bundle):",
+          "",
+          "   ```sh",
+          "   .claude/procedures/set-issue-type.sh <issue-number> <Feature|Task|Epic|Bug>",
+          "   ```",
+          "",
+          "   The helper resolves owner/repo, looks up the issue type node ID, looks up the issue node ID, and applies the `updateIssueIssueType` mutation in one step. It exits non-zero with a clear diagnostic on any error and lists available types if the type name is not recognised.",
+          "",
+          "   **Under the hood** (documented fallback if the helper is unavailable): the helper performs a two-step GraphQL flow \u2014 first a `repository(...).issueTypes` query to map the human-readable type name to a node ID, then the `updateIssueIssueType` mutation. The canonical queries are:",
+          "",
+          "   ```sh",
+          "   gh api graphql -f query='query($owner:String!,$repo:String!){repository(owner:$owner,name:$repo){issueTypes(first:50){nodes{id name}}}}' -f owner=<owner> -f repo=<repo>",
+          "   gh api graphql -f query='mutation($issueId:ID!,$typeId:ID!){updateIssueIssueType(input:{issueId:$issueId,issueTypeId:$typeId}){issue{number issueType{name}}}}' -f issueId=<issue-node-id> -f typeId=<issue-type-node-id>",
+          "   ```",
+          "",
+          "### Issue Body Template",
+          "",
+          "```markdown",
+          "## Summary",
+          "",
+          "<1-3 sentences describing the issue>",
+          "",
+          "## Details",
+          "",
+          "<Detailed description, acceptance criteria, or reproduction steps as appropriate>",
+          "",
+          "## Dependencies",
+          "",
+          "Depends on: #<issue-number> (if any, otherwise omit this section)",
+          "```",
+          "",
+          "### Important",
+          "",
+          "- Always use the conventional prefix in the issue title",
+          "- Always assign the correct GitHub issue type via the `set-issue-type.sh` helper (step 7) \u2014 never via `gh issue create --type`",
+          "- Always include `type:*`, `priority:*`, and `status:*` labels",
+          "- If the user does not specify a type, ask before creating the issue",
+          "- If the priority cannot be inferred from the description, ask the user before creating the issue",
+          "- Keep titles concise and descriptive"
+        ].join("\n"),
+        tags: ["workflow"]
+      },
+      {
+        name: "pr-workflow",
+        description: "Automated workflow for opening a pull request",
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# PR Workflow",
+          "",
+          '## "Open a PR" Automation',
+          "",
+          "When the user says **open a PR** (or similar), follow these steps exactly:",
+          "",
+          "1. **Regenerate project files** \u2014 run the three-step regen sequence (`pnpm i`, then `pnpm exec projen`, then `pnpm i` again) to ensure all generated files are up to date. The leading `pnpm i` is required because `pnpm exec projen` synthesises against whatever version of configulator (and projen, and any projen plugins) is currently resolved in `node_modules`; if the lockfile has moved past `node_modules` (typically right after `git pull` lands a dependency upgrade, or on a fresh checkout), synth runs against stale templates and produces phantom drift in `.claude/`, `.github/labels.yml`, `CLAUDE.md`, and other generated files. The trailing `pnpm i` picks up any dependency changes projen wrote into `package.json` during synth. Check `git diff` after the third step \u2014 if there are changes, commit them before proceeding.",
+          ...renderPrWorkflowBuildStep(buildPolicy),
+          "3. **Check for uncommitted changes** \u2014 if any exist, commit them with a conventional commit message",
+          "4. **Pull and rebase from the default branch** \u2014 run `git pull origin {{repository.defaultBranch}} --rebase` to incorporate the latest changes and resolve any conflicts before pushing",
+          "5. **Push the branch** to origin: `git push -u origin <branch>`",
+          "6. **Create the PR** using `gh pr create`:",
+          "   - **Title**: use a conventional commit style title (e.g., `feat(scope): short description`)",
+          "   - **Body**: include `Closes #<issue-number>` (derived from the branch name) and a brief summary of changes",
+          "7. **Delegate review and merge to the `pr-reviewer` sub-agent.** After the PR is created, invoke the `/review-pr <pr-number>` skill (or otherwise hand the new PR number to the `pr-reviewer` sub-agent). The reviewer verifies the diff against the linked issue's acceptance criteria and enables squash auto-merge when all checks pass. Do **not** run `gh pr merge --auto` yourself \u2014 review/merge policy lives solely in the `pr-reviewer` agent.",
+          "",
+          "### PR Body Template",
+          "",
+          "```markdown",
+          "## Summary",
+          "",
+          "<1-3 bullet points describing what changed and why>",
+          "",
+          "Closes #<issue-number>",
+          "",
+          "## Test Plan",
+          "",
+          "- [ ] Tests pass locally",
+          "- [ ] Relevant changes have been reviewed",
+          "```",
+          "",
+          "### Important",
+          "",
+          "- Always derive the issue number from the branch name (e.g., `feat/42-add-login` \u2192 `#42`)",
+          "- Use conventional commit format for the PR title",
+          "- Delegate merge to the `pr-reviewer` sub-agent \u2014 do not merge manually and do not enable auto-merge directly"
+        ].join("\n"),
+        tags: ["workflow"]
+      },
+      {
+        name: "branch-cleanup",
+        description: "Local-branch hygiene helpers shipped with the github-workflow bundle, including the /clean-merged-branches skill for safely force-deleting branches whose content has already merged into the base (handles squash merges).",
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# Branch Cleanup",
+          "",
+          "Local branches accumulate after every merged PR. In squash-merge",
+          "repositories `git branch -d` refuses to delete them because the",
+          "commit hash on the base differs, even when the branch content is",
+          "fully merged. The `github-workflow` bundle ships two affordances",
+          "that use content-equality (not commit-graph reachability) to",
+          "identify branches safe to force-delete:",
+          "",
+          "- `/clean-merged-branches` \u2014 interactive slash-command skill that",
+          "  classifies every local branch, prompts for confirmation, then",
+          "  runs `git branch -D` on the confirmed list. See",
+          "  `.claude/skills/clean-merged-branches/SKILL.md` for usage,",
+          "  output format, and the squash-merge verification algorithm.",
+          "- `.claude/procedures/clean-merged-branches.sh` \u2014 analysis-only",
+          "  procedure for non-interactive agent use (orchestrator,",
+          "  maintenance-audit). NEVER deletes \u2014 only reports `MERGED` /",
+          "  `UNMERGED` / `EMPTY` / `SKIP_WORKTREE` lines."
+        ].join("\n"),
+        tags: ["workflow"]
+      }
+    ],
+    skills: [cleanMergedBranchesSkill],
+    procedures: [setIssueTypeProcedure, cleanMergedBranchesProcedure]
+  };
+}
+var githubWorkflowBundle = buildGithubWorkflowBundle();
 
 // src/agent/bundles/industry-discovery.ts
 function buildIndustryDiscoveryAnalystSubAgent(paths, issueDefaults) {
@@ -18986,7 +19411,7 @@ var peopleProfileBundle = buildPeopleProfileBundle();
 
 // src/pnpm/pnpm-workspace.ts
 import { relative } from "path";
-import { Component, YamlFile } from "projen";
+import { Component as Component3, YamlFile } from "projen";
 var MINIMUM_RELEASE_AGE = {
   ZERO_DAYS: 0,
   ONE_HOUR: 60,
@@ -19000,7 +19425,7 @@ var MINIMUM_RELEASE_AGE = {
   SIX_DAYS: 8640,
   ONE_WEEK: 10080
 };
-var PnpmWorkspace = class _PnpmWorkspace extends Component {
+var PnpmWorkspace = class _PnpmWorkspace extends Component3 {
   /**
    * Get the pnpm workspace component of a project. If it does not exist,
    * return undefined.
@@ -28565,7 +28990,7 @@ function buildResearchPipelineBundle(paths = DEFAULT_AGENT_PATHS, issueDefaults
 var researchPipelineBundle = buildResearchPipelineBundle();
 
 // src/projects/project-metadata.ts
-import { Component as Component2 } from "projen";
+import { Component as Component4 } from "projen";
 import { NodeProject } from "projen/lib/javascript";
 var GITHUB_HTTPS_RE = /(?:https?:\/\/|git\+https:\/\/)github\.com\/([^/]+)\/([^/.]+)(?:\.git)?/;
 var GITHUB_SSH_RE = /git@github\.com:([^/]+)\/([^/.]+)(?:\.git)?/;
@@ -28580,7 +29005,7 @@ function parseGitHubUrl(url) {
   }
   return { owner: void 0, name: void 0 };
 }
-var ProjectMetadata = class _ProjectMetadata extends Component2 {
+var ProjectMetadata = class _ProjectMetadata extends Component4 {
   /**
    * Returns the ProjectMetadata instance for a project. Walks up the parent
    * chain so sub-projects resolve the metadata declared on a root
@@ -31177,435 +31602,56 @@ function buildStandardsResearchBundle(paths = DEFAULT_AGENT_PATHS, issueDefaults
 }
 var standardsResearchBundle = buildStandardsResearchBundle();
 
-// src/turbo/turbo-repo.ts
-import {
-  Component as Component4,
-  FileBase,
-  JsonFile,
-  SampleDir,
-  SampleFile
-} from "projen/lib";
-import { JobPermission } from "projen/lib/github/workflows-model";
-
-// src/turbo/turbo-repo-task.ts
-import { Component as Component3 } from "projen/lib";
-var TurboRepoTask = class extends Component3 {
-  constructor(project, options) {
-    super(project);
-    this.project = project;
-    this.name = options.name;
-    this.dependsOn = options.dependsOn ?? [];
-    this.env = options.env ?? [];
-    this.passThroughEnv = options.passThroughEnv ?? [];
-    this.outputs = options.outputs ?? [];
-    this.cache = options.cache ?? true;
-    this.inputs = [
-      ...options.inputs ?? [],
-      // rerun if projen config changes
-      ".projen/**",
-      // ignore mac files
-      "!.DS_Store",
-      "!**/.DS_Store"
-    ];
-    this.outputLogs = options.outputLogs ?? "new-only";
-    this.persistent = options.persistent ?? false;
-    this.interactive = options.interactive ?? false;
-    this.isActive = true;
-  }
-  taskConfig() {
-    return {
-      dependsOn: this.dependsOn,
-      env: this.env,
-      passThroughEnv: this.passThroughEnv,
-      outputs: this.outputs,
-      cache: this.cache,
-      inputs: this.inputs,
-      outputLogs: this.outputLogs,
-      persistent: this.persistent,
-      interactive: this.interactive
-    };
-  }
-};
-
-// src/turbo/turbo-repo.ts
-var ROOT_TURBO_TASK_NAME = "turbo:build";
-var ROOT_CI_TASK_NAME = "build:all";
-var _TurboRepo = class _TurboRepo extends Component4 {
-  constructor(project, options = {}) {
-    super(project);
-    this.project = project;
-    /**
-     * Sub-Tasks to run
-     */
-    this.tasks = [];
-    this.turboVersion = options.turboVersion ?? "catalog:";
-    this.isRootProject = project === project.root;
-    if (this.isRootProject) {
-      project.addDevDeps(`turbo@${this.turboVersion}`);
-    }
-    project.gitignore.addPatterns("/.turbo");
-    project.npmignore?.addPatterns("/.turbo/");
-    this.extends = options.extends ?? (this.isRootProject ? [] : ["//"]);
-    this.globalDependencies = options.globalDependencies ?? [];
-    this.globalEnv = options.globalEnv ?? [];
-    this.globalPassThroughEnv = options.globalPassThroughEnv ?? [];
-    this.ui = options.ui ?? "stream";
-    this.dangerouslyDisablePackageManagerCheck = options.dangerouslyDisablePackageManagerCheck ?? false;
-    this.cacheDir = options.cacheDir ?? ".turbo/cache";
-    this.daemon = options.daemon ?? true;
-    this.envMode = options.envMode ?? "strict";
-    this.runOptions = {
-      ...options.runOptions,
-      summarize: options.runOptions?.summarize ?? true,
-      concurrency: options.runOptions?.concurrency ?? 10
-    };
-    this.remoteCacheOptions = options.remoteCacheOptions;
-    this.buildAllTaskEnvVars = options.buildAllTaskEnvVars ?? {};
-    this.buildTask = new TurboRepoTask(this.project, {
-      name: ROOT_TURBO_TASK_NAME,
-      dependsOn: this.isRootProject ? [`^${ROOT_TURBO_TASK_NAME}`] : []
-    });
-    if (this.isRootProject) {
-      this.buildAllTask = this.project.tasks.addTask(ROOT_CI_TASK_NAME, {
-        description: "Root build followed by sub-project builds. Mimics the CI build process in one step."
-      });
-      this.buildAllTask.exec("turbo telemetry disable");
-      if (this.buildAllTaskEnvVars) {
-        Object.entries(this.buildAllTaskEnvVars).forEach(([name, value]) => {
-          this.addGlobalEnvVar(name, value);
-        });
-      }
-      if (!this.remoteCacheOptions) {
-        this.buildAllTask.exec(
-          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(false)}`
-        );
-      } else {
-        this.buildAllTask.exec(
-          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
-          {
-            condition: '[ ! -n "$CI" ]',
-            env: {
-              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`,
-              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`
-            }
-          }
-        );
-        this.buildAllTask.exec(
-          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
-          {
-            condition: '[ -n "$CI" ]',
-            env: {
-              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text)`,
-              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text)`
-            }
-          }
-        );
-      }
-    }
-    if (!this.isRootProject) {
-      this.preCompileTask = new TurboRepoTask(project, {
-        name: options.preCompileTask?.name ?? "pre-compile",
-        inputs: ["src/**"]
-      });
-      this.compileTask = new TurboRepoTask(project, {
-        name: options.compileTask?.name ?? "compile",
-        inputs: ["src/**"]
-      });
-      this.postCompileTask = new TurboRepoTask(project, {
-        name: options.postCompileTask?.name ?? "post-compile",
-        inputs: ["src/**"]
-      });
-      this.testTask = new TurboRepoTask(project, {
-        name: options.testTask?.name ?? "test"
-      });
-      this.packageTask = new TurboRepoTask(project, {
-        name: options.packageTask?.name ?? "package",
-        inputs: [".npmignore"]
-      });
-      this.tasks.push(
-        this.preCompileTask,
-        this.compileTask,
-        this.postCompileTask,
-        this.testTask,
-        this.packageTask
-      );
-    }
-  }
-  /**
-   * Static method to discovert turbo in a project.
-   */
-  static of(project) {
-    const isDefined = (c) => c instanceof _TurboRepo;
-    return project.components.find(isDefined);
-  }
-  /**
-   * Render the `turbo run` CLI flag string for the `build:all` / `reset:all`
-   * task commands from {@link runOptions}. With no `runOptions` configured the
-   * output matches the historically hard-coded flags exactly.
-   *
-   * @param remote - when `true`, also emit the remote-cache flags
-   * (`--cache=remote:rw` plus `--api` / `--token` / `--team` derived from
-   * {@link remoteCacheOptions}). The remote-cache `build:all` variant passes
-   * `true`; `reset:all` and the local `build:all` variant pass `false`.
-   */
-  renderRunArgs(remote) {
-    const run = this.runOptions;
-    const args = [];
-    if (run.summarize) {
-      args.push("--summarize");
-    }
-    args.push(`--concurrency=${run.concurrency}`);
-    if (run.force) {
-      args.push("--force");
-    }
-    if (run.noCache) {
-      args.push("--no-cache");
-    }
-    if (run.only) {
-      args.push("--only");
-    }
-    if (run.affected) {
-      args.push("--affected");
-    }
-    if (run.cacheWorkers !== void 0) {
-      args.push(`--cache-workers=${run.cacheWorkers}`);
-    }
-    if (run.continueOn !== void 0) {
-      args.push(`--continue=${run.continueOn}`);
-    }
-    if (run.frameworkInference !== void 0) {
-      args.push(`--framework-inference=${run.frameworkInference}`);
-    }
-    for (const filter of run.filter ?? []) {
-      args.push(`--filter=${filter}`);
-    }
-    if (run.outputLogs !== void 0) {
-      args.push(`--output-logs=${run.outputLogs}`);
-    }
-    if (run.logOrder !== void 0) {
-      args.push(`--log-order=${run.logOrder}`);
-    }
-    if (run.logPrefix !== void 0) {
-      args.push(`--log-prefix=${run.logPrefix}`);
-    }
-    if (run.dryRun !== void 0) {
-      args.push(`--dry-run=${run.dryRun}`);
-    }
-    const cache = run.cache ?? (remote ? "remote:rw" : void 0);
-    if (cache !== void 0) {
-      args.push(`--cache=${cache}`);
-    }
-    if (remote && this.remoteCacheOptions) {
-      args.push(
-        "--api=$TURBO_ENDPOINT",
-        "--token=$TURBO_TOKEN",
-        `--team=${this.remoteCacheOptions.teamName}`
-      );
-    }
-    if (run.additionalArgs) {
-      args.push(...run.additionalArgs);
-    }
-    return args.join(" ");
-  }
-  /**
-   * Add an env var to the global env vars for all tasks.
-   * This will also become an input for the build:all task cache at the root.
-   */
-  addGlobalEnvVar(name, value) {
-    this.buildAllTask?.env(name, value);
-    if (this.isRootProject) {
-      this.globalEnv.push(name);
-    }
-  }
-  activateBranchNameEnvVar(options) {
-    const value = '$([ -n "$GIT_BRANCH_NAME" ] && echo "$GIT_BRANCH_NAME" || git rev-parse --abbrev-ref HEAD)';
-    if (options === void 0) {
-      this.project.logger.warn(
-        "TurboRepo.activateBranchNameEnvVar() with no arguments is deprecated. It writes GIT_BRANCH_NAME to the root `globalEnv`, which forces every task in the monorepo to miss cache on every branch switch. Pass `{ tasks: [...] }` and name only the tasks that actually consume the branch (e.g. CDK synth/package) to preserve cross-branch cache hits for everything else."
-      );
-      this.addGlobalEnvVar("GIT_BRANCH_NAME", value);
-      return;
-    }
-    const knownTaskNames = this.tasks.map((task) => task.name);
-    const unknown = options.tasks.filter(
-      (name) => !knownTaskNames.includes(name)
-    );
-    if (unknown.length > 0) {
-      throw new Error(
-        `TurboRepo.activateBranchNameEnvVar: unknown task name(s) ${JSON.stringify(
-          unknown
-        )}. Known tasks on this TurboRepo: ${JSON.stringify(knownTaskNames)}.`
-      );
-    }
-    for (const name of options.tasks) {
-      const task = this.tasks.find((t) => t.name === name);
-      if (task && !task.env.includes("GIT_BRANCH_NAME")) {
-        task.env.push("GIT_BRANCH_NAME");
-      }
-    }
-  }
-  /**
-   * Paths of all generated files in the project, deduped, for use as task
-   * inputs so the compile cache invalidates when they change. Includes
-   * projen-managed `FileBase` files plus generated-once `SampleFile` /
-   * `SampleDir` — whose paths projen keeps private, so they are read defensively
-   * and skipped if that internal shape ever changes. Computed at synth time so
-   * files added after this component (e.g. a subclass's SampleFiles) are seen.
-   */
-  generatedFileInputs() {
-    const inputs = /* @__PURE__ */ new Set();
-    for (const component of this.project.components) {
-      if (component instanceof FileBase) {
-        inputs.add(component.path);
-      } else if (component instanceof SampleFile) {
-        const filePath = component.filePath;
-        if (typeof filePath === "string") {
-          inputs.add(filePath);
-        }
-      } else if (component instanceof SampleDir) {
-        const dir = component.dir;
-        if (typeof dir === "string") {
-          inputs.add(`${dir}/**`);
-        }
-      }
-    }
-    return Array.from(inputs);
-  }
-  preSynthesize() {
-    let nextDependsOn = this.project.deps.all.filter((d) => d.version === "workspace:*").map((d) => [d.name, ROOT_TURBO_TASK_NAME].join("#"));
-    if (!this.isRootProject) {
-      [
-        [this.project.preCompileTask, this.preCompileTask],
-        [this.project.compileTask, this.compileTask],
-        [this.project.postCompileTask, this.postCompileTask],
-        [this.project.testTask, this.testTask],
-        [this.project.packageTask, this.packageTask]
-      ].forEach(([pjTask, turboTask]) => {
-        if (pjTask && turboTask && pjTask.steps.length > 0) {
-          if (nextDependsOn.length > 0) {
-            turboTask.dependsOn.push(...nextDependsOn);
-          }
-          nextDependsOn = [turboTask.name];
-        } else {
-          turboTask.isActive = false;
-        }
-      });
-      this.buildTask.dependsOn.push(...nextDependsOn);
-    }
-    const generatedInputs = this.generatedFileInputs();
-    const appendGeneratedInputs = (task) => {
-      if (!task) {
-        return;
-      }
-      for (const input of generatedInputs) {
-        if (!task.inputs.includes(input)) {
-          task.inputs.push(input);
-        }
-      }
-    };
-    if (this.isRootProject) {
-      appendGeneratedInputs(this.buildTask);
-    } else {
-      appendGeneratedInputs(this.preCompileTask);
-      appendGeneratedInputs(this.compileTask);
-      appendGeneratedInputs(this.postCompileTask);
-    }
-    const fileName = "turbo.json";
-    this.project.addPackageIgnore(fileName);
-    new JsonFile(this.project, fileName, {
-      obj: {
-        extends: this.extends.length ? this.extends : void 0,
-        globalDependencies: this.isRootProject && this.globalDependencies.length ? this.globalDependencies : void 0,
-        globalEnv: this.isRootProject && this.globalEnv.length ? this.globalEnv : void 0,
-        globalPassThroughEnv: this.isRootProject && this.globalPassThroughEnv.length ? this.globalPassThroughEnv : void 0,
-        ui: this.isRootProject ? this.ui : void 0,
-        dangerouslyDisablePackageManagerCheck: this.isRootProject ? this.dangerouslyDisablePackageManagerCheck : void 0,
-        cacheDir: this.isRootProject ? this.cacheDir : void 0,
-        envMode: this.isRootProject ? this.envMode : void 0,
-        /**
-         * All tasks
-         */
-        tasks: this.tasks.filter((task) => task.isActive).reduce(
-          (acc, task) => {
-            acc[task.name] = {
-              ...task.taskConfig()
-            };
-            return acc;
-          },
-          {
-            [this.buildTask.name]: { ...this.buildTask.taskConfig() }
-          }
-        )
-      }
-    });
-    super.preSynthesize();
+// src/agent/bundles/turborepo.ts
+function renderCachingBullet(policy) {
+  if (policy.remoteCacheEnabled && policy.awsProfileName) {
+    return `- Uses remote caching (requires AWS credentials on the \`${policy.awsProfileName}\` profile)`;
   }
-};
-_TurboRepo.buildWorkflowOptions = (remoteCacheOptions) => {
+  return "- Local caching only \u2014 no remote cache is configured, so no AWS credentials are required";
+}
+function buildTurborepoBundle(buildPolicy = DEFAULT_BUILD_POLICY) {
   return {
-    env: {
-      GIT_BRANCH_NAME: "${{ github.head_ref || github.ref_name }}"
-    },
-    permissions: {
-      contents: JobPermission.WRITE,
-      idToken: JobPermission.WRITE
-    },
-    preBuildSteps: [
+    name: "turborepo",
+    description: "Turborepo workspace rules and task pipeline conventions",
+    appliesWhen: (project) => hasComponent(project, TurboRepo),
+    rules: [
       {
-        name: "AWS Creds for SSM",
-        uses: "aws-actions/configure-aws-credentials@v6",
-        with: {
-          ["role-to-assume"]: remoteCacheOptions.oidcRole,
-          ["aws-region"]: "us-east-1",
-          ["role-duration-seconds"]: "900"
-        }
+        name: "turborepo-conventions",
+        description: "Turborepo build system and task pipeline conventions",
+        scope: AGENT_RULE_SCOPE.FILE_PATTERN,
+        filePatterns: ["turbo.json", "package.json"],
+        content: [
+          "# Turborepo Conventions",
+          "",
+          "## Build System",
+          "",
+          "- **Build**: `pnpm build:all` (uses Turborepo)",
+          "- **Test**: `pnpm test` or `pnpm test:watch`",
+          "- **Lint**: `pnpm eslint`",
+          "",
+          "## Task Pipeline",
+          "",
+          renderCachingBullet(buildPolicy),
+          "- Only rebuilds changed packages",
+          "- Cache key based on file hashes and dependency graph",
+          "- Configured in `turbo.json`",
+          "",
+          "## Workspace Rules",
+          "",
+          "- Source files: `src/` directory",
+          "- Tests: Co-located with source files (`.spec.ts` or `.test.ts`)",
+          "- Exports: Use `index.ts` files for clean public APIs",
+          "- Configuration: Managed by Projen (edit `.projenrc.ts` or `projenrc/*.ts`)"
+        ].join("\n"),
+        tags: ["workflow"]
       }
-    ]
-  };
-};
-var TurboRepo = _TurboRepo;
-
-// src/agent/bundles/turborepo.ts
-var turborepoBundle = {
-  name: "turborepo",
-  description: "Turborepo workspace rules and task pipeline conventions",
-  appliesWhen: (project) => hasComponent(project, TurboRepo),
-  rules: [
-    {
-      name: "turborepo-conventions",
-      description: "Turborepo build system and task pipeline conventions",
-      scope: AGENT_RULE_SCOPE.FILE_PATTERN,
-      filePatterns: ["turbo.json", "package.json"],
-      content: [
-        "# Turborepo Conventions",
-        "",
-        "## Build System",
-        "",
-        "- **Build**: `pnpm build:all` (uses Turborepo)",
-        "- **Test**: `pnpm test` or `pnpm test:watch`",
-        "- **Lint**: `pnpm eslint`",
-        "",
-        "## Task Pipeline",
-        "",
-        "- Uses remote caching (requires AWS credentials)",
-        "- Only rebuilds changed packages",
-        "- Cache key based on file hashes and dependency graph",
-        "- Configured in `turbo.json`",
-        "",
-        "## Workspace Rules",
-        "",
-        "- Source files: `src/` directory",
-        "- Tests: Co-located with source files (`.spec.ts` or `.test.ts`)",
-        "- Exports: Use `index.ts` files for clean public APIs",
-        "- Configuration: Managed by Projen (edit `.projenrc.ts` or `projenrc/*.ts`)"
-      ].join("\n"),
-      tags: ["workflow"]
+    ],
+    claudePermissions: {
+      allow: ["Bash(npx turbo:*)"]
     }
-  ],
-  claudePermissions: {
-    allow: ["Bash(npx turbo:*)"]
-  }
-};
+  };
+}
+var turborepoBundle = buildTurborepoBundle();
 
 // src/agent/bundles/typescript.ts
 var typescriptBundle = {
@@ -32820,7 +32866,7 @@ function renderPriorityRulesSection(rules) {
 }
 
 // src/agent/bundles/index.ts
-function buildBuiltInBundles(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAULT_RESOLVED_ISSUE_DEFAULTS, defaultAgentTier = AGENT_MODEL.BALANCED, bundleAgentTiers = /* @__PURE__ */ new Map(), prReviewPolicy = resolvePrReviewPolicy()) {
+function buildBuiltInBundles(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAULT_RESOLVED_ISSUE_DEFAULTS, defaultAgentTier = AGENT_MODEL.BALANCED, bundleAgentTiers = /* @__PURE__ */ new Map(), prReviewPolicy = resolvePrReviewPolicy(), buildPolicy = DEFAULT_BUILD_POLICY) {
   const tierFor = (bundle) => bundleAgentTiers.get(bundle) ?? defaultAgentTier;
   return [
     buildBaseBundle(paths),
@@ -32828,11 +32874,11 @@ function buildBuiltInBundles(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAUL
     typescriptBundle,
     vitestBundle,
     jestBundle,
-    turborepoBundle,
+    buildTurborepoBundle(buildPolicy),
     pnpmBundle,
     awsCdkBundle,
     projenBundle,
-    githubWorkflowBundle,
+    buildGithubWorkflowBundle(buildPolicy),
     slackBundle,
     buildMeetingAnalysisBundle(tierFor("meeting-analysis")),
     agendaBundle,
@@ -33917,6 +33963,13 @@ var AgentConfig = class _AgentConfig extends Component8 {
    * their rendered rule content reflects any consumer override.
    * Bundles that do not read agent paths are passed through as-is
    * from their default const exports.
+   *
+   * The build policy is auto-detected from the project's `TurboRepo`
+   * component here rather than configured, so build guidance in the
+   * `github-workflow` and `turborepo` rules only claims an AWS
+   * credential requirement when a remote cache actually exists. The
+   * getter is lazy by design — `TurboRepo` must already be attached
+   * to the project when the bundles are first read.
    */
   get pathAwareBundles() {
     if (!this.cachedBundles) {
@@ -33925,7 +33978,8 @@ var AgentConfig = class _AgentConfig extends Component8 {
         resolveIssueDefaults(this.options.issueDefaults),
         resolveDefaultAgentTier(this.options),
         resolveBundleAgentTiers(this.options),
-        resolvePrReviewPolicy(this.options.prReviewPolicy)
+        resolvePrReviewPolicy(this.options.prReviewPolicy),
+        resolveBuildPolicy(this.project)
       );
     }
     return this.cachedBundles;
@@ -40643,6 +40697,7 @@ export {
   DEFAULT_API_EXTRACTOR_REPORT_FILENAME,
   DEFAULT_API_EXTRACTOR_REPORT_FOLDER,
   DEFAULT_AUDIT_REPORT_DIR,
+  DEFAULT_BUILD_POLICY,
   DEFAULT_BUNDLE_OVERRIDES,
   DEFAULT_DECOMPOSITION_TEMPLATE,
   DEFAULT_DISPATCH_MODEL,
@@ -40763,6 +40818,7 @@ export {
   buildCompanyProfileBundle,
   buildCustomerProfileBundle,
   buildDocsSyncBundle,
+  buildGithubWorkflowBundle,
   buildIndustryDiscoveryBundle,
   buildMaintenanceAuditBundle,
   buildMeetingAnalysisBundle,
@@ -40777,6 +40833,7 @@ export {
   buildResearchPipelineBundle,
   buildSoftwareProfileBundle,
   buildStandardsResearchBundle,
+  buildTurborepoBundle,
   buildUnblockDependentsProcedure,
   bundleNameForWorkflowRule,
   businessModelsBundle,
@@ -40894,6 +40951,7 @@ export {
   resolveAgentTiers,
   resolveAstroProjectOutdir,
   resolveAwsCdkProjectOutdir,
+  resolveBuildPolicy,
   resolveBundleAgentTiers,
   resolveDefaultAgentTier,
   resolveIssueDefaults,