@codedrifters/configulator 0.0.423 → 0.0.424

package/lib/index.d.mts

@@ -9549,9 +9549,16 @@ declare class AwsDeploymentTarget extends Component {
  *    layer; the caller is responsible for spreading the accessor result first
  *    and then the call-site option on top.
  *
+ * ## CLI version
+ *
+ * Beyond per-command flags, the component also owns {@link CdkCli.cliVersion} —
+ * the `aws-cdk` version generated CI jobs install before invoking `cdk`. It
+ * defaults to the project's own `aws-cdk` requirement so a deploy runs the same
+ * CLI that synthesized the cloud assembly it is deploying.
+ *
  * Auto-instantiated by {@link AwsDeploymentConfig} when absent; consumers can
  * pre-instantiate it via `new CdkCli(project, options)` to register custom
- * per-stage defaults and per-account overrides.
+ * per-stage defaults, per-account overrides, and a pinned CLI version.
  *
  ******************************************************************************/
 /**
@@ -9626,6 +9633,26 @@ interface CdkCliOptions {
      * ```
      */
     readonly accountOverrides?: Record<string, CdkTargetOverrides>;
+    /**
+     * The `aws-cdk` CLI version CI jobs install before invoking `cdk`.
+     *
+     * Rendered into the generated deploy and diff jobs as
+     * `pnpm dlx "aws-cdk@<version>"`, so a CI run deploys a cloud assembly with
+     * the same CLI that synthesized it instead of whatever happens to be latest
+     * on the registry at run time.
+     *
+     * Accepts any npm version specifier. Supplying a range (`^2`) rather than an
+     * exact version keeps the drift this option exists to close, so prefer an
+     * exact pin.
+     *
+     * @default - the project's own `aws-cdk` dependency requirement
+     * (`cdkDeps.cdkCliVersion`), which is the CLI that runs the `synth` task and
+     * therefore produces the cloud assembly CI deploys. Projects created through
+     * configulator's `AwsCdkProject` pin this exactly; a bare projen
+     * `AwsCdkTypeScriptApp` that never set `cdkCliVersion` falls back to projen's
+     * own `^2` default.
+     */
+    readonly cliVersion?: string;
 }
 declare class CdkCli extends Component {
     /**
@@ -9660,6 +9687,13 @@ declare class CdkCli extends Component {
      * The consumer-supplied per-account overrides, keyed by AWS account ID.
      */
     readonly accountOverrides: Record<string, CdkTargetOverrides>;
+    /**
+     * The resolved `aws-cdk` CLI version that generated CI jobs install.
+     *
+     * Always concrete, so callers rendering a workflow step never have to
+     * re-apply the default. See {@link CdkCliOptions.cliVersion}.
+     */
+    readonly cliVersion: string;
     constructor(project: AwsCdkTypeScriptApp, options?: CdkCliOptions);
     /**
      * Resolve the `cdk deploy` options to use against a given target.
@@ -12409,6 +12443,19 @@ interface DeployWorkflowOptions {
      * @default - no diff jobs are emitted
      */
     readonly diff?: DeployDiffOptions;
+    /**
+     * Pin this workflow's cloud-touching jobs to one repository, as an
+     * `owner/repo` slug.
+     *
+     * Guards every deploy and diff job with
+     * `github.repository == '<owner>/<repo>'` so a mirror or clone of the
+     * consumer repo hosted elsewhere skips them instead of failing at the OIDC
+     * credentials step. The build job is intentionally left unguarded.
+     *
+     * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+     * @default - no repository guard is emitted
+     */
+    readonly homeRepository?: string;
 }
 /**
  * Adds a build + deploy GitHub Actions workflow for an AwsCdkTypeScriptApp.
@@ -12418,7 +12465,7 @@ interface DeployWorkflowOptions {
  * the job summary. See the docs page for the full convention and naming
  * guidance.
  *
- * @see docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md
+ * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
  */
 declare class AwsDeployWorkflow extends Component {
     project: AwsCdkTypeScriptApp;
@@ -12460,6 +12507,10 @@ declare class AwsDeployWorkflow extends Component {
      * never have to re-apply the defaults.
      */
     readonly diffOptions: Required<DeployDiffOptions>;
+    /**
+     * Repository this workflow's cloud-touching jobs are pinned to, if any.
+     */
+    readonly homeRepository?: string;
     constructor(project: AwsCdkTypeScriptApp, options?: DeployWorkflowOptions);
     setupNode: () => Array<JobStep>;
     setupPnpm: () => Array<JobStep>;
@@ -12501,8 +12552,8 @@ declare class AwsDeployWorkflow extends Component {
      * Steps for a target's optional `cdk diff` job.
      *
      * Mirrors {@link deploySteps}' toolchain and credential setup — same pnpm /
-     * Node setup, same floating `aws-cdk` install, same OIDC role — so both jobs
-     * move together when the CLI version is pinned.
+     * Node setup, same version-pinned `aws-cdk` install, same OIDC role — so a
+     * diff is computed by the same CLI that will run the deploy.
      *
      * The `cdk diff` flags come from the {@link CdkCli} precedence chain via
      * `diffOptionsFor(target)`, so `method`, `securityOnly`, `fail`, and the rest
@@ -13656,6 +13707,19 @@ interface AwsTeardownWorkflowOptions {
      * @default ["feat/*", "fix/*", "feature/*"]
      */
     readonly deleteBranchPatterns?: Array<string>;
+    /**
+     * Pin the teardown jobs to one repository, as an `owner/repo` slug.
+     *
+     * Guards every teardown job with `github.repository == '<owner>/<repo>'` so a
+     * mirror or clone of the consumer repo does not delete stacks it does not
+     * own. Especially load-bearing here: a clone's branch list differs from the
+     * home repo's, so an unguarded scheduled run would classify live stacks as
+     * orphans.
+     *
+     * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+     * @default - no repository guard is emitted
+     */
+    readonly homeRepository?: string;
 }
 /**
  * Scheduled GitHub Actions workflow that tears down orphaned CloudFormation
@@ -14085,6 +14149,21 @@ declare const COMPLETE_JOB_ID = "complete";
  */
 declare function addBuildCompleteJob(buildWorkflow: BuildWorkflow): void;
 
+/**
+ * Render the GitHub Actions expression fragment that pins a job to one
+ * repository, validating the slug at synth time.
+ *
+ * Validation is deliberately eager: a typo'd slug matches no repository, so
+ * every guarded job would skip silently while the aggregate `complete` gate
+ * still reported success. Failing synth surfaces that immediately.
+ *
+ * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+ * @param homeRepository - `owner/repo` slug, or `undefined` to emit no guard.
+ * @param componentName - Component name used in the thrown error message.
+ * @returns The condition fragment, or `undefined` when the workflow is unpinned.
+ */
+declare const renderHomeRepositoryCondition: (homeRepository: string | undefined, componentName: string) => string | undefined;
+
 /**
  * Sets `with["include-hidden-files"] = true` on every build-artifact
  * `Upload artifact` step generated by projen's
@@ -14233,4 +14312,4 @@ declare function pinPnpmActionSetup(project: Project$1): void;
  */
 declare function pinSetupNodeVersion(project: Project$1): void;
 
-export { AGENT_MODEL, AGENT_PLATFORM, AGENT_REGISTRY_ENTRIES, AGENT_RULE_SCOPE, AGENT_TIER_ROLES, AGENT_TIER_VALUES, AUDIT_CATEGORY_ORDER, type ActionItemFilingConfig, type ActivateBranchNameEnvVarOptions, type AddStorybookOptions, type AgentCommand, AgentConfig, type AgentConfigOptions, type AgentExpansionRules, type AgentFeaturesConfig, type AgentModel, type AgentPathsConfig, type AgentPlatform, type AgentPlatformOverrides, type AgentProcedure, type AgentRegistryEntry, type AgentRule, type AgentRuleBundle, type AgentRuleScope, type AgentSkill, type AgentSubAgent, type AgentSubAgentPlatformOverrides, type AgentTier, type AgentTierConfig, type AgentTierEntry, type AnalyzeTsDocCoverageOptions, type ApiDiffCheckOptions, type ApiDiffFinding, type ApiDiffResult, ApiExtractor, type ApiExtractorOptions, type ApiExtractorReportOptions, type ApiSurfaceEntry, type ApproveMergeUpgradeOptions, AstroConfig, type AstroConfigOptions, type AstroIntegrationSpec, AstroOutput, AstroProject, type AstroProjectOptions, AuditCategory, type AuditCheckRunner, type AuditCheckRunnerContext, type AuditFinding, type AuditFindingBase, type AuditLocation, AuditMode, type AuditReport, AuditSeverity, type AwsAccount, AwsCdkProject, type AwsCdkProjectOptions, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, type AwsDeploymentTargetOptions, type AwsLocalDeploymentConfig, type AwsOrganization, type AwsRegion, AwsTeardownWorkflow, type AwsTeardownWorkflowOptions, BUILT_IN_BUNDLES, BUNDLE_OWNERSHIP, type BundleOwnership, CDK_BOOTSTRAP_DEFAULTS_BY_STAGE, CDK_DEPLOY_DEFAULTS_BY_STAGE, CDK_DEPLOY_METHOD, CDK_DESTROY_DEFAULTS_BY_STAGE, CDK_DIFF_DEFAULTS_BY_STAGE, CDK_DIFF_METHOD, CDK_GC_ACTION, CDK_GC_TYPE, CDK_INIT_LANGUAGE, CDK_INIT_TEMPLATE, CDK_PROGRESS, CDK_REQUIRE_APPROVAL, CDK_SYNTH_DEFAULTS_BY_STAGE, CDK_WATCH_DEFAULTS_BY_STAGE, CLAUDE_RULE_TARGET, COMPLETE_JOB_ID, CONVENTIONAL_COMMIT_TYPE_LABELS, type CdkAcknowledgeOptions, type CdkBootstrapOptions, CdkCli, type CdkCliOptions, type CdkContextOptions, type CdkDeployMethod, type CdkDeployOptions, type CdkDestroyOptions, type CdkDiffMethod, type CdkDiffOptions, type CdkDocsOptions, type CdkDoctorOptions, type CdkDriftOptions, type CdkFlagsOptions, type CdkGcAction, type CdkGcOptions, type CdkGcType, type CdkGlobalOptions, type CdkImportOptions, type CdkInitLanguage, type CdkInitOptions, type CdkInitTemplate, type CdkListOptions, type CdkMetadataOptions, type CdkMigrateOptions, type CdkNoticesOptions, type CdkOrphanOptions, type CdkProgress, type CdkPublishAssetsOptions, type CdkRefactorOptions, type CdkRequireApproval, type CdkRollbackOptions, type CdkSynthOptions, type CdkTargetOverrides, type CdkWatchOptions, type CiDeploymentConfig, type ClassTypeOptions, type ClaudeAutoModeConfig, type ClaudeHookAction, type ClaudeHookEntry, type ClaudeHooksConfig, type ClaudeMdConfig, type ClaudePermissionsConfig, type ClaudeRuleTarget, type ClaudeSandboxConfig, type ClaudeSettingsConfig, type CompileFencedSamplesOptions, type CopilotHandoff, type CursorHookAction, type CursorHooksConfig, type CursorSettingsConfig, type CustomDocSection, DEFAULT_AC_THRESHOLDS, DEFAULT_AGENT_PATHS, DEFAULT_AGENT_TIERS, DEFAULT_API_EXTRACTOR_CONFIG_FILE, DEFAULT_API_EXTRACTOR_ENTRY_POINT, DEFAULT_API_EXTRACTOR_REPORT_FILENAME, DEFAULT_API_EXTRACTOR_REPORT_FOLDER, DEFAULT_AUDIT_REPORT_DIR, DEFAULT_BASE_CONVENTIONS, DEFAULT_BUILD_POLICY, DEFAULT_BUNDLE_OVERRIDES, DEFAULT_DECOMPOSITION_TEMPLATE, DEFAULT_DISPATCH_MODEL, DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO, DEFAULT_GITHUB_ISSUE_TYPE, DEFAULT_HOUSEKEEPING_MODEL, DEFAULT_ISSUE_PRIORITY, DEFAULT_ISSUE_STATUS, DEFAULT_ISSUE_TEMPLATES_BUNDLE_PATH_PATTERNS, DEFAULT_ISSUE_TEMPLATES_EMIT_CHECKER, DEFAULT_ISSUE_TEMPLATES_EMIT_STARTER, DEFAULT_ISSUE_TEMPLATES_ENABLED, DEFAULT_ISSUE_TEMPLATES_PATH, DEFAULT_ISSUE_TEMPLATES_REQUIRE_REFERENCE, DEFAULT_OFF_PEAK_CRON_EXAMPLE, DEFAULT_ORCHESTRATOR_CONVENTIONS, DEFAULT_PARTIAL_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_PATHS_EXEMPT_FROM_SIZE, DEFAULT_PRIORITY_LABELS, DEFAULT_PRODUCT_CONTEXT_PATH, DEFAULT_PROGRESS_FILES_ENABLED, DEFAULT_PROGRESS_FILES_FILENAME_PATTERN, DEFAULT_PROGRESS_FILES_FORMAT, DEFAULT_PROGRESS_FILES_STALE_AFTER_HOURS, DEFAULT_PROGRESS_FILES_STATE_DIR, DEFAULT_REQUIREMENT_CATEGORY_DIRS, DEFAULT_REQUIRE_PRODUCT_CONTEXT, DEFAULT_RESOLVED_ISSUE_DEFAULTS, DEFAULT_RULE_CONVENTIONS, DEFAULT_SAMPLE_COMPILER_OPTIONS, DEFAULT_SCHEDULED_TASKS_ROOT, DEFAULT_SCHEDULED_TASK_ENTRIES, DEFAULT_SHARED_EDITING_CONFLICT_STRATEGY, DEFAULT_SHARED_EDITING_EMIT_HELPER, DEFAULT_SHARED_EDITING_ENABLED, DEFAULT_SHARED_EDITING_VERIFY_COMMIT, DEFAULT_SHARED_INDEX_PATHS, DEFAULT_SKILL_EVALS_EMIT_RUNNER, DEFAULT_SKILL_EVALS_ENABLED, DEFAULT_SKILL_EVALS_SKILLS_ROOT, DEFAULT_SOURCES_THRESHOLDS, DEFAULT_STATE_FILE_PATH, DEFAULT_STATUS_LABELS, DEFAULT_TEARDOWN_BRANCH_PATTERNS, DEFAULT_TEMPORAL_FRAMING_CADENCES, DEFAULT_TEMPORAL_FRAMING_EMIT_CHECKER, DEFAULT_TEMPORAL_FRAMING_ENABLED, DEFAULT_TEMPORAL_FRAMING_PATHS, DEFAULT_TYPE_LABELS, DEFAULT_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_UNBLOCK_DEPENDENTS_ENABLED, DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED, DOCS_SYNC_AUDIT_SCHEMA_VERSION, type DeployDiffOptions, type DeployWorkflowOptions, type DeploymentMetadata, type DocReferenceRecord, type EffectiveScopeThresholds, type ExtractDocReferencesOptions, type ExtractFencedSamplesOptions, type FencedSampleRecord, type FocusArea, type FocusAreaMatch, type FocusConfig, GITHUB_ISSUE_TYPES, GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX, type GitBranch, type GitHubBoardMetadata, type GitHubProjectMetadata, type GitHubSprintMetadata, type GithubIssueType, type IDependencyResolver, ISSUE_TEMPLATES_GENERATED_SUFFIX, type IssueDefaultsConfig, type IssueDefaultsOverride, type IssueDefaultsPriority, type IssueDefaultsStatus, type IssueTemplateRecipeStub, type IssueTemplatesConfig, type IssueTypeAssignmentStepOptions, JsiiFaker, LAYOUT_ENFORCEMENT, LAYOUT_ROOT_BY_PROJECT_TYPE, type LabelDefinition, type LayoutEnforcement, type LayoutViolation, type LinkFailureFinding, MAX_LABEL_DESCRIPTION_LENGTH, MCP_TRANSPORT, MERGE_METHODS, MIMIMUM_RELEASE_AGE, MINIMUM_RELEASE_AGE, MONOREPO_LAYOUT, type McpServerConfig, type McpTransport, type MeetingArea, type MeetingScope, type MeetingType, type MeetingTypeKind, type MeetingsConfig, type MergeMethod, type MonorepoLayoutRoot, type MonorepoPnpmOptions, MonorepoProject, type MonorepoProjectOptions, Nvmrc, type OrganizationMetadata, PHASE_LABEL_TYPE_MAP, PROD_DEPLOY_NAME, PROGRESS_FILES_FORMAT_VALUES, type PhaseLabelTypeOutcome, type PhaseLabelTypeResolution, PnpmWorkspace, type PnpmWorkspaceOptions, type PrReviewAutoMergeConfig, type PrReviewCiVerificationConfig, type PrReviewPolicyConfig, type PriorityRule, type ProgressFilesConfig, ProjectMetadata, type ProjectMetadataOptions, REQUIREMENTS_WRITER_PATHS, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ReactViteSiteProject, type ReactViteSiteProjectOptions, type ReferenceMismatchCheckOptions, type ReferenceMismatchFinding, type RemoteCacheOptions, type RepositoryMetadata, type RequirementBlockFields, type RequirementCategoryDirsConfig, RequirementIssueTemplate, type RequirementIssueTemplateOptions, ResetTask, type ResetTaskOptions, type ResolvedAgentPaths, type ResolvedAgentTier, type ResolvedBaseConventions, type ResolvedBuildPolicy, type ResolvedIssueDefaults, type ResolvedIssueDefaultsEntry, type ResolvedIssueTemplates, type ResolvedOrchestratorConventions, type ResolvedPrReviewAutoMerge, type ResolvedPrReviewPolicy, type ResolvedProgressFiles, type ResolvedProjectMetadata, type ResolvedRequirementCategoryDirs, type ResolvedRuleConventions, type ResolvedRunRatio, type ResolvedScheduledTask, type ResolvedScheduledTasks, type ResolvedScopeGate, type ResolvedScopeGateBundleOverride, type ResolvedSharedEditing, type ResolvedSkillEvals, type ResolvedTemporalFraming, type ResolvedUnblockDependents, type RunRatioConfig, type RunScanOptions, type RunScanResult, SCHEDULED_TASK_MODEL_VALUES, SCOPE_CLASS_VALUES, SET_ISSUE_TYPE_HELPER_PATH, SHARED_EDITING_CONFLICT_STRATEGY_VALUES, STARLIGHT_ROLE, SUPPRESSED_WORKFLOW_RULE_NAMES, type SampleCompilationFailure, type SampleFailureFinding, SampleLang, type ScheduledTaskEntry, type ScheduledTaskModel, type ScheduledTaskOverride, type ScheduledTasksConfig, type ScopeClass, type ScopeGateBundleOverride, type ScopeGateConfig, type ScopeGateThresholds, type SharedEditingConfig, type SkillEvalsConfig, type SlackMetadata, type SourceTierExamples, type StarlightEditLink, type StarlightLogo, StarlightProject, type StarlightProjectOptions, type StarlightRole, type StarlightSidebarItem, type StarlightSingletonViolation, type StarlightSocialLink, type SyncLabelsOptions, TEMPORAL_FRAMING_CATEGORY_VALUES, TURBO_RUN_CONTINUE, TURBO_RUN_DRY_RUN, TURBO_RUN_LOG_ORDER, TURBO_RUN_LOG_PREFIX, TURBO_RUN_OUTPUT_LOGS, type TemplateResolveResult, type TemporalFramingCategory, type TemporalFramingConfig, TestRunner, TsDocCoverageKind, type TsDocCoverageRecord, TsdocConfig, type TsdocConfigOptions, type TsdocCoverageCheckOptions, type TsdocCoverageFinding, TurboRepo, type TurboRepoOptions, TurboRepoTask, type TurboRepoTaskOptions, type TurboRunContinue, type TurboRunDryRun, type TurboRunLogOrder, type TurboRunLogPrefix, type TurboRunOptions, type TurboRunOutputLogs, TypeScriptConfig, TypeScriptProject, type TypeScriptProjectOptions, UNKNOWN_TYPE_FALLBACK_TIER, type UnblockDependentsConfig, type UpstreamConfigulatorConfig, VALID_PRIORITY_VALUES, VALID_STATUS_VALUES, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, type VersionKey, Vitest, type VitestConfigOptions, type VitestOptions, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, addPlaywright, addStorybook, addSyncLabelsWorkflow, agendaBundle, analyzeTsDocCoverage, auditReportJsonSchema, awsCdkBundle, baseBundle, bcmWriterBundle, buildAgentRegistryRule, buildBaseBundle, buildBcmWriterBundle, buildBuiltInBundles, buildBusinessModelsBundle, buildCheckBlockedProcedure, buildCompanyProfileBundle, buildCustomerProfileBundle, buildDocsSyncBundle, buildGithubWorkflowBundle, buildIndustryDiscoveryBundle, buildMaintenanceAuditBundle, buildMeetingAnalysisBundle, buildOrchestratorBundle, buildOrchestratorConventionsContent, buildPeopleProfileBundle, buildPrReviewBundle, buildRegulatoryResearchBundle, buildReport, buildRequirementsAnalystBundle, buildRequirementsReviewerBundle, buildRequirementsWriterBundle, buildResearchPipelineBundle, buildSoftwareProfileBundle, buildStandardsResearchBundle, buildTurborepoBundle, buildUnblockDependentsProcedure, bundleNameForWorkflowRule, businessModelsBundle, checkClosingKeywordsProcedure, checkDocSamplesProcedure, checkLinksProcedure, classifyIssueScope, classifyRun, collectIssueTemplateRecipeStubs, companyProfileBundle, compileFencedSamples, createApiDiffCheck, createReferenceMismatchCheck, createTsdocCoverageCheck, customerProfileBundle, diffApiRollups, docsSyncBundle, emptyCategoryBuckets, extractApiProcedure, extractDocReferences, extractFencedSamples, formatLayoutViolation, formatStarlightSingletonViolation, getLatestEligibleVersion, githubIssueTypeForTitle, githubWorkflowBundle, hasAnyDocsEmittingBundle, hasAnyDownstreamIssueKindBundle, includeHiddenFilesInBuildArtifact, industryDiscoveryBundle, isPhaseLabelOwnedByExcluded, isScheduledTaskOwnedByExcluded, isSuppressedWorkflowRule, isTypeLabelOwnedByExcluded, issueTemplatesChildGlob, issueTemplatesGeneratedPath, jestBundle, labelsForPhase, maintenanceAuditBundle, meetingAnalysisBundle, mergeCdkOptions, nextRequirementIdProcedure, orchestratorBundle, parseApiRollup, peopleProfileBundle, persistAuditReport, pinPnpmActionSetup, pinSetupNodeVersion, pnpmBundle, prReviewBundle, projenBundle, referenceRecordToFinding, regulatoryResearchBundle, renderAgentTierCaseStatement, renderAgentTierSection, renderCdkAcknowledge, renderCdkBootstrap, renderCdkContext, renderCdkDeploy, renderCdkDestroy, renderCdkDiff, renderCdkDocs, renderCdkDoctor, renderCdkDrift, renderCdkFlags, renderCdkGc, renderCdkImport, renderCdkInit, renderCdkList, renderCdkMetadata, renderCdkMigrate, renderCdkNotices, renderCdkOrphan, renderCdkPublishAssets, renderCdkRefactor, renderCdkRollback, renderCdkSynth, renderCdkWatch, renderCheckClosingKeywordsScript, renderCheckDocSamplesProcedure, renderCheckLinksProcedure, renderCustomDocSectionBlock, renderCustomDocSections, renderExtractApiProcedure, renderFocusSection, renderGithubIssueTypeSection, renderGithubIssueTypeSectionLines, renderIssueTemplateLabelsCheckerScript, renderIssueTemplatesBundleHook, renderIssueTemplatesCheckerScript, renderIssueTemplatesGeneratedPage, renderIssueTemplatesRuleContent, renderIssueTemplatesStarterPage, renderIssueTypeAssignmentBlanket, renderIssueTypeAssignmentStep, renderMeetingTypesSection, renderNextRequirementIdProcedure, renderPhaseTypeInvariantSection, renderPhaseTypeInvariantShellHelpers, renderPriorityRulesSection, renderProgressFileName, renderProgressFilePath, renderProgressFilesBundleHook, renderProgressFilesRuleContent, renderRequirementBlock, renderRunRatioSection, renderRunRatioShellHelpers, renderScheduledTaskSkillFile, renderScheduledTasksSection, renderScopeGateSection, renderScopeGateShellHelpers, renderSetIssueTypeFallbackLines, renderSharedEditingBundleHook, renderSharedEditingHelperScript, renderSharedEditingRuleContent, renderSkillEvalsBundleHook, renderSkillEvalsRuleContent, renderSkillEvalsRunnerScript, renderSourceTierExamples, renderStripToolArtifactTagsProcedure, renderTemporalFramingCheckerScript, renderTemporalFramingRuleContent, renderTitlePrefixTypeBullets, renderUnblockDependentsScript, renderUnblockDependentsSection, requirementsAnalystBundle, requirementsReviewerBundle, requirementsWriterBundle, researchPipelineBundle, resolveAgentPaths, resolveAgentTiers, resolveAstroProjectOutdir, resolveAwsCdkProjectOutdir, resolveBuildPolicy, resolveIssueDefaults, resolveIssueTemplates, resolveModelAlias, resolveOrchestratorAssets, resolveOutdirFromPackageName, resolveOverrideForLabels, resolvePrReviewPolicy, resolveProgressFiles, resolveReactViteSiteProjectOutdir, resolveRunRatio, resolveScheduledTasks, resolveScopeGate, resolveSharedEditing, resolveSkillEvals, resolveTemplateVariables, resolveTemporalFraming, resolveTypeLabelForLabels, resolveTypeScriptProjectOutdir, resolveUnblockDependents, runScan, slackBundle, softwareProfileBundle, standardsResearchBundle, stripToolArtifactTagsProcedure, tsdocRecordToFindings, turborepoBundle, typeLabelForPhaseLabel, typescriptBundle, upstreamConfigulatorDocsBundle, validateAgentTierConfig, validateIssueDefaultsConfig, validateIssueTemplatesConfig, validateMonorepoLayout, validatePrReviewPolicyConfig, validateProgressFilesConfig, validateRunRatioConfig, validateScheduledTasksConfig, validateScopeGateConfig, validateSharedEditingConfig, validateSkillEvalsConfig, validateStarlightSingleton, validateTemporalFramingConfig, validateUnblockDependentsConfig, vitestBundle };
+export { AGENT_MODEL, AGENT_PLATFORM, AGENT_REGISTRY_ENTRIES, AGENT_RULE_SCOPE, AGENT_TIER_ROLES, AGENT_TIER_VALUES, AUDIT_CATEGORY_ORDER, type ActionItemFilingConfig, type ActivateBranchNameEnvVarOptions, type AddStorybookOptions, type AgentCommand, AgentConfig, type AgentConfigOptions, type AgentExpansionRules, type AgentFeaturesConfig, type AgentModel, type AgentPathsConfig, type AgentPlatform, type AgentPlatformOverrides, type AgentProcedure, type AgentRegistryEntry, type AgentRule, type AgentRuleBundle, type AgentRuleScope, type AgentSkill, type AgentSubAgent, type AgentSubAgentPlatformOverrides, type AgentTier, type AgentTierConfig, type AgentTierEntry, type AnalyzeTsDocCoverageOptions, type ApiDiffCheckOptions, type ApiDiffFinding, type ApiDiffResult, ApiExtractor, type ApiExtractorOptions, type ApiExtractorReportOptions, type ApiSurfaceEntry, type ApproveMergeUpgradeOptions, AstroConfig, type AstroConfigOptions, type AstroIntegrationSpec, AstroOutput, AstroProject, type AstroProjectOptions, AuditCategory, type AuditCheckRunner, type AuditCheckRunnerContext, type AuditFinding, type AuditFindingBase, type AuditLocation, AuditMode, type AuditReport, AuditSeverity, type AwsAccount, AwsCdkProject, type AwsCdkProjectOptions, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, type AwsDeploymentTargetOptions, type AwsLocalDeploymentConfig, type AwsOrganization, type AwsRegion, AwsTeardownWorkflow, type AwsTeardownWorkflowOptions, BUILT_IN_BUNDLES, BUNDLE_OWNERSHIP, type BundleOwnership, CDK_BOOTSTRAP_DEFAULTS_BY_STAGE, CDK_DEPLOY_DEFAULTS_BY_STAGE, CDK_DEPLOY_METHOD, CDK_DESTROY_DEFAULTS_BY_STAGE, CDK_DIFF_DEFAULTS_BY_STAGE, CDK_DIFF_METHOD, CDK_GC_ACTION, CDK_GC_TYPE, CDK_INIT_LANGUAGE, CDK_INIT_TEMPLATE, CDK_PROGRESS, CDK_REQUIRE_APPROVAL, CDK_SYNTH_DEFAULTS_BY_STAGE, CDK_WATCH_DEFAULTS_BY_STAGE, CLAUDE_RULE_TARGET, COMPLETE_JOB_ID, CONVENTIONAL_COMMIT_TYPE_LABELS, type CdkAcknowledgeOptions, type CdkBootstrapOptions, CdkCli, type CdkCliOptions, type CdkContextOptions, type CdkDeployMethod, type CdkDeployOptions, type CdkDestroyOptions, type CdkDiffMethod, type CdkDiffOptions, type CdkDocsOptions, type CdkDoctorOptions, type CdkDriftOptions, type CdkFlagsOptions, type CdkGcAction, type CdkGcOptions, type CdkGcType, type CdkGlobalOptions, type CdkImportOptions, type CdkInitLanguage, type CdkInitOptions, type CdkInitTemplate, type CdkListOptions, type CdkMetadataOptions, type CdkMigrateOptions, type CdkNoticesOptions, type CdkOrphanOptions, type CdkProgress, type CdkPublishAssetsOptions, type CdkRefactorOptions, type CdkRequireApproval, type CdkRollbackOptions, type CdkSynthOptions, type CdkTargetOverrides, type CdkWatchOptions, type CiDeploymentConfig, type ClassTypeOptions, type ClaudeAutoModeConfig, type ClaudeHookAction, type ClaudeHookEntry, type ClaudeHooksConfig, type ClaudeMdConfig, type ClaudePermissionsConfig, type ClaudeRuleTarget, type ClaudeSandboxConfig, type ClaudeSettingsConfig, type CompileFencedSamplesOptions, type CopilotHandoff, type CursorHookAction, type CursorHooksConfig, type CursorSettingsConfig, type CustomDocSection, DEFAULT_AC_THRESHOLDS, DEFAULT_AGENT_PATHS, DEFAULT_AGENT_TIERS, DEFAULT_API_EXTRACTOR_CONFIG_FILE, DEFAULT_API_EXTRACTOR_ENTRY_POINT, DEFAULT_API_EXTRACTOR_REPORT_FILENAME, DEFAULT_API_EXTRACTOR_REPORT_FOLDER, DEFAULT_AUDIT_REPORT_DIR, DEFAULT_BASE_CONVENTIONS, DEFAULT_BUILD_POLICY, DEFAULT_BUNDLE_OVERRIDES, DEFAULT_DECOMPOSITION_TEMPLATE, DEFAULT_DISPATCH_MODEL, DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO, DEFAULT_GITHUB_ISSUE_TYPE, DEFAULT_HOUSEKEEPING_MODEL, DEFAULT_ISSUE_PRIORITY, DEFAULT_ISSUE_STATUS, DEFAULT_ISSUE_TEMPLATES_BUNDLE_PATH_PATTERNS, DEFAULT_ISSUE_TEMPLATES_EMIT_CHECKER, DEFAULT_ISSUE_TEMPLATES_EMIT_STARTER, DEFAULT_ISSUE_TEMPLATES_ENABLED, DEFAULT_ISSUE_TEMPLATES_PATH, DEFAULT_ISSUE_TEMPLATES_REQUIRE_REFERENCE, DEFAULT_OFF_PEAK_CRON_EXAMPLE, DEFAULT_ORCHESTRATOR_CONVENTIONS, DEFAULT_PARTIAL_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_PATHS_EXEMPT_FROM_SIZE, DEFAULT_PRIORITY_LABELS, DEFAULT_PRODUCT_CONTEXT_PATH, DEFAULT_PROGRESS_FILES_ENABLED, DEFAULT_PROGRESS_FILES_FILENAME_PATTERN, DEFAULT_PROGRESS_FILES_FORMAT, DEFAULT_PROGRESS_FILES_STALE_AFTER_HOURS, DEFAULT_PROGRESS_FILES_STATE_DIR, DEFAULT_REQUIREMENT_CATEGORY_DIRS, DEFAULT_REQUIRE_PRODUCT_CONTEXT, DEFAULT_RESOLVED_ISSUE_DEFAULTS, DEFAULT_RULE_CONVENTIONS, DEFAULT_SAMPLE_COMPILER_OPTIONS, DEFAULT_SCHEDULED_TASKS_ROOT, DEFAULT_SCHEDULED_TASK_ENTRIES, DEFAULT_SHARED_EDITING_CONFLICT_STRATEGY, DEFAULT_SHARED_EDITING_EMIT_HELPER, DEFAULT_SHARED_EDITING_ENABLED, DEFAULT_SHARED_EDITING_VERIFY_COMMIT, DEFAULT_SHARED_INDEX_PATHS, DEFAULT_SKILL_EVALS_EMIT_RUNNER, DEFAULT_SKILL_EVALS_ENABLED, DEFAULT_SKILL_EVALS_SKILLS_ROOT, DEFAULT_SOURCES_THRESHOLDS, DEFAULT_STATE_FILE_PATH, DEFAULT_STATUS_LABELS, DEFAULT_TEARDOWN_BRANCH_PATTERNS, DEFAULT_TEMPORAL_FRAMING_CADENCES, DEFAULT_TEMPORAL_FRAMING_EMIT_CHECKER, DEFAULT_TEMPORAL_FRAMING_ENABLED, DEFAULT_TEMPORAL_FRAMING_PATHS, DEFAULT_TYPE_LABELS, DEFAULT_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_UNBLOCK_DEPENDENTS_ENABLED, DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED, DOCS_SYNC_AUDIT_SCHEMA_VERSION, type DeployDiffOptions, type DeployWorkflowOptions, type DeploymentMetadata, type DocReferenceRecord, type EffectiveScopeThresholds, type ExtractDocReferencesOptions, type ExtractFencedSamplesOptions, type FencedSampleRecord, type FocusArea, type FocusAreaMatch, type FocusConfig, GITHUB_ISSUE_TYPES, GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX, type GitBranch, type GitHubBoardMetadata, type GitHubProjectMetadata, type GitHubSprintMetadata, type GithubIssueType, type IDependencyResolver, ISSUE_TEMPLATES_GENERATED_SUFFIX, type IssueDefaultsConfig, type IssueDefaultsOverride, type IssueDefaultsPriority, type IssueDefaultsStatus, type IssueTemplateRecipeStub, type IssueTemplatesConfig, type IssueTypeAssignmentStepOptions, JsiiFaker, LAYOUT_ENFORCEMENT, LAYOUT_ROOT_BY_PROJECT_TYPE, type LabelDefinition, type LayoutEnforcement, type LayoutViolation, type LinkFailureFinding, MAX_LABEL_DESCRIPTION_LENGTH, MCP_TRANSPORT, MERGE_METHODS, MIMIMUM_RELEASE_AGE, MINIMUM_RELEASE_AGE, MONOREPO_LAYOUT, type McpServerConfig, type McpTransport, type MeetingArea, type MeetingScope, type MeetingType, type MeetingTypeKind, type MeetingsConfig, type MergeMethod, type MonorepoLayoutRoot, type MonorepoPnpmOptions, MonorepoProject, type MonorepoProjectOptions, Nvmrc, type OrganizationMetadata, PHASE_LABEL_TYPE_MAP, PROD_DEPLOY_NAME, PROGRESS_FILES_FORMAT_VALUES, type PhaseLabelTypeOutcome, type PhaseLabelTypeResolution, PnpmWorkspace, type PnpmWorkspaceOptions, type PrReviewAutoMergeConfig, type PrReviewCiVerificationConfig, type PrReviewPolicyConfig, type PriorityRule, type ProgressFilesConfig, ProjectMetadata, type ProjectMetadataOptions, REQUIREMENTS_WRITER_PATHS, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ReactViteSiteProject, type ReactViteSiteProjectOptions, type ReferenceMismatchCheckOptions, type ReferenceMismatchFinding, type RemoteCacheOptions, type RepositoryMetadata, type RequirementBlockFields, type RequirementCategoryDirsConfig, RequirementIssueTemplate, type RequirementIssueTemplateOptions, ResetTask, type ResetTaskOptions, type ResolvedAgentPaths, type ResolvedAgentTier, type ResolvedBaseConventions, type ResolvedBuildPolicy, type ResolvedIssueDefaults, type ResolvedIssueDefaultsEntry, type ResolvedIssueTemplates, type ResolvedOrchestratorConventions, type ResolvedPrReviewAutoMerge, type ResolvedPrReviewPolicy, type ResolvedProgressFiles, type ResolvedProjectMetadata, type ResolvedRequirementCategoryDirs, type ResolvedRuleConventions, type ResolvedRunRatio, type ResolvedScheduledTask, type ResolvedScheduledTasks, type ResolvedScopeGate, type ResolvedScopeGateBundleOverride, type ResolvedSharedEditing, type ResolvedSkillEvals, type ResolvedTemporalFraming, type ResolvedUnblockDependents, type RunRatioConfig, type RunScanOptions, type RunScanResult, SCHEDULED_TASK_MODEL_VALUES, SCOPE_CLASS_VALUES, SET_ISSUE_TYPE_HELPER_PATH, SHARED_EDITING_CONFLICT_STRATEGY_VALUES, STARLIGHT_ROLE, SUPPRESSED_WORKFLOW_RULE_NAMES, type SampleCompilationFailure, type SampleFailureFinding, SampleLang, type ScheduledTaskEntry, type ScheduledTaskModel, type ScheduledTaskOverride, type ScheduledTasksConfig, type ScopeClass, type ScopeGateBundleOverride, type ScopeGateConfig, type ScopeGateThresholds, type SharedEditingConfig, type SkillEvalsConfig, type SlackMetadata, type SourceTierExamples, type StarlightEditLink, type StarlightLogo, StarlightProject, type StarlightProjectOptions, type StarlightRole, type StarlightSidebarItem, type StarlightSingletonViolation, type StarlightSocialLink, type SyncLabelsOptions, TEMPORAL_FRAMING_CATEGORY_VALUES, TURBO_RUN_CONTINUE, TURBO_RUN_DRY_RUN, TURBO_RUN_LOG_ORDER, TURBO_RUN_LOG_PREFIX, TURBO_RUN_OUTPUT_LOGS, type TemplateResolveResult, type TemporalFramingCategory, type TemporalFramingConfig, TestRunner, TsDocCoverageKind, type TsDocCoverageRecord, TsdocConfig, type TsdocConfigOptions, type TsdocCoverageCheckOptions, type TsdocCoverageFinding, TurboRepo, type TurboRepoOptions, TurboRepoTask, type TurboRepoTaskOptions, type TurboRunContinue, type TurboRunDryRun, type TurboRunLogOrder, type TurboRunLogPrefix, type TurboRunOptions, type TurboRunOutputLogs, TypeScriptConfig, TypeScriptProject, type TypeScriptProjectOptions, UNKNOWN_TYPE_FALLBACK_TIER, type UnblockDependentsConfig, type UpstreamConfigulatorConfig, VALID_PRIORITY_VALUES, VALID_STATUS_VALUES, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, type VersionKey, Vitest, type VitestConfigOptions, type VitestOptions, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, addPlaywright, addStorybook, addSyncLabelsWorkflow, agendaBundle, analyzeTsDocCoverage, auditReportJsonSchema, awsCdkBundle, baseBundle, bcmWriterBundle, buildAgentRegistryRule, buildBaseBundle, buildBcmWriterBundle, buildBuiltInBundles, buildBusinessModelsBundle, buildCheckBlockedProcedure, buildCompanyProfileBundle, buildCustomerProfileBundle, buildDocsSyncBundle, buildGithubWorkflowBundle, buildIndustryDiscoveryBundle, buildMaintenanceAuditBundle, buildMeetingAnalysisBundle, buildOrchestratorBundle, buildOrchestratorConventionsContent, buildPeopleProfileBundle, buildPrReviewBundle, buildRegulatoryResearchBundle, buildReport, buildRequirementsAnalystBundle, buildRequirementsReviewerBundle, buildRequirementsWriterBundle, buildResearchPipelineBundle, buildSoftwareProfileBundle, buildStandardsResearchBundle, buildTurborepoBundle, buildUnblockDependentsProcedure, bundleNameForWorkflowRule, businessModelsBundle, checkClosingKeywordsProcedure, checkDocSamplesProcedure, checkLinksProcedure, classifyIssueScope, classifyRun, collectIssueTemplateRecipeStubs, companyProfileBundle, compileFencedSamples, createApiDiffCheck, createReferenceMismatchCheck, createTsdocCoverageCheck, customerProfileBundle, diffApiRollups, docsSyncBundle, emptyCategoryBuckets, extractApiProcedure, extractDocReferences, extractFencedSamples, formatLayoutViolation, formatStarlightSingletonViolation, getLatestEligibleVersion, githubIssueTypeForTitle, githubWorkflowBundle, hasAnyDocsEmittingBundle, hasAnyDownstreamIssueKindBundle, includeHiddenFilesInBuildArtifact, industryDiscoveryBundle, isPhaseLabelOwnedByExcluded, isScheduledTaskOwnedByExcluded, isSuppressedWorkflowRule, isTypeLabelOwnedByExcluded, issueTemplatesChildGlob, issueTemplatesGeneratedPath, jestBundle, labelsForPhase, maintenanceAuditBundle, meetingAnalysisBundle, mergeCdkOptions, nextRequirementIdProcedure, orchestratorBundle, parseApiRollup, peopleProfileBundle, persistAuditReport, pinPnpmActionSetup, pinSetupNodeVersion, pnpmBundle, prReviewBundle, projenBundle, referenceRecordToFinding, regulatoryResearchBundle, renderAgentTierCaseStatement, renderAgentTierSection, renderCdkAcknowledge, renderCdkBootstrap, renderCdkContext, renderCdkDeploy, renderCdkDestroy, renderCdkDiff, renderCdkDocs, renderCdkDoctor, renderCdkDrift, renderCdkFlags, renderCdkGc, renderCdkImport, renderCdkInit, renderCdkList, renderCdkMetadata, renderCdkMigrate, renderCdkNotices, renderCdkOrphan, renderCdkPublishAssets, renderCdkRefactor, renderCdkRollback, renderCdkSynth, renderCdkWatch, renderCheckClosingKeywordsScript, renderCheckDocSamplesProcedure, renderCheckLinksProcedure, renderCustomDocSectionBlock, renderCustomDocSections, renderExtractApiProcedure, renderFocusSection, renderGithubIssueTypeSection, renderGithubIssueTypeSectionLines, renderHomeRepositoryCondition, renderIssueTemplateLabelsCheckerScript, renderIssueTemplatesBundleHook, renderIssueTemplatesCheckerScript, renderIssueTemplatesGeneratedPage, renderIssueTemplatesRuleContent, renderIssueTemplatesStarterPage, renderIssueTypeAssignmentBlanket, renderIssueTypeAssignmentStep, renderMeetingTypesSection, renderNextRequirementIdProcedure, renderPhaseTypeInvariantSection, renderPhaseTypeInvariantShellHelpers, renderPriorityRulesSection, renderProgressFileName, renderProgressFilePath, renderProgressFilesBundleHook, renderProgressFilesRuleContent, renderRequirementBlock, renderRunRatioSection, renderRunRatioShellHelpers, renderScheduledTaskSkillFile, renderScheduledTasksSection, renderScopeGateSection, renderScopeGateShellHelpers, renderSetIssueTypeFallbackLines, renderSharedEditingBundleHook, renderSharedEditingHelperScript, renderSharedEditingRuleContent, renderSkillEvalsBundleHook, renderSkillEvalsRuleContent, renderSkillEvalsRunnerScript, renderSourceTierExamples, renderStripToolArtifactTagsProcedure, renderTemporalFramingCheckerScript, renderTemporalFramingRuleContent, renderTitlePrefixTypeBullets, renderUnblockDependentsScript, renderUnblockDependentsSection, requirementsAnalystBundle, requirementsReviewerBundle, requirementsWriterBundle, researchPipelineBundle, resolveAgentPaths, resolveAgentTiers, resolveAstroProjectOutdir, resolveAwsCdkProjectOutdir, resolveBuildPolicy, resolveIssueDefaults, resolveIssueTemplates, resolveModelAlias, resolveOrchestratorAssets, resolveOutdirFromPackageName, resolveOverrideForLabels, resolvePrReviewPolicy, resolveProgressFiles, resolveReactViteSiteProjectOutdir, resolveRunRatio, resolveScheduledTasks, resolveScopeGate, resolveSharedEditing, resolveSkillEvals, resolveTemplateVariables, resolveTemporalFraming, resolveTypeLabelForLabels, resolveTypeScriptProjectOutdir, resolveUnblockDependents, runScan, slackBundle, softwareProfileBundle, standardsResearchBundle, stripToolArtifactTagsProcedure, tsdocRecordToFindings, turborepoBundle, typeLabelForPhaseLabel, typescriptBundle, upstreamConfigulatorDocsBundle, validateAgentTierConfig, validateIssueDefaultsConfig, validateIssueTemplatesConfig, validateMonorepoLayout, validatePrReviewPolicyConfig, validateProgressFilesConfig, validateRunRatioConfig, validateScheduledTasksConfig, validateScopeGateConfig, validateSharedEditingConfig, validateSkillEvalsConfig, validateStarlightSingleton, validateTemporalFramingConfig, validateUnblockDependentsConfig, vitestBundle };

package/lib/index.d.ts

@@ -9598,9 +9598,16 @@ declare class AwsDeploymentTarget extends Component {
  *    layer; the caller is responsible for spreading the accessor result first
  *    and then the call-site option on top.
  *
+ * ## CLI version
+ *
+ * Beyond per-command flags, the component also owns {@link CdkCli.cliVersion} —
+ * the `aws-cdk` version generated CI jobs install before invoking `cdk`. It
+ * defaults to the project's own `aws-cdk` requirement so a deploy runs the same
+ * CLI that synthesized the cloud assembly it is deploying.
+ *
  * Auto-instantiated by {@link AwsDeploymentConfig} when absent; consumers can
  * pre-instantiate it via `new CdkCli(project, options)` to register custom
- * per-stage defaults and per-account overrides.
+ * per-stage defaults, per-account overrides, and a pinned CLI version.
  *
  ******************************************************************************/
 /**
@@ -9675,6 +9682,26 @@ interface CdkCliOptions {
      * ```
      */
     readonly accountOverrides?: Record<string, CdkTargetOverrides>;
+    /**
+     * The `aws-cdk` CLI version CI jobs install before invoking `cdk`.
+     *
+     * Rendered into the generated deploy and diff jobs as
+     * `pnpm dlx "aws-cdk@<version>"`, so a CI run deploys a cloud assembly with
+     * the same CLI that synthesized it instead of whatever happens to be latest
+     * on the registry at run time.
+     *
+     * Accepts any npm version specifier. Supplying a range (`^2`) rather than an
+     * exact version keeps the drift this option exists to close, so prefer an
+     * exact pin.
+     *
+     * @default - the project's own `aws-cdk` dependency requirement
+     * (`cdkDeps.cdkCliVersion`), which is the CLI that runs the `synth` task and
+     * therefore produces the cloud assembly CI deploys. Projects created through
+     * configulator's `AwsCdkProject` pin this exactly; a bare projen
+     * `AwsCdkTypeScriptApp` that never set `cdkCliVersion` falls back to projen's
+     * own `^2` default.
+     */
+    readonly cliVersion?: string;
 }
 declare class CdkCli extends Component {
     /**
@@ -9709,6 +9736,13 @@ declare class CdkCli extends Component {
      * The consumer-supplied per-account overrides, keyed by AWS account ID.
      */
     readonly accountOverrides: Record<string, CdkTargetOverrides>;
+    /**
+     * The resolved `aws-cdk` CLI version that generated CI jobs install.
+     *
+     * Always concrete, so callers rendering a workflow step never have to
+     * re-apply the default. See {@link CdkCliOptions.cliVersion}.
+     */
+    readonly cliVersion: string;
     constructor(project: AwsCdkTypeScriptApp, options?: CdkCliOptions);
     /**
      * Resolve the `cdk deploy` options to use against a given target.
@@ -12458,6 +12492,19 @@ interface DeployWorkflowOptions {
      * @default - no diff jobs are emitted
      */
     readonly diff?: DeployDiffOptions;
+    /**
+     * Pin this workflow's cloud-touching jobs to one repository, as an
+     * `owner/repo` slug.
+     *
+     * Guards every deploy and diff job with
+     * `github.repository == '<owner>/<repo>'` so a mirror or clone of the
+     * consumer repo hosted elsewhere skips them instead of failing at the OIDC
+     * credentials step. The build job is intentionally left unguarded.
+     *
+     * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+     * @default - no repository guard is emitted
+     */
+    readonly homeRepository?: string;
 }
 /**
  * Adds a build + deploy GitHub Actions workflow for an AwsCdkTypeScriptApp.
@@ -12467,7 +12514,7 @@ interface DeployWorkflowOptions {
  * the job summary. See the docs page for the full convention and naming
  * guidance.
  *
- * @see docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md
+ * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
  */
 declare class AwsDeployWorkflow extends Component {
     project: AwsCdkTypeScriptApp;
@@ -12509,6 +12556,10 @@ declare class AwsDeployWorkflow extends Component {
      * never have to re-apply the defaults.
      */
     readonly diffOptions: Required<DeployDiffOptions>;
+    /**
+     * Repository this workflow's cloud-touching jobs are pinned to, if any.
+     */
+    readonly homeRepository?: string;
     constructor(project: AwsCdkTypeScriptApp, options?: DeployWorkflowOptions);
     setupNode: () => Array<JobStep>;
     setupPnpm: () => Array<JobStep>;
@@ -12550,8 +12601,8 @@ declare class AwsDeployWorkflow extends Component {
      * Steps for a target's optional `cdk diff` job.
      *
      * Mirrors {@link deploySteps}' toolchain and credential setup — same pnpm /
-     * Node setup, same floating `aws-cdk` install, same OIDC role — so both jobs
-     * move together when the CLI version is pinned.
+     * Node setup, same version-pinned `aws-cdk` install, same OIDC role — so a
+     * diff is computed by the same CLI that will run the deploy.
      *
      * The `cdk diff` flags come from the {@link CdkCli} precedence chain via
      * `diffOptionsFor(target)`, so `method`, `securityOnly`, `fail`, and the rest
@@ -13705,6 +13756,19 @@ interface AwsTeardownWorkflowOptions {
      * @default ["feat/*", "fix/*", "feature/*"]
      */
     readonly deleteBranchPatterns?: Array<string>;
+    /**
+     * Pin the teardown jobs to one repository, as an `owner/repo` slug.
+     *
+     * Guards every teardown job with `github.repository == '<owner>/<repo>'` so a
+     * mirror or clone of the consumer repo does not delete stacks it does not
+     * own. Especially load-bearing here: a clone's branch list differs from the
+     * home repo's, so an unguarded scheduled run would classify live stacks as
+     * orphans.
+     *
+     * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+     * @default - no repository guard is emitted
+     */
+    readonly homeRepository?: string;
 }
 /**
  * Scheduled GitHub Actions workflow that tears down orphaned CloudFormation
@@ -14134,6 +14198,21 @@ declare const COMPLETE_JOB_ID = "complete";
  */
 declare function addBuildCompleteJob(buildWorkflow: BuildWorkflow): void;
 
+/**
+ * Render the GitHub Actions expression fragment that pins a job to one
+ * repository, validating the slug at synth time.
+ *
+ * Validation is deliberately eager: a typo'd slug matches no repository, so
+ * every guarded job would skip silently while the aggregate `complete` gate
+ * still reported success. Failing synth surfaces that immediately.
+ *
+ * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+ * @param homeRepository - `owner/repo` slug, or `undefined` to emit no guard.
+ * @param componentName - Component name used in the thrown error message.
+ * @returns The condition fragment, or `undefined` when the workflow is unpinned.
+ */
+declare const renderHomeRepositoryCondition: (homeRepository: string | undefined, componentName: string) => string | undefined;
+
 /**
  * Sets `with["include-hidden-files"] = true` on every build-artifact
  * `Upload artifact` step generated by projen's
@@ -14282,5 +14361,5 @@ declare function pinPnpmActionSetup(project: Project): void;
  */
 declare function pinSetupNodeVersion(project: Project): void;
 
-export { AGENT_MODEL, AGENT_PLATFORM, AGENT_REGISTRY_ENTRIES, AGENT_RULE_SCOPE, AGENT_TIER_ROLES, AGENT_TIER_VALUES, AUDIT_CATEGORY_ORDER, AgentConfig, ApiExtractor, AstroConfig, AstroOutput, AstroProject, AuditCategory, AuditMode, AuditSeverity, AwsCdkProject, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, AwsTeardownWorkflow, BUILT_IN_BUNDLES, BUNDLE_OWNERSHIP, CDK_BOOTSTRAP_DEFAULTS_BY_STAGE, CDK_DEPLOY_DEFAULTS_BY_STAGE, CDK_DEPLOY_METHOD, CDK_DESTROY_DEFAULTS_BY_STAGE, CDK_DIFF_DEFAULTS_BY_STAGE, CDK_DIFF_METHOD, CDK_GC_ACTION, CDK_GC_TYPE, CDK_INIT_LANGUAGE, CDK_INIT_TEMPLATE, CDK_PROGRESS, CDK_REQUIRE_APPROVAL, CDK_SYNTH_DEFAULTS_BY_STAGE, CDK_WATCH_DEFAULTS_BY_STAGE, CLAUDE_RULE_TARGET, COMPLETE_JOB_ID, CONVENTIONAL_COMMIT_TYPE_LABELS, CdkCli, DEFAULT_AC_THRESHOLDS, DEFAULT_AGENT_PATHS, DEFAULT_AGENT_TIERS, DEFAULT_API_EXTRACTOR_CONFIG_FILE, DEFAULT_API_EXTRACTOR_ENTRY_POINT, DEFAULT_API_EXTRACTOR_REPORT_FILENAME, DEFAULT_API_EXTRACTOR_REPORT_FOLDER, DEFAULT_AUDIT_REPORT_DIR, DEFAULT_BASE_CONVENTIONS, DEFAULT_BUILD_POLICY, DEFAULT_BUNDLE_OVERRIDES, DEFAULT_DECOMPOSITION_TEMPLATE, DEFAULT_DISPATCH_MODEL, DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO, DEFAULT_GITHUB_ISSUE_TYPE, DEFAULT_HOUSEKEEPING_MODEL, DEFAULT_ISSUE_PRIORITY, DEFAULT_ISSUE_STATUS, DEFAULT_ISSUE_TEMPLATES_BUNDLE_PATH_PATTERNS, DEFAULT_ISSUE_TEMPLATES_EMIT_CHECKER, DEFAULT_ISSUE_TEMPLATES_EMIT_STARTER, DEFAULT_ISSUE_TEMPLATES_ENABLED, DEFAULT_ISSUE_TEMPLATES_PATH, DEFAULT_ISSUE_TEMPLATES_REQUIRE_REFERENCE, DEFAULT_OFF_PEAK_CRON_EXAMPLE, DEFAULT_ORCHESTRATOR_CONVENTIONS, DEFAULT_PARTIAL_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_PATHS_EXEMPT_FROM_SIZE, DEFAULT_PRIORITY_LABELS, DEFAULT_PRODUCT_CONTEXT_PATH, DEFAULT_PROGRESS_FILES_ENABLED, DEFAULT_PROGRESS_FILES_FILENAME_PATTERN, DEFAULT_PROGRESS_FILES_FORMAT, DEFAULT_PROGRESS_FILES_STALE_AFTER_HOURS, DEFAULT_PROGRESS_FILES_STATE_DIR, DEFAULT_REQUIREMENT_CATEGORY_DIRS, DEFAULT_REQUIRE_PRODUCT_CONTEXT, DEFAULT_RESOLVED_ISSUE_DEFAULTS, DEFAULT_RULE_CONVENTIONS, DEFAULT_SAMPLE_COMPILER_OPTIONS, DEFAULT_SCHEDULED_TASKS_ROOT, DEFAULT_SCHEDULED_TASK_ENTRIES, DEFAULT_SHARED_EDITING_CONFLICT_STRATEGY, DEFAULT_SHARED_EDITING_EMIT_HELPER, DEFAULT_SHARED_EDITING_ENABLED, DEFAULT_SHARED_EDITING_VERIFY_COMMIT, DEFAULT_SHARED_INDEX_PATHS, DEFAULT_SKILL_EVALS_EMIT_RUNNER, DEFAULT_SKILL_EVALS_ENABLED, DEFAULT_SKILL_EVALS_SKILLS_ROOT, DEFAULT_SOURCES_THRESHOLDS, DEFAULT_STATE_FILE_PATH, DEFAULT_STATUS_LABELS, DEFAULT_TEARDOWN_BRANCH_PATTERNS, DEFAULT_TEMPORAL_FRAMING_CADENCES, DEFAULT_TEMPORAL_FRAMING_EMIT_CHECKER, DEFAULT_TEMPORAL_FRAMING_ENABLED, DEFAULT_TEMPORAL_FRAMING_PATHS, DEFAULT_TYPE_LABELS, DEFAULT_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_UNBLOCK_DEPENDENTS_ENABLED, DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED, DOCS_SYNC_AUDIT_SCHEMA_VERSION, GITHUB_ISSUE_TYPES, GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX, ISSUE_TEMPLATES_GENERATED_SUFFIX, JsiiFaker, LAYOUT_ENFORCEMENT, LAYOUT_ROOT_BY_PROJECT_TYPE, MAX_LABEL_DESCRIPTION_LENGTH, MCP_TRANSPORT, MERGE_METHODS, MIMIMUM_RELEASE_AGE, MINIMUM_RELEASE_AGE, MONOREPO_LAYOUT, MonorepoProject, Nvmrc, PHASE_LABEL_TYPE_MAP, PROD_DEPLOY_NAME, PROGRESS_FILES_FORMAT_VALUES, PnpmWorkspace, ProjectMetadata, REQUIREMENTS_WRITER_PATHS, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ReactViteSiteProject, RequirementIssueTemplate, ResetTask, SCHEDULED_TASK_MODEL_VALUES, SCOPE_CLASS_VALUES, SET_ISSUE_TYPE_HELPER_PATH, SHARED_EDITING_CONFLICT_STRATEGY_VALUES, STARLIGHT_ROLE, SUPPRESSED_WORKFLOW_RULE_NAMES, SampleLang, StarlightProject, TEMPORAL_FRAMING_CATEGORY_VALUES, TURBO_RUN_CONTINUE, TURBO_RUN_DRY_RUN, TURBO_RUN_LOG_ORDER, TURBO_RUN_LOG_PREFIX, TURBO_RUN_OUTPUT_LOGS, TestRunner, TsDocCoverageKind, TsdocConfig, TurboRepo, TurboRepoTask, TypeScriptConfig, TypeScriptProject, UNKNOWN_TYPE_FALLBACK_TIER, VALID_PRIORITY_VALUES, VALID_STATUS_VALUES, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, Vitest, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, addPlaywright, addStorybook, addSyncLabelsWorkflow, agendaBundle, analyzeTsDocCoverage, auditReportJsonSchema, awsCdkBundle, baseBundle, bcmWriterBundle, buildAgentRegistryRule, buildBaseBundle, buildBcmWriterBundle, buildBuiltInBundles, buildBusinessModelsBundle, buildCheckBlockedProcedure, buildCompanyProfileBundle, buildCustomerProfileBundle, buildDocsSyncBundle, buildGithubWorkflowBundle, buildIndustryDiscoveryBundle, buildMaintenanceAuditBundle, buildMeetingAnalysisBundle, buildOrchestratorBundle, buildOrchestratorConventionsContent, buildPeopleProfileBundle, buildPrReviewBundle, buildRegulatoryResearchBundle, buildReport, buildRequirementsAnalystBundle, buildRequirementsReviewerBundle, buildRequirementsWriterBundle, buildResearchPipelineBundle, buildSoftwareProfileBundle, buildStandardsResearchBundle, buildTurborepoBundle, buildUnblockDependentsProcedure, bundleNameForWorkflowRule, businessModelsBundle, checkClosingKeywordsProcedure, checkDocSamplesProcedure, checkLinksProcedure, classifyIssueScope, classifyRun, collectIssueTemplateRecipeStubs, companyProfileBundle, compileFencedSamples, createApiDiffCheck, createReferenceMismatchCheck, createTsdocCoverageCheck, customerProfileBundle, diffApiRollups, docsSyncBundle, emptyCategoryBuckets, extractApiProcedure, extractDocReferences, extractFencedSamples, formatLayoutViolation, formatStarlightSingletonViolation, getLatestEligibleVersion, githubIssueTypeForTitle, githubWorkflowBundle, hasAnyDocsEmittingBundle, hasAnyDownstreamIssueKindBundle, includeHiddenFilesInBuildArtifact, industryDiscoveryBundle, isPhaseLabelOwnedByExcluded, isScheduledTaskOwnedByExcluded, isSuppressedWorkflowRule, isTypeLabelOwnedByExcluded, issueTemplatesChildGlob, issueTemplatesGeneratedPath, jestBundle, labelsForPhase, maintenanceAuditBundle, meetingAnalysisBundle, mergeCdkOptions, nextRequirementIdProcedure, orchestratorBundle, parseApiRollup, peopleProfileBundle, persistAuditReport, pinPnpmActionSetup, pinSetupNodeVersion, pnpmBundle, prReviewBundle, projenBundle, referenceRecordToFinding, regulatoryResearchBundle, renderAgentTierCaseStatement, renderAgentTierSection, renderCdkAcknowledge, renderCdkBootstrap, renderCdkContext, renderCdkDeploy, renderCdkDestroy, renderCdkDiff, renderCdkDocs, renderCdkDoctor, renderCdkDrift, renderCdkFlags, renderCdkGc, renderCdkImport, renderCdkInit, renderCdkList, renderCdkMetadata, renderCdkMigrate, renderCdkNotices, renderCdkOrphan, renderCdkPublishAssets, renderCdkRefactor, renderCdkRollback, renderCdkSynth, renderCdkWatch, renderCheckClosingKeywordsScript, renderCheckDocSamplesProcedure, renderCheckLinksProcedure, renderCustomDocSectionBlock, renderCustomDocSections, renderExtractApiProcedure, renderFocusSection, renderGithubIssueTypeSection, renderGithubIssueTypeSectionLines, renderIssueTemplateLabelsCheckerScript, renderIssueTemplatesBundleHook, renderIssueTemplatesCheckerScript, renderIssueTemplatesGeneratedPage, renderIssueTemplatesRuleContent, renderIssueTemplatesStarterPage, renderIssueTypeAssignmentBlanket, renderIssueTypeAssignmentStep, renderMeetingTypesSection, renderNextRequirementIdProcedure, renderPhaseTypeInvariantSection, renderPhaseTypeInvariantShellHelpers, renderPriorityRulesSection, renderProgressFileName, renderProgressFilePath, renderProgressFilesBundleHook, renderProgressFilesRuleContent, renderRequirementBlock, renderRunRatioSection, renderRunRatioShellHelpers, renderScheduledTaskSkillFile, renderScheduledTasksSection, renderScopeGateSection, renderScopeGateShellHelpers, renderSetIssueTypeFallbackLines, renderSharedEditingBundleHook, renderSharedEditingHelperScript, renderSharedEditingRuleContent, renderSkillEvalsBundleHook, renderSkillEvalsRuleContent, renderSkillEvalsRunnerScript, renderSourceTierExamples, renderStripToolArtifactTagsProcedure, renderTemporalFramingCheckerScript, renderTemporalFramingRuleContent, renderTitlePrefixTypeBullets, renderUnblockDependentsScript, renderUnblockDependentsSection, requirementsAnalystBundle, requirementsReviewerBundle, requirementsWriterBundle, researchPipelineBundle, resolveAgentPaths, resolveAgentTiers, resolveAstroProjectOutdir, resolveAwsCdkProjectOutdir, resolveBuildPolicy, resolveIssueDefaults, resolveIssueTemplates, resolveModelAlias, resolveOrchestratorAssets, resolveOutdirFromPackageName, resolveOverrideForLabels, resolvePrReviewPolicy, resolveProgressFiles, resolveReactViteSiteProjectOutdir, resolveRunRatio, resolveScheduledTasks, resolveScopeGate, resolveSharedEditing, resolveSkillEvals, resolveTemplateVariables, resolveTemporalFraming, resolveTypeLabelForLabels, resolveTypeScriptProjectOutdir, resolveUnblockDependents, runScan, slackBundle, softwareProfileBundle, standardsResearchBundle, stripToolArtifactTagsProcedure, tsdocRecordToFindings, turborepoBundle, typeLabelForPhaseLabel, typescriptBundle, upstreamConfigulatorDocsBundle, validateAgentTierConfig, validateIssueDefaultsConfig, validateIssueTemplatesConfig, validateMonorepoLayout, validatePrReviewPolicyConfig, validateProgressFilesConfig, validateRunRatioConfig, validateScheduledTasksConfig, validateScopeGateConfig, validateSharedEditingConfig, validateSkillEvalsConfig, validateStarlightSingleton, validateTemporalFramingConfig, validateUnblockDependentsConfig, vitestBundle };
+export { AGENT_MODEL, AGENT_PLATFORM, AGENT_REGISTRY_ENTRIES, AGENT_RULE_SCOPE, AGENT_TIER_ROLES, AGENT_TIER_VALUES, AUDIT_CATEGORY_ORDER, AgentConfig, ApiExtractor, AstroConfig, AstroOutput, AstroProject, AuditCategory, AuditMode, AuditSeverity, AwsCdkProject, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, AwsTeardownWorkflow, BUILT_IN_BUNDLES, BUNDLE_OWNERSHIP, CDK_BOOTSTRAP_DEFAULTS_BY_STAGE, CDK_DEPLOY_DEFAULTS_BY_STAGE, CDK_DEPLOY_METHOD, CDK_DESTROY_DEFAULTS_BY_STAGE, CDK_DIFF_DEFAULTS_BY_STAGE, CDK_DIFF_METHOD, CDK_GC_ACTION, CDK_GC_TYPE, CDK_INIT_LANGUAGE, CDK_INIT_TEMPLATE, CDK_PROGRESS, CDK_REQUIRE_APPROVAL, CDK_SYNTH_DEFAULTS_BY_STAGE, CDK_WATCH_DEFAULTS_BY_STAGE, CLAUDE_RULE_TARGET, COMPLETE_JOB_ID, CONVENTIONAL_COMMIT_TYPE_LABELS, CdkCli, DEFAULT_AC_THRESHOLDS, DEFAULT_AGENT_PATHS, DEFAULT_AGENT_TIERS, DEFAULT_API_EXTRACTOR_CONFIG_FILE, DEFAULT_API_EXTRACTOR_ENTRY_POINT, DEFAULT_API_EXTRACTOR_REPORT_FILENAME, DEFAULT_API_EXTRACTOR_REPORT_FOLDER, DEFAULT_AUDIT_REPORT_DIR, DEFAULT_BASE_CONVENTIONS, DEFAULT_BUILD_POLICY, DEFAULT_BUNDLE_OVERRIDES, DEFAULT_DECOMPOSITION_TEMPLATE, DEFAULT_DISPATCH_MODEL, DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO, DEFAULT_GITHUB_ISSUE_TYPE, DEFAULT_HOUSEKEEPING_MODEL, DEFAULT_ISSUE_PRIORITY, DEFAULT_ISSUE_STATUS, DEFAULT_ISSUE_TEMPLATES_BUNDLE_PATH_PATTERNS, DEFAULT_ISSUE_TEMPLATES_EMIT_CHECKER, DEFAULT_ISSUE_TEMPLATES_EMIT_STARTER, DEFAULT_ISSUE_TEMPLATES_ENABLED, DEFAULT_ISSUE_TEMPLATES_PATH, DEFAULT_ISSUE_TEMPLATES_REQUIRE_REFERENCE, DEFAULT_OFF_PEAK_CRON_EXAMPLE, DEFAULT_ORCHESTRATOR_CONVENTIONS, DEFAULT_PARTIAL_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_PATHS_EXEMPT_FROM_SIZE, DEFAULT_PRIORITY_LABELS, DEFAULT_PRODUCT_CONTEXT_PATH, DEFAULT_PROGRESS_FILES_ENABLED, DEFAULT_PROGRESS_FILES_FILENAME_PATTERN, DEFAULT_PROGRESS_FILES_FORMAT, DEFAULT_PROGRESS_FILES_STALE_AFTER_HOURS, DEFAULT_PROGRESS_FILES_STATE_DIR, DEFAULT_REQUIREMENT_CATEGORY_DIRS, DEFAULT_REQUIRE_PRODUCT_CONTEXT, DEFAULT_RESOLVED_ISSUE_DEFAULTS, DEFAULT_RULE_CONVENTIONS, DEFAULT_SAMPLE_COMPILER_OPTIONS, DEFAULT_SCHEDULED_TASKS_ROOT, DEFAULT_SCHEDULED_TASK_ENTRIES, DEFAULT_SHARED_EDITING_CONFLICT_STRATEGY, DEFAULT_SHARED_EDITING_EMIT_HELPER, DEFAULT_SHARED_EDITING_ENABLED, DEFAULT_SHARED_EDITING_VERIFY_COMMIT, DEFAULT_SHARED_INDEX_PATHS, DEFAULT_SKILL_EVALS_EMIT_RUNNER, DEFAULT_SKILL_EVALS_ENABLED, DEFAULT_SKILL_EVALS_SKILLS_ROOT, DEFAULT_SOURCES_THRESHOLDS, DEFAULT_STATE_FILE_PATH, DEFAULT_STATUS_LABELS, DEFAULT_TEARDOWN_BRANCH_PATTERNS, DEFAULT_TEMPORAL_FRAMING_CADENCES, DEFAULT_TEMPORAL_FRAMING_EMIT_CHECKER, DEFAULT_TEMPORAL_FRAMING_ENABLED, DEFAULT_TEMPORAL_FRAMING_PATHS, DEFAULT_TYPE_LABELS, DEFAULT_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_UNBLOCK_DEPENDENTS_ENABLED, DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED, DOCS_SYNC_AUDIT_SCHEMA_VERSION, GITHUB_ISSUE_TYPES, GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX, ISSUE_TEMPLATES_GENERATED_SUFFIX, JsiiFaker, LAYOUT_ENFORCEMENT, LAYOUT_ROOT_BY_PROJECT_TYPE, MAX_LABEL_DESCRIPTION_LENGTH, MCP_TRANSPORT, MERGE_METHODS, MIMIMUM_RELEASE_AGE, MINIMUM_RELEASE_AGE, MONOREPO_LAYOUT, MonorepoProject, Nvmrc, PHASE_LABEL_TYPE_MAP, PROD_DEPLOY_NAME, PROGRESS_FILES_FORMAT_VALUES, PnpmWorkspace, ProjectMetadata, REQUIREMENTS_WRITER_PATHS, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ReactViteSiteProject, RequirementIssueTemplate, ResetTask, SCHEDULED_TASK_MODEL_VALUES, SCOPE_CLASS_VALUES, SET_ISSUE_TYPE_HELPER_PATH, SHARED_EDITING_CONFLICT_STRATEGY_VALUES, STARLIGHT_ROLE, SUPPRESSED_WORKFLOW_RULE_NAMES, SampleLang, StarlightProject, TEMPORAL_FRAMING_CATEGORY_VALUES, TURBO_RUN_CONTINUE, TURBO_RUN_DRY_RUN, TURBO_RUN_LOG_ORDER, TURBO_RUN_LOG_PREFIX, TURBO_RUN_OUTPUT_LOGS, TestRunner, TsDocCoverageKind, TsdocConfig, TurboRepo, TurboRepoTask, TypeScriptConfig, TypeScriptProject, UNKNOWN_TYPE_FALLBACK_TIER, VALID_PRIORITY_VALUES, VALID_STATUS_VALUES, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, Vitest, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, addPlaywright, addStorybook, addSyncLabelsWorkflow, agendaBundle, analyzeTsDocCoverage, auditReportJsonSchema, awsCdkBundle, baseBundle, bcmWriterBundle, buildAgentRegistryRule, buildBaseBundle, buildBcmWriterBundle, buildBuiltInBundles, buildBusinessModelsBundle, buildCheckBlockedProcedure, buildCompanyProfileBundle, buildCustomerProfileBundle, buildDocsSyncBundle, buildGithubWorkflowBundle, buildIndustryDiscoveryBundle, buildMaintenanceAuditBundle, buildMeetingAnalysisBundle, buildOrchestratorBundle, buildOrchestratorConventionsContent, buildPeopleProfileBundle, buildPrReviewBundle, buildRegulatoryResearchBundle, buildReport, buildRequirementsAnalystBundle, buildRequirementsReviewerBundle, buildRequirementsWriterBundle, buildResearchPipelineBundle, buildSoftwareProfileBundle, buildStandardsResearchBundle, buildTurborepoBundle, buildUnblockDependentsProcedure, bundleNameForWorkflowRule, businessModelsBundle, checkClosingKeywordsProcedure, checkDocSamplesProcedure, checkLinksProcedure, classifyIssueScope, classifyRun, collectIssueTemplateRecipeStubs, companyProfileBundle, compileFencedSamples, createApiDiffCheck, createReferenceMismatchCheck, createTsdocCoverageCheck, customerProfileBundle, diffApiRollups, docsSyncBundle, emptyCategoryBuckets, extractApiProcedure, extractDocReferences, extractFencedSamples, formatLayoutViolation, formatStarlightSingletonViolation, getLatestEligibleVersion, githubIssueTypeForTitle, githubWorkflowBundle, hasAnyDocsEmittingBundle, hasAnyDownstreamIssueKindBundle, includeHiddenFilesInBuildArtifact, industryDiscoveryBundle, isPhaseLabelOwnedByExcluded, isScheduledTaskOwnedByExcluded, isSuppressedWorkflowRule, isTypeLabelOwnedByExcluded, issueTemplatesChildGlob, issueTemplatesGeneratedPath, jestBundle, labelsForPhase, maintenanceAuditBundle, meetingAnalysisBundle, mergeCdkOptions, nextRequirementIdProcedure, orchestratorBundle, parseApiRollup, peopleProfileBundle, persistAuditReport, pinPnpmActionSetup, pinSetupNodeVersion, pnpmBundle, prReviewBundle, projenBundle, referenceRecordToFinding, regulatoryResearchBundle, renderAgentTierCaseStatement, renderAgentTierSection, renderCdkAcknowledge, renderCdkBootstrap, renderCdkContext, renderCdkDeploy, renderCdkDestroy, renderCdkDiff, renderCdkDocs, renderCdkDoctor, renderCdkDrift, renderCdkFlags, renderCdkGc, renderCdkImport, renderCdkInit, renderCdkList, renderCdkMetadata, renderCdkMigrate, renderCdkNotices, renderCdkOrphan, renderCdkPublishAssets, renderCdkRefactor, renderCdkRollback, renderCdkSynth, renderCdkWatch, renderCheckClosingKeywordsScript, renderCheckDocSamplesProcedure, renderCheckLinksProcedure, renderCustomDocSectionBlock, renderCustomDocSections, renderExtractApiProcedure, renderFocusSection, renderGithubIssueTypeSection, renderGithubIssueTypeSectionLines, renderHomeRepositoryCondition, renderIssueTemplateLabelsCheckerScript, renderIssueTemplatesBundleHook, renderIssueTemplatesCheckerScript, renderIssueTemplatesGeneratedPage, renderIssueTemplatesRuleContent, renderIssueTemplatesStarterPage, renderIssueTypeAssignmentBlanket, renderIssueTypeAssignmentStep, renderMeetingTypesSection, renderNextRequirementIdProcedure, renderPhaseTypeInvariantSection, renderPhaseTypeInvariantShellHelpers, renderPriorityRulesSection, renderProgressFileName, renderProgressFilePath, renderProgressFilesBundleHook, renderProgressFilesRuleContent, renderRequirementBlock, renderRunRatioSection, renderRunRatioShellHelpers, renderScheduledTaskSkillFile, renderScheduledTasksSection, renderScopeGateSection, renderScopeGateShellHelpers, renderSetIssueTypeFallbackLines, renderSharedEditingBundleHook, renderSharedEditingHelperScript, renderSharedEditingRuleContent, renderSkillEvalsBundleHook, renderSkillEvalsRuleContent, renderSkillEvalsRunnerScript, renderSourceTierExamples, renderStripToolArtifactTagsProcedure, renderTemporalFramingCheckerScript, renderTemporalFramingRuleContent, renderTitlePrefixTypeBullets, renderUnblockDependentsScript, renderUnblockDependentsSection, requirementsAnalystBundle, requirementsReviewerBundle, requirementsWriterBundle, researchPipelineBundle, resolveAgentPaths, resolveAgentTiers, resolveAstroProjectOutdir, resolveAwsCdkProjectOutdir, resolveBuildPolicy, resolveIssueDefaults, resolveIssueTemplates, resolveModelAlias, resolveOrchestratorAssets, resolveOutdirFromPackageName, resolveOverrideForLabels, resolvePrReviewPolicy, resolveProgressFiles, resolveReactViteSiteProjectOutdir, resolveRunRatio, resolveScheduledTasks, resolveScopeGate, resolveSharedEditing, resolveSkillEvals, resolveTemplateVariables, resolveTemporalFraming, resolveTypeLabelForLabels, resolveTypeScriptProjectOutdir, resolveUnblockDependents, runScan, slackBundle, softwareProfileBundle, standardsResearchBundle, stripToolArtifactTagsProcedure, tsdocRecordToFindings, turborepoBundle, typeLabelForPhaseLabel, typescriptBundle, upstreamConfigulatorDocsBundle, validateAgentTierConfig, validateIssueDefaultsConfig, validateIssueTemplatesConfig, validateMonorepoLayout, validatePrReviewPolicyConfig, validateProgressFilesConfig, validateRunRatioConfig, validateScheduledTasksConfig, validateScopeGateConfig, validateSharedEditingConfig, validateSkillEvalsConfig, validateStarlightSingleton, validateTemporalFramingConfig, validateUnblockDependentsConfig, vitestBundle };
 export type { ActionItemFilingConfig, ActivateBranchNameEnvVarOptions, AddStorybookOptions, AgentCommand, AgentConfigOptions, AgentExpansionRules, AgentFeaturesConfig, AgentModel, AgentPathsConfig, AgentPlatform, AgentPlatformOverrides, AgentProcedure, AgentRegistryEntry, AgentRule, AgentRuleBundle, AgentRuleScope, AgentSkill, AgentSubAgent, AgentSubAgentPlatformOverrides, AgentTier, AgentTierConfig, AgentTierEntry, AnalyzeTsDocCoverageOptions, ApiDiffCheckOptions, ApiDiffFinding, ApiDiffResult, ApiExtractorOptions, ApiExtractorReportOptions, ApiSurfaceEntry, ApproveMergeUpgradeOptions, AstroConfigOptions, AstroIntegrationSpec, AstroProjectOptions, AuditCheckRunner, AuditCheckRunnerContext, AuditFinding, AuditFindingBase, AuditLocation, AuditReport, AwsAccount, AwsCdkProjectOptions, AwsDeploymentTargetOptions, AwsLocalDeploymentConfig, AwsOrganization, AwsRegion, AwsTeardownWorkflowOptions, BundleOwnership, CdkAcknowledgeOptions, CdkBootstrapOptions, CdkCliOptions, CdkContextOptions, CdkDeployMethod, CdkDeployOptions, CdkDestroyOptions, CdkDiffMethod, CdkDiffOptions, CdkDocsOptions, CdkDoctorOptions, CdkDriftOptions, CdkFlagsOptions, CdkGcAction, CdkGcOptions, CdkGcType, CdkGlobalOptions, CdkImportOptions, CdkInitLanguage, CdkInitOptions, CdkInitTemplate, CdkListOptions, CdkMetadataOptions, CdkMigrateOptions, CdkNoticesOptions, CdkOrphanOptions, CdkProgress, CdkPublishAssetsOptions, CdkRefactorOptions, CdkRequireApproval, CdkRollbackOptions, CdkSynthOptions, CdkTargetOverrides, CdkWatchOptions, CiDeploymentConfig, ClassTypeOptions, ClaudeAutoModeConfig, ClaudeHookAction, ClaudeHookEntry, ClaudeHooksConfig, ClaudeMdConfig, ClaudePermissionsConfig, ClaudeRuleTarget, ClaudeSandboxConfig, ClaudeSettingsConfig, CompileFencedSamplesOptions, CopilotHandoff, CursorHookAction, CursorHooksConfig, CursorSettingsConfig, CustomDocSection, DeployDiffOptions, DeployWorkflowOptions, DeploymentMetadata, DocReferenceRecord, EffectiveScopeThresholds, ExtractDocReferencesOptions, ExtractFencedSamplesOptions, FencedSampleRecord, FocusArea, FocusAreaMatch, FocusConfig, GitBranch, GitHubBoardMetadata, GitHubProjectMetadata, GitHubSprintMetadata, GithubIssueType, IDependencyResolver, IssueDefaultsConfig, IssueDefaultsOverride, IssueDefaultsPriority, IssueDefaultsStatus, IssueTemplateRecipeStub, IssueTemplatesConfig, IssueTypeAssignmentStepOptions, LabelDefinition, LayoutEnforcement, LayoutViolation, LinkFailureFinding, McpServerConfig, McpTransport, MeetingArea, MeetingScope, MeetingType, MeetingTypeKind, MeetingsConfig, MergeMethod, MonorepoLayoutRoot, MonorepoPnpmOptions, MonorepoProjectOptions, OrganizationMetadata, PhaseLabelTypeOutcome, PhaseLabelTypeResolution, PnpmWorkspaceOptions, PrReviewAutoMergeConfig, PrReviewCiVerificationConfig, PrReviewPolicyConfig, PriorityRule, ProgressFilesConfig, ProjectMetadataOptions, ReactViteSiteProjectOptions, ReferenceMismatchCheckOptions, ReferenceMismatchFinding, RemoteCacheOptions, RepositoryMetadata, RequirementBlockFields, RequirementCategoryDirsConfig, RequirementIssueTemplateOptions, ResetTaskOptions, ResolvedAgentPaths, ResolvedAgentTier, ResolvedBaseConventions, ResolvedBuildPolicy, ResolvedIssueDefaults, ResolvedIssueDefaultsEntry, ResolvedIssueTemplates, ResolvedOrchestratorConventions, ResolvedPrReviewAutoMerge, ResolvedPrReviewPolicy, ResolvedProgressFiles, ResolvedProjectMetadata, ResolvedRequirementCategoryDirs, ResolvedRuleConventions, ResolvedRunRatio, ResolvedScheduledTask, ResolvedScheduledTasks, ResolvedScopeGate, ResolvedScopeGateBundleOverride, ResolvedSharedEditing, ResolvedSkillEvals, ResolvedTemporalFraming, ResolvedUnblockDependents, RunRatioConfig, RunScanOptions, RunScanResult, SampleCompilationFailure, SampleFailureFinding, ScheduledTaskEntry, ScheduledTaskModel, ScheduledTaskOverride, ScheduledTasksConfig, ScopeClass, ScopeGateBundleOverride, ScopeGateConfig, ScopeGateThresholds, SharedEditingConfig, SkillEvalsConfig, SlackMetadata, SourceTierExamples, StarlightEditLink, StarlightLogo, StarlightProjectOptions, StarlightRole, StarlightSidebarItem, StarlightSingletonViolation, StarlightSocialLink, SyncLabelsOptions, TemplateResolveResult, TemporalFramingCategory, TemporalFramingConfig, TsDocCoverageRecord, TsdocConfigOptions, TsdocCoverageCheckOptions, TsdocCoverageFinding, TurboRepoOptions, TurboRepoTaskOptions, TurboRunContinue, TurboRunDryRun, TurboRunLogOrder, TurboRunLogPrefix, TurboRunOptions, TurboRunOutputLogs, TypeScriptProjectOptions, UnblockDependentsConfig, UpstreamConfigulatorConfig, VersionKey, VitestConfigOptions, VitestOptions };

package/lib/index.js

@@ -457,6 +457,7 @@ __export(index_exports, {
   renderFocusSection: () => renderFocusSection,
   renderGithubIssueTypeSection: () => renderGithubIssueTypeSection,
   renderGithubIssueTypeSectionLines: () => renderGithubIssueTypeSectionLines,
+  renderHomeRepositoryCondition: () => renderHomeRepositoryCondition,
   renderIssueTemplateLabelsCheckerScript: () => renderIssueTemplateLabelsCheckerScript,
   renderIssueTemplatesBundleHook: () => renderIssueTemplatesBundleHook,
   renderIssueTemplatesCheckerScript: () => renderIssueTemplatesCheckerScript,
@@ -37971,6 +37972,7 @@ var CdkCli = class _CdkCli extends import_projen11.Component {
     this.diffDefaults = options.diffDefaults ?? {};
     this.bootstrapDefaults = options.bootstrapDefaults ?? {};
     this.accountOverrides = options.accountOverrides ?? {};
+    this.cliVersion = options.cliVersion ?? project.cdkDeps.cdkCliVersion;
   }
   /**
    * Resolve the `cdk deploy` options to use against a given target.
@@ -42292,6 +42294,22 @@ var import_projen26 = require("projen");
 var import_build = require("projen/lib/build");
 var import_github6 = require("projen/lib/github");
 var import_workflows_model5 = require("projen/lib/github/workflows-model");
+
+// src/workflows/home-repository.ts
+var HOME_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+var renderHomeRepositoryCondition = (homeRepository, componentName) => {
+  if (homeRepository === void 0) {
+    return void 0;
+  }
+  if (!HOME_REPOSITORY_PATTERN.test(homeRepository)) {
+    throw new Error(
+      `${componentName} requires \`homeRepository\` to be an \`owner/repo\` slug, got "${homeRepository}"`
+    );
+  }
+  return `github.repository == '${homeRepository}'`;
+};
+
+// src/workflows/aws-deploy-workflow.ts
 var PROD_DEPLOY_NAME = "prod-deploy";
 var DIFF_OUTPUT_FILE = "cdk-diff.txt";
 var DIFF_SUMMARY_BYTE_LIMIT = 9e5;
@@ -42418,17 +42436,18 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         awsDeploymentConfig
       } = target;
       const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
-      const { rootCdkOut } = awsDeploymentConfig;
+      const { rootCdkOut, cdkCli } = awsDeploymentConfig;
       const deployJobName = this.buildJobName(target);
       return [
         ...this.setupPnpm(),
         ...this.setupNode(),
         /**
-         * Install CDK
+         * Install CDK, pinned to the same version that synthesized the cloud
+         * assembly being deployed. See {@link CdkCli.cliVersion}.
          */
         {
           name: "Install CDK",
-          run: "pnpm add aws-cdk"
+          run: `pnpm add "aws-cdk@${cdkCli.cliVersion}"`
         },
         /**
          * Configure AWS creds.
@@ -42448,8 +42467,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
          */
         {
           name: `Deploy ${awsStageType}/${deploymentTargetRole}/${account}/${region}`,
-          run: `pnpm dlx aws-cdk ${renderCdkDeploy({
-            ...awsDeploymentConfig.cdkCli.deployOptionsFor(target),
+          run: `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDeploy({
+            ...cdkCli.deployOptionsFor(target),
             app: rootCdkOut,
             stackPatterns: stackPattern ? [stackPattern] : void 0
           })} --outputs-file cdk-outputs.json`
@@ -42501,8 +42520,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
      * Steps for a target's optional `cdk diff` job.
      *
      * Mirrors {@link deploySteps}' toolchain and credential setup — same pnpm /
-     * Node setup, same floating `aws-cdk` install, same OIDC role — so both jobs
-     * move together when the CLI version is pinned.
+     * Node setup, same version-pinned `aws-cdk` install, same OIDC role — so a
+     * diff is computed by the same CLI that will run the deploy.
      *
      * The `cdk diff` flags come from the {@link CdkCli} precedence chain via
      * `diffOptionsFor(target)`, so `method`, `securityOnly`, `fail`, and the rest
@@ -42522,7 +42541,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         awsDeploymentConfig
       } = target;
       const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
-      const { rootCdkOut } = awsDeploymentConfig;
+      const { rootCdkOut, cdkCli } = awsDeploymentConfig;
       const label = `${awsStageType}/${deploymentTargetRole}/${account}/${region}`;
       const artifactName = this.buildDiffArtifactName(target);
       const capturedFileGuard = `always() && hashFiles('${DIFF_OUTPUT_FILE}') != ''`;
@@ -42531,11 +42550,12 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         ...this.setupPnpm(),
         ...this.setupNode(),
         /**
-         * Install CDK
+         * Install CDK, pinned to the same version that synthesized the cloud
+         * assembly being diffed. See {@link CdkCli.cliVersion}.
          */
         {
           name: "Install CDK",
-          run: "pnpm add aws-cdk"
+          run: `pnpm add "aws-cdk@${cdkCli.cliVersion}"`
         },
         /**
          * Configure AWS creds.
@@ -42559,8 +42579,8 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
           shell: "bash",
           run: [
             "set -o pipefail",
-            `pnpm dlx aws-cdk ${renderCdkDiff({
-              ...awsDeploymentConfig.cdkCli.diffOptionsFor(target),
+            `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDiff({
+              ...cdkCli.diffOptionsFor(target),
               app: rootCdkOut,
               ci: true,
               noColor: true,
@@ -42642,6 +42662,11 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       artifact: options.diff?.artifact ?? true,
       summary: options.diff?.summary ?? true
     };
+    this.homeRepository = options.homeRepository;
+    const homeRepositoryCondition = renderHomeRepositoryCondition(
+      this.homeRepository,
+      "AwsDeployWorkflow"
+    );
     if (options.buildWorkflow && options.buildWorkflowOptions) {
       throw new Error(
         "Cannot provide both buildWorkflow and buildWorkflowOptions"
@@ -42719,10 +42744,11 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       const branchFilterCondition = this.buildBranchFilterCondition(
         target.branches
       );
-      const jobCondition = branchFilterCondition ? "${{ " + [
+      const jobCondition = "${{ " + [
         "!needs.build.outputs.self_mutation_happened",
-        `(${branchFilterCondition})`
-      ].join(" && ") + " }}" : "${{ !needs.build.outputs.self_mutation_happened }}";
+        ...homeRepositoryCondition ? [homeRepositoryCondition] : [],
+        ...branchFilterCondition ? [`(${branchFilterCondition})`] : []
+      ].join(" && ") + " }}";
       this.buildWorkflow.addPostBuildJob(deployJobName, {
         name: `Deploy ${this.project.name} ${target.awsStageType}/${target.deploymentTargetRole}/${target.account}/${target.region}`,
         needs: [
@@ -42817,7 +42843,8 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
       stageTypeTagName,
       environmentTypeTagName,
       branchNameTagName,
-      deleteBranchPatterns
+      deleteBranchPatterns,
+      homeRepository
     } = options;
     if (!repoTagName) {
       throw new Error("AwsTeardownWorkflow requires `repoTagName`");
@@ -42846,6 +42873,10 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
       deleteBranchPatterns,
       awsDestructionTargets
     );
+    const homeRepositoryCondition = renderHomeRepositoryCondition(
+      homeRepository,
+      "AwsTeardownWorkflow"
+    );
     const workflow = new import_github7.GithubWorkflow(github, "teardown-dev");
     workflow.on({
       workflowDispatch: {},
@@ -42872,6 +42903,7 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
         {
           name: `Teardown Stacks in ${awsStageType}/${deploymentTargetRole}/${account}/${region}`,
           runsOn: ["ubuntu-latest"],
+          ...homeRepositoryCondition ? { if: `\${{ ${homeRepositoryCondition} }}` } : {},
           permissions: {
             contents: import_workflows_model6.JobPermission.READ,
             idToken: import_workflows_model6.JobPermission.WRITE
@@ -43906,6 +43938,7 @@ export const collections = {
   renderFocusSection,
   renderGithubIssueTypeSection,
   renderGithubIssueTypeSectionLines,
+  renderHomeRepositoryCondition,
   renderIssueTemplateLabelsCheckerScript,
   renderIssueTemplatesBundleHook,
   renderIssueTemplatesCheckerScript,