@codedrifters/configulator 0.0.428 → 0.0.430

package/lib/index.js

@@ -184,6 +184,7 @@ __export(index_exports, {
   AUDIT_CATEGORY_ORDER: () => AUDIT_CATEGORY_ORDER,
   AgentConfig: () => AgentConfig,
   ApiExtractor: () => ApiExtractor,
+  ApplyWorkflow: () => ApplyWorkflow,
   AstroConfig: () => AstroConfig,
   AstroOutput: () => AstroOutput,
   AstroProject: () => AstroProject,
@@ -279,7 +280,12 @@ __export(index_exports, {
   DEFAULT_UNBLOCK_DEPENDENTS_ENABLED: () => DEFAULT_UNBLOCK_DEPENDENTS_ENABLED,
   DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED: () => DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED,
   DEPLOY_GATE: () => DEPLOY_GATE,
+  DIFF_ARTIFACT_NAME: () => DIFF_ARTIFACT_NAME,
+  DIFF_OUTPUT_DIRECTORY: () => DIFF_OUTPUT_DIRECTORY,
+  DIFF_PART_ARTIFACT_PREFIX: () => DIFF_PART_ARTIFACT_PREFIX,
+  DIFF_REPORT_JOB_ID: () => DIFF_REPORT_JOB_ID,
   DOCS_SYNC_AUDIT_SCHEMA_VERSION: () => DOCS_SYNC_AUDIT_SCHEMA_VERSION,
+  DiffReportJob: () => DiffReportJob,
   GITHUB_ISSUE_TYPES: () => GITHUB_ISSUE_TYPES,
   GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX: () => GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX,
   ISSUE_TEMPLATES_GENERATED_SUFFIX: () => ISSUE_TEMPLATES_GENERATED_SUFFIX,
@@ -338,6 +344,7 @@ __export(index_exports, {
   VERSION_NPM_PACKAGES: () => VERSION_NPM_PACKAGES,
   VSCodeConfig: () => VSCodeConfig,
   Vitest: () => Vitest,
+  WorkflowHomeRepository: () => WorkflowHomeRepository,
   addApproveMergeUpgradeWorkflow: () => addApproveMergeUpgradeWorkflow,
   addBuildCompleteJob: () => addBuildCompleteJob,
   addPlaywright: () => addPlaywright,
@@ -458,6 +465,7 @@ __export(index_exports, {
   renderCheckLinksProcedure: () => renderCheckLinksProcedure,
   renderCustomDocSectionBlock: () => renderCustomDocSectionBlock,
   renderCustomDocSections: () => renderCustomDocSections,
+  renderDiffPartUploadStep: () => renderDiffPartUploadStep,
   renderExtractApiProcedure: () => renderExtractApiProcedure,
   renderFocusSection: () => renderFocusSection,
   renderGithubIssueTypeSection: () => renderGithubIssueTypeSection,
@@ -489,6 +497,8 @@ __export(index_exports, {
   renderScopeGateSection: () => renderScopeGateSection,
   renderScopeGateShellHelpers: () => renderScopeGateShellHelpers,
   renderSetIssueTypeFallbackLines: () => renderSetIssueTypeFallbackLines,
+  renderSetupNode: () => renderSetupNode,
+  renderSetupPnpm: () => renderSetupPnpm,
   renderSharedEditingBundleHook: () => renderSharedEditingBundleHook,
   renderSharedEditingHelperScript: () => renderSharedEditingHelperScript,
   renderSharedEditingRuleContent: () => renderSharedEditingRuleContent,
@@ -42290,69 +42300,23 @@ var DEFAULT_FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0
 `;
 
 // src/projects/aws-cdk-project.ts
-var import_projen28 = require("projen");
+var import_projen31 = require("projen");
 var import_javascript5 = require("projen/lib/javascript");
 var import_release2 = require("projen/lib/release");
 var import_ts_deepmerge4 = require("ts-deepmerge");
 
 // src/workflows/aws-deploy-workflow.ts
 var import_utils11 = __toESM(require_lib());
-var import_projen26 = require("projen");
+var import_projen29 = require("projen");
 var import_build = require("projen/lib/build");
+var import_github8 = require("projen/lib/github");
+var import_workflows_model7 = require("projen/lib/github/workflows-model");
+
+// src/workflows/apply-workflow.ts
+var import_projen26 = require("projen");
 var import_github6 = require("projen/lib/github");
 var import_workflows_model5 = require("projen/lib/github/workflows-model");
 
-// src/workflows/deploy-gate.ts
-var DEPLOY_GATE = {
-  /**
-   * Hold each deploy job behind a GitHub environment so its protection rules —
-   * required reviewers, wait timers, deployment branch policies — apply before
-   * the job is sent to a runner.
-   */
-  ENVIRONMENT: "environment",
-  /**
-   * Split the workflow in two. A **plan** workflow builds and diffs but never
-   * deploys; a dispatch-only **apply** workflow deploys the exact cloud
-   * assembly a nominated plan run produced.
-   *
-   * Needs no protection rule, so unlike {@link DEPLOY_GATE.ENVIRONMENT} it
-   * works on every GitHub plan. `environmentName` is optional here and layers
-   * an environment onto the apply jobs.
-   */
-  PLAN_APPLY: "plan-apply"
-};
-var resolveEnvironmentGate = (gate, environmentName, componentName) => {
-  const trimmed = environmentName?.trim();
-  if (gate === void 0) {
-    if (trimmed) {
-      throw new Error(
-        `${componentName} requires \`gate\` to be set when \`environmentName\` is supplied, got "${environmentName}" with no gate`
-      );
-    }
-    return void 0;
-  }
-  if (gate === DEPLOY_GATE.ENVIRONMENT && !trimmed) {
-    throw new Error(
-      `${componentName} requires a non-empty \`environmentName\` when \`gate\` is "${gate}"`
-    );
-  }
-  return trimmed;
-};
-
-// src/workflows/home-repository.ts
-var HOME_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
-var renderHomeRepositoryCondition = (homeRepository, componentName) => {
-  if (homeRepository === void 0) {
-    return void 0;
-  }
-  if (!HOME_REPOSITORY_PATTERN.test(homeRepository)) {
-    throw new Error(
-      `${componentName} requires \`homeRepository\` to be an \`owner/repo\` slug, got "${homeRepository}"`
-    );
-  }
-  return `github.repository == '${homeRepository}'`;
-};
-
 // src/workflows/plan-apply.ts
 var VALIDATE_PLAN_JOB_ID = "validate-plan";
 var PLAN_RUN_ID_INPUT = "plan_run_id";
@@ -42452,46 +42416,532 @@ var renderPlanValidationScript = (options) => {
   ].join("\n");
 };
 
-// src/workflows/aws-deploy-workflow.ts
-var PROD_DEPLOY_NAME = "prod-deploy";
-var DIFF_OUTPUT_FILE = "cdk-diff.txt";
+// src/workflows/apply-workflow.ts
+var ApplyWorkflow = class _ApplyWorkflow extends import_projen26.Component {
+  constructor(project, github, options) {
+    super(project);
+    /**
+     * Every attached component's targets, in attach order. Held as targets rather
+     * than branches because `AwsDeploymentTarget.branches` is mutable — the
+     * branch union is read at `preSynthesize`, once every component has attached.
+     */
+    this.attachedTargets = [];
+    /**
+     * Attach another component's apply jobs to this workflow.
+     *
+     * Every setting the shared `validate-plan` job bakes in must match what the
+     * workflow was created with — there is one validation job for the whole file,
+     * so a disagreement cannot be honoured and is rejected rather than resolved
+     * in favour of whichever component happened to be constructed first.
+     */
+    this.attach = (options) => {
+      const { componentName } = options;
+      const name = this.workflow.name;
+      if (options.planWorkflowName !== this.contract.planWorkflowName) {
+        throw new Error(
+          `${componentName} cannot attach to the apply workflow "${name}": it plans from build workflow "${options.planWorkflowName}", but that apply workflow only accepts runs of "${this.contract.planWorkflowName}". Every component sharing an apply workflow must share one build workflow.`
+        );
+      }
+      this.requireAgreement(
+        componentName,
+        "requireCurrentHead",
+        options.requireCurrentHead,
+        this.contract.requireCurrentHead
+      );
+      this.requireAgreement(
+        componentName,
+        "verifyArtifactDigest",
+        options.verifyArtifactDigest,
+        this.contract.verifyArtifactDigest
+      );
+      this.attachedTargets.push(...options.awsDeploymentTargets);
+    };
+    /**
+     * Reject a boolean `planApply` setting that differs from the one this
+     * workflow was created with.
+     */
+    this.requireAgreement = (componentName, option, supplied, expected) => {
+      if (supplied === expected) {
+        return;
+      }
+      throw new Error(
+        `${componentName} cannot attach to the apply workflow "${this.workflow.name}": \`planApply.${option}\` is ${supplied} here and ${expected} on the components already attached. The setting is baked into the one shared \`${VALIDATE_PLAN_JOB_ID}\` job, so every component sharing an apply workflow must agree on it.`
+      );
+    };
+    /**
+     * Render the validation job every apply job depends on.
+     *
+     * `allowedBranches` is the union of every attached target's branches, deduped
+     * and left in attach order. The apply run's own `github.ref` says nothing
+     * about what was planned, so the list is checked against the *plan run's*
+     * `head_branch` rather than against a workflow-level branch filter.
+     */
+    this.renderValidateJob = () => {
+      const { planWorkflowName, requireCurrentHead, verifyArtifactDigest } = this.contract;
+      const allowedBranches = Array.from(
+        new Set(
+          this.attachedTargets.flatMap(
+            (target) => target.branches.map((b) => b.branch)
+          )
+        )
+      );
+      return {
+        name: "Validate plan run",
+        runsOn: ["ubuntu-latest"],
+        permissions: {
+          actions: import_workflows_model5.JobPermission.READ,
+          contents: import_workflows_model5.JobPermission.READ
+        },
+        ...this.homeRepositoryCondition ? { if: `\${{ ${this.homeRepositoryCondition} }}` } : {},
+        outputs: {
+          head_sha: { stepId: "validate_plan_run", outputName: "head_sha" },
+          head_branch: { stepId: "validate_plan_run", outputName: "head_branch" },
+          ...verifyArtifactDigest ? {
+            artifact_digest: {
+              stepId: "validate_plan_run",
+              outputName: "artifact_digest"
+            }
+          } : {}
+        },
+        steps: [
+          {
+            name: "Validate plan run",
+            id: "validate_plan_run",
+            uses: "actions/github-script@v9",
+            /**
+             * The dispatch input reaches the script through the environment
+             * rather than a `${{ }}` interpolation, so a crafted run id cannot
+             * inject JavaScript into the validation itself.
+             */
+            env: {
+              PLAN_RUN_ID: `\${{ inputs.${PLAN_RUN_ID_INPUT} }}`
+            },
+            with: {
+              script: renderPlanValidationScript({
+                planWorkflowPath: `.github/workflows/${planWorkflowName}.yml`,
+                allowedBranches,
+                requireCurrentHead,
+                verifyArtifactDigest
+              })
+            }
+          }
+        ]
+      };
+    };
+    const { applyWorkflowName } = options;
+    if (github.tryFindWorkflow(applyWorkflowName)) {
+      throw new Error(
+        `${options.componentName} cannot create the apply workflow "${applyWorkflowName}" because a workflow with that name already exists. Set \`planApply.applyWorkflow\` to share the existing one, or \`planApply.applyWorkflowName\` to something unique.`
+      );
+    }
+    this.contract = {
+      planWorkflowName: options.planWorkflowName,
+      requireCurrentHead: options.requireCurrentHead,
+      verifyArtifactDigest: options.verifyArtifactDigest
+    };
+    this.homeRepositoryCondition = options.homeRepositoryCondition;
+    this.attachedTargets.push(...options.awsDeploymentTargets);
+    this.workflow = new import_github6.GithubWorkflow(github, applyWorkflowName);
+    this.workflow.on({
+      workflowDispatch: {
+        inputs: {
+          [PLAN_RUN_ID_INPUT]: {
+            description: "Run id of the plan workflow run to apply. Its build artifact is deployed verbatim.",
+            required: true,
+            type: "string"
+          }
+        }
+      }
+    });
+    this.workflow.addJob(VALIDATE_PLAN_JOB_ID, this.renderValidateJob());
+  }
+  static of(project, workflow) {
+    const isDefined = (c) => c instanceof _ApplyWorkflow && c.workflow === workflow;
+    return project.components.find(isDefined);
+  }
+  preSynthesize() {
+    this.workflow.updateJob(VALIDATE_PLAN_JOB_ID, this.renderValidateJob());
+    super.preSynthesize();
+  }
+};
+
+// src/workflows/deploy-gate.ts
+var DEPLOY_GATE = {
+  /**
+   * Hold each deploy job behind a GitHub environment so its protection rules —
+   * required reviewers, wait timers, deployment branch policies — apply before
+   * the job is sent to a runner.
+   */
+  ENVIRONMENT: "environment",
+  /**
+   * Split the workflow in two. A **plan** workflow builds and diffs but never
+   * deploys; a dispatch-only **apply** workflow deploys the exact cloud
+   * assembly a nominated plan run produced.
+   *
+   * Needs no protection rule, so unlike {@link DEPLOY_GATE.ENVIRONMENT} it
+   * works on every GitHub plan. `environmentName` is optional here and layers
+   * an environment onto the apply jobs.
+   */
+  PLAN_APPLY: "plan-apply"
+};
+var resolveEnvironmentGate = (gate, environmentName, componentName) => {
+  const trimmed = environmentName?.trim();
+  if (gate === void 0) {
+    if (trimmed) {
+      throw new Error(
+        `${componentName} requires \`gate\` to be set when \`environmentName\` is supplied, got "${environmentName}" with no gate`
+      );
+    }
+    return void 0;
+  }
+  if (gate === DEPLOY_GATE.ENVIRONMENT && !trimmed) {
+    throw new Error(
+      `${componentName} requires a non-empty \`environmentName\` when \`gate\` is "${gate}"`
+    );
+  }
+  return trimmed;
+};
+
+// src/workflows/diff-report-job.ts
+var import_projen27 = require("projen");
+var import_github7 = require("projen/lib/github");
+var import_workflows_model6 = require("projen/lib/github/workflows-model");
+var DIFF_REPORT_JOB_ID = "diff-report";
+var DIFF_OUTPUT_DIRECTORY = "cdk-diff";
+var DIFF_PART_ARTIFACT_PREFIX = "cdk-diff-part";
+var DIFF_ARTIFACT_NAME = "cdk-diff";
+var DIFF_PART_RETENTION_DAYS = 1;
 var DIFF_SUMMARY_BYTE_LIMIT = 9e5;
-var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Component {
-  constructor(project, options = {}) {
+var RUN_URL = "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}";
+var DiffReportJob = class _DiffReportJob extends import_projen27.Component {
+  constructor(project, options) {
     super(project);
-    this.project = project;
-    this.options = options;
     /**
-     * AWS environment type, such as primary or secondary.
+     * Every contributed target, in attach order.
+     */
+    this.targets = [];
+    /**
+     * Publish settings are OR-ed rather than first-wins: one report means one
+     * answer, and a component that asked for a summary should get one even when
+     * a sibling did not.
+     */
+    this.summary = false;
+    this.artifact = false;
+    /**
+     * Fold one component's contribution in.
+     */
+    this.record = (options) => {
+      this.targets.push(...options.targets);
+      this.summary = this.summary || options.summary;
+      this.artifact = this.artifact || options.artifact;
+    };
+    /**
+     * Compose the report's own condition.
      *
-     * @deprecated Use deployment target role terminology elsewhere. This property is maintained for backward compatibility.
-     * @default 'primary' (this is the only type supported currently)
+     * `!cancelled()` leads, and it is load-bearing: a job whose `needs` failed or
+     * were skipped is skipped by default, so without a status function the report
+     * would vanish in exactly the cases it is most wanted — one target's diff
+     * failing, or some targets not applying to this branch.
      */
-    this.awsEnvironmentType = import_utils11.DEPLOYMENT_TARGET_ROLE.PRIMARY;
-    this.setupNode = () => {
+    this.renderJobCondition = () => {
+      const branchConditions = this.targets.map(
+        (target) => target.branchCondition
+      );
+      const anyBranch = branchConditions.some((condition) => !condition);
+      const branchClause = anyBranch ? void 0 : Array.from(new Set(branchConditions)).join(" || ");
+      return "${{ " + [
+        "!cancelled()",
+        "!needs.build.outputs.self_mutation_happened",
+        ...this.homeRepositoryCondition ? [this.homeRepositoryCondition] : [],
+        ...branchClause ? [`(${branchClause})`] : []
+      ].join(" && ") + " }}";
+    };
+    /**
+     * Pull every target's part into one directory.
+     *
+     * `continueOnError` because a run where every target's diff job was skipped
+     * by its branch filter matches no parts at all, and a report with nothing to
+     * report is not a failure.
+     */
+    this.renderDownloadStep = () => {
       return [
-        {
-          name: "Setup Node",
-          uses: `actions/setup-node@${VERSION.SETUP_NODE_ACTION_VERSION}`,
+        import_github7.WorkflowSteps.downloadArtifact({
+          name: "Download target diffs",
+          continueOnError: true,
           with: {
-            ["node-version"]: VERSION.NODE_WORKFLOWS
-          },
-          // occasionally this step fails due to internal issues at github
-          timeoutMinutes: 1
+            pattern: `${DIFF_PART_ARTIFACT_PREFIX}-*`,
+            mergeMultiple: true,
+            path: DIFF_OUTPUT_DIRECTORY
+          }
+        })
+      ];
+    };
+    /**
+     * Render every target's diff into the job summary, one collapsed `<details>`
+     * block per target.
+     *
+     * A target whose part is absent renders as "did not run", which is what
+     * distinguishes a target that was skipped or whose diff failed before it
+     * captured anything from one that simply had no changes — the latter has a
+     * file, carrying the CDK CLI's own no-differences wording, rather than being
+     * detected by matching on it.
+     */
+    this.renderSummaryStep = () => {
+      if (!this.summary || this.targets.length === 0) {
+        return [];
+      }
+      const budget = Math.floor(DIFF_SUMMARY_BYTE_LIMIT / this.targets.length);
+      const rows = this.targets.map(
+        (target) => `'${target.label}|${target.outputFile}'`
+      );
+      return [
+        {
+          name: "Render diff report",
+          if: "!cancelled()",
+          shell: "bash",
+          run: [
+            "{",
+            "  while IFS='|' read -r label file; do",
+            '    echo "## cdk diff \u2014 $label"',
+            '    echo ""',
+            '    if [ ! -f "$file" ]; then',
+            "      echo '_Did not run._'",
+            '      echo ""',
+            "      continue",
+            "    fi",
+            "    echo '<details><summary>cdk diff output</summary>'",
+            '    echo ""',
+            "    echo '```'",
+            `    if [ "$(wc -c < "$file")" -gt ${budget} ]; then`,
+            `      head -c ${budget} "$file"`,
+            `      printf '\\n... truncated at ${budget} bytes ...\\n'`,
+            "    else",
+            '      cat "$file"',
+            "    fi",
+            "    echo '```'",
+            '    echo ""',
+            "    echo '</details>'",
+            '    echo ""',
+            `  done < <(printf '%s\\n' ${rows.join(" ")})`,
+            ...this.artifact ? [
+              `  echo 'Full diff: the \`${DIFF_ARTIFACT_NAME}\` artifact on [this run](${RUN_URL}).'`
+            ] : [],
+            '} >> "$GITHUB_STEP_SUMMARY"'
+          ].join("\n")
         }
       ];
     };
-    this.setupPnpm = () => {
+    /**
+     * Fail the report when any target's diff failed.
+     *
+     * Runs last, so the summary and the artifact are published first — a reviewer
+     * still gets the whole picture, including whatever the failing target managed
+     * to capture. But the report must not end up green: everything gated behind
+     * it `needs` it, and a job whose `needs` failed is skipped, which is what
+     * keeps a failed diff from letting a gated deploy through to *Waiting for
+     * approval*. Without this the report would always succeed and a diff failure
+     * would only soft-block behind a human.
+     *
+     * Only `failure` counts. A target skipped by its branch filter reports
+     * `skipped`, which is normal and must not fail the report.
+     */
+    this.renderFailureStep = () => {
+      const jobNames = Array.from(
+        new Set(this.targets.map((target) => target.jobName))
+      );
+      if (jobNames.length === 0) {
+        return [];
+      }
       return [
         {
-          name: "Setup PNPM",
-          uses: `pnpm/action-setup@${VERSION.PNPM_ACTION_SETUP_VERSION}`,
+          name: "Fail if any target's diff failed",
+          if: "!cancelled()",
+          shell: "bash",
+          run: [
+            ...jobNames.map(
+              (jobName) => `if [ "\${{ needs.${jobName}.result }}" = "failure" ]; then echo "::error::Diff job ${jobName} failed"; failed=1; fi`
+            ),
+            'if [ "${failed:-0}" = "1" ]; then exit 1; fi'
+          ].join("\n")
+        }
+      ];
+    };
+    /**
+     * Upload the merged directory as the one artifact meant to be read.
+     */
+    this.renderUploadStep = () => {
+      if (!this.artifact || this.targets.length === 0) {
+        return [];
+      }
+      return [
+        import_github7.WorkflowSteps.uploadArtifact({
+          name: "Upload combined diff",
+          if: "!cancelled()",
           with: {
-            version: this.rootProject.pnpmVersion
+            name: DIFF_ARTIFACT_NAME,
+            path: DIFF_OUTPUT_DIRECTORY,
+            ifNoFilesFound: "ignore"
           }
-        }
+        })
       ];
     };
+    this.buildWorkflow = options.buildWorkflow;
+    this.homeRepositoryCondition = options.homeRepositoryCondition;
+    this.record(options);
+    this.buildWorkflow.workflow.addJob(DIFF_REPORT_JOB_ID, {
+      name: "Diff report",
+      needs: ["build"],
+      runsOn: ["ubuntu-latest"],
+      permissions: {
+        contents: import_workflows_model6.JobPermission.READ
+      },
+      steps: []
+    });
+  }
+  static of(project, buildWorkflow) {
+    const isDefined = (c) => c instanceof _DiffReportJob && c.buildWorkflow === buildWorkflow;
+    return project.components.find(isDefined);
+  }
+  /**
+   * Add a component's targets to the plan workflow's diff report, creating the
+   * report job the first time it is called for that workflow.
+   */
+  static attach(project, options) {
+    const existing = _DiffReportJob.of(project, options.buildWorkflow);
+    if (existing) {
+      existing.record(options);
+      return existing;
+    }
+    return new _DiffReportJob(project, options);
+  }
+  preSynthesize() {
+    this.buildWorkflow.workflow.updateJob(DIFF_REPORT_JOB_ID, {
+      name: "Diff report",
+      /**
+       * `build` is a direct dependency so the job can read its
+       * self-mutation output, which is otherwise unreachable — the `needs`
+       * context only carries direct dependencies, not transitive ones.
+       */
+      needs: [
+        "build",
+        ...Array.from(new Set(this.targets.map((target) => target.jobName)))
+      ],
+      runsOn: ["ubuntu-latest"],
+      permissions: {
+        contents: import_workflows_model6.JobPermission.READ
+      },
+      if: this.renderJobCondition(),
+      steps: [
+        ...this.renderDownloadStep(),
+        ...this.renderSummaryStep(),
+        ...this.renderUploadStep(),
+        ...this.renderFailureStep()
+      ]
+    });
+    super.preSynthesize();
+  }
+};
+var renderDiffPartUploadStep = (options) => {
+  return import_github7.WorkflowSteps.uploadArtifact({
+    name: `Upload diff ${options.label}`,
+    if: "!cancelled()",
+    with: {
+      name: options.artifactName,
+      path: options.outputFile,
+      ifNoFilesFound: "ignore",
+      retentionDays: DIFF_PART_RETENTION_DAYS
+    }
+  });
+};
+
+// src/workflows/home-repository.ts
+var import_projen28 = require("projen");
+var HOME_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+var renderHomeRepositoryCondition = (homeRepository, componentName) => {
+  if (homeRepository === void 0) {
+    return void 0;
+  }
+  if (!HOME_REPOSITORY_PATTERN.test(homeRepository)) {
+    throw new Error(
+      `${componentName} requires \`homeRepository\` to be an \`owner/repo\` slug, got "${homeRepository}"`
+    );
+  }
+  return `github.repository == '${homeRepository}'`;
+};
+var describePin = (homeRepository) => homeRepository === void 0 ? "unset" : `"${homeRepository}"`;
+var WorkflowHomeRepository = class _WorkflowHomeRepository extends import_projen28.Component {
+  static of(project, workflow) {
+    const isDefined = (c) => c instanceof _WorkflowHomeRepository && c.workflow === workflow;
+    return project.components.find(isDefined);
+  }
+  /**
+   * Record a pin against a workflow, throwing when it disagrees with what an
+   * earlier component declared for the same one.
+   *
+   * @param project - Project the record is attached to. Use the root project,
+   * so components on sibling sub-projects find each other.
+   */
+  static require(project, options) {
+    const { workflow, workflowName, homeRepository, componentName } = options;
+    const existing = _WorkflowHomeRepository.of(project, workflow);
+    if (!existing) {
+      return new _WorkflowHomeRepository(project, options);
+    }
+    if (existing.homeRepository !== homeRepository) {
+      throw new Error(
+        `${componentName} requires every component sharing the workflow "${workflowName}" to declare the same \`homeRepository\`, got ${describePin(homeRepository)} here and ${describePin(existing.homeRepository)} already declared. The pin guards every job in one workflow file, so it cannot differ between them.`
+      );
+    }
+    return existing;
+  }
+  constructor(project, options) {
+    super(project);
+    this.workflow = options.workflow;
+    this.homeRepository = options.homeRepository;
+  }
+};
+
+// src/workflows/node-setup.ts
+var renderSetupNode = () => {
+  return [
+    {
+      name: "Setup Node",
+      uses: `actions/setup-node@${VERSION.SETUP_NODE_ACTION_VERSION}`,
+      with: {
+        ["node-version"]: VERSION.NODE_WORKFLOWS
+      },
+      timeoutMinutes: 1
+    }
+  ];
+};
+var renderSetupPnpm = (pnpmVersion) => {
+  return [
+    {
+      name: "Setup PNPM",
+      uses: `pnpm/action-setup@${VERSION.PNPM_ACTION_SETUP_VERSION}`,
+      with: {
+        version: pnpmVersion
+      }
+    }
+  ];
+};
+
+// src/workflows/aws-deploy-workflow.ts
+var PROD_DEPLOY_NAME = "prod-deploy";
+var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen29.Component {
+  constructor(project, options = {}) {
+    super(project);
+    this.project = project;
+    this.options = options;
+    /**
+     * AWS environment type, such as primary or secondary.
+     *
+     * @deprecated Use deployment target role terminology elsewhere. This property is maintained for backward compatibility.
+     * @default 'primary' (this is the only type supported currently)
+     */
+    this.awsEnvironmentType = import_utils11.DEPLOYMENT_TARGET_ROLE.PRIMARY;
+    this.setupNode = () => renderSetupNode();
+    this.setupPnpm = () => renderSetupPnpm(this.rootProject.pnpmVersion);
     /**
      * Build the deterministic GitHub Actions job name for a deploy target.
      *
@@ -42509,45 +42959,43 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       ].join("-");
     };
     /**
-     * Build the deterministic GitHub Actions job name for a target's `cdk diff`
-     * job. Mirrors {@link buildJobName} with a `diff` verb so the diff and deploy
-     * jobs for one target sort next to each other in the run view.
+     * Build the deterministic GitHub Actions job name for a target's apply job.
+     * Mirrors {@link buildJobName} with an `apply` verb.
      */
-    this.buildDiffJobName = (target) => {
+    this.buildApplyJobName = (target) => {
       return [
         target.awsStageType,
         target.deploymentTargetRole,
-        "diff",
+        "apply",
         target.project.name,
         target.account,
         target.region
       ].join("-");
     };
     /**
-     * Build the deterministic GitHub Actions job name for a target's apply job.
-     * Mirrors {@link buildJobName} with an `apply` verb.
+     * Build the deterministic GitHub Actions job name for a target's `cdk diff`
+     * job. Mirrors {@link buildJobName} with a `diff` verb so the diff and deploy
+     * jobs for one target sort next to each other in the run view.
      */
-    this.buildApplyJobName = (target) => {
+    this.buildDiffJobName = (target) => {
       return [
         target.awsStageType,
         target.deploymentTargetRole,
-        "apply",
+        "diff",
         target.project.name,
         target.account,
         target.region
       ].join("-");
     };
     /**
-     * Build the CI artifact name for a target's captured diff.
+     * Build the slug that makes a target unique among every target in the plan
+     * workflow, across every deploy component feeding it.
      *
-     * Carries every component that makes a target unique — including
-     * `deploymentTargetRole`, which two otherwise-identical targets can differ
-     * on. `actions/upload-artifact` v4+ treats artifacts as immutable and rejects
-     * a duplicate name within a run, so parallel diff jobs cannot share one.
+     * Includes `deploymentTargetRole`, which two otherwise-identical targets can
+     * differ on.
      */
-    this.buildDiffArtifactName = (target) => {
+    this.buildDiffSlug = (target) => {
       return [
-        "cdk-diff",
         target.awsStageType,
         target.deploymentTargetRole,
         target.project.name,
@@ -42556,83 +43004,45 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       ].join("-");
     };
     /**
-     * Create the dispatch-only apply workflow and its validation job.
+     * Build the file a target's captured diff is written to, both in its own diff
+     * job's workspace and in the merged directory the report job assembles.
+     */
+    this.buildDiffOutputFile = (target) => {
+      return `${DIFF_OUTPUT_DIRECTORY}/${this.buildDiffSlug(target)}.txt`;
+    };
+    /**
+     * Build the intermediate artifact name carrying one target's captured diff.
+     *
+     * The diff jobs run in parallel and `actions/upload-artifact` v4+ rejects a
+     * duplicate name within a run, so each target needs its own. The report job
+     * merges them into a single artifact, which is the one meant to be read.
+     */
+    this.buildDiffPartArtifactName = (target) => {
+      return `${DIFF_PART_ARTIFACT_PREFIX}-${this.buildDiffSlug(target)}`;
+    };
+    /**
+     * Join an apply workflow another `AwsDeployWorkflow` already created, so this
+     * component's apply jobs land in that file rather than a second one.
      *
-     * The workflow file name defaults to the plan workflow's name suffixed with
-     * `-apply`. A name already in use throws rather than silently colliding on
-     * the underlying `.github/workflows/<name>.yml` file — the usual cause is two
-     * `AwsDeployWorkflow`s sharing one build workflow, and the fix is an explicit
-     * `planApply.applyWorkflowName`.
+     * Rejects a `GithubWorkflow` that is not an apply workflow: attaching to an
+     * arbitrary one would add apply jobs depending on a `validate-plan` job that
+     * does not exist there, which GitHub rejects only at run time.
      */
-    this.createApplyWorkflow = (github, homeRepositoryCondition) => {
-      const { applyWorkflowName, requireCurrentHead, verifyArtifactDigest } = this.planApplyOptions;
-      if (github.tryFindWorkflow(applyWorkflowName)) {
+    this.attachApplyWorkflow = (workflow) => {
+      const shared = ApplyWorkflow.of(this.rootProject, workflow);
+      if (!shared) {
         throw new Error(
-          `AwsDeployWorkflow cannot create the apply workflow "${applyWorkflowName}" because a workflow with that name already exists. Set \`planApply.applyWorkflowName\` to something unique.`
+          `AwsDeployWorkflow cannot attach to the workflow "${workflow.name}" because it is not an apply workflow. Pass the \`applyWorkflow\` of an AwsDeployWorkflow built with the \`plan-apply\` gate.`
         );
       }
-      const workflow = new import_github6.GithubWorkflow(github, applyWorkflowName);
-      workflow.on({
-        workflowDispatch: {
-          inputs: {
-            [PLAN_RUN_ID_INPUT]: {
-              description: "Run id of the plan workflow run to apply. Its build artifact is deployed verbatim.",
-              required: true,
-              type: "string"
-            }
-          }
-        }
+      shared.attach({
+        planWorkflowName: this.buildWorkflow.name,
+        requireCurrentHead: this.planApplyOptions.requireCurrentHead,
+        verifyArtifactDigest: this.planApplyOptions.verifyArtifactDigest,
+        awsDeploymentTargets: this.awsDeploymentTargets,
+        componentName: "AwsDeployWorkflow"
       });
-      const allowedBranches = Array.from(
-        new Set(
-          this.awsDeploymentTargets.flatMap(
-            (target) => target.branches.map((b) => b.branch)
-          )
-        )
-      );
-      workflow.addJob(VALIDATE_PLAN_JOB_ID, {
-        name: "Validate plan run",
-        runsOn: ["ubuntu-latest"],
-        permissions: {
-          actions: import_workflows_model5.JobPermission.READ,
-          contents: import_workflows_model5.JobPermission.READ
-        },
-        ...homeRepositoryCondition ? { if: `\${{ ${homeRepositoryCondition} }}` } : {},
-        outputs: {
-          head_sha: { stepId: "validate_plan_run", outputName: "head_sha" },
-          head_branch: { stepId: "validate_plan_run", outputName: "head_branch" },
-          ...verifyArtifactDigest ? {
-            artifact_digest: {
-              stepId: "validate_plan_run",
-              outputName: "artifact_digest"
-            }
-          } : {}
-        },
-        steps: [
-          {
-            name: "Validate plan run",
-            id: "validate_plan_run",
-            uses: "actions/github-script@v9",
-            /**
-             * The dispatch input reaches the script through the environment
-             * rather than a `${{ }}` interpolation, so a crafted run id cannot
-             * inject JavaScript into the validation itself.
-             */
-            env: {
-              PLAN_RUN_ID: `\${{ inputs.${PLAN_RUN_ID_INPUT} }}`
-            },
-            with: {
-              script: renderPlanValidationScript({
-                planWorkflowPath: `.github/workflows/${this.buildWorkflow.name}.yml`,
-                allowedBranches,
-                requireCurrentHead,
-                verifyArtifactDigest
-              })
-            }
-          }
-        ]
-      });
-      return workflow;
+      return shared;
     };
     /**
      * Register one target's apply job on the apply workflow.
@@ -42667,9 +43077,9 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         ],
         runsOn: ["ubuntu-latest"],
         permissions: {
-          actions: import_workflows_model5.JobPermission.READ,
-          contents: import_workflows_model5.JobPermission.READ,
-          idToken: import_workflows_model5.JobPermission.WRITE
+          actions: import_workflows_model7.JobPermission.READ,
+          contents: import_workflows_model7.JobPermission.READ,
+          idToken: import_workflows_model7.JobPermission.WRITE
         },
         ...this.environmentName ? { environment: this.environmentName } : void 0,
         /**
@@ -42859,9 +43269,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       const { roleArn, stackPattern } = ciDeploymentConfig ?? {};
       const { rootCdkOut, cdkCli } = awsDeploymentConfig;
       const label = `${awsStageType}/${deploymentTargetRole}/${account}/${region}`;
-      const artifactName = this.buildDiffArtifactName(target);
-      const capturedFileGuard = `always() && hashFiles('${DIFF_OUTPUT_FILE}') != ''`;
-      const runUrl = "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}";
+      const outputFile = this.buildDiffOutputFile(target);
       return [
         ...this.setupPnpm(),
         ...this.setupNode(),
@@ -42881,69 +43289,36 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         /**
          * Run CDK Diff, capturing the output while leaving it visible in the job
          * log. `pipefail` keeps the CLI's exit code from being masked by `tee`.
+         *
+         * The capture lands under the same path the report job will merge it
+         * back to, so a target's file name is identical in both places.
          */
         {
           name: `Diff ${label}`,
           shell: "bash",
           run: [
             "set -o pipefail",
+            `mkdir -p ${DIFF_OUTPUT_DIRECTORY}`,
             `pnpm dlx "aws-cdk@${cdkCli.cliVersion}" ${renderCdkDiff({
               ...cdkCli.diffOptionsFor(target),
               app: rootCdkOut,
               ci: true,
               noColor: true,
               stackPatterns: stackPattern ? [stackPattern] : void 0
-            })} 2>&1 | tee ${DIFF_OUTPUT_FILE}`
+            })} 2>&1 | tee ${outputFile}`
           ].join("\n")
         },
         /**
-         * Render the captured diff into the job summary inside a collapsed
-         * `<details>` block, truncated below GitHub's 1 MiB per-step cap — a
-         * summary that exceeds the cap is dropped in full rather than clipped.
+         * Hand the capture to the report job. Guarded on `!cancelled()` rather
+         * than success, so a diff that exits non-zero — a synth error, or a
+         * consumer who opted into `--fail` — still contributes what it captured
+         * instead of leaving a hole in the report.
          */
-        ...this.diffOptions.summary ? [
-          {
-            name: `Render diff summary ${label}`,
-            if: capturedFileGuard,
-            shell: "bash",
-            run: [
-              `size=$(wc -c < ${DIFF_OUTPUT_FILE})`,
-              "{",
-              `  echo '## cdk diff \u2014 ${label}'`,
-              '  echo ""',
-              "  echo '<details><summary>cdk diff output</summary>'",
-              '  echo ""',
-              "  echo '```'",
-              `  if [ "$size" -gt ${DIFF_SUMMARY_BYTE_LIMIT} ]; then`,
-              `    head -c ${DIFF_SUMMARY_BYTE_LIMIT} ${DIFF_OUTPUT_FILE}`,
-              `    printf '\\n... truncated at ${DIFF_SUMMARY_BYTE_LIMIT} bytes ...\\n'`,
-              "  else",
-              `    cat ${DIFF_OUTPUT_FILE}`,
-              "  fi",
-              "  echo '```'",
-              '  echo ""',
-              "  echo '</details>'",
-              ...this.diffOptions.artifact ? [
-                '  echo ""',
-                `  echo 'Full diff: the \`${artifactName}\` artifact on [this run](${runUrl}).'`
-              ] : [],
-              '} >> "$GITHUB_STEP_SUMMARY"'
-            ].join("\n")
-          }
-        ] : [],
-        /**
-         * Upload the untruncated diff as a per-run artifact.
-         */
-        ...this.diffOptions.artifact ? [
-          import_github6.WorkflowSteps.uploadArtifact({
-            name: `Upload diff ${label}`,
-            if: capturedFileGuard,
-            with: {
-              name: artifactName,
-              path: DIFF_OUTPUT_FILE
-            }
-          })
-        ] : []
+        renderDiffPartUploadStep({
+          label,
+          artifactName: this.buildDiffPartArtifactName(target),
+          outputFile
+        })
       ];
     };
     if (!(project.root instanceof MonorepoProject)) {
@@ -42952,7 +43327,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       );
     }
     this.rootProject = project.root;
-    const github = import_github6.GitHub.of(this.rootProject);
+    const github = import_github8.GitHub.of(this.rootProject);
     if (!github) {
       throw new Error(
         "AwsDeployWorkflow requires a GitHub component in the root project"
@@ -43009,14 +43384,20 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
       buildTask: this.rootProject.buildTask,
       /**
        * Use push triggers based n the branch config for each environment.
+       *
+       * Deduped: targets in one workflow routinely share a branch — two prod
+       * targets both default to `main` — and a repeated entry is only noise
+       * in the generated file, since GitHub treats this as a filter list.
        */
       workflowTriggers: {
         push: {
-          branches: [
-            ...this.awsDeploymentTargets.flatMap(
-              (t) => t.branches.map((b) => b.branch)
+          branches: Array.from(
+            new Set(
+              this.awsDeploymentTargets.flatMap(
+                (t) => t.branches.map((b) => b.branch)
+              )
             )
-          ]
+          )
         },
         workflowDispatch: {},
         ...options.buildWorkflowOptions?.workflowTriggers
@@ -43059,16 +43440,40 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
         ...buildWorkflowOptions?.preBuildSteps ?? []
       ]
     });
+    WorkflowHomeRepository.require(this.rootProject, {
+      workflow: this.buildWorkflow,
+      workflowName: this.buildWorkflow.name,
+      homeRepository: this.homeRepository,
+      componentName: "AwsDeployWorkflow"
+    });
+    const sharedApplyWorkflow = options.planApply?.applyWorkflow;
+    if (sharedApplyWorkflow && options.planApply?.applyWorkflowName) {
+      throw new Error(
+        "Cannot provide both planApply.applyWorkflow and planApply.applyWorkflowName: the workflow being joined already has a name."
+      );
+    }
     this.planApplyOptions = {
-      applyWorkflowName: options.planApply?.applyWorkflowName ?? `${this.buildWorkflow.name}-apply`,
+      applyWorkflowName: sharedApplyWorkflow?.name ?? options.planApply?.applyWorkflowName ?? `${this.buildWorkflow.name}-apply`,
       requireCurrentHead: options.planApply?.requireCurrentHead ?? false,
       verifyArtifactDigest: options.planApply?.verifyArtifactDigest ?? false
     };
     if (isPlanApply) {
-      this.applyWorkflow = this.createApplyWorkflow(
-        github,
-        homeRepositoryCondition
-      );
+      const applyWorkflow = sharedApplyWorkflow ? this.attachApplyWorkflow(sharedApplyWorkflow) : new ApplyWorkflow(this.rootProject, github, {
+        applyWorkflowName: this.planApplyOptions.applyWorkflowName,
+        planWorkflowName: this.buildWorkflow.name,
+        requireCurrentHead: this.planApplyOptions.requireCurrentHead,
+        verifyArtifactDigest: this.planApplyOptions.verifyArtifactDigest,
+        homeRepositoryCondition,
+        awsDeploymentTargets: this.awsDeploymentTargets,
+        componentName: "AwsDeployWorkflow"
+      });
+      this.applyWorkflow = applyWorkflow.workflow;
+      WorkflowHomeRepository.require(this.rootProject, {
+        workflow: applyWorkflow.workflow,
+        workflowName: this.planApplyOptions.applyWorkflowName,
+        homeRepository: this.homeRepository,
+        componentName: "AwsDeployWorkflow"
+      });
     }
     this.awsDeploymentTargets.forEach((target) => {
       const deployJobName = this.buildJobName(target);
@@ -43088,16 +43493,16 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
           name: `Deploy ${this.project.name} ${target.awsStageType}/${target.deploymentTargetRole}/${target.account}/${target.region}`,
           needs: [
             "build",
-            ...gatedOnDiff ? [this.buildDiffJobName(target)] : [],
+            ...gatedOnDiff ? [DIFF_REPORT_JOB_ID] : [],
             ...this.deployAfterTargets.map((p) => {
               return this.buildJobName(p);
             })
           ],
           runsOn: ["ubuntu-latest"],
           permissions: {
-            contents: import_workflows_model5.JobPermission.READ,
-            idToken: import_workflows_model5.JobPermission.WRITE,
-            pullRequests: import_workflows_model5.JobPermission.WRITE
+            contents: import_workflows_model7.JobPermission.READ,
+            idToken: import_workflows_model7.JobPermission.WRITE,
+            pullRequests: import_workflows_model7.JobPermission.WRITE
           },
           ...this.environmentName ? { environment: this.environmentName } : void 0,
           concurrency: deployJobName,
@@ -43112,14 +43517,28 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
           needs: ["build"],
           runsOn: ["ubuntu-latest"],
           permissions: {
-            contents: import_workflows_model5.JobPermission.READ,
-            idToken: import_workflows_model5.JobPermission.WRITE
+            contents: import_workflows_model7.JobPermission.READ,
+            idToken: import_workflows_model7.JobPermission.WRITE
           },
           if: jobCondition,
           steps: [...this.diffSteps(target)]
         });
       }
     });
+    if (this.diffOptions.enabled && this.awsDeploymentTargets.length > 0) {
+      DiffReportJob.attach(this.rootProject, {
+        buildWorkflow: this.buildWorkflow,
+        homeRepositoryCondition,
+        summary: this.diffOptions.summary,
+        artifact: this.diffOptions.artifact,
+        targets: this.awsDeploymentTargets.map((target) => ({
+          label: `${this.project.name} ${target.awsStageType}/${target.deploymentTargetRole}/${target.account}/${target.region}`,
+          jobName: this.buildDiffJobName(target),
+          outputFile: this.buildDiffOutputFile(target),
+          branchCondition: this.buildBranchFilterCondition(target.branches)
+        }))
+      });
+    }
     addBuildCompleteJob(this.buildWorkflow);
   }
   static of(project, buildWorkflow) {
@@ -43133,7 +43552,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
           name: "Build Sub Projects",
           run: `pnpm exec projen ${ROOT_CI_TASK_NAME}`
         },
-        import_github6.WorkflowSteps.uploadArtifact({
+        import_github8.WorkflowSteps.uploadArtifact({
           name: "Upload Turbo runs",
           if: "always()",
           continueOnError: true,
@@ -43149,9 +43568,9 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen26.Compone
 };
 
 // src/workflows/aws-teardown-workflow.ts
-var import_projen27 = require("projen");
-var import_github7 = require("projen/lib/github");
-var import_workflows_model6 = require("projen/lib/github/workflows-model");
+var import_projen30 = require("projen");
+var import_github9 = require("projen/lib/github");
+var import_workflows_model8 = require("projen/lib/github/workflows-model");
 var DEFAULT_TEARDOWN_BRANCH_PATTERNS = [
   "feat/*",
   "fix/*",
@@ -43171,7 +43590,7 @@ var resolveBranchPatterns = (explicit, targets) => {
   }
   return [...DEFAULT_TEARDOWN_BRANCH_PATTERNS];
 };
-var AwsTeardownWorkflow = class extends import_projen27.Component {
+var AwsTeardownWorkflow = class extends import_projen30.Component {
   constructor(rootProject, options) {
     super(rootProject);
     this.rootProject = rootProject;
@@ -43201,7 +43620,7 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
         "AwsTeardownWorkflow requires the root project to be a MonorepoProject"
       );
     }
-    const github = import_github7.GitHub.of(this.rootProject);
+    const github = import_github9.GitHub.of(this.rootProject);
     if (!github) {
       throw new Error(
         "AwsTeardownWorkflow requires a GitHub component in the root project"
@@ -43215,7 +43634,7 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
       homeRepository,
       "AwsTeardownWorkflow"
     );
-    const workflow = new import_github7.GithubWorkflow(github, "teardown-dev");
+    const workflow = new import_github9.GithubWorkflow(github, "teardown-dev");
     workflow.on({
       workflowDispatch: {},
       schedule: [
@@ -43243,8 +43662,8 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
           runsOn: ["ubuntu-latest"],
           ...homeRepositoryCondition ? { if: `\${{ ${homeRepositoryCondition} }}` } : {},
           permissions: {
-            contents: import_workflows_model6.JobPermission.READ,
-            idToken: import_workflows_model6.JobPermission.WRITE
+            contents: import_workflows_model8.JobPermission.READ,
+            idToken: import_workflows_model8.JobPermission.WRITE
           },
           env: {
             REPO: "${{ github.repository }}",
@@ -43359,7 +43778,7 @@ var AwsTeardownWorkflow = class extends import_projen27.Component {
 };
 
 // src/projects/aws-cdk-project.ts
-var AwsCdkProject = class extends import_projen28.awscdk.AwsCdkTypeScriptApp {
+var AwsCdkProject = class extends import_projen31.awscdk.AwsCdkTypeScriptApp {
   constructor(userOptions) {
     if (!(userOptions.parent instanceof MonorepoProject)) {
       throw new Error(
@@ -43575,7 +43994,7 @@ var AwsCdkProject = class extends import_projen28.awscdk.AwsCdkTypeScriptApp {
 };
 
 // src/projects/react-vite-site-project.ts
-var import_projen29 = require("projen");
+var import_projen32 = require("projen");
 var import_ts_deepmerge5 = require("ts-deepmerge");
 var ReactViteSiteProject = class extends TypeScriptProject {
   constructor(userOptions) {
@@ -43614,7 +44033,7 @@ var ReactViteSiteProject = class extends TypeScriptProject {
     };
     super(options);
     this.package.addField("type", "module");
-    new import_projen29.TextFile(this, ".nvmrc", { lines: ["v24.11.0"] });
+    new import_projen32.TextFile(this, ".nvmrc", { lines: ["v24.11.0"] });
     this.tsconfig?.file.addOverride("compilerOptions.target", "ES2020");
     this.tsconfig?.file.addOverride("compilerOptions.lib", [
       "ES2020",
@@ -43649,7 +44068,7 @@ var ReactViteSiteProject = class extends TypeScriptProject {
       "vitest/globals",
       "vite/client"
     ]);
-    new import_projen29.SampleFile(this, "vite.config.ts", {
+    new import_projen32.SampleFile(this, "vite.config.ts", {
       contents: `import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 import tailwindcss from '@tailwindcss/vite';
@@ -43661,7 +44080,7 @@ export default defineConfig({
 });
 `
     });
-    new import_projen29.SampleFile(this, "src/vite-env.d.ts", {
+    new import_projen32.SampleFile(this, "src/vite-env.d.ts", {
       contents: `/// <reference types="vite/client" />
 
 interface ImportMetaEnv {
@@ -43676,7 +44095,7 @@ interface ImportMeta {
     });
     if (options.testRunner !== TestRunner.JEST) {
       this.tryRemoveFile("vitest.config.ts");
-      new import_projen29.SampleFile(this, "vitest.config.ts", {
+      new import_projen32.SampleFile(this, "vitest.config.ts", {
         contents: `import { defineConfig, mergeConfig } from 'vitest/config';
 import react from '@vitejs/plugin-react';
 import viteConfig from './vite.config';
@@ -43820,7 +44239,7 @@ export default mergeConfig(
     }
     if (userOptions.sampleCode === true) {
       const siteName = options.name;
-      new import_projen29.SampleFile(this, "index.html", {
+      new import_projen32.SampleFile(this, "index.html", {
         contents: `<!doctype html>
 <html>
   <head>
@@ -43835,7 +44254,7 @@ export default mergeConfig(
 </html>
 `
       });
-      new import_projen29.SampleFile(this, "src/routes.tsx", {
+      new import_projen32.SampleFile(this, "src/routes.tsx", {
         contents: `import { createBrowserRouter } from 'react-router-dom';
 import App from './App';
 
@@ -43844,7 +44263,7 @@ export const router = createBrowserRouter([
 ]);
 `
       });
-      new import_projen29.SampleFile(this, "src/main.tsx", {
+      new import_projen32.SampleFile(this, "src/main.tsx", {
         contents: `import React from 'react';
 import ReactDOM from 'react-dom/client';
 import { RouterProvider } from 'react-router-dom';
@@ -43858,7 +44277,7 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
 );
 `
       });
-      new import_projen29.SampleFile(this, "src/App.tsx", {
+      new import_projen32.SampleFile(this, "src/App.tsx", {
         contents: `export default function App() {
   return (
     <main className="p-4">
@@ -43868,11 +44287,11 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
 }
 `
       });
-      new import_projen29.SampleFile(this, "src/index.css", {
+      new import_projen32.SampleFile(this, "src/index.css", {
         contents: `@import "tailwindcss";
 `
       });
-      new import_projen29.SampleFile(this, "src/setupTests.ts", {
+      new import_projen32.SampleFile(this, "src/setupTests.ts", {
         contents: `import '@testing-library/jest-dom';
 `
       });
@@ -43881,7 +44300,7 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
 };
 
 // src/projects/starlight-project.ts
-var import_projen30 = require("projen");
+var import_projen33 = require("projen");
 var STARLIGHT_ROLE = {
   DOCS: "docs",
   SITE: "site"
@@ -43923,10 +44342,10 @@ var StarlightProject = class extends AstroProject {
       turbo.compileTask.inputs.push("src/content/**");
     }
     if (userOptions.sampleContent === true) {
-      new import_projen30.SampleFile(this, "src/content/docs/index.mdx", {
+      new import_projen33.SampleFile(this, "src/content/docs/index.mdx", {
         contents: DEFAULT_INDEX_MDX
       });
-      new import_projen30.SampleFile(this, "src/content.config.ts", {
+      new import_projen33.SampleFile(this, "src/content.config.ts", {
         contents: DEFAULT_CONTENT_CONFIG_TS
       });
     }
@@ -44009,6 +44428,7 @@ export const collections = {
   AUDIT_CATEGORY_ORDER,
   AgentConfig,
   ApiExtractor,
+  ApplyWorkflow,
   AstroConfig,
   AstroOutput,
   AstroProject,
@@ -44104,7 +44524,12 @@ export const collections = {
   DEFAULT_UNBLOCK_DEPENDENTS_ENABLED,
   DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED,
   DEPLOY_GATE,
+  DIFF_ARTIFACT_NAME,
+  DIFF_OUTPUT_DIRECTORY,
+  DIFF_PART_ARTIFACT_PREFIX,
+  DIFF_REPORT_JOB_ID,
   DOCS_SYNC_AUDIT_SCHEMA_VERSION,
+  DiffReportJob,
   GITHUB_ISSUE_TYPES,
   GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX,
   ISSUE_TEMPLATES_GENERATED_SUFFIX,
@@ -44163,6 +44588,7 @@ export const collections = {
   VERSION_NPM_PACKAGES,
   VSCodeConfig,
   Vitest,
+  WorkflowHomeRepository,
   addApproveMergeUpgradeWorkflow,
   addBuildCompleteJob,
   addPlaywright,
@@ -44283,6 +44709,7 @@ export const collections = {
   renderCheckLinksProcedure,
   renderCustomDocSectionBlock,
   renderCustomDocSections,
+  renderDiffPartUploadStep,
   renderExtractApiProcedure,
   renderFocusSection,
   renderGithubIssueTypeSection,
@@ -44314,6 +44741,8 @@ export const collections = {
   renderScopeGateSection,
   renderScopeGateShellHelpers,
   renderSetIssueTypeFallbackLines,
+  renderSetupNode,
+  renderSetupPnpm,
   renderSharedEditingBundleHook,
   renderSharedEditingHelperScript,
   renderSharedEditingRuleContent,