@codedrifters/configulator 0.0.463 → 0.0.465

package/lib/index.d.mts

@@ -13693,6 +13693,41 @@ declare const resolveApprovalGate: (gate: DeployGate | undefined, approvals: Dep
  * @returns The environment name, or `undefined` when no environment applies.
  */
 declare const resolveEnvironmentGate: (gate: DeployGate | undefined, environmentName: string | undefined, componentName: string) => string | undefined;
+/**
+ * Resolve whether the per-target `cdk diff` jobs carry the deploy
+ * environment, validating the pairing at synth time.
+ *
+ * The flag exists for one reason: a job's OIDC subject claim is
+ * `repo:<owner>/<repo>:environment:<name>` when the job declares an
+ * environment and `repo:<owner>/<repo>:ref:refs/heads/<branch>` when it does
+ * not. A deployer-role trust policy narrowed to environment subjects alone
+ * therefore rejects the diff jobs — the only cloud-touching jobs the
+ * {@link DEPLOY_GATE.ENVIRONMENT} gate leaves on the ref claim — and since the
+ * merged report gates every deploy, the whole run dies before anything
+ * deploys. Stamping the environment on the diff jobs puts them on the same
+ * subject as the deploys they inform.
+ *
+ * Mirrors {@link resolveEnvironmentGate} and {@link resolveApprovalGate}:
+ * every rejected combination renders a workflow whose diff jobs *look*
+ * environment-scoped and are not, and the symptom is a role-assumption failure
+ * at run time rather than an error at synth time.
+ *
+ * Outside {@link DEPLOY_GATE.ENVIRONMENT} there is no deploy environment to
+ * borrow. Under {@link DEPLOY_GATE.PLAN_APPLY} that is deliberate rather than
+ * incidental: the deploy jobs live in the apply workflow, so any
+ * `environmentName` belongs to *that* workflow, and the plan's diff is the
+ * review surface an operator reads before dispatching the apply. Holding it
+ * behind the apply's environment would make the review wait on the approval it
+ * exists to inform.
+ *
+ * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+ * @param gate - Gate model, or `undefined` to leave the workflow ungated.
+ * @param diffEnvironment - The `diff.environment` flag as the caller set it.
+ * @param diffEnabled - Resolved `diff.enabled`, so an inert flag is caught.
+ * @param componentName - Component name used in the thrown error message.
+ * @returns Whether the diff jobs carry the deploy environment.
+ */
+declare const resolveDiffEnvironment: (gate: DeployGate | undefined, diffEnvironment: boolean | undefined, diffEnabled: boolean, componentName: string) => boolean;
 
 /**
  * Job id of the apply workflow's validation job. Every apply job depends on
@@ -13835,6 +13870,30 @@ interface DeployDiffOptions {
      * @default true (when `enabled`)
      */
     readonly summary?: boolean;
+    /**
+     * Put the workflow's `environmentName` on each diff job, so it authenticates
+     * with the same OIDC subject claim as the deploy jobs it informs.
+     *
+     * A job's `sub` claim is `repo:<owner>/<repo>:environment:<name>` when the
+     * job declares an environment and `repo:<owner>/<repo>:ref:refs/heads/<branch>`
+     * when it does not. Under the `environment` gate the diff jobs are the only
+     * cloud-touching jobs left on the ref form, so a deployer-role trust policy
+     * narrowed to environment subjects alone rejects every one of them at the
+     * credentials step — and because the merged report gates the deploys, the run
+     * dies before anything deploys.
+     *
+     * Requires `gate: "environment"` and `enabled`; anything else fails synth.
+     *
+     * This does **not** gate the diff. An environment with no protection rules
+     * adds no prompt, which is what keeps the diff readable before the approval
+     * it exists to inform. A required-reviewer rule on the *deploy* environment
+     * would make every diff job prompt individually — put that rule on the
+     * separate `approvalEnvironmentName` under `approvals: "once"` instead.
+     *
+     * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+     * @default false
+     */
+    readonly environment?: boolean;
 }
 interface DeployWorkflowOptions {
     /**
@@ -13898,7 +13957,9 @@ interface DeployWorkflowOptions {
      * The `cdk diff` flags themselves are **not** configured here — they come
      * from the {@link CdkCli} precedence chain (per-stage built-in → per-stage
      * `diffDefaults` → per-account override → per-target `cdkOptions.diff`). This
-     * option only controls whether the jobs are emitted and what they publish.
+     * option only controls whether the jobs are emitted, what they publish, and —
+     * via {@link DeployDiffOptions.environment} — which OIDC subject claim they
+     * authenticate with.
      *
      * @default - no diff jobs are emitted, unless `gate` is `plan-apply`
      */
@@ -15560,6 +15621,10 @@ interface AwsCdkProjectOptions extends Omit<awscdk.AwsCdkTypeScriptAppOptions, "
      * `deployWorkflows[].diff` overrides it for that stage, matching the
      * `buildWorkflowOptions` precedence rule.
      *
+     * `environment` is not usable here: auto-derived workflows set no `gate`, so
+     * there is no environment for the diff jobs to borrow and the flag fails
+     * synth. Set it on the individual `deployWorkflows` entry that gates.
+     *
      * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
      * @default - no diff jobs are emitted
      */
@@ -16489,4 +16554,4 @@ declare function pinPnpmActionSetup(project: Project$1): void;
  */
 declare function pinSetupNodeVersion(project: Project$1): void;
 
-export { AGENT_MODEL, AGENT_PLATFORM, AGENT_REGISTRY_ENTRIES, AGENT_RULE_SCOPE, AGENT_TIER_ROLES, AGENT_TIER_VALUES, APPROVE_JOB_ID, AUDIT_CATEGORY_ORDER, type ActionItemFilingConfig, type ActivateBranchNameEnvVarOptions, type AddStorybookOptions, type AgentCommand, AgentConfig, type AgentConfigOptions, type AgentExpansionRules, type AgentFeaturesConfig, type AgentModel, type AgentPathsConfig, type AgentPlatform, type AgentPlatformOverrides, type AgentProcedure, type AgentRegistryEntry, type AgentRule, type AgentRuleBundle, type AgentRuleScope, type AgentSkill, type AgentSubAgent, type AgentSubAgentPlatformOverrides, type AgentTier, type AgentTierConfig, type AgentTierEntry, type AnalyzeTsDocCoverageOptions, type ApiDiffCheckOptions, type ApiDiffFinding, type ApiDiffResult, ApiExtractor, type ApiExtractorOptions, type ApiExtractorReportOptions, type ApiSurfaceEntry, ApplyWorkflow, type ApplyWorkflowAttachOptions, type ApplyWorkflowContract, type ApplyWorkflowOptions, type ApproveMergeUpgradeOptions, AstroConfig, type AstroConfigOptions, type AstroIntegrationSpec, AstroOutput, AstroProject, type AstroProjectOptions, AuditCategory, type AuditCheckRunner, type AuditCheckRunnerContext, type AuditFinding, type AuditFindingBase, type AuditLocation, AuditMode, type AuditReport, AuditSeverity, type AwsAccount, AwsCdkProject, type AwsCdkProjectOptions, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, type AwsDeploymentTargetOptions, type AwsLocalDeploymentConfig, type AwsOrganization, type AwsRegion, AwsTeardownWorkflow, type AwsTeardownWorkflowOptions, BUILD_ARTIFACT_NAME, BUILT_IN_BUNDLES, BUNDLE_OWNERSHIP, type BundleOwnership, CDK_BOOTSTRAP_DEFAULTS_BY_STAGE, CDK_DEPLOY_DEFAULTS_BY_STAGE, CDK_DEPLOY_METHOD, CDK_DESTROY_DEFAULTS_BY_STAGE, CDK_DIFF_DEFAULTS_BY_STAGE, CDK_DIFF_METHOD, CDK_GC_ACTION, CDK_GC_TYPE, CDK_INIT_LANGUAGE, CDK_INIT_PACKAGE_MANAGER, CDK_INIT_TEMPLATE, CDK_MIGRATE_FROM_SCAN, CDK_PROGRESS, CDK_REQUIRE_APPROVAL, CDK_SYNTH_DEFAULTS_BY_STAGE, CDK_WATCH_DEFAULTS_BY_STAGE, CLAUDE_RULE_TARGET, COMPLETE_JOB_ID, CONVENTIONAL_COMMIT_TYPE_LABELS, type CdkAcknowledgeOptions, type CdkBootstrapOptions, CdkCli, type CdkCliOptions, type CdkCliTelemetryOptions, type CdkContextOptions, type CdkDeployMethod, type CdkDeployOptions, type CdkDestroyOptions, type CdkDiagnoseOptions, type CdkDiffMethod, type CdkDiffOptions, type CdkDocsOptions, type CdkDoctorOptions, type CdkDriftOptions, type CdkFlagsOptions, type CdkGcAction, type CdkGcOptions, type CdkGcType, type CdkGlobalOptions, type CdkImportOptions, type CdkInitLanguage, type CdkInitOptions, type CdkInitPackageManager, type CdkInitTemplate, type CdkListOptions, type CdkLspOptions, type CdkMetadataOptions, type CdkMigrateFromScan, type CdkMigrateOptions, type CdkNoticesOptions, type CdkOrphanOptions, type CdkProgress, type CdkPublishAssetsOptions, type CdkRefactorOptions, type CdkRequireApproval, type CdkRollbackOptions, type CdkSynthOptions, type CdkTargetOverrides, type CdkValidateOptions, type CdkWatchOptions, type CiDeploymentConfig, type ClassTypeOptions, type ClaudeAutoModeConfig, type ClaudeHookAction, type ClaudeHookEntry, type ClaudeHooksConfig, type ClaudeMdConfig, type ClaudePermissionsConfig, type ClaudeRuleTarget, type ClaudeSandboxConfig, type ClaudeSettingsConfig, type CompileFencedSamplesOptions, type CopilotHandoff, type CursorHookAction, type CursorHooksConfig, type CursorSettingsConfig, type CustomDocSection, DEFAULT_AC_THRESHOLDS, DEFAULT_AGENT_PATHS, DEFAULT_AGENT_TIERS, DEFAULT_API_EXTRACTOR_CONFIG_FILE, DEFAULT_API_EXTRACTOR_ENTRY_POINT, DEFAULT_API_EXTRACTOR_REPORT_FILENAME, DEFAULT_API_EXTRACTOR_REPORT_FOLDER, DEFAULT_AUDIT_REPORT_DIR, DEFAULT_BASE_CONVENTIONS, DEFAULT_BUILD_POLICY, DEFAULT_BUNDLE_OVERRIDES, DEFAULT_DECOMPOSITION_TEMPLATE, DEFAULT_DISPATCH_MODEL, DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO, DEFAULT_GITHUB_ISSUE_TYPE, DEFAULT_HOUSEKEEPING_MODEL, DEFAULT_ISSUE_PRIORITY, DEFAULT_ISSUE_STATUS, DEFAULT_ISSUE_TEMPLATES_BUNDLE_PATH_PATTERNS, DEFAULT_ISSUE_TEMPLATES_EMIT_CHECKER, DEFAULT_ISSUE_TEMPLATES_EMIT_STARTER, DEFAULT_ISSUE_TEMPLATES_ENABLED, DEFAULT_ISSUE_TEMPLATES_PATH, DEFAULT_ISSUE_TEMPLATES_REQUIRE_REFERENCE, DEFAULT_OFF_PEAK_CRON_EXAMPLE, DEFAULT_ORCHESTRATOR_CONVENTIONS, DEFAULT_PARTIAL_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_PATHS_EXEMPT_FROM_SIZE, DEFAULT_PRIORITY_LABELS, DEFAULT_PRODUCT_CONTEXT_PATH, DEFAULT_PROGRESS_FILES_ENABLED, DEFAULT_PROGRESS_FILES_FILENAME_PATTERN, DEFAULT_PROGRESS_FILES_FORMAT, DEFAULT_PROGRESS_FILES_STALE_AFTER_HOURS, DEFAULT_PROGRESS_FILES_STATE_DIR, DEFAULT_REQUIREMENT_CATEGORY_DIRS, DEFAULT_REQUIRE_PRODUCT_CONTEXT, DEFAULT_RESOLVED_ISSUE_DEFAULTS, DEFAULT_RULE_CONVENTIONS, DEFAULT_SAMPLE_COMPILER_OPTIONS, DEFAULT_SCHEDULED_TASKS_ROOT, DEFAULT_SCHEDULED_TASK_ENTRIES, DEFAULT_SHARED_EDITING_CONFLICT_STRATEGY, DEFAULT_SHARED_EDITING_EMIT_HELPER, DEFAULT_SHARED_EDITING_ENABLED, DEFAULT_SHARED_EDITING_VERIFY_COMMIT, DEFAULT_SHARED_INDEX_PATHS, DEFAULT_SKILL_EVALS_EMIT_RUNNER, DEFAULT_SKILL_EVALS_ENABLED, DEFAULT_SKILL_EVALS_SKILLS_ROOT, DEFAULT_SOURCES_THRESHOLDS, DEFAULT_STATE_FILE_PATH, DEFAULT_STATUS_LABELS, DEFAULT_TEARDOWN_BRANCH_PATTERNS, DEFAULT_TEMPORAL_FRAMING_CADENCES, DEFAULT_TEMPORAL_FRAMING_EMIT_CHECKER, DEFAULT_TEMPORAL_FRAMING_ENABLED, DEFAULT_TEMPORAL_FRAMING_PATHS, DEFAULT_TYPE_LABELS, DEFAULT_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_UNBLOCK_DEPENDENTS_ENABLED, DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED, DEPLOY_APPROVALS, DEPLOY_GATE, DIFF_ARTIFACT_NAME, DIFF_NEW_STACK_MARKER, DIFF_OUTPUT_DIRECTORY, DIFF_PART_ARTIFACT_PREFIX, DIFF_REPORT_JOB_ID, DOCS_SYNC_AUDIT_SCHEMA_VERSION, type DeployApprovals, type DeployDiffOptions, type DeployGate, type DeployWorkflowOptions, type DeploymentMetadata, DiffReportJob, type DiffReportJobAttachOptions, type DiffReportTarget, type DocReferenceRecord, type EffectiveScopeThresholds, type ExtractDocReferencesOptions, type ExtractFencedSamplesOptions, type FencedSampleRecord, type FocusArea, type FocusAreaMatch, type FocusConfig, GITHUB_ISSUE_TYPES, GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX, GIT_BRANCH_NAME_ENV, GIT_BRANCH_NAME_ENV_VALUE, type GitBranch, type GitHubBoardMetadata, type GitHubProjectMetadata, type GitHubSprintMetadata, type GithubIssueType, type IDependencyResolver, ISSUE_TEMPLATES_GENERATED_SUFFIX, type IssueDefaultsConfig, type IssueDefaultsOverride, type IssueDefaultsPriority, type IssueDefaultsStatus, type IssueTemplateRecipeStub, type IssueTemplatesConfig, type IssueTypeAssignmentStepOptions, JsiiFaker, LAYOUT_ENFORCEMENT, LAYOUT_ROOT_BY_PROJECT_TYPE, type LabelDefinition, type LayoutEnforcement, type LayoutViolation, type LinkFailureFinding, MAX_LABEL_DESCRIPTION_LENGTH, MCP_TRANSPORT, MERGE_METHODS, MIMIMUM_RELEASE_AGE, MINIMUM_RELEASE_AGE, MONOREPO_LAYOUT, type McpServerConfig, type McpTransport, type MeetingArea, type MeetingScope, type MeetingType, type MeetingTypeKind, type MeetingsConfig, type MergeMethod, type MonorepoLayoutRoot, type MonorepoPnpmOptions, MonorepoProject, type MonorepoProjectOptions, Nvmrc, type OrganizationMetadata, PERMISSION_BACKUP_FILE, PHASE_LABEL_TYPE_MAP, PLAN_RUN_ID_INPUT, PROD_DEPLOY_NAME, PROGRESS_FILES_FORMAT_VALUES, type PhaseLabelTypeOutcome, type PhaseLabelTypeResolution, type PlanApplyOptions, type PlanValidationScriptOptions, type PnpmCuratedSettingKey, type PnpmPeerDependencyRules, type PnpmSupportedArchitectures, type PnpmUpdateConfigSettings, type PnpmUpdateSettings, PnpmWorkspace, type PnpmWorkspaceOptions, type PrReviewAutoMergeConfig, type PrReviewCiVerificationConfig, type PrReviewPolicyConfig, type PriorityRule, type ProgressFilesConfig, ProjectMetadata, type ProjectMetadataOptions, REQUIREMENTS_WRITER_PATHS, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ReactViteSiteProject, type ReactViteSiteProjectOptions, type ReferenceMismatchCheckOptions, type ReferenceMismatchFinding, type RemoteCacheOptions, type RepositoryMetadata, type RequirementBlockFields, type RequirementCategoryDirsConfig, RequirementIssueTemplate, type RequirementIssueTemplateOptions, ResetTask, type ResetTaskOptions, type ResolvedAgentPaths, type ResolvedAgentTier, type ResolvedBaseConventions, type ResolvedBuildPolicy, type ResolvedIssueDefaults, type ResolvedIssueDefaultsEntry, type ResolvedIssueTemplates, type ResolvedOrchestratorConventions, type ResolvedPrReviewAutoMerge, type ResolvedPrReviewPolicy, type ResolvedProgressFiles, type ResolvedProjectMetadata, type ResolvedRequirementCategoryDirs, type ResolvedRuleConventions, type ResolvedRunRatio, type ResolvedScheduledTask, type ResolvedScheduledTasks, type ResolvedScopeGate, type ResolvedScopeGateBundleOverride, type ResolvedSharedEditing, type ResolvedSkillEvals, type ResolvedTemporalFraming, type ResolvedUnblockDependents, type RunRatioConfig, type RunScanOptions, type RunScanResult, SCHEDULED_TASK_MODEL_VALUES, SCOPE_CLASS_VALUES, SET_ISSUE_TYPE_HELPER_PATH, SHARED_EDITING_CONFLICT_STRATEGY_VALUES, STARLIGHT_ROLE, SUPPRESSED_WORKFLOW_RULE_NAMES, type SampleCompilationFailure, type SampleFailureFinding, SampleLang, type ScheduledTaskEntry, type ScheduledTaskModel, type ScheduledTaskOverride, type ScheduledTasksConfig, type ScopeClass, type ScopeGateBundleOverride, type ScopeGateConfig, type ScopeGateThresholds, type SharedEditingConfig, type SkillEvalsConfig, type SlackMetadata, type SourceTierExamples, type StarlightEditLink, type StarlightLogo, StarlightProject, type StarlightProjectOptions, type StarlightRole, type StarlightSidebarItem, type StarlightSingletonViolation, type StarlightSocialLink, type SyncLabelsOptions, TEMPORAL_FRAMING_CATEGORY_VALUES, TURBO_RUN_CONTINUE, TURBO_RUN_DRY_RUN, TURBO_RUN_LOG_ORDER, TURBO_RUN_LOG_PREFIX, TURBO_RUN_OUTPUT_LOGS, type TemplateResolveResult, type TemporalFramingCategory, type TemporalFramingConfig, TestRunner, TsDocCoverageKind, type TsDocCoverageRecord, TsdocConfig, type TsdocConfigOptions, type TsdocCoverageCheckOptions, type TsdocCoverageFinding, TurboRepo, type TurboRepoOptions, TurboRepoTask, type TurboRepoTaskOptions, type TurboRunContinue, type TurboRunDryRun, type TurboRunLogOrder, type TurboRunLogPrefix, type TurboRunOptions, type TurboRunOutputLogs, TypeScriptConfig, TypeScriptProject, type TypeScriptProjectOptions, UNKNOWN_TYPE_FALLBACK_TIER, type UnblockDependentsConfig, type UpstreamConfigulatorConfig, VALIDATE_PLAN_JOB_ID, VALID_PRIORITY_VALUES, VALID_STATUS_VALUES, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, type VersionKey, Vitest, type VitestConfigOptions, type VitestOptions, WorkflowHomeRepository, type WorkflowHomeRepositoryOptions, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, addPlaywright, addStorybook, addSyncLabelsWorkflow, agendaBundle, analyzeTsDocCoverage, auditReportJsonSchema, awsCdkBundle, baseBundle, bcmWriterBundle, buildAgentRegistryRule, buildBaseBundle, buildBcmWriterBundle, buildBuiltInBundles, buildBusinessModelsBundle, buildCheckBlockedProcedure, buildCompanyProfileBundle, buildCustomerProfileBundle, buildDocsSyncBundle, buildGithubWorkflowBundle, buildIndustryDiscoveryBundle, buildMaintenanceAuditBundle, buildMeetingAnalysisBundle, buildOrchestratorBundle, buildOrchestratorConventionsContent, buildPeopleProfileBundle, buildPrReviewBundle, buildRegulatoryResearchBundle, buildReport, buildRequirementsAnalystBundle, buildRequirementsReviewerBundle, buildRequirementsWriterBundle, buildResearchPipelineBundle, buildSoftwareProfileBundle, buildStandardsResearchBundle, buildTurborepoBundle, buildUnblockDependentsProcedure, bundleNameForWorkflowRule, businessModelsBundle, checkClosingKeywordsProcedure, checkDocSamplesProcedure, checkLinksProcedure, classifyIssueScope, classifyRun, collectIssueTemplateRecipeStubs, companyProfileBundle, compileFencedSamples, createApiDiffCheck, createReferenceMismatchCheck, createTsdocCoverageCheck, customerProfileBundle, diffApiRollups, docsSyncBundle, emptyCategoryBuckets, extractApiProcedure, extractDocReferences, extractFencedSamples, formatLayoutViolation, formatStarlightSingletonViolation, getLatestEligibleVersion, githubIssueTypeForTitle, githubWorkflowBundle, hasAnyDocsEmittingBundle, hasAnyDownstreamIssueKindBundle, includeHiddenFilesInBuildArtifact, industryDiscoveryBundle, isPhaseLabelOwnedByExcluded, isScheduledTaskOwnedByExcluded, isSuppressedWorkflowRule, isTypeLabelOwnedByExcluded, issueTemplatesChildGlob, issueTemplatesGeneratedPath, jestBundle, labelsForPhase, maintenanceAuditBundle, meetingAnalysisBundle, mergeCdkOptions, nextRequirementIdProcedure, orchestratorBundle, parseApiRollup, peopleProfileBundle, persistAuditReport, pinPnpmActionSetup, pinSetupNodeVersion, pnpmBundle, prReviewBundle, projenBundle, referenceRecordToFinding, regulatoryResearchBundle, renderAgentTierCaseStatement, renderAgentTierSection, renderCdkAcknowledge, renderCdkBootstrap, renderCdkCliTelemetry, renderCdkContext, renderCdkDeploy, renderCdkDestroy, renderCdkDiagnose, renderCdkDiff, renderCdkDocs, renderCdkDoctor, renderCdkDrift, renderCdkFlags, renderCdkGc, renderCdkImport, renderCdkInit, renderCdkList, renderCdkLsp, renderCdkMetadata, renderCdkMigrate, renderCdkNotices, renderCdkOrphan, renderCdkPublishAssets, renderCdkRefactor, renderCdkRollback, renderCdkSynth, renderCdkValidate, renderCdkWatch, renderCheckClosingKeywordsScript, renderCheckDocSamplesProcedure, renderCheckLinksProcedure, renderCustomDocSectionBlock, renderCustomDocSections, renderDiffPartUploadStep, renderExtractApiProcedure, renderFocusSection, renderGithubIssueTypeSection, renderGithubIssueTypeSectionLines, renderHomeRepositoryCondition, renderIssueTemplateLabelsCheckerScript, renderIssueTemplatesBundleHook, renderIssueTemplatesCheckerScript, renderIssueTemplatesGeneratedPage, renderIssueTemplatesRuleContent, renderIssueTemplatesStarterPage, renderIssueTypeAssignmentBlanket, renderIssueTypeAssignmentStep, renderMeetingTypesSection, renderNextRequirementIdProcedure, renderPhaseTypeInvariantSection, renderPhaseTypeInvariantShellHelpers, renderPlanValidationScript, renderPriorityRulesSection, renderProgressFileName, renderProgressFilePath, renderProgressFilesBundleHook, renderProgressFilesRuleContent, renderRequirementBlock, renderRunRatioSection, renderRunRatioShellHelpers, renderScheduledTaskSkillFile, renderScheduledTasksSection, renderScopeGateSection, renderScopeGateShellHelpers, renderSetIssueTypeFallbackLines, renderSetupNode, renderSetupPnpm, renderSharedEditingBundleHook, renderSharedEditingHelperScript, renderSharedEditingRuleContent, renderSkillEvalsBundleHook, renderSkillEvalsRuleContent, renderSkillEvalsRunnerScript, renderSourceTierExamples, renderStripToolArtifactTagsProcedure, renderTemporalFramingCheckerScript, renderTemporalFramingRuleContent, renderTitlePrefixTypeBullets, renderUnblockDependentsScript, renderUnblockDependentsSection, requirementsAnalystBundle, requirementsReviewerBundle, requirementsWriterBundle, researchPipelineBundle, resolveAgentPaths, resolveAgentTiers, resolveApprovalGate, resolveAstroProjectOutdir, resolveAwsCdkProjectOutdir, resolveBuildPolicy, resolveEnvironmentGate, resolveIssueDefaults, resolveIssueTemplates, resolveModelAlias, resolveOrchestratorAssets, resolveOutdirFromPackageName, resolveOverrideForLabels, resolvePrReviewPolicy, resolveProgressFiles, resolveReactViteSiteProjectOutdir, resolveRunRatio, resolveScheduledTasks, resolveScopeGate, resolveSharedEditing, resolveSkillEvals, resolveTemplateVariables, resolveTemporalFraming, resolveTypeLabelForLabels, resolveTypeScriptProjectOutdir, resolveUnblockDependents, runScan, slackBundle, softwareProfileBundle, standardsResearchBundle, stripToolArtifactTagsProcedure, tsdocRecordToFindings, turborepoBundle, typeLabelForPhaseLabel, typescriptBundle, upstreamConfigulatorDocsBundle, validateAgentTierConfig, validateIssueDefaultsConfig, validateIssueTemplatesConfig, validateMonorepoLayout, validatePrReviewPolicyConfig, validateProgressFilesConfig, validateRunRatioConfig, validateScheduledTasksConfig, validateScopeGateConfig, validateSharedEditingConfig, validateSkillEvalsConfig, validateStarlightSingleton, validateTemporalFramingConfig, validateUnblockDependentsConfig, vitestBundle };
+export { AGENT_MODEL, AGENT_PLATFORM, AGENT_REGISTRY_ENTRIES, AGENT_RULE_SCOPE, AGENT_TIER_ROLES, AGENT_TIER_VALUES, APPROVE_JOB_ID, AUDIT_CATEGORY_ORDER, type ActionItemFilingConfig, type ActivateBranchNameEnvVarOptions, type AddStorybookOptions, type AgentCommand, AgentConfig, type AgentConfigOptions, type AgentExpansionRules, type AgentFeaturesConfig, type AgentModel, type AgentPathsConfig, type AgentPlatform, type AgentPlatformOverrides, type AgentProcedure, type AgentRegistryEntry, type AgentRule, type AgentRuleBundle, type AgentRuleScope, type AgentSkill, type AgentSubAgent, type AgentSubAgentPlatformOverrides, type AgentTier, type AgentTierConfig, type AgentTierEntry, type AnalyzeTsDocCoverageOptions, type ApiDiffCheckOptions, type ApiDiffFinding, type ApiDiffResult, ApiExtractor, type ApiExtractorOptions, type ApiExtractorReportOptions, type ApiSurfaceEntry, ApplyWorkflow, type ApplyWorkflowAttachOptions, type ApplyWorkflowContract, type ApplyWorkflowOptions, type ApproveMergeUpgradeOptions, AstroConfig, type AstroConfigOptions, type AstroIntegrationSpec, AstroOutput, AstroProject, type AstroProjectOptions, AuditCategory, type AuditCheckRunner, type AuditCheckRunnerContext, type AuditFinding, type AuditFindingBase, type AuditLocation, AuditMode, type AuditReport, AuditSeverity, type AwsAccount, AwsCdkProject, type AwsCdkProjectOptions, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, type AwsDeploymentTargetOptions, type AwsLocalDeploymentConfig, type AwsOrganization, type AwsRegion, AwsTeardownWorkflow, type AwsTeardownWorkflowOptions, BUILD_ARTIFACT_NAME, BUILT_IN_BUNDLES, BUNDLE_OWNERSHIP, type BundleOwnership, CDK_BOOTSTRAP_DEFAULTS_BY_STAGE, CDK_DEPLOY_DEFAULTS_BY_STAGE, CDK_DEPLOY_METHOD, CDK_DESTROY_DEFAULTS_BY_STAGE, CDK_DIFF_DEFAULTS_BY_STAGE, CDK_DIFF_METHOD, CDK_GC_ACTION, CDK_GC_TYPE, CDK_INIT_LANGUAGE, CDK_INIT_PACKAGE_MANAGER, CDK_INIT_TEMPLATE, CDK_MIGRATE_FROM_SCAN, CDK_PROGRESS, CDK_REQUIRE_APPROVAL, CDK_SYNTH_DEFAULTS_BY_STAGE, CDK_WATCH_DEFAULTS_BY_STAGE, CLAUDE_RULE_TARGET, COMPLETE_JOB_ID, CONVENTIONAL_COMMIT_TYPE_LABELS, type CdkAcknowledgeOptions, type CdkBootstrapOptions, CdkCli, type CdkCliOptions, type CdkCliTelemetryOptions, type CdkContextOptions, type CdkDeployMethod, type CdkDeployOptions, type CdkDestroyOptions, type CdkDiagnoseOptions, type CdkDiffMethod, type CdkDiffOptions, type CdkDocsOptions, type CdkDoctorOptions, type CdkDriftOptions, type CdkFlagsOptions, type CdkGcAction, type CdkGcOptions, type CdkGcType, type CdkGlobalOptions, type CdkImportOptions, type CdkInitLanguage, type CdkInitOptions, type CdkInitPackageManager, type CdkInitTemplate, type CdkListOptions, type CdkLspOptions, type CdkMetadataOptions, type CdkMigrateFromScan, type CdkMigrateOptions, type CdkNoticesOptions, type CdkOrphanOptions, type CdkProgress, type CdkPublishAssetsOptions, type CdkRefactorOptions, type CdkRequireApproval, type CdkRollbackOptions, type CdkSynthOptions, type CdkTargetOverrides, type CdkValidateOptions, type CdkWatchOptions, type CiDeploymentConfig, type ClassTypeOptions, type ClaudeAutoModeConfig, type ClaudeHookAction, type ClaudeHookEntry, type ClaudeHooksConfig, type ClaudeMdConfig, type ClaudePermissionsConfig, type ClaudeRuleTarget, type ClaudeSandboxConfig, type ClaudeSettingsConfig, type CompileFencedSamplesOptions, type CopilotHandoff, type CursorHookAction, type CursorHooksConfig, type CursorSettingsConfig, type CustomDocSection, DEFAULT_AC_THRESHOLDS, DEFAULT_AGENT_PATHS, DEFAULT_AGENT_TIERS, DEFAULT_API_EXTRACTOR_CONFIG_FILE, DEFAULT_API_EXTRACTOR_ENTRY_POINT, DEFAULT_API_EXTRACTOR_REPORT_FILENAME, DEFAULT_API_EXTRACTOR_REPORT_FOLDER, DEFAULT_AUDIT_REPORT_DIR, DEFAULT_BASE_CONVENTIONS, DEFAULT_BUILD_POLICY, DEFAULT_BUNDLE_OVERRIDES, DEFAULT_DECOMPOSITION_TEMPLATE, DEFAULT_DISPATCH_MODEL, DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO, DEFAULT_GITHUB_ISSUE_TYPE, DEFAULT_HOUSEKEEPING_MODEL, DEFAULT_ISSUE_PRIORITY, DEFAULT_ISSUE_STATUS, DEFAULT_ISSUE_TEMPLATES_BUNDLE_PATH_PATTERNS, DEFAULT_ISSUE_TEMPLATES_EMIT_CHECKER, DEFAULT_ISSUE_TEMPLATES_EMIT_STARTER, DEFAULT_ISSUE_TEMPLATES_ENABLED, DEFAULT_ISSUE_TEMPLATES_PATH, DEFAULT_ISSUE_TEMPLATES_REQUIRE_REFERENCE, DEFAULT_OFF_PEAK_CRON_EXAMPLE, DEFAULT_ORCHESTRATOR_CONVENTIONS, DEFAULT_PARTIAL_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_PATHS_EXEMPT_FROM_SIZE, DEFAULT_PRIORITY_LABELS, DEFAULT_PRODUCT_CONTEXT_PATH, DEFAULT_PROGRESS_FILES_ENABLED, DEFAULT_PROGRESS_FILES_FILENAME_PATTERN, DEFAULT_PROGRESS_FILES_FORMAT, DEFAULT_PROGRESS_FILES_STALE_AFTER_HOURS, DEFAULT_PROGRESS_FILES_STATE_DIR, DEFAULT_REQUIREMENT_CATEGORY_DIRS, DEFAULT_REQUIRE_PRODUCT_CONTEXT, DEFAULT_RESOLVED_ISSUE_DEFAULTS, DEFAULT_RULE_CONVENTIONS, DEFAULT_SAMPLE_COMPILER_OPTIONS, DEFAULT_SCHEDULED_TASKS_ROOT, DEFAULT_SCHEDULED_TASK_ENTRIES, DEFAULT_SHARED_EDITING_CONFLICT_STRATEGY, DEFAULT_SHARED_EDITING_EMIT_HELPER, DEFAULT_SHARED_EDITING_ENABLED, DEFAULT_SHARED_EDITING_VERIFY_COMMIT, DEFAULT_SHARED_INDEX_PATHS, DEFAULT_SKILL_EVALS_EMIT_RUNNER, DEFAULT_SKILL_EVALS_ENABLED, DEFAULT_SKILL_EVALS_SKILLS_ROOT, DEFAULT_SOURCES_THRESHOLDS, DEFAULT_STATE_FILE_PATH, DEFAULT_STATUS_LABELS, DEFAULT_TEARDOWN_BRANCH_PATTERNS, DEFAULT_TEMPORAL_FRAMING_CADENCES, DEFAULT_TEMPORAL_FRAMING_EMIT_CHECKER, DEFAULT_TEMPORAL_FRAMING_ENABLED, DEFAULT_TEMPORAL_FRAMING_PATHS, DEFAULT_TYPE_LABELS, DEFAULT_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_UNBLOCK_DEPENDENTS_ENABLED, DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED, DEPLOY_APPROVALS, DEPLOY_GATE, DIFF_ARTIFACT_NAME, DIFF_NEW_STACK_MARKER, DIFF_OUTPUT_DIRECTORY, DIFF_PART_ARTIFACT_PREFIX, DIFF_REPORT_JOB_ID, DOCS_SYNC_AUDIT_SCHEMA_VERSION, type DeployApprovals, type DeployDiffOptions, type DeployGate, type DeployWorkflowOptions, type DeploymentMetadata, DiffReportJob, type DiffReportJobAttachOptions, type DiffReportTarget, type DocReferenceRecord, type EffectiveScopeThresholds, type ExtractDocReferencesOptions, type ExtractFencedSamplesOptions, type FencedSampleRecord, type FocusArea, type FocusAreaMatch, type FocusConfig, GITHUB_ISSUE_TYPES, GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX, GIT_BRANCH_NAME_ENV, GIT_BRANCH_NAME_ENV_VALUE, type GitBranch, type GitHubBoardMetadata, type GitHubProjectMetadata, type GitHubSprintMetadata, type GithubIssueType, type IDependencyResolver, ISSUE_TEMPLATES_GENERATED_SUFFIX, type IssueDefaultsConfig, type IssueDefaultsOverride, type IssueDefaultsPriority, type IssueDefaultsStatus, type IssueTemplateRecipeStub, type IssueTemplatesConfig, type IssueTypeAssignmentStepOptions, JsiiFaker, LAYOUT_ENFORCEMENT, LAYOUT_ROOT_BY_PROJECT_TYPE, type LabelDefinition, type LayoutEnforcement, type LayoutViolation, type LinkFailureFinding, MAX_LABEL_DESCRIPTION_LENGTH, MCP_TRANSPORT, MERGE_METHODS, MIMIMUM_RELEASE_AGE, MINIMUM_RELEASE_AGE, MONOREPO_LAYOUT, type McpServerConfig, type McpTransport, type MeetingArea, type MeetingScope, type MeetingType, type MeetingTypeKind, type MeetingsConfig, type MergeMethod, type MonorepoLayoutRoot, type MonorepoPnpmOptions, MonorepoProject, type MonorepoProjectOptions, Nvmrc, type OrganizationMetadata, PERMISSION_BACKUP_FILE, PHASE_LABEL_TYPE_MAP, PLAN_RUN_ID_INPUT, PROD_DEPLOY_NAME, PROGRESS_FILES_FORMAT_VALUES, type PhaseLabelTypeOutcome, type PhaseLabelTypeResolution, type PlanApplyOptions, type PlanValidationScriptOptions, type PnpmCuratedSettingKey, type PnpmPeerDependencyRules, type PnpmSupportedArchitectures, type PnpmUpdateConfigSettings, type PnpmUpdateSettings, PnpmWorkspace, type PnpmWorkspaceOptions, type PrReviewAutoMergeConfig, type PrReviewCiVerificationConfig, type PrReviewPolicyConfig, type PriorityRule, type ProgressFilesConfig, ProjectMetadata, type ProjectMetadataOptions, REQUIREMENTS_WRITER_PATHS, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ReactViteSiteProject, type ReactViteSiteProjectOptions, type ReferenceMismatchCheckOptions, type ReferenceMismatchFinding, type RemoteCacheOptions, type RepositoryMetadata, type RequirementBlockFields, type RequirementCategoryDirsConfig, RequirementIssueTemplate, type RequirementIssueTemplateOptions, ResetTask, type ResetTaskOptions, type ResolvedAgentPaths, type ResolvedAgentTier, type ResolvedBaseConventions, type ResolvedBuildPolicy, type ResolvedIssueDefaults, type ResolvedIssueDefaultsEntry, type ResolvedIssueTemplates, type ResolvedOrchestratorConventions, type ResolvedPrReviewAutoMerge, type ResolvedPrReviewPolicy, type ResolvedProgressFiles, type ResolvedProjectMetadata, type ResolvedRequirementCategoryDirs, type ResolvedRuleConventions, type ResolvedRunRatio, type ResolvedScheduledTask, type ResolvedScheduledTasks, type ResolvedScopeGate, type ResolvedScopeGateBundleOverride, type ResolvedSharedEditing, type ResolvedSkillEvals, type ResolvedTemporalFraming, type ResolvedUnblockDependents, type RunRatioConfig, type RunScanOptions, type RunScanResult, SCHEDULED_TASK_MODEL_VALUES, SCOPE_CLASS_VALUES, SET_ISSUE_TYPE_HELPER_PATH, SHARED_EDITING_CONFLICT_STRATEGY_VALUES, STARLIGHT_ROLE, SUPPRESSED_WORKFLOW_RULE_NAMES, type SampleCompilationFailure, type SampleFailureFinding, SampleLang, type ScheduledTaskEntry, type ScheduledTaskModel, type ScheduledTaskOverride, type ScheduledTasksConfig, type ScopeClass, type ScopeGateBundleOverride, type ScopeGateConfig, type ScopeGateThresholds, type SharedEditingConfig, type SkillEvalsConfig, type SlackMetadata, type SourceTierExamples, type StarlightEditLink, type StarlightLogo, StarlightProject, type StarlightProjectOptions, type StarlightRole, type StarlightSidebarItem, type StarlightSingletonViolation, type StarlightSocialLink, type SyncLabelsOptions, TEMPORAL_FRAMING_CATEGORY_VALUES, TURBO_RUN_CONTINUE, TURBO_RUN_DRY_RUN, TURBO_RUN_LOG_ORDER, TURBO_RUN_LOG_PREFIX, TURBO_RUN_OUTPUT_LOGS, type TemplateResolveResult, type TemporalFramingCategory, type TemporalFramingConfig, TestRunner, TsDocCoverageKind, type TsDocCoverageRecord, TsdocConfig, type TsdocConfigOptions, type TsdocCoverageCheckOptions, type TsdocCoverageFinding, TurboRepo, type TurboRepoOptions, TurboRepoTask, type TurboRepoTaskOptions, type TurboRunContinue, type TurboRunDryRun, type TurboRunLogOrder, type TurboRunLogPrefix, type TurboRunOptions, type TurboRunOutputLogs, TypeScriptConfig, TypeScriptProject, type TypeScriptProjectOptions, UNKNOWN_TYPE_FALLBACK_TIER, type UnblockDependentsConfig, type UpstreamConfigulatorConfig, VALIDATE_PLAN_JOB_ID, VALID_PRIORITY_VALUES, VALID_STATUS_VALUES, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, type VersionKey, Vitest, type VitestConfigOptions, type VitestOptions, WorkflowHomeRepository, type WorkflowHomeRepositoryOptions, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, addPlaywright, addStorybook, addSyncLabelsWorkflow, agendaBundle, analyzeTsDocCoverage, auditReportJsonSchema, awsCdkBundle, baseBundle, bcmWriterBundle, buildAgentRegistryRule, buildBaseBundle, buildBcmWriterBundle, buildBuiltInBundles, buildBusinessModelsBundle, buildCheckBlockedProcedure, buildCompanyProfileBundle, buildCustomerProfileBundle, buildDocsSyncBundle, buildGithubWorkflowBundle, buildIndustryDiscoveryBundle, buildMaintenanceAuditBundle, buildMeetingAnalysisBundle, buildOrchestratorBundle, buildOrchestratorConventionsContent, buildPeopleProfileBundle, buildPrReviewBundle, buildRegulatoryResearchBundle, buildReport, buildRequirementsAnalystBundle, buildRequirementsReviewerBundle, buildRequirementsWriterBundle, buildResearchPipelineBundle, buildSoftwareProfileBundle, buildStandardsResearchBundle, buildTurborepoBundle, buildUnblockDependentsProcedure, bundleNameForWorkflowRule, businessModelsBundle, checkClosingKeywordsProcedure, checkDocSamplesProcedure, checkLinksProcedure, classifyIssueScope, classifyRun, collectIssueTemplateRecipeStubs, companyProfileBundle, compileFencedSamples, createApiDiffCheck, createReferenceMismatchCheck, createTsdocCoverageCheck, customerProfileBundle, diffApiRollups, docsSyncBundle, emptyCategoryBuckets, extractApiProcedure, extractDocReferences, extractFencedSamples, formatLayoutViolation, formatStarlightSingletonViolation, getLatestEligibleVersion, githubIssueTypeForTitle, githubWorkflowBundle, hasAnyDocsEmittingBundle, hasAnyDownstreamIssueKindBundle, includeHiddenFilesInBuildArtifact, industryDiscoveryBundle, isPhaseLabelOwnedByExcluded, isScheduledTaskOwnedByExcluded, isSuppressedWorkflowRule, isTypeLabelOwnedByExcluded, issueTemplatesChildGlob, issueTemplatesGeneratedPath, jestBundle, labelsForPhase, maintenanceAuditBundle, meetingAnalysisBundle, mergeCdkOptions, nextRequirementIdProcedure, orchestratorBundle, parseApiRollup, peopleProfileBundle, persistAuditReport, pinPnpmActionSetup, pinSetupNodeVersion, pnpmBundle, prReviewBundle, projenBundle, referenceRecordToFinding, regulatoryResearchBundle, renderAgentTierCaseStatement, renderAgentTierSection, renderCdkAcknowledge, renderCdkBootstrap, renderCdkCliTelemetry, renderCdkContext, renderCdkDeploy, renderCdkDestroy, renderCdkDiagnose, renderCdkDiff, renderCdkDocs, renderCdkDoctor, renderCdkDrift, renderCdkFlags, renderCdkGc, renderCdkImport, renderCdkInit, renderCdkList, renderCdkLsp, renderCdkMetadata, renderCdkMigrate, renderCdkNotices, renderCdkOrphan, renderCdkPublishAssets, renderCdkRefactor, renderCdkRollback, renderCdkSynth, renderCdkValidate, renderCdkWatch, renderCheckClosingKeywordsScript, renderCheckDocSamplesProcedure, renderCheckLinksProcedure, renderCustomDocSectionBlock, renderCustomDocSections, renderDiffPartUploadStep, renderExtractApiProcedure, renderFocusSection, renderGithubIssueTypeSection, renderGithubIssueTypeSectionLines, renderHomeRepositoryCondition, renderIssueTemplateLabelsCheckerScript, renderIssueTemplatesBundleHook, renderIssueTemplatesCheckerScript, renderIssueTemplatesGeneratedPage, renderIssueTemplatesRuleContent, renderIssueTemplatesStarterPage, renderIssueTypeAssignmentBlanket, renderIssueTypeAssignmentStep, renderMeetingTypesSection, renderNextRequirementIdProcedure, renderPhaseTypeInvariantSection, renderPhaseTypeInvariantShellHelpers, renderPlanValidationScript, renderPriorityRulesSection, renderProgressFileName, renderProgressFilePath, renderProgressFilesBundleHook, renderProgressFilesRuleContent, renderRequirementBlock, renderRunRatioSection, renderRunRatioShellHelpers, renderScheduledTaskSkillFile, renderScheduledTasksSection, renderScopeGateSection, renderScopeGateShellHelpers, renderSetIssueTypeFallbackLines, renderSetupNode, renderSetupPnpm, renderSharedEditingBundleHook, renderSharedEditingHelperScript, renderSharedEditingRuleContent, renderSkillEvalsBundleHook, renderSkillEvalsRuleContent, renderSkillEvalsRunnerScript, renderSourceTierExamples, renderStripToolArtifactTagsProcedure, renderTemporalFramingCheckerScript, renderTemporalFramingRuleContent, renderTitlePrefixTypeBullets, renderUnblockDependentsScript, renderUnblockDependentsSection, requirementsAnalystBundle, requirementsReviewerBundle, requirementsWriterBundle, researchPipelineBundle, resolveAgentPaths, resolveAgentTiers, resolveApprovalGate, resolveAstroProjectOutdir, resolveAwsCdkProjectOutdir, resolveBuildPolicy, resolveDiffEnvironment, resolveEnvironmentGate, resolveIssueDefaults, resolveIssueTemplates, resolveModelAlias, resolveOrchestratorAssets, resolveOutdirFromPackageName, resolveOverrideForLabels, resolvePrReviewPolicy, resolveProgressFiles, resolveReactViteSiteProjectOutdir, resolveRunRatio, resolveScheduledTasks, resolveScopeGate, resolveSharedEditing, resolveSkillEvals, resolveTemplateVariables, resolveTemporalFraming, resolveTypeLabelForLabels, resolveTypeScriptProjectOutdir, resolveUnblockDependents, runScan, slackBundle, softwareProfileBundle, standardsResearchBundle, stripToolArtifactTagsProcedure, tsdocRecordToFindings, turborepoBundle, typeLabelForPhaseLabel, typescriptBundle, upstreamConfigulatorDocsBundle, validateAgentTierConfig, validateIssueDefaultsConfig, validateIssueTemplatesConfig, validateMonorepoLayout, validatePrReviewPolicyConfig, validateProgressFilesConfig, validateRunRatioConfig, validateScheduledTasksConfig, validateScopeGateConfig, validateSharedEditingConfig, validateSkillEvalsConfig, validateStarlightSingleton, validateTemporalFramingConfig, validateUnblockDependentsConfig, vitestBundle };

package/lib/index.d.ts

@@ -13742,6 +13742,41 @@ declare const resolveApprovalGate: (gate: DeployGate | undefined, approvals: Dep
  * @returns The environment name, or `undefined` when no environment applies.
  */
 declare const resolveEnvironmentGate: (gate: DeployGate | undefined, environmentName: string | undefined, componentName: string) => string | undefined;
+/**
+ * Resolve whether the per-target `cdk diff` jobs carry the deploy
+ * environment, validating the pairing at synth time.
+ *
+ * The flag exists for one reason: a job's OIDC subject claim is
+ * `repo:<owner>/<repo>:environment:<name>` when the job declares an
+ * environment and `repo:<owner>/<repo>:ref:refs/heads/<branch>` when it does
+ * not. A deployer-role trust policy narrowed to environment subjects alone
+ * therefore rejects the diff jobs — the only cloud-touching jobs the
+ * {@link DEPLOY_GATE.ENVIRONMENT} gate leaves on the ref claim — and since the
+ * merged report gates every deploy, the whole run dies before anything
+ * deploys. Stamping the environment on the diff jobs puts them on the same
+ * subject as the deploys they inform.
+ *
+ * Mirrors {@link resolveEnvironmentGate} and {@link resolveApprovalGate}:
+ * every rejected combination renders a workflow whose diff jobs *look*
+ * environment-scoped and are not, and the symptom is a role-assumption failure
+ * at run time rather than an error at synth time.
+ *
+ * Outside {@link DEPLOY_GATE.ENVIRONMENT} there is no deploy environment to
+ * borrow. Under {@link DEPLOY_GATE.PLAN_APPLY} that is deliberate rather than
+ * incidental: the deploy jobs live in the apply workflow, so any
+ * `environmentName` belongs to *that* workflow, and the plan's diff is the
+ * review surface an operator reads before dispatching the apply. Holding it
+ * behind the apply's environment would make the review wait on the approval it
+ * exists to inform.
+ *
+ * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+ * @param gate - Gate model, or `undefined` to leave the workflow ungated.
+ * @param diffEnvironment - The `diff.environment` flag as the caller set it.
+ * @param diffEnabled - Resolved `diff.enabled`, so an inert flag is caught.
+ * @param componentName - Component name used in the thrown error message.
+ * @returns Whether the diff jobs carry the deploy environment.
+ */
+declare const resolveDiffEnvironment: (gate: DeployGate | undefined, diffEnvironment: boolean | undefined, diffEnabled: boolean, componentName: string) => boolean;
 
 /**
  * Job id of the apply workflow's validation job. Every apply job depends on
@@ -13884,6 +13919,30 @@ interface DeployDiffOptions {
      * @default true (when `enabled`)
      */
     readonly summary?: boolean;
+    /**
+     * Put the workflow's `environmentName` on each diff job, so it authenticates
+     * with the same OIDC subject claim as the deploy jobs it informs.
+     *
+     * A job's `sub` claim is `repo:<owner>/<repo>:environment:<name>` when the
+     * job declares an environment and `repo:<owner>/<repo>:ref:refs/heads/<branch>`
+     * when it does not. Under the `environment` gate the diff jobs are the only
+     * cloud-touching jobs left on the ref form, so a deployer-role trust policy
+     * narrowed to environment subjects alone rejects every one of them at the
+     * credentials step — and because the merged report gates the deploys, the run
+     * dies before anything deploys.
+     *
+     * Requires `gate: "environment"` and `enabled`; anything else fails synth.
+     *
+     * This does **not** gate the diff. An environment with no protection rules
+     * adds no prompt, which is what keeps the diff readable before the approval
+     * it exists to inform. A required-reviewer rule on the *deploy* environment
+     * would make every diff job prompt individually — put that rule on the
+     * separate `approvalEnvironmentName` under `approvals: "once"` instead.
+     *
+     * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
+     * @default false
+     */
+    readonly environment?: boolean;
 }
 interface DeployWorkflowOptions {
     /**
@@ -13947,7 +14006,9 @@ interface DeployWorkflowOptions {
      * The `cdk diff` flags themselves are **not** configured here — they come
      * from the {@link CdkCli} precedence chain (per-stage built-in → per-stage
      * `diffDefaults` → per-account override → per-target `cdkOptions.diff`). This
-     * option only controls whether the jobs are emitted and what they publish.
+     * option only controls whether the jobs are emitted, what they publish, and —
+     * via {@link DeployDiffOptions.environment} — which OIDC subject claim they
+     * authenticate with.
      *
      * @default - no diff jobs are emitted, unless `gate` is `plan-apply`
      */
@@ -15609,6 +15670,10 @@ interface AwsCdkProjectOptions extends Omit<awscdk.AwsCdkTypeScriptAppOptions, "
      * `deployWorkflows[].diff` overrides it for that stage, matching the
      * `buildWorkflowOptions` precedence rule.
      *
+     * `environment` is not usable here: auto-derived workflows set no `gate`, so
+     * there is no environment for the diff jobs to borrow and the flag fails
+     * synth. Set it on the individual `deployWorkflows` entry that gates.
+     *
      * @see `docs/packages/@codedrifters/configulator/workflows/aws-deploy-workflow.md`
      * @default - no diff jobs are emitted
      */
@@ -16538,5 +16603,5 @@ declare function pinPnpmActionSetup(project: Project): void;
  */
 declare function pinSetupNodeVersion(project: Project): void;
 
-export { AGENT_MODEL, AGENT_PLATFORM, AGENT_REGISTRY_ENTRIES, AGENT_RULE_SCOPE, AGENT_TIER_ROLES, AGENT_TIER_VALUES, APPROVE_JOB_ID, AUDIT_CATEGORY_ORDER, AgentConfig, ApiExtractor, ApplyWorkflow, AstroConfig, AstroOutput, AstroProject, AuditCategory, AuditMode, AuditSeverity, AwsCdkProject, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, AwsTeardownWorkflow, BUILD_ARTIFACT_NAME, BUILT_IN_BUNDLES, BUNDLE_OWNERSHIP, CDK_BOOTSTRAP_DEFAULTS_BY_STAGE, CDK_DEPLOY_DEFAULTS_BY_STAGE, CDK_DEPLOY_METHOD, CDK_DESTROY_DEFAULTS_BY_STAGE, CDK_DIFF_DEFAULTS_BY_STAGE, CDK_DIFF_METHOD, CDK_GC_ACTION, CDK_GC_TYPE, CDK_INIT_LANGUAGE, CDK_INIT_PACKAGE_MANAGER, CDK_INIT_TEMPLATE, CDK_MIGRATE_FROM_SCAN, CDK_PROGRESS, CDK_REQUIRE_APPROVAL, CDK_SYNTH_DEFAULTS_BY_STAGE, CDK_WATCH_DEFAULTS_BY_STAGE, CLAUDE_RULE_TARGET, COMPLETE_JOB_ID, CONVENTIONAL_COMMIT_TYPE_LABELS, CdkCli, DEFAULT_AC_THRESHOLDS, DEFAULT_AGENT_PATHS, DEFAULT_AGENT_TIERS, DEFAULT_API_EXTRACTOR_CONFIG_FILE, DEFAULT_API_EXTRACTOR_ENTRY_POINT, DEFAULT_API_EXTRACTOR_REPORT_FILENAME, DEFAULT_API_EXTRACTOR_REPORT_FOLDER, DEFAULT_AUDIT_REPORT_DIR, DEFAULT_BASE_CONVENTIONS, DEFAULT_BUILD_POLICY, DEFAULT_BUNDLE_OVERRIDES, DEFAULT_DECOMPOSITION_TEMPLATE, DEFAULT_DISPATCH_MODEL, DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO, DEFAULT_GITHUB_ISSUE_TYPE, DEFAULT_HOUSEKEEPING_MODEL, DEFAULT_ISSUE_PRIORITY, DEFAULT_ISSUE_STATUS, DEFAULT_ISSUE_TEMPLATES_BUNDLE_PATH_PATTERNS, DEFAULT_ISSUE_TEMPLATES_EMIT_CHECKER, DEFAULT_ISSUE_TEMPLATES_EMIT_STARTER, DEFAULT_ISSUE_TEMPLATES_ENABLED, DEFAULT_ISSUE_TEMPLATES_PATH, DEFAULT_ISSUE_TEMPLATES_REQUIRE_REFERENCE, DEFAULT_OFF_PEAK_CRON_EXAMPLE, DEFAULT_ORCHESTRATOR_CONVENTIONS, DEFAULT_PARTIAL_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_PATHS_EXEMPT_FROM_SIZE, DEFAULT_PRIORITY_LABELS, DEFAULT_PRODUCT_CONTEXT_PATH, DEFAULT_PROGRESS_FILES_ENABLED, DEFAULT_PROGRESS_FILES_FILENAME_PATTERN, DEFAULT_PROGRESS_FILES_FORMAT, DEFAULT_PROGRESS_FILES_STALE_AFTER_HOURS, DEFAULT_PROGRESS_FILES_STATE_DIR, DEFAULT_REQUIREMENT_CATEGORY_DIRS, DEFAULT_REQUIRE_PRODUCT_CONTEXT, DEFAULT_RESOLVED_ISSUE_DEFAULTS, DEFAULT_RULE_CONVENTIONS, DEFAULT_SAMPLE_COMPILER_OPTIONS, DEFAULT_SCHEDULED_TASKS_ROOT, DEFAULT_SCHEDULED_TASK_ENTRIES, DEFAULT_SHARED_EDITING_CONFLICT_STRATEGY, DEFAULT_SHARED_EDITING_EMIT_HELPER, DEFAULT_SHARED_EDITING_ENABLED, DEFAULT_SHARED_EDITING_VERIFY_COMMIT, DEFAULT_SHARED_INDEX_PATHS, DEFAULT_SKILL_EVALS_EMIT_RUNNER, DEFAULT_SKILL_EVALS_ENABLED, DEFAULT_SKILL_EVALS_SKILLS_ROOT, DEFAULT_SOURCES_THRESHOLDS, DEFAULT_STATE_FILE_PATH, DEFAULT_STATUS_LABELS, DEFAULT_TEARDOWN_BRANCH_PATTERNS, DEFAULT_TEMPORAL_FRAMING_CADENCES, DEFAULT_TEMPORAL_FRAMING_EMIT_CHECKER, DEFAULT_TEMPORAL_FRAMING_ENABLED, DEFAULT_TEMPORAL_FRAMING_PATHS, DEFAULT_TYPE_LABELS, DEFAULT_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_UNBLOCK_DEPENDENTS_ENABLED, DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED, DEPLOY_APPROVALS, DEPLOY_GATE, DIFF_ARTIFACT_NAME, DIFF_NEW_STACK_MARKER, DIFF_OUTPUT_DIRECTORY, DIFF_PART_ARTIFACT_PREFIX, DIFF_REPORT_JOB_ID, DOCS_SYNC_AUDIT_SCHEMA_VERSION, DiffReportJob, GITHUB_ISSUE_TYPES, GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX, GIT_BRANCH_NAME_ENV, GIT_BRANCH_NAME_ENV_VALUE, ISSUE_TEMPLATES_GENERATED_SUFFIX, JsiiFaker, LAYOUT_ENFORCEMENT, LAYOUT_ROOT_BY_PROJECT_TYPE, MAX_LABEL_DESCRIPTION_LENGTH, MCP_TRANSPORT, MERGE_METHODS, MIMIMUM_RELEASE_AGE, MINIMUM_RELEASE_AGE, MONOREPO_LAYOUT, MonorepoProject, Nvmrc, PERMISSION_BACKUP_FILE, PHASE_LABEL_TYPE_MAP, PLAN_RUN_ID_INPUT, PROD_DEPLOY_NAME, PROGRESS_FILES_FORMAT_VALUES, PnpmWorkspace, ProjectMetadata, REQUIREMENTS_WRITER_PATHS, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ReactViteSiteProject, RequirementIssueTemplate, ResetTask, SCHEDULED_TASK_MODEL_VALUES, SCOPE_CLASS_VALUES, SET_ISSUE_TYPE_HELPER_PATH, SHARED_EDITING_CONFLICT_STRATEGY_VALUES, STARLIGHT_ROLE, SUPPRESSED_WORKFLOW_RULE_NAMES, SampleLang, StarlightProject, TEMPORAL_FRAMING_CATEGORY_VALUES, TURBO_RUN_CONTINUE, TURBO_RUN_DRY_RUN, TURBO_RUN_LOG_ORDER, TURBO_RUN_LOG_PREFIX, TURBO_RUN_OUTPUT_LOGS, TestRunner, TsDocCoverageKind, TsdocConfig, TurboRepo, TurboRepoTask, TypeScriptConfig, TypeScriptProject, UNKNOWN_TYPE_FALLBACK_TIER, VALIDATE_PLAN_JOB_ID, VALID_PRIORITY_VALUES, VALID_STATUS_VALUES, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, Vitest, WorkflowHomeRepository, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, addPlaywright, addStorybook, addSyncLabelsWorkflow, agendaBundle, analyzeTsDocCoverage, auditReportJsonSchema, awsCdkBundle, baseBundle, bcmWriterBundle, buildAgentRegistryRule, buildBaseBundle, buildBcmWriterBundle, buildBuiltInBundles, buildBusinessModelsBundle, buildCheckBlockedProcedure, buildCompanyProfileBundle, buildCustomerProfileBundle, buildDocsSyncBundle, buildGithubWorkflowBundle, buildIndustryDiscoveryBundle, buildMaintenanceAuditBundle, buildMeetingAnalysisBundle, buildOrchestratorBundle, buildOrchestratorConventionsContent, buildPeopleProfileBundle, buildPrReviewBundle, buildRegulatoryResearchBundle, buildReport, buildRequirementsAnalystBundle, buildRequirementsReviewerBundle, buildRequirementsWriterBundle, buildResearchPipelineBundle, buildSoftwareProfileBundle, buildStandardsResearchBundle, buildTurborepoBundle, buildUnblockDependentsProcedure, bundleNameForWorkflowRule, businessModelsBundle, checkClosingKeywordsProcedure, checkDocSamplesProcedure, checkLinksProcedure, classifyIssueScope, classifyRun, collectIssueTemplateRecipeStubs, companyProfileBundle, compileFencedSamples, createApiDiffCheck, createReferenceMismatchCheck, createTsdocCoverageCheck, customerProfileBundle, diffApiRollups, docsSyncBundle, emptyCategoryBuckets, extractApiProcedure, extractDocReferences, extractFencedSamples, formatLayoutViolation, formatStarlightSingletonViolation, getLatestEligibleVersion, githubIssueTypeForTitle, githubWorkflowBundle, hasAnyDocsEmittingBundle, hasAnyDownstreamIssueKindBundle, includeHiddenFilesInBuildArtifact, industryDiscoveryBundle, isPhaseLabelOwnedByExcluded, isScheduledTaskOwnedByExcluded, isSuppressedWorkflowRule, isTypeLabelOwnedByExcluded, issueTemplatesChildGlob, issueTemplatesGeneratedPath, jestBundle, labelsForPhase, maintenanceAuditBundle, meetingAnalysisBundle, mergeCdkOptions, nextRequirementIdProcedure, orchestratorBundle, parseApiRollup, peopleProfileBundle, persistAuditReport, pinPnpmActionSetup, pinSetupNodeVersion, pnpmBundle, prReviewBundle, projenBundle, referenceRecordToFinding, regulatoryResearchBundle, renderAgentTierCaseStatement, renderAgentTierSection, renderCdkAcknowledge, renderCdkBootstrap, renderCdkCliTelemetry, renderCdkContext, renderCdkDeploy, renderCdkDestroy, renderCdkDiagnose, renderCdkDiff, renderCdkDocs, renderCdkDoctor, renderCdkDrift, renderCdkFlags, renderCdkGc, renderCdkImport, renderCdkInit, renderCdkList, renderCdkLsp, renderCdkMetadata, renderCdkMigrate, renderCdkNotices, renderCdkOrphan, renderCdkPublishAssets, renderCdkRefactor, renderCdkRollback, renderCdkSynth, renderCdkValidate, renderCdkWatch, renderCheckClosingKeywordsScript, renderCheckDocSamplesProcedure, renderCheckLinksProcedure, renderCustomDocSectionBlock, renderCustomDocSections, renderDiffPartUploadStep, renderExtractApiProcedure, renderFocusSection, renderGithubIssueTypeSection, renderGithubIssueTypeSectionLines, renderHomeRepositoryCondition, renderIssueTemplateLabelsCheckerScript, renderIssueTemplatesBundleHook, renderIssueTemplatesCheckerScript, renderIssueTemplatesGeneratedPage, renderIssueTemplatesRuleContent, renderIssueTemplatesStarterPage, renderIssueTypeAssignmentBlanket, renderIssueTypeAssignmentStep, renderMeetingTypesSection, renderNextRequirementIdProcedure, renderPhaseTypeInvariantSection, renderPhaseTypeInvariantShellHelpers, renderPlanValidationScript, renderPriorityRulesSection, renderProgressFileName, renderProgressFilePath, renderProgressFilesBundleHook, renderProgressFilesRuleContent, renderRequirementBlock, renderRunRatioSection, renderRunRatioShellHelpers, renderScheduledTaskSkillFile, renderScheduledTasksSection, renderScopeGateSection, renderScopeGateShellHelpers, renderSetIssueTypeFallbackLines, renderSetupNode, renderSetupPnpm, renderSharedEditingBundleHook, renderSharedEditingHelperScript, renderSharedEditingRuleContent, renderSkillEvalsBundleHook, renderSkillEvalsRuleContent, renderSkillEvalsRunnerScript, renderSourceTierExamples, renderStripToolArtifactTagsProcedure, renderTemporalFramingCheckerScript, renderTemporalFramingRuleContent, renderTitlePrefixTypeBullets, renderUnblockDependentsScript, renderUnblockDependentsSection, requirementsAnalystBundle, requirementsReviewerBundle, requirementsWriterBundle, researchPipelineBundle, resolveAgentPaths, resolveAgentTiers, resolveApprovalGate, resolveAstroProjectOutdir, resolveAwsCdkProjectOutdir, resolveBuildPolicy, resolveEnvironmentGate, resolveIssueDefaults, resolveIssueTemplates, resolveModelAlias, resolveOrchestratorAssets, resolveOutdirFromPackageName, resolveOverrideForLabels, resolvePrReviewPolicy, resolveProgressFiles, resolveReactViteSiteProjectOutdir, resolveRunRatio, resolveScheduledTasks, resolveScopeGate, resolveSharedEditing, resolveSkillEvals, resolveTemplateVariables, resolveTemporalFraming, resolveTypeLabelForLabels, resolveTypeScriptProjectOutdir, resolveUnblockDependents, runScan, slackBundle, softwareProfileBundle, standardsResearchBundle, stripToolArtifactTagsProcedure, tsdocRecordToFindings, turborepoBundle, typeLabelForPhaseLabel, typescriptBundle, upstreamConfigulatorDocsBundle, validateAgentTierConfig, validateIssueDefaultsConfig, validateIssueTemplatesConfig, validateMonorepoLayout, validatePrReviewPolicyConfig, validateProgressFilesConfig, validateRunRatioConfig, validateScheduledTasksConfig, validateScopeGateConfig, validateSharedEditingConfig, validateSkillEvalsConfig, validateStarlightSingleton, validateTemporalFramingConfig, validateUnblockDependentsConfig, vitestBundle };
+export { AGENT_MODEL, AGENT_PLATFORM, AGENT_REGISTRY_ENTRIES, AGENT_RULE_SCOPE, AGENT_TIER_ROLES, AGENT_TIER_VALUES, APPROVE_JOB_ID, AUDIT_CATEGORY_ORDER, AgentConfig, ApiExtractor, ApplyWorkflow, AstroConfig, AstroOutput, AstroProject, AuditCategory, AuditMode, AuditSeverity, AwsCdkProject, AwsDeployWorkflow, AwsDeploymentConfig, AwsDeploymentTarget, AwsTeardownWorkflow, BUILD_ARTIFACT_NAME, BUILT_IN_BUNDLES, BUNDLE_OWNERSHIP, CDK_BOOTSTRAP_DEFAULTS_BY_STAGE, CDK_DEPLOY_DEFAULTS_BY_STAGE, CDK_DEPLOY_METHOD, CDK_DESTROY_DEFAULTS_BY_STAGE, CDK_DIFF_DEFAULTS_BY_STAGE, CDK_DIFF_METHOD, CDK_GC_ACTION, CDK_GC_TYPE, CDK_INIT_LANGUAGE, CDK_INIT_PACKAGE_MANAGER, CDK_INIT_TEMPLATE, CDK_MIGRATE_FROM_SCAN, CDK_PROGRESS, CDK_REQUIRE_APPROVAL, CDK_SYNTH_DEFAULTS_BY_STAGE, CDK_WATCH_DEFAULTS_BY_STAGE, CLAUDE_RULE_TARGET, COMPLETE_JOB_ID, CONVENTIONAL_COMMIT_TYPE_LABELS, CdkCli, DEFAULT_AC_THRESHOLDS, DEFAULT_AGENT_PATHS, DEFAULT_AGENT_TIERS, DEFAULT_API_EXTRACTOR_CONFIG_FILE, DEFAULT_API_EXTRACTOR_ENTRY_POINT, DEFAULT_API_EXTRACTOR_REPORT_FILENAME, DEFAULT_API_EXTRACTOR_REPORT_FOLDER, DEFAULT_AUDIT_REPORT_DIR, DEFAULT_BASE_CONVENTIONS, DEFAULT_BUILD_POLICY, DEFAULT_BUNDLE_OVERRIDES, DEFAULT_DECOMPOSITION_TEMPLATE, DEFAULT_DISPATCH_MODEL, DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO, DEFAULT_GITHUB_ISSUE_TYPE, DEFAULT_HOUSEKEEPING_MODEL, DEFAULT_ISSUE_PRIORITY, DEFAULT_ISSUE_STATUS, DEFAULT_ISSUE_TEMPLATES_BUNDLE_PATH_PATTERNS, DEFAULT_ISSUE_TEMPLATES_EMIT_CHECKER, DEFAULT_ISSUE_TEMPLATES_EMIT_STARTER, DEFAULT_ISSUE_TEMPLATES_ENABLED, DEFAULT_ISSUE_TEMPLATES_PATH, DEFAULT_ISSUE_TEMPLATES_REQUIRE_REFERENCE, DEFAULT_OFF_PEAK_CRON_EXAMPLE, DEFAULT_ORCHESTRATOR_CONVENTIONS, DEFAULT_PARTIAL_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_PATHS_EXEMPT_FROM_SIZE, DEFAULT_PRIORITY_LABELS, DEFAULT_PRODUCT_CONTEXT_PATH, DEFAULT_PROGRESS_FILES_ENABLED, DEFAULT_PROGRESS_FILES_FILENAME_PATTERN, DEFAULT_PROGRESS_FILES_FORMAT, DEFAULT_PROGRESS_FILES_STALE_AFTER_HOURS, DEFAULT_PROGRESS_FILES_STATE_DIR, DEFAULT_REQUIREMENT_CATEGORY_DIRS, DEFAULT_REQUIRE_PRODUCT_CONTEXT, DEFAULT_RESOLVED_ISSUE_DEFAULTS, DEFAULT_RULE_CONVENTIONS, DEFAULT_SAMPLE_COMPILER_OPTIONS, DEFAULT_SCHEDULED_TASKS_ROOT, DEFAULT_SCHEDULED_TASK_ENTRIES, DEFAULT_SHARED_EDITING_CONFLICT_STRATEGY, DEFAULT_SHARED_EDITING_EMIT_HELPER, DEFAULT_SHARED_EDITING_ENABLED, DEFAULT_SHARED_EDITING_VERIFY_COMMIT, DEFAULT_SHARED_INDEX_PATHS, DEFAULT_SKILL_EVALS_EMIT_RUNNER, DEFAULT_SKILL_EVALS_ENABLED, DEFAULT_SKILL_EVALS_SKILLS_ROOT, DEFAULT_SOURCES_THRESHOLDS, DEFAULT_STATE_FILE_PATH, DEFAULT_STATUS_LABELS, DEFAULT_TEARDOWN_BRANCH_PATTERNS, DEFAULT_TEMPORAL_FRAMING_CADENCES, DEFAULT_TEMPORAL_FRAMING_EMIT_CHECKER, DEFAULT_TEMPORAL_FRAMING_ENABLED, DEFAULT_TEMPORAL_FRAMING_PATHS, DEFAULT_TYPE_LABELS, DEFAULT_UNBLOCK_COMMENT_TEMPLATE, DEFAULT_UNBLOCK_DEPENDENTS_ENABLED, DEFAULT_UPSTREAM_CONFIGULATOR_ENABLED, DEPLOY_APPROVALS, DEPLOY_GATE, DIFF_ARTIFACT_NAME, DIFF_NEW_STACK_MARKER, DIFF_OUTPUT_DIRECTORY, DIFF_PART_ARTIFACT_PREFIX, DIFF_REPORT_JOB_ID, DOCS_SYNC_AUDIT_SCHEMA_VERSION, DiffReportJob, GITHUB_ISSUE_TYPES, GITHUB_ISSUE_TYPE_BY_TITLE_PREFIX, GIT_BRANCH_NAME_ENV, GIT_BRANCH_NAME_ENV_VALUE, ISSUE_TEMPLATES_GENERATED_SUFFIX, JsiiFaker, LAYOUT_ENFORCEMENT, LAYOUT_ROOT_BY_PROJECT_TYPE, MAX_LABEL_DESCRIPTION_LENGTH, MCP_TRANSPORT, MERGE_METHODS, MIMIMUM_RELEASE_AGE, MINIMUM_RELEASE_AGE, MONOREPO_LAYOUT, MonorepoProject, Nvmrc, PERMISSION_BACKUP_FILE, PHASE_LABEL_TYPE_MAP, PLAN_RUN_ID_INPUT, PROD_DEPLOY_NAME, PROGRESS_FILES_FORMAT_VALUES, PnpmWorkspace, ProjectMetadata, REQUIREMENTS_WRITER_PATHS, ROOT_CI_TASK_NAME, ROOT_TURBO_TASK_NAME, ReactViteSiteProject, RequirementIssueTemplate, ResetTask, SCHEDULED_TASK_MODEL_VALUES, SCOPE_CLASS_VALUES, SET_ISSUE_TYPE_HELPER_PATH, SHARED_EDITING_CONFLICT_STRATEGY_VALUES, STARLIGHT_ROLE, SUPPRESSED_WORKFLOW_RULE_NAMES, SampleLang, StarlightProject, TEMPORAL_FRAMING_CATEGORY_VALUES, TURBO_RUN_CONTINUE, TURBO_RUN_DRY_RUN, TURBO_RUN_LOG_ORDER, TURBO_RUN_LOG_PREFIX, TURBO_RUN_OUTPUT_LOGS, TestRunner, TsDocCoverageKind, TsdocConfig, TurboRepo, TurboRepoTask, TypeScriptConfig, TypeScriptProject, UNKNOWN_TYPE_FALLBACK_TIER, VALIDATE_PLAN_JOB_ID, VALID_PRIORITY_VALUES, VALID_STATUS_VALUES, VERSION, VERSION_KEYS_SKIP, VERSION_NPM_PACKAGES, VSCodeConfig, Vitest, WorkflowHomeRepository, addApproveMergeUpgradeWorkflow, addBuildCompleteJob, addPlaywright, addStorybook, addSyncLabelsWorkflow, agendaBundle, analyzeTsDocCoverage, auditReportJsonSchema, awsCdkBundle, baseBundle, bcmWriterBundle, buildAgentRegistryRule, buildBaseBundle, buildBcmWriterBundle, buildBuiltInBundles, buildBusinessModelsBundle, buildCheckBlockedProcedure, buildCompanyProfileBundle, buildCustomerProfileBundle, buildDocsSyncBundle, buildGithubWorkflowBundle, buildIndustryDiscoveryBundle, buildMaintenanceAuditBundle, buildMeetingAnalysisBundle, buildOrchestratorBundle, buildOrchestratorConventionsContent, buildPeopleProfileBundle, buildPrReviewBundle, buildRegulatoryResearchBundle, buildReport, buildRequirementsAnalystBundle, buildRequirementsReviewerBundle, buildRequirementsWriterBundle, buildResearchPipelineBundle, buildSoftwareProfileBundle, buildStandardsResearchBundle, buildTurborepoBundle, buildUnblockDependentsProcedure, bundleNameForWorkflowRule, businessModelsBundle, checkClosingKeywordsProcedure, checkDocSamplesProcedure, checkLinksProcedure, classifyIssueScope, classifyRun, collectIssueTemplateRecipeStubs, companyProfileBundle, compileFencedSamples, createApiDiffCheck, createReferenceMismatchCheck, createTsdocCoverageCheck, customerProfileBundle, diffApiRollups, docsSyncBundle, emptyCategoryBuckets, extractApiProcedure, extractDocReferences, extractFencedSamples, formatLayoutViolation, formatStarlightSingletonViolation, getLatestEligibleVersion, githubIssueTypeForTitle, githubWorkflowBundle, hasAnyDocsEmittingBundle, hasAnyDownstreamIssueKindBundle, includeHiddenFilesInBuildArtifact, industryDiscoveryBundle, isPhaseLabelOwnedByExcluded, isScheduledTaskOwnedByExcluded, isSuppressedWorkflowRule, isTypeLabelOwnedByExcluded, issueTemplatesChildGlob, issueTemplatesGeneratedPath, jestBundle, labelsForPhase, maintenanceAuditBundle, meetingAnalysisBundle, mergeCdkOptions, nextRequirementIdProcedure, orchestratorBundle, parseApiRollup, peopleProfileBundle, persistAuditReport, pinPnpmActionSetup, pinSetupNodeVersion, pnpmBundle, prReviewBundle, projenBundle, referenceRecordToFinding, regulatoryResearchBundle, renderAgentTierCaseStatement, renderAgentTierSection, renderCdkAcknowledge, renderCdkBootstrap, renderCdkCliTelemetry, renderCdkContext, renderCdkDeploy, renderCdkDestroy, renderCdkDiagnose, renderCdkDiff, renderCdkDocs, renderCdkDoctor, renderCdkDrift, renderCdkFlags, renderCdkGc, renderCdkImport, renderCdkInit, renderCdkList, renderCdkLsp, renderCdkMetadata, renderCdkMigrate, renderCdkNotices, renderCdkOrphan, renderCdkPublishAssets, renderCdkRefactor, renderCdkRollback, renderCdkSynth, renderCdkValidate, renderCdkWatch, renderCheckClosingKeywordsScript, renderCheckDocSamplesProcedure, renderCheckLinksProcedure, renderCustomDocSectionBlock, renderCustomDocSections, renderDiffPartUploadStep, renderExtractApiProcedure, renderFocusSection, renderGithubIssueTypeSection, renderGithubIssueTypeSectionLines, renderHomeRepositoryCondition, renderIssueTemplateLabelsCheckerScript, renderIssueTemplatesBundleHook, renderIssueTemplatesCheckerScript, renderIssueTemplatesGeneratedPage, renderIssueTemplatesRuleContent, renderIssueTemplatesStarterPage, renderIssueTypeAssignmentBlanket, renderIssueTypeAssignmentStep, renderMeetingTypesSection, renderNextRequirementIdProcedure, renderPhaseTypeInvariantSection, renderPhaseTypeInvariantShellHelpers, renderPlanValidationScript, renderPriorityRulesSection, renderProgressFileName, renderProgressFilePath, renderProgressFilesBundleHook, renderProgressFilesRuleContent, renderRequirementBlock, renderRunRatioSection, renderRunRatioShellHelpers, renderScheduledTaskSkillFile, renderScheduledTasksSection, renderScopeGateSection, renderScopeGateShellHelpers, renderSetIssueTypeFallbackLines, renderSetupNode, renderSetupPnpm, renderSharedEditingBundleHook, renderSharedEditingHelperScript, renderSharedEditingRuleContent, renderSkillEvalsBundleHook, renderSkillEvalsRuleContent, renderSkillEvalsRunnerScript, renderSourceTierExamples, renderStripToolArtifactTagsProcedure, renderTemporalFramingCheckerScript, renderTemporalFramingRuleContent, renderTitlePrefixTypeBullets, renderUnblockDependentsScript, renderUnblockDependentsSection, requirementsAnalystBundle, requirementsReviewerBundle, requirementsWriterBundle, researchPipelineBundle, resolveAgentPaths, resolveAgentTiers, resolveApprovalGate, resolveAstroProjectOutdir, resolveAwsCdkProjectOutdir, resolveBuildPolicy, resolveDiffEnvironment, resolveEnvironmentGate, resolveIssueDefaults, resolveIssueTemplates, resolveModelAlias, resolveOrchestratorAssets, resolveOutdirFromPackageName, resolveOverrideForLabels, resolvePrReviewPolicy, resolveProgressFiles, resolveReactViteSiteProjectOutdir, resolveRunRatio, resolveScheduledTasks, resolveScopeGate, resolveSharedEditing, resolveSkillEvals, resolveTemplateVariables, resolveTemporalFraming, resolveTypeLabelForLabels, resolveTypeScriptProjectOutdir, resolveUnblockDependents, runScan, slackBundle, softwareProfileBundle, standardsResearchBundle, stripToolArtifactTagsProcedure, tsdocRecordToFindings, turborepoBundle, typeLabelForPhaseLabel, typescriptBundle, upstreamConfigulatorDocsBundle, validateAgentTierConfig, validateIssueDefaultsConfig, validateIssueTemplatesConfig, validateMonorepoLayout, validatePrReviewPolicyConfig, validateProgressFilesConfig, validateRunRatioConfig, validateScheduledTasksConfig, validateScopeGateConfig, validateSharedEditingConfig, validateSkillEvalsConfig, validateStarlightSingleton, validateTemporalFramingConfig, validateUnblockDependentsConfig, vitestBundle };
 export type { ActionItemFilingConfig, ActivateBranchNameEnvVarOptions, AddStorybookOptions, AgentCommand, AgentConfigOptions, AgentExpansionRules, AgentFeaturesConfig, AgentModel, AgentPathsConfig, AgentPlatform, AgentPlatformOverrides, AgentProcedure, AgentRegistryEntry, AgentRule, AgentRuleBundle, AgentRuleScope, AgentSkill, AgentSubAgent, AgentSubAgentPlatformOverrides, AgentTier, AgentTierConfig, AgentTierEntry, AnalyzeTsDocCoverageOptions, ApiDiffCheckOptions, ApiDiffFinding, ApiDiffResult, ApiExtractorOptions, ApiExtractorReportOptions, ApiSurfaceEntry, ApplyWorkflowAttachOptions, ApplyWorkflowContract, ApplyWorkflowOptions, ApproveMergeUpgradeOptions, AstroConfigOptions, AstroIntegrationSpec, AstroProjectOptions, AuditCheckRunner, AuditCheckRunnerContext, AuditFinding, AuditFindingBase, AuditLocation, AuditReport, AwsAccount, AwsCdkProjectOptions, AwsDeploymentTargetOptions, AwsLocalDeploymentConfig, AwsOrganization, AwsRegion, AwsTeardownWorkflowOptions, BundleOwnership, CdkAcknowledgeOptions, CdkBootstrapOptions, CdkCliOptions, CdkCliTelemetryOptions, CdkContextOptions, CdkDeployMethod, CdkDeployOptions, CdkDestroyOptions, CdkDiagnoseOptions, CdkDiffMethod, CdkDiffOptions, CdkDocsOptions, CdkDoctorOptions, CdkDriftOptions, CdkFlagsOptions, CdkGcAction, CdkGcOptions, CdkGcType, CdkGlobalOptions, CdkImportOptions, CdkInitLanguage, CdkInitOptions, CdkInitPackageManager, CdkInitTemplate, CdkListOptions, CdkLspOptions, CdkMetadataOptions, CdkMigrateFromScan, CdkMigrateOptions, CdkNoticesOptions, CdkOrphanOptions, CdkProgress, CdkPublishAssetsOptions, CdkRefactorOptions, CdkRequireApproval, CdkRollbackOptions, CdkSynthOptions, CdkTargetOverrides, CdkValidateOptions, CdkWatchOptions, CiDeploymentConfig, ClassTypeOptions, ClaudeAutoModeConfig, ClaudeHookAction, ClaudeHookEntry, ClaudeHooksConfig, ClaudeMdConfig, ClaudePermissionsConfig, ClaudeRuleTarget, ClaudeSandboxConfig, ClaudeSettingsConfig, CompileFencedSamplesOptions, CopilotHandoff, CursorHookAction, CursorHooksConfig, CursorSettingsConfig, CustomDocSection, DeployApprovals, DeployDiffOptions, DeployGate, DeployWorkflowOptions, DeploymentMetadata, DiffReportJobAttachOptions, DiffReportTarget, DocReferenceRecord, EffectiveScopeThresholds, ExtractDocReferencesOptions, ExtractFencedSamplesOptions, FencedSampleRecord, FocusArea, FocusAreaMatch, FocusConfig, GitBranch, GitHubBoardMetadata, GitHubProjectMetadata, GitHubSprintMetadata, GithubIssueType, IDependencyResolver, IssueDefaultsConfig, IssueDefaultsOverride, IssueDefaultsPriority, IssueDefaultsStatus, IssueTemplateRecipeStub, IssueTemplatesConfig, IssueTypeAssignmentStepOptions, LabelDefinition, LayoutEnforcement, LayoutViolation, LinkFailureFinding, McpServerConfig, McpTransport, MeetingArea, MeetingScope, MeetingType, MeetingTypeKind, MeetingsConfig, MergeMethod, MonorepoLayoutRoot, MonorepoPnpmOptions, MonorepoProjectOptions, OrganizationMetadata, PhaseLabelTypeOutcome, PhaseLabelTypeResolution, PlanApplyOptions, PlanValidationScriptOptions, PnpmCuratedSettingKey, PnpmPeerDependencyRules, PnpmSupportedArchitectures, PnpmUpdateConfigSettings, PnpmUpdateSettings, PnpmWorkspaceOptions, PrReviewAutoMergeConfig, PrReviewCiVerificationConfig, PrReviewPolicyConfig, PriorityRule, ProgressFilesConfig, ProjectMetadataOptions, ReactViteSiteProjectOptions, ReferenceMismatchCheckOptions, ReferenceMismatchFinding, RemoteCacheOptions, RepositoryMetadata, RequirementBlockFields, RequirementCategoryDirsConfig, RequirementIssueTemplateOptions, ResetTaskOptions, ResolvedAgentPaths, ResolvedAgentTier, ResolvedBaseConventions, ResolvedBuildPolicy, ResolvedIssueDefaults, ResolvedIssueDefaultsEntry, ResolvedIssueTemplates, ResolvedOrchestratorConventions, ResolvedPrReviewAutoMerge, ResolvedPrReviewPolicy, ResolvedProgressFiles, ResolvedProjectMetadata, ResolvedRequirementCategoryDirs, ResolvedRuleConventions, ResolvedRunRatio, ResolvedScheduledTask, ResolvedScheduledTasks, ResolvedScopeGate, ResolvedScopeGateBundleOverride, ResolvedSharedEditing, ResolvedSkillEvals, ResolvedTemporalFraming, ResolvedUnblockDependents, RunRatioConfig, RunScanOptions, RunScanResult, SampleCompilationFailure, SampleFailureFinding, ScheduledTaskEntry, ScheduledTaskModel, ScheduledTaskOverride, ScheduledTasksConfig, ScopeClass, ScopeGateBundleOverride, ScopeGateConfig, ScopeGateThresholds, SharedEditingConfig, SkillEvalsConfig, SlackMetadata, SourceTierExamples, StarlightEditLink, StarlightLogo, StarlightProjectOptions, StarlightRole, StarlightSidebarItem, StarlightSingletonViolation, StarlightSocialLink, SyncLabelsOptions, TemplateResolveResult, TemporalFramingCategory, TemporalFramingConfig, TsDocCoverageRecord, TsdocConfigOptions, TsdocCoverageCheckOptions, TsdocCoverageFinding, TurboRepoOptions, TurboRepoTaskOptions, TurboRunContinue, TurboRunDryRun, TurboRunLogOrder, TurboRunLogPrefix, TurboRunOptions, TurboRunOutputLogs, TypeScriptProjectOptions, UnblockDependentsConfig, UpstreamConfigulatorConfig, VersionKey, VitestConfigOptions, VitestOptions, WorkflowHomeRepositoryOptions };

package/lib/index.js

@@ -535,6 +535,7 @@ __export(index_exports, {
   resolveBuildPolicy: () => resolveBuildPolicy,
   resolveBundleAgentTiers: () => resolveBundleAgentTiers,
   resolveDefaultAgentTier: () => resolveDefaultAgentTier,
+  resolveDiffEnvironment: () => resolveDiffEnvironment,
   resolveEnvironmentGate: () => resolveEnvironmentGate,
   resolveIssueDefaults: () => resolveIssueDefaults,
   resolveIssueTemplates: () => resolveIssueTemplates,
@@ -43064,6 +43065,22 @@ var resolveEnvironmentGate = (gate, environmentName, componentName) => {
   }
   return trimmed;
 };
+var resolveDiffEnvironment = (gate, diffEnvironment, diffEnabled, componentName) => {
+  if (!diffEnvironment) {
+    return false;
+  }
+  if (gate !== DEPLOY_GATE.ENVIRONMENT) {
+    throw new Error(
+      `${componentName} requires \`gate\` to be "${DEPLOY_GATE.ENVIRONMENT}" when \`diff.environment\` is set, got ${gate ? `"${gate}"` : "no gate"}`
+    );
+  }
+  if (!diffEnabled) {
+    throw new Error(
+      `${componentName} requires \`diff.enabled\` when \`diff.environment\` is set \u2014 there are no diff jobs to put the environment on`
+    );
+  }
+  return true;
+};
 
 // src/workflows/diff-report-job.ts
 var import_projen27 = require("projen");
@@ -43992,10 +44009,17 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen29.Compone
         "AwsDeployWorkflow cannot disable `diff` under the `plan-apply` gate: the diff jobs are what keep the plan workflow publishing the build artifact the apply workflow deploys."
       );
     }
+    const diffEnabled = options.diff?.enabled ?? isPlanApply;
     this.diffOptions = {
-      enabled: options.diff?.enabled ?? isPlanApply,
+      enabled: diffEnabled,
       artifact: options.diff?.artifact ?? true,
-      summary: options.diff?.summary ?? true
+      summary: options.diff?.summary ?? true,
+      environment: resolveDiffEnvironment(
+        options.gate,
+        options.diff?.environment,
+        diffEnabled,
+        "AwsDeployWorkflow"
+      )
     };
     this.branchScopedConcurrency = options.branchScopedConcurrency ?? false;
     this.environmentName = resolveEnvironmentGate(
@@ -44175,6 +44199,7 @@ var AwsDeployWorkflow = class _AwsDeployWorkflow extends import_projen29.Compone
             contents: import_workflows_model7.JobPermission.READ,
             idToken: import_workflows_model7.JobPermission.WRITE
           },
+          ...this.diffOptions.environment && this.environmentName ? { environment: this.environmentName } : void 0,
           concurrency: this.buildDiffConcurrency(diffJobName),
           if: jobCondition,
           steps: [...this.diffSteps(target)]
@@ -45538,6 +45563,7 @@ export const collections = {
   resolveBuildPolicy,
   resolveBundleAgentTiers,
   resolveDefaultAgentTier,
+  resolveDiffEnvironment,
   resolveEnvironmentGate,
   resolveIssueDefaults,
   resolveIssueTemplates,