@empire-builder-kit/nx 1.0.0-rc.31 → 1.0.0-rc.32

package/src/generators/preset/workspace-files-stage-authority.js

@@ -18,18 +18,36 @@ pnpm nx run <workspace>:stage-authority-render -- \\
 \`\`\`
 
 Locally admitted stages require at least one reviewed
-\`--aws-principal-arn\`. Stages that require protected GitHub deployment require
-one exact \`--github-repository\` environment trust and reject local AWS
-principals. The \`starter\` profile may add that exact GitHub trust to either of
-its locally admitted stages because its GitHub paved road is optional; locally
-admitted stages in isolated profiles reject GitHub trust.
+\`--aws-principal-arn\`. Stages that require only protected GitHub deployment
+require one exact \`--github-repository\` environment trust and reject local AWS
+principals. Production-isolated staging requires both the local principal and
+the protected GitHub environment trust: local staging remains supported, while
+the protected \`develop\` deployment produces the receipt consumed by production
+promotion. The \`starter\` profile may add that exact GitHub trust to either of
+its locally admitted stages because its GitHub paved road is optional. Fully
+isolated development rejects GitHub trust.
 
-GitHub trust is scoped to the repository's exact stage environment.
-Repositories that use GitHub's immutable owner/repository-ID OIDC subject
-customization must also supply both \`--github-owner-id=<numeric-id>\` and
-\`--github-repository-id=<numeric-id>\`; supplying only one ID or mixing an ID
-with a name-only subject is rejected. Apply the rendered template as the named
-stack shown in the manifest, then read back the deployed template and policies
+GitHub trust is scoped to the repository's exact stage environment and always
+uses GitHub's immutable owner/repository-ID OIDC subject customization. Every
+\`--github-repository\` must be accompanied by both
+\`--github-owner-id=<numeric-id>\` and
+\`--github-repository-id=<numeric-id>\`; a partial or name-only subject is
+rejected. Obtain the canonical slug and IDs from the GitHub bootstrap report,
+but do not enable immutable subjects yet for an existing repository. First apply the rendered
+\`ownership-template.json\` as the owner-claim stack named in
+\`ownership-manifest.json\`. CloudFormation creates the retained
+\`/ebk/<stage>/workspace-owner\` record atomically. Then apply
+\`template.json\` as the authority stack shown in \`manifest.json\`; its
+CloudFormation Rule reads the exact owner before any IAM change. A second
+workspace therefore cannot address the same account, Region, and stage tuple,
+while a clone retaining the committed deployment ID reuses both stacks.
+Read back and simulate the effective immutable-subject trust, then apply the
+GitHub bootstrap change that configures the repository's default immutable OIDC
+subject. This AWS-trust-first order prevents an existing protected deployment
+from being stranded between the subject-format and trust-policy changes.
+Existing deployed workspaces must first commit the explicit migration evidence
+described in \`docs/workspace-deployment-ownership.md\`; never claim an existing
+tuple by editing policy directly. Read back the deployed template and policies
 and compare their canonical digests before any application mutation. Simulate
 representative permitted lifecycle calls and denied account, trust,
 boundary-removal, cross-stage, cross-account, and cross-Region calls against
@@ -90,14 +108,28 @@ The role may inspect secret metadata. SST 4.17.1's generated Foundation Aurora
 credential is the one value exception: the temporary deployer may put and read
 that exact stage/account/Region-bound secret version so the pinned provider can
 create and reconcile it. The reserved name must also carry the exact
-\`ebk:stage\` tag. Operator-secret and all other secret values remain denied.
-Because \`CreateSecret\` and
-\`UpdateSecret\` can optionally carry a value, IAM cannot distinguish a
-metadata-only call; reviewed generated source and CloudTrail are the honest
-controls for those two provider APIs.
+\`ebk:stage\` tag. \`GetSecretValue\` and \`PutSecretValue\` remain denied for
+operator-secret and all other Slice containers.
+Generated source creates Slice containers inside the deterministic
+\`ebk/<stage>/*\` namespace. The temporary deployer's \`UpdateSecret\` authority
+is denied outside that namespace and the exact generated Foundation
+provider-secret identity. Imported, externally owned or shared, unmanaged,
+other-stage, cross-account, and cross-Region containers remain outside this
+update authority. The namespace is reserved for EBK-owned, stage-exclusive
+containers, including explicitly approved cross-Slice use; imported or
+externally owned containers must use a name outside it. The namespace contract
+covers generated database, machine-client, generated-value, and EBK-owned
+operator containers without adding a new IAM exception for every provider
+resource type. It does not admit
+\`GetSecretValue\` or \`PutSecretValue\` for Slice containers. Because
+\`CreateSecret\` and \`UpdateSecret\` can optionally carry a value, IAM cannot
+distinguish a metadata-only call; reviewed generated source, temporary
+credentials, the stage namespace, and CloudTrail are the honest controls for
+those provider APIs.
 SSM value reads are limited to the stage's Foundation configuration, SST 4.17.1
-bootstrap record, stage-qualified SST passphrases, and SST's VPC private-key
-reference. Foundation removal enumerates Product Slice registration names and
+bootstrap record, stage-qualified SST passphrases, SST's VPC private-key
+reference, and the exact retained workspace-owner record. The deployment role
+can read but cannot change or delete that owner. Foundation removal enumerates Product Slice registration names and
 metadata without reading their values. Recursive and historical SSM value reads
 are denied. These controls,
 the exact trust, temporary credentials, requested Region, known account/stage
@@ -116,8 +148,67 @@ bootstrap state and assets. Tag and name denies are defense in depth, not a hard
 IAM boundary between same-account deployment roles. Choose
 \`production-isolated\` when production requires an AWS-enforced deployment
 blast-radius boundary from development and staging.
+`,
+        'docs/workspace-deployment-ownership.md': `# Workspace deployment ownership
+
+Every generated workspace commits one stable, random \`workspaceDeploymentId\`
+and \`workspaceDeploymentProvenance: { kind: "fresh", schemaVersion: 1 }\`.
+That identity belongs to the workspace, not to a checkout: clones with the same
+committed policy are the same deployment owner.
+
+Before authority or SST lifecycle work, each active account/Region/canonical
+stage tuple must contain exactly one retained String parameter at
+\`/ebk/<stage>/workspace-owner\`. The value binds the tuple to the generated
+deployment ID; the current workspace name remains diagnostic metadata and may
+be renamed without transferring authority. The ownership claim is deliberately
+exclusive and retained. Two workspaces do not cohabit one tuple, and removing
+an application stack does not release the claim.
+
+Render stage authority with \`pnpm nx run ${options.name}:stage-authority-render --
+--stage=<stage> ...\`. Apply the emitted \`ownership-template.json\` as the exact
+claim stack in \`ownership-manifest.json\` before applying the authority template.
+CloudFormation's fixed-name SSM create is the atomic claim. The authority
+template accepts only that exact parameter path and fails its Rule before any
+IAM change unless its value is the exact committed owner. The deployment role
+may read the owner but is explicitly denied every owner mutation.
+
+For a read-only report, run
+\`node tools/stage-authority-render.mjs --stage=<stage> --ownership-doctor=true
+--profile=<temporary-profile>\`. It reports \`owned\`, \`unclaimed\`, or \`conflict\`;
+a conflict identifies the committed owner without changing AWS.
+
+## Existing prerelease deployments
+
+An existing policy without the required deployment identity provenance is fail
+closed. Inventory
+each configured tuple read-only and commit bounded evidence under
+\`docs/adoption/\`. The evidence must bind the exact prior policy SHA-256,
+workspace name, proposed \`ebkws-<32 lowercase hex>\` ID, and every configured
+tuple. The ID, exact Region, and every active-stage account must be committed in
+the same migration change; an empty interim topology cannot reserve future
+coordinates. Each tuple declares \`empty\` with no resource digests or
+\`existing-workspace\` with sorted SHA-256 digests of its bounded resource
+identity evidence. Then run the repository-policy generator with both
+\`--workspaceDeploymentId\` and
+\`--workspaceDeploymentMigrationEvidence\`. Report-only mode shows the exact
+result with \`workspaceDeploymentProvenance.kind: "migrated"\`; \`--apply\`
+commits it. Every later policy read revalidates the retained evidence bytes,
+workspace identity, the syntactically valid diagnostic name recorded at migration,
+and exact active stage/account/Region tuple set. The current package name may be
+renamed without renewing ownership evidence because authority is bound to the
+immutable deployment ID rather than that diagnostic label.
+A profile, account, or Region change for a migrated workspace requires a new
+versioned evidence path whose previous-policy digest binds the current policy;
+unrelated policy changes retain the existing binding.
+
+This migration is an explicit ownership assertion, not automatic discovery.
+Never use it to adopt a tuple whose resources belong to another workspace. An
+occupied but unclaimed tuple requires reviewed evidence that the existing
+resources belong to this workspace. There is no implicit compatibility claim,
+ownership transfer, or force-adoption path.
 `,
         'tools/stage-authority-render.mjs': `import {
+  assertBoundStageAuthorityTemplateFitsBodyLimit,
   canonicalStageAuthorityTemplate,
   createStageAuthorityPlan,
 } from '@empire-builder-kit/nx/aws-authority';
@@ -125,9 +216,15 @@ import {
   configuredDeploymentAccountForStage,
   configuredDeploymentRegion,
   isActiveDeploymentStage,
+  readRepositoryOperatingPolicy,
   requiresGithubDeployment,
-  validateRepositoryOperatingPolicy,
 } from '@empire-builder-kit/nx/repository-policy';
+import {
+  bindStageAuthorityTemplateToWorkspaceOwner,
+  canonicalWorkspaceStageOwner,
+  createWorkspaceStageOwnershipClaimPlan,
+  inspectWorkspaceStageOwnership,
+} from '@empire-builder-kit/nx/workspace-deployment';
 import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -150,19 +247,22 @@ const stage = values.get('stage');
 if (!['development', 'staging', 'production'].includes(stage)) {
   throw new Error('--stage must be development, staging, or production.');
 }
-const policyResult = validateRepositoryOperatingPolicy(
-  JSON.parse(readFileSync('ebk.repository-policy.json', 'utf8')),
-);
-if (!policyResult.valid) {
-  throw new Error(
-    'Repository Operating Policy is invalid:\\n' +
-      policyResult.issues.map(({ message, path }) => '- ' + path + ': ' + message).join('\\n'),
-  );
+const policy = readRepositoryOperatingPolicy(process.cwd());
+const rootPackage = JSON.parse(readFileSync('package.json', 'utf8'));
+const workspaceName = rootPackage?.name;
+if (
+  typeof workspaceName !== 'string' ||
+  workspaceName.length > 214 ||
+  !/^(?:@[a-z0-9][a-z0-9._~-]*\\/)?[a-z0-9][a-z0-9._~-]*$/.test(workspaceName)
+) {
+  throw new Error('Workspace ownership requires the current generated root package name.');
 }
-const policy = policyResult.value;
 if (policy.deploymentProfile !== '${options.deploymentProfile}') {
   throw new Error('Generated and committed deployment profiles differ.');
 }
+if (policy.workspaceDeploymentId !== '${options.workspaceDeploymentId}') {
+  throw new Error('Generated and committed workspace deployment identities differ.');
+}
 if (!isActiveDeploymentStage(policy.deploymentProfile, stage)) {
   throw new Error('Requested stage is inactive for the committed deployment profile.');
 }
@@ -172,11 +272,66 @@ const accountId = configuredDeploymentAccountForStage(
   stage,
 );
 const region = configuredDeploymentRegion(policy.deploymentRegion);
+if (/^(?:us-iso-|us-isob-|eu-isoe-|us-isof-)/.test(region)) {
+  throw new Error(
+    'The committed Region belongs to an unsupported AWS partition. Generated authority supports aws, aws-cn, and aws-us-gov only.',
+  );
+}
 const partition = region.startsWith('cn-')
   ? 'aws-cn'
   : region.startsWith('us-gov-')
     ? 'aws-us-gov'
     : 'aws';
+const ownershipTarget = {
+  accountId,
+  region,
+  stage,
+  workspaceDeploymentId: policy.workspaceDeploymentId,
+  workspaceName,
+};
+const ownershipDoctor = values.get('ownership-doctor');
+if (ownershipDoctor !== undefined && ownershipDoctor !== 'true') {
+  throw new Error('--ownership-doctor must be exactly true when supplied.');
+}
+if (ownershipDoctor === 'true') {
+  if (principals.length > 0 || values.has('github-repository')) {
+    throw new Error('Workspace ownership doctor does not accept authority trust inputs.');
+  }
+  const profile = values.get('profile');
+  const [{ GetCallerIdentityCommand, STSClient }, { fromIni }] = await Promise.all([
+    import('@aws-sdk/client-sts'),
+    import('@aws-sdk/credential-providers'),
+  ]);
+  const credentials = profile ? fromIni({ profile }) : undefined;
+  const identity = await new STSClient({
+    ...(credentials ? { credentials } : {}),
+    region,
+  }).send(new GetCallerIdentityCommand({}));
+  if (identity.Account !== accountId) {
+    throw new Error('Workspace ownership doctor caller differs from the committed stage account.');
+  }
+  const inspection = await inspectWorkspaceStageOwnership(
+    ownershipTarget,
+    profile ? { profile } : {},
+  );
+  process.stdout.write(JSON.stringify({
+    accountId,
+    expectedOwner: inspection.expectedOwner,
+    kind: 'ebk-workspace-stage-owner-doctor',
+    parameterArn: inspection.parameterArn,
+    region,
+    ...(inspection.status === 'owned'
+      ? { owner: inspection.expectedOwner }
+      : inspection.status === 'conflict' && inspection.actualOwner
+        ? { owner: inspection.actualOwner }
+        : {}),
+    ...(inspection.status === 'conflict' ? { reason: inspection.reason } : {}),
+    schemaVersion: 1,
+    stage,
+    status: inspection.status,
+  }, null, 2) + '\\n');
+  if (inspection.status !== 'owned') process.exitCode = 1;
+} else {
 const repository = values.get('github-repository');
 if (repository && !/^[A-Za-z0-9_.-]+[/][A-Za-z0-9_.-]+$/.test(repository)) {
   throw new Error('--github-repository must be one exact owner/repository slug.');
@@ -184,8 +339,10 @@ if (repository && !/^[A-Za-z0-9_.-]+[/][A-Za-z0-9_.-]+$/.test(repository)) {
 const githubOwnerId = values.get('github-owner-id');
 const githubRepositoryId = values.get('github-repository-id');
 const githubId = /^[1-9][0-9]{0,19}$/;
-if (Boolean(githubOwnerId) !== Boolean(githubRepositoryId)) {
-  throw new Error('--github-owner-id and --github-repository-id must be supplied together.');
+if (repository && (!githubOwnerId || !githubRepositoryId)) {
+  throw new Error(
+    '--github-repository requires both --github-owner-id and --github-repository-id.',
+  );
 }
 if ((githubOwnerId || githubRepositoryId) && !repository) {
   throw new Error('Immutable GitHub IDs require --github-repository.');
@@ -197,36 +354,35 @@ if (
   throw new Error('Immutable GitHub owner and repository IDs must be positive bounded integers.');
 }
 const githubOnly = requiresGithubDeployment(policy.deploymentProfile, stage);
-const githubOptional = policy.deploymentProfile === 'starter';
-if (githubOnly) {
-  if (!repository) {
-    throw new Error(
-      'This stage requires protected GitHub deployment and one exact --github-repository trust.',
-    );
-  }
-  if (principals.length > 0) {
-    throw new Error(
-      'Protected GitHub deployment stages reject local --aws-principal-arn trust.',
-    );
-  }
-} else {
-  if (principals.length === 0) {
-    throw new Error(
-      'Locally admitted stages require at least one reviewed --aws-principal-arn.',
-    );
-  }
-  if (repository && !githubOptional) {
-    throw new Error(
-      'This locally admitted isolated-profile stage does not permit GitHub trust.',
-    );
-  }
+const productionIsolatedStaging =
+  policy.deploymentProfile === 'production-isolated' && stage === 'staging';
+const localRequired = !githubOnly;
+const githubRequired = githubOnly || productionIsolatedStaging;
+const githubAllowed = githubRequired || policy.deploymentProfile === 'starter';
+if (localRequired && principals.length === 0) {
+  throw new Error(
+    'Locally admitted stages require at least one reviewed --aws-principal-arn.',
+  );
+}
+if (!localRequired && principals.length > 0) {
+  throw new Error(
+    'Protected GitHub deployment stages reject local --aws-principal-arn trust.',
+  );
+}
+if (githubRequired && !repository) {
+  throw new Error(
+    'This stage requires protected GitHub deployment and one exact --github-repository trust.',
+  );
+}
+if (repository && !githubAllowed) {
+  throw new Error(
+    'This locally admitted isolated-profile stage does not permit GitHub trust.',
+  );
 }
 const [githubOwner, githubRepository] = repository?.split('/') ?? [];
 const githubSubject = repository
   ? 'repo:' +
-    (githubOwnerId
-      ? githubOwner + '@' + githubOwnerId + '/' + githubRepository + '@' + githubRepositoryId
-      : repository) +
+    githubOwner + '@' + githubOwnerId + '/' + githubRepository + '@' + githubRepositoryId +
     ':environment:' + stage
   : undefined;
 const plan = createStageAuthorityPlan({
@@ -245,16 +401,52 @@ const plan = createStageAuthorityPlan({
   partition,
   stage,
 });
+const ownership = createWorkspaceStageOwnershipClaimPlan(ownershipTarget);
+const authorityTemplate = bindStageAuthorityTemplateToWorkspaceOwner(
+  plan.template,
+  ownershipTarget,
+);
+assertBoundStageAuthorityTemplateFitsBodyLimit(authorityTemplate);
+const template = canonicalStageAuthorityTemplate(authorityTemplate);
 const directory = join('.ebk', 'authority', stage);
 mkdirSync(directory, { mode: 0o700, recursive: true });
-const template = canonicalStageAuthorityTemplate(plan.template);
 const templatePath = join(directory, 'template.json');
 const manifestPath = join(directory, 'manifest.json');
+const ownershipTemplate = canonicalStageAuthorityTemplate(ownership.template);
+const ownershipTemplatePath = join(directory, 'ownership-template.json');
+const ownershipManifestPath = join(directory, 'ownership-manifest.json');
 writeFileSync(templatePath, template, { encoding: 'utf8', mode: 0o600 });
+writeFileSync(ownershipTemplatePath, ownershipTemplate, {
+  encoding: 'utf8',
+  mode: 0o600,
+});
+const ownershipTemplateSha256 = createHash('sha256')
+  .update(ownershipTemplate)
+  .digest('hex');
+const ownershipManifest = {
+  accountId,
+  digest: ownershipTemplateSha256,
+  kind: 'ebk-workspace-stage-owner-claim',
+  parameterArn: ownership.parameterArn,
+  parameterName: ownership.parameterName,
+  region,
+  schemaVersion: 1,
+  stackName: ownership.stackName,
+  stage,
+  templateSha256: ownershipTemplateSha256,
+  workspaceDeploymentId: policy.workspaceDeploymentId,
+  workspaceName,
+};
+writeFileSync(
+  ownershipManifestPath,
+  JSON.stringify(ownershipManifest, null, 2) + '\\n',
+  { encoding: 'utf8', mode: 0o600 },
+);
+const templateSha256 = createHash('sha256').update(template).digest('hex');
 const manifest = {
   accountId,
   deploymentRoleArn: plan.identity.deploymentRoleArn,
-  digest: plan.digest,
+  digest: templateSha256,
   kind: 'ebk-stage-authority-render',
   limitations: plan.limitations,
   profile: policy.deploymentProfile,
@@ -262,13 +454,25 @@ const manifest = {
   schemaVersion: 1,
   stackName: plan.identity.stackName,
   stage,
-  templateSha256: createHash('sha256').update(template).digest('hex'),
+  templateSha256,
+  workspaceDeploymentId: policy.workspaceDeploymentId,
+  workspaceName,
+  workspaceOwner: canonicalWorkspaceStageOwner(ownershipTarget),
+  workspaceOwnerClaimStackName: ownership.stackName,
+  workspaceOwnerManifestPath: ownershipManifestPath,
 };
 writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\\n', {
   encoding: 'utf8',
   mode: 0o600,
 });
-process.stdout.write(JSON.stringify({ manifestPath, ...manifest, templatePath }) + '\\n');
+process.stdout.write(JSON.stringify({
+  manifestPath,
+  ...manifest,
+  ownershipManifestPath,
+  ownershipTemplatePath,
+  templatePath,
+}) + '\\n');
+}
 `,
     };
 }

package/src/generators/preset/workspace-files-stage-authority.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-files-stage-authority.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-stage-authority.ts"],"names":[],"mappings":";;AAEA,gFAgRC;AAhRD,SAAgB,kCAAkC,CAAC,OAElD;IACC,OAAO;QACL,oCAAoC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiHzC;QACG,kCAAkC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA2CJ,OAAO,CAAC,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6G5D;KACE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-files-stage-authority.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-stage-authority.ts"],"names":[],"mappings":";;AAEA,gFA8dC;AA9dD,SAAgB,kCAAkC,CAAC,OAIlD;IACC,OAAO;QACL,oCAAoC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiJzC;QACG,wCAAwC,EAAE;;;;;;;;;;;;;;;4CAeF,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CvD;QACG,kCAAkC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCAkDJ,OAAO,CAAC,iBAAiB;;;wCAGrB,OAAO,CAAC,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqNpE;KACE,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-thin-deploy.d.ts

@@ -10,7 +10,6 @@ export interface ThinDeployActionPins {
 }
 export interface ThinDeployToolVersions {
     node: string;
-    pnpm: string;
     sst: string;
 }
 export interface ThinDeployWorkflowOptions {
@@ -24,6 +23,12 @@ export interface ThinDeployWorkflowFilePlan {
     managedPaths: readonly [typeof THIN_DEPLOY_WORKFLOW_PATH];
 }
 export declare function renderThinDeployVerifyCaller(profile: DeploymentProfile): string;
+/** @internal Exported for executable source-contract tests. */
+export declare function exactStageDeployerGuardScript(operation: string, accountVariable: string): string;
+/** @internal Shared verbatim by every generated protected workflow. */
+export declare function canonicalStageAuthorityDerivationScript(): string;
+/** @internal Exported for executable source-contract tests. */
+export declare function exactStagingPromotionPullGuardScript(): string;
 /** @internal Shared verbatim with the generated workflow and executable tests. */
 export declare function stagingPromotionReceiptValidationScript(): string;
 /** @internal Shared verbatim with the generated workflow and executable tests. */