@empire-builder-kit/nx 1.0.0-rc.31 → 1.0.0-rc.32

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.THIN_DEPLOY_WORKFLOW_PATH = void 0;
 exports.renderThinDeployVerifyCaller = renderThinDeployVerifyCaller;
+exports.exactStageDeployerGuardScript = exactStageDeployerGuardScript;
+exports.canonicalStageAuthorityDerivationScript = canonicalStageAuthorityDerivationScript;
+exports.exactStagingPromotionPullGuardScript = exactStagingPromotionPullGuardScript;
 exports.stagingPromotionReceiptValidationScript = stagingPromotionReceiptValidationScript;
 exports.restoredCandidateValidationScript = restoredCandidateValidationScript;
 exports.stagingPromotionSealScript = stagingPromotionSealScript;
@@ -51,9 +54,7 @@ function workflowCallTrigger(profile) {
 function renderThinDeployVerifyCaller(profile) {
     if (profile === 'starter')
         return '';
-    const protectedBranchCondition = profile === 'production-isolated'
-        ? "github.ref == 'refs/heads/main'"
-        : "(github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main')";
+    const protectedBranchCondition = "(github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main')";
     return `
 
   deploy:
@@ -86,6 +87,73 @@ function indentedScript(source, spaces) {
         .map((line) => `${prefix}${line}`)
         .join('\n');
 }
+/** @internal Exported for executable source-contract tests. */
+function exactStageDeployerGuardScript(operation, accountVariable) {
+    return `read -r caller_account caller_arn <<< "$(aws sts get-caller-identity --query '[Account,Arn]' --output text)"
+[ "$caller_account" = "${accountVariable}" ] || {
+  echo '${operation} caller account differs from committed policy'; exit 1;
+}
+caller_partition="\${caller_arn#arn:}"
+caller_partition="\${caller_partition%%:*}"
+[ "$caller_partition" = "$AWS_PARTITION" ] || {
+  echo '${operation} caller partition differs from committed policy'; exit 1;
+}
+expected_role_arn="arn:$AWS_PARTITION:iam::${accountVariable}:role/ebk/$EBK_STAGE/deployment/ebk-$EBK_STAGE-deploy"
+[ "$AWS_DEPLOY_ROLE_ARN" = "$expected_role_arn" ] || {
+  echo '${operation} configured role is not the canonical stage deployer'; exit 1;
+}
+expected_caller_prefix="arn:$AWS_PARTITION:sts::${accountVariable}:assumed-role/ebk-$EBK_STAGE-deploy/"
+case "$caller_arn" in
+  "$expected_caller_prefix"?*) ;;
+  *) echo '${operation} caller is not the exact stage deployer'; exit 1 ;;
+esac`;
+}
+/** @internal Shared verbatim by every generated protected workflow. */
+function canonicalStageAuthorityDerivationScript() {
+    return `case "$EBK_STAGE" in
+  development) account_id="$EBK_DEVELOPMENT_ACCOUNT" ;;
+  staging) account_id="$EBK_STAGING_ACCOUNT" ;;
+  production) account_id="$EBK_PRODUCTION_ACCOUNT" ;;
+  *) exit 1 ;;
+esac
+case "$account_id" in *[!0-9]*|'') exit 1 ;; esac
+[ "\${#account_id}" -eq 12 ]
+case "$EBK_REGION" in
+  cn-*) partition=aws-cn; audience=sts.amazonaws.com.cn ;;
+  us-gov-*) partition=aws-us-gov; audience=sts.amazonaws.com ;;
+  us-iso-*|us-isob-*|eu-isoe-*|us-isof-*)
+    echo 'The committed Region belongs to an unsupported AWS partition.' >&2
+    exit 1
+    ;;
+  *) partition=aws; audience=sts.amazonaws.com ;;
+esac
+role_arn="arn:$partition:iam::$account_id:role/ebk/$EBK_STAGE/deployment/ebk-$EBK_STAGE-deploy"
+echo "account_id=$account_id" >> "$GITHUB_OUTPUT"
+echo "audience=$audience" >> "$GITHUB_OUTPUT"
+echo "partition=$partition" >> "$GITHUB_OUTPUT"
+echo "role_arn=$role_arn" >> "$GITHUB_OUTPUT"`;
+}
+/** @internal Exported for executable source-contract tests. */
+function exactStagingPromotionPullGuardScript() {
+    return `read -r caller_account caller_arn <<< "$(aws sts get-caller-identity --query '[Account,Arn]' --output text)"
+[ "$caller_account" = "$EBK_STAGING_ACCOUNT_ID" ] || {
+  echo 'Staging registry caller account differs from committed policy'; exit 1;
+}
+caller_partition="\${caller_arn#arn:}"
+caller_partition="\${caller_partition%%:*}"
+[ "$caller_partition" = "$AWS_PARTITION" ] || {
+  echo 'Staging registry caller partition differs from committed policy'; exit 1;
+}
+expected_role_arn="arn:$AWS_PARTITION:iam::$EBK_STAGING_ACCOUNT_ID:role/ebk/promotion/ebk-staging-promotion-pull"
+[ "$AWS_STAGING_PROMOTION_PULL_ROLE_ARN" = "$expected_role_arn" ] || {
+  echo 'Staging registry configured role is not the canonical promotion pull role'; exit 1;
+}
+expected_caller_prefix="arn:$AWS_PARTITION:sts::$EBK_STAGING_ACCOUNT_ID:assumed-role/ebk-staging-promotion-pull/"
+case "$caller_arn" in
+  "$expected_caller_prefix"?*) ;;
+  *) echo 'Staging registry caller is not the exact promotion pull role'; exit 1 ;;
+esac`;
+}
 /** @internal Shared verbatim with the generated workflow and executable tests. */
 function stagingPromotionReceiptValidationScript() {
     return `import { createHash } from 'node:crypto';
@@ -395,12 +463,15 @@ jobs:
       account_id: \${{ steps.account.outputs.account_id }}
       has_slices: \${{ steps.policy.outputs.has_slices }}
       ordered_projects: \${{ steps.policy.outputs.ordered_projects }}
+      oidc_audience: \${{ steps.account.outputs.audience }}
+      partition: \${{ steps.account.outputs.partition }}
       profile: \${{ steps.policy.outputs.deployment_profile }}
       project: \${{ steps.route.outputs.project }}
       region: \${{ steps.policy.outputs.deployment_region }}
       slice_projects: \${{ steps.policy.outputs.slice_projects }}
       staging_account_id: \${{ steps.policy.outputs.staging_account_id }}
       stage: \${{ steps.route.outputs.stage }}
+      stage_deploy_role_arn: \${{ steps.account.outputs.role_arn }}
     steps:
       - name: Verify exact protected branch tip before setup
         env:
@@ -453,8 +524,6 @@ jobs:
           persist-credentials: false
           ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
       - uses: ${actionPins.pnpmSetup}
-        with:
-          version: ${toolVersions.pnpm}
       - uses: ${actionPins.setupNode}
         with:
           node-version: ${toolVersions.node}
@@ -516,23 +585,15 @@ jobs:
           EBK_REPOSITORY_PROFILE: \${{ steps.policy.outputs.deployment_profile }}
         run: test "$EBK_RENDERED_PROFILE" = "$EBK_REPOSITORY_PROFILE"
       - id: account
-        name: Select committed stage account
+        name: Derive canonical committed stage authority
         env:
           EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
           EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
           EBK_STAGE: \${{ steps.route.outputs.stage }}
           EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
         run: |
-          set -euo pipefail
-          case "$EBK_STAGE" in
-            development) account_id="$EBK_DEVELOPMENT_ACCOUNT" ;;
-            staging) account_id="$EBK_STAGING_ACCOUNT" ;;
-            production) account_id="$EBK_PRODUCTION_ACCOUNT" ;;
-            *) exit 1 ;;
-          esac
-          case "$account_id" in *[!0-9]*|'') exit 1 ;; esac
-          [ "\${#account_id}" -eq 12 ]
-          echo "account_id=$account_id" >> "$GITHUB_OUTPUT"
+${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()}`, 10)}
 
   immutable-artifacts:
     name: prepare exact immutable release artifacts
@@ -739,15 +800,16 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       contents: read
       id-token: write
     env:
-      AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
       AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
       AWS_REGION: \${{ vars.AWS_REGION }}
       EBK_ACTION: deploy
       EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
       EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
       EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
-      EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: \${{ needs.prepare.outputs.stage }}
       EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
     steps:
@@ -764,8 +826,6 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
-        with:
-          version: ${toolVersions.pnpm}
       - uses: ${actionPins.setupNode}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
@@ -812,6 +872,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       - name: Assume the current stage deployment role for container build
         uses: ${actionPins.configureAwsCredentials}
         with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
           aws-region: \${{ vars.AWS_REGION }}
           role-session-name: ebk-container-\${{ matrix.architecture }}-\${{ github.run_id }}-\${{ github.run_attempt }}
           role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
@@ -824,6 +885,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       - name: Build and run exact native OCI artifacts
         run: |
           set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Container build', '$EBK_POLICY_ACCOUNT_ID'), 10)}
           IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
           for project in "\${projects[@]}"; do
             test -n "$project" || continue
@@ -858,15 +920,16 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       artifact_digest: \${{ steps.retain.outputs.artifact-digest }}
       artifact_id: \${{ steps.retain.outputs.artifact-id }}
     env:
-      AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
       AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
       AWS_REGION: \${{ vars.AWS_REGION }}
       EBK_ACTION: deploy
       EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
       EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
       EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
-      EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: \${{ needs.prepare.outputs.stage }}
       EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
     steps:
@@ -883,8 +946,6 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
-        with:
-          version: ${toolVersions.pnpm}
       - uses: ${actionPins.setupNode}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
@@ -940,6 +1001,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       - name: Assume the current stage deployment role for container assembly
         uses: ${actionPins.configureAwsCredentials}
         with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
           aws-region: \${{ vars.AWS_REGION }}
           role-session-name: ebk-container-assemble-\${{ github.run_id }}-\${{ github.run_attempt }}
           role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
@@ -952,6 +1014,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       - name: Assemble exact dual-architecture indexes
         run: |
           set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Container assembly', '$EBK_POLICY_ACCOUNT_ID'), 10)}
           IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
           for project in "\${projects[@]}"; do
             test -n "$project" || continue
@@ -993,8 +1056,9 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       artifact_digest: \${{ steps.retain.outputs.artifact-digest }}
       artifact_id: \${{ steps.retain.outputs.artifact-id }}
     env:
-      AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
       AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
       AWS_REGION: \${{ vars.AWS_REGION }}
       EBK_ACTION: deploy
       EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
@@ -1002,7 +1066,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
       EBK_POLICY_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
-      EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: production
       EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
     steps:
@@ -1019,8 +1083,6 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
-        with:
-          version: ${toolVersions.pnpm}
       - uses: ${actionPins.setupNode}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
@@ -1077,17 +1139,20 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       - name: Assume exact staging registry pull role
         uses: ${actionPins.configureAwsCredentials}
         with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
           aws-region: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
           role-session-name: ebk-staging-container-pull-\${{ github.run_id }}-\${{ github.run_attempt }}
           role-to-assume: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
       - name: Authenticate exact staging source registry
         env:
+          AWS_STAGING_PROMOTION_PULL_ROLE_ARN: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
           EBK_STAGING_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
           EBK_STAGING_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
         run: |
           set -euo pipefail
           [ "$EBK_STAGING_ACCOUNT_ID" = "$EBK_POLICY_STAGING_ACCOUNT_ID" ]
-          [ "$(aws sts get-caller-identity --query Account --output text)" = "$EBK_STAGING_ACCOUNT_ID" ]
+          [ "$EBK_STAGING_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStagingPromotionPullGuardScript(), 10)}
           [ "$EBK_STAGING_ACCOUNT_ID" != "$AWS_EXPECTED_ACCOUNT_ID" ]
           registry_suffix=.com
           case "$EBK_STAGING_REGION" in cn-*) registry_suffix=.com.cn ;; esac
@@ -1114,6 +1179,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       - name: Assume the production deployment role for container promotion
         uses: ${actionPins.configureAwsCredentials}
         with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
           aws-region: \${{ vars.AWS_REGION }}
           role-session-name: ebk-production-container-push-\${{ github.run_id }}-\${{ github.run_attempt }}
           role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
@@ -1125,7 +1191,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
           set -euo pipefail
           [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ]
           [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
-          [ "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID" ]
+${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPECTED_ACCOUNT_ID'), 10)}
           IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
           for project in "\${projects[@]}"; do
             test -n "$project" || continue
@@ -1181,8 +1247,9 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       contents: read
       id-token: write
     env:
-      AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
       AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
       AWS_REGION: \${{ vars.AWS_REGION }}
       EBK_ACTION: \${{ needs.prepare.outputs.action }}
       EBK_ALLOW_PRODUCTION_REMOVE: \${{ vars.EBK_ALLOW_PRODUCTION_REMOVE }}
@@ -1195,9 +1262,9 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       EBK_ORDERED_PROJECTS: \${{ needs.prepare.outputs.ordered_projects }}
       EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
       EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
-      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit || env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit || inputs.source_commit || github.sha }}
       EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
-      EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: \${{ needs.prepare.outputs.stage }}
     steps:
       - name: Check out immutable deployment source
@@ -1213,8 +1280,6 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
-        with:
-          version: ${toolVersions.pnpm}
       - uses: ${actionPins.setupNode}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
@@ -1355,6 +1420,7 @@ ${indentedScript(restoredCandidateValidationScript(), 10)}
       - name: Assume the one stage deployment role
         uses: ${actionPins.configureAwsCredentials}
         with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
           aws-region: \${{ vars.AWS_REGION }}
           role-session-name: ebk-native-\${{ github.run_id }}-\${{ github.run_attempt }}
           role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
@@ -1363,7 +1429,7 @@ ${indentedScript(restoredCandidateValidationScript(), 10)}
           set -euo pipefail
           [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
           [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
-          [ "$(aws sts get-caller-identity --query Account --output text)" = "$EBK_POLICY_ACCOUNT_ID" ]
+${indentedScript(exactStageDeployerGuardScript('Native lifecycle', '$EBK_POLICY_ACCOUNT_ID'), 10)}
       - name: Run ordered native lifecycle targets
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''

package/src/generators/preset/workspace-files-thin-deploy.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-files-thin-deploy.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-deploy.ts"],"names":[],"mappings":";;;AA4EA,oEA+BC;AAYD,0FAiFC;AAGD,8EAmCC;AAGD,gEA4EC;AAGD,gFAoEC;AA+iCD,4EAUC;AA37CY,QAAA,yBAAyB,GACpC,8BAAuC,CAAC;AA6B1C,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,MAAM,UAAU,GACd,iEAAiE,CAAC;AAEpE,SAAS,aAAa,CAAC,OAAkC;IACvD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA0B;IACrD,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;;;;;;;;;;;;;;CAiBL,CAAC;AACF,CAAC;AAED,SAAgB,4BAA4B,CAC1C,OAA0B;IAE1B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,OAAO,KAAK,qBAAqB;QAC/B,CAAC,CAAC,iCAAiC;QACnC,CAAC,CAAC,yEAAyE,CAAC;IAChF,OAAO;;;;;;;;QAQD,wBAAwB;;;;;;;;;;;;;;2CAcW,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,MAAM;SACV,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,kFAAkF;AAClF,SAAgB,uCAAuC;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4HA+EmH,CAAC;AAC7H,CAAC;AAED,kFAAkF;AAClF,SAAgB,iCAAiC;IAC/C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wGAiC+F,CAAC;AACzG,CAAC;AAED,kFAAkF;AAClF,SAAgB,0BAA0B;IACxC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uHA0E8G,CAAC;AACxH,CAAC;AAED,kFAAkF;AAClF,SAAgB,kCAAkC;IAChD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEN,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAkC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACtE,OAAO;;;;EAIP,mBAAmB,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;8BAwBV,YAAY,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA+D9B,UAAU,CAAC,QAAQ;;;;;gBAKnB,UAAU,CAAC,SAAS;;qBAEf,YAAY,CAAC,IAAI;gBACtB,UAAU,CAAC,SAAS;;0BAEV,YAAY,CAAC,IAAI;;;;;;;;yBAQlB,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4ClB,IAAI;;;kCAGM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAiDnC,UAAU,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6FnB,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;EAwBzC,cAAc,CAAC,uCAAuC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0E/C,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;;qBAKf,YAAY,CAAC,IAAI;gBACtB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;;;;;;gBAoBlC,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAyCzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;;qBAKf,YAAY,CAAC,IAAI;gBACtB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0BlC,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2CzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;;qBAKf,YAAY,CAAC,IAAI;gBACtB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAqClC,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;gBAuBlC,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAkEzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;;qBAKf,YAAY,CAAC,IAAI;gBACtB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;;gBAGf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;gBAiB3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;gBAa3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCzC,cAAc,CAAC,iCAAiC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAiC9B,IAAI;;;;;;2BAMJ,IAAI;;;;;;;;;;;;;;;;;;;gBAmBf,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;;;;;;0BAoBxB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;EAwB5B,cAAc,CAAC,0BAA0B,EAAE,EAAE,EAAE,CAAC;;;;;;;;;EAShD,cAAc,CAAC,kCAAkC,EAAE,EAAE,EAAE,CAAC;;;;gBAI1C,UAAU,CAAC,cAAc;;;;;;;;;;CAUxC,CAAC;AACF,CAAC;AAED,SAAgB,gCAAgC,CAC9C,OAAkC;IAElC,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO;QACL,KAAK,EAAE;YACL,CAAC,iCAAyB,CAAC,EAAE,wBAAwB,CAAC,OAAO,CAAC;SAC/D;QACD,YAAY,EAAE,CAAC,iCAAyB,CAAC;KAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-files-thin-deploy.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-deploy.ts"],"names":[],"mappings":";;;AA2EA,oEA6BC;AAYD,sEAsBC;AAGD,0FAuBC;AAGD,oFAmBC;AAGD,0FAiFC;AAGD,8EAmCC;AAGD,gEA4EC;AAGD,gFAoEC;AA6iCD,4EAUC;AA//CY,QAAA,yBAAyB,GACpC,8BAAuC,CAAC;AA4B1C,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,MAAM,UAAU,GACd,iEAAiE,CAAC;AAEpE,SAAS,aAAa,CAAC,OAAkC;IACvD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA0B;IACrD,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;;;;;;;;;;;;;;CAiBL,CAAC;AACF,CAAC;AAED,SAAgB,4BAA4B,CAC1C,OAA0B;IAE1B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,yEAAyE,CAAC;IAC5E,OAAO;;;;;;;;QAQD,wBAAwB;;;;;;;;;;;;;;2CAcW,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,MAAM;SACV,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,+DAA+D;AAC/D,SAAgB,6BAA6B,CAC3C,SAAiB,EACjB,eAAuB;IAEvB,OAAO;yBACgB,eAAe;UAC9B,SAAS;;;;;UAKT,SAAS;;6CAE0B,eAAe;;UAElD,SAAS;;kDAE+B,eAAe;;;aAGpD,SAAS;KACjB,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,SAAgB,uCAAuC;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;8CAqBqC,CAAC;AAC/C,CAAC;AAED,+DAA+D;AAC/D,SAAgB,oCAAoC;IAClD,OAAO;;;;;;;;;;;;;;;;;KAiBJ,CAAC;AACN,CAAC;AAED,kFAAkF;AAClF,SAAgB,uCAAuC;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4HA+EmH,CAAC;AAC7H,CAAC;AAED,kFAAkF;AAClF,SAAgB,iCAAiC;IAC/C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wGAiC+F,CAAC;AACzG,CAAC;AAED,kFAAkF;AAClF,SAAgB,0BAA0B;IACxC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uHA0E8G,CAAC;AACxH,CAAC;AAED,kFAAkF;AAClF,SAAgB,kCAAkC;IAChD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEN,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAkC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACtE,OAAO;;;;EAIP,mBAAmB,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;8BAwBV,YAAY,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAkE9B,UAAU,CAAC,QAAQ;;;;;gBAKnB,UAAU,CAAC,SAAS;gBACpB,UAAU,CAAC,SAAS;;0BAEV,YAAY,CAAC,IAAI;;;;;;;;yBAQlB,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4ClB,IAAI;;;kCAGM,iBAAiB;;;;;;;;;;;;EAYjD,cAAc,CAAC,sBAAsB,uCAAuC,EAAE,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6BvE,UAAU,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6FnB,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;EAwBzC,cAAc,CAAC,uCAAuC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2E/C,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,6BAA6B,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;gBAOhF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0CzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,6BAA6B,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;;;;gBAanF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA4CzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,oCAAoC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;gBAyB5C,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;EAchD,cAAc,CAAC,6BAA6B,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;gBAUtF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAmEzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;;gBAGf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;gBAiB3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;gBAa3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCzC,cAAc,CAAC,iCAAiC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAiC9B,IAAI;;;;;;2BAMJ,IAAI;;;;;;;;;;;;;;;;;;;gBAmBf,UAAU,CAAC,uBAAuB;;;;;;;;;;;EAWhD,cAAc,CAAC,6BAA6B,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;0BAUvE,IAAI;;;;;;;;;;;;;;;;;;;;;;;;EAwB5B,cAAc,CAAC,0BAA0B,EAAE,EAAE,EAAE,CAAC;;;;;;;;;EAShD,cAAc,CAAC,kCAAkC,EAAE,EAAE,EAAE,CAAC;;;;gBAI1C,UAAU,CAAC,cAAc;;;;;;;;;;CAUxC,CAAC;AACF,CAAC;AAED,SAAgB,gCAAgC,CAC9C,OAAkC;IAElC,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO;QACL,KAAK,EAAE;YACL,CAAC,iCAAyB,CAAC,EAAE,wBAAwB,CAAC,OAAO,CAAC;SAC/D;QACD,YAAY,EAAE,CAAC,iCAAyB,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-thin-docs.js

@@ -28,9 +28,11 @@ generated branch rules, CODEOWNER review, resolved-conversation requirement,
 merge-only history, and read-only default workflow permissions.
 
 The managed \`Deploy\` workflow is the single protected infrastructure path.
-It assumes one environment-scoped \`AWS_DEPLOY_ROLE_ARN\`, invokes the same root
-Nx lifecycle used locally, runs migrations and Slice smoke checks after each
-successful native SST deployment, and retains one bounded deployment receipt.
+It derives the canonical stage deployment-role ARN from committed account,
+stage, Region-partition, and naming policy; the GitHub environment supplies no
+deployment-role secret. It invokes the same root Nx lifecycle used locally,
+runs migrations and Slice smoke checks after each successful native SST
+deployment, and retains one bounded deployment receipt.
 For isolated profiles, the protected-branch \`Verify\` run calls the reusable
 \`Deploy\` workflow only after acceptance and its immutable candidate succeed.
 The call binds the exact source commit, branch ref, run, and attempt, consumes
@@ -48,12 +50,25 @@ candidate recorded by the successful staging deployment.
 When \`starter\` uses its optional manual workflow, \`develop\` routes to
 development and \`main\` routes to production; starter has no automatic caller.
 Every protected job checks out an immutable commit, validates managed source,
-and assumes the committed stage role through the matching GitHub environment.
-
-Run GitHub bootstrap in report mode before apply. It configures repository and
-environment policy but never creates AWS credentials, secrets, or roles. Place
-the exact deployment role ARN, account, and Region only in their protected
-stage environment; do not add repository-scope fallbacks.
+and assumes the derived stage role through the matching GitHub environment.
+The reusable Verify caller delegates job-scoped \`id-token: write\`; each
+credential-bearing job proves both the configured canonical ARN and terminal
+STS assumed-role caller immediately before OCI or lifecycle mutation.
+
+Run GitHub bootstrap in report mode first to obtain the repository's canonical
+slug and immutable owner/repository IDs. It configures repository and environment
+policy but never creates AWS credentials, secrets, or roles. For an existing
+repository, keep its current OIDC subject active while you render and apply the
+stage AWS trust for the reported immutable subject, then read back and simulate
+that effective trust. Only after AWS accepts the immutable subject should you
+rerun GitHub bootstrap with \`--apply\` and the exact
+\`--immutableOidcTrustAcknowledgement=aws-trust-ready:<repositoryIdentity.subjectPrefix>\`
+reported by the same inspection. A missing, wrong, or stale acknowledgement
+blocks the subject cutover before any GitHub setting is changed.
+This AWS-trust-first order prevents protected deployment from being stranded.
+Place the exact account and Region in their protected stage environment.
+Isolated production additionally keeps its exact staging promotion-pull role
+secret; do not add repository-scope fallbacks.
 `,
         'docs/repository-operating-policy.md': `# Repository Operating Policy
 
@@ -91,7 +106,8 @@ and the exact TTY acknowledgement
 commit, a real TTY, and
 \`deploy:production:<account>:<region>:<source-commit>\`.
 
-GitHub deploys immutable commits through one environment-scoped OIDC role. The
+GitHub deploys immutable commits through one canonical stage-scoped OIDC role
+whose ARN is derived from committed policy. The
 starter workflow is optional; isolated profiles require GitHub for the stages
 declared by their profile. Direct user SST invocation is outside the supported
 paved road.

package/src/generators/preset/workspace-files-thin-docs.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-files-thin-docs.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-docs.ts"],"names":[],"mappings":";;AAMA,4EA6NC;AAnOD,+DAI0C;AAE1C,SAAgB,gCAAgC,CAAC,OAGhD;IACC,MAAM,MAAM,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAA,mCAAwB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,OAAO;QACL,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI;;;;;;;kBAOhB,OAAO,CAAC,iBAAiB,yBAAyB,SAAS;;;;;CAK5E;QACG,sBAAsB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkC3B;QACG,qCAAqC,EAAE;;;IAGvC,OAAO,CAAC,iBAAiB;EAC3B,SAAS;;;;;aAKE,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4DxB;QACG,+BAA+B,EAAE;;;;yBAIZ,OAAO,CAAC,iBAAiB;EAChD,SAAS;;;;;;;;;;eAUI,cAAc;;CAE5B;QACG,sCAAsC,EAAE;;;;;;;gBAO5B,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;yCA0Ba,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtD;KACE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-files-thin-docs.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-docs.ts"],"names":[],"mappings":";;AAMA,4EA6OC;AAnPD,+DAI0C;AAE1C,SAAgB,gCAAgC,CAAC,OAGhD;IACC,MAAM,MAAM,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAA,mCAAwB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,OAAO;QACL,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI;;;;;;;kBAOhB,OAAO,CAAC,iBAAiB,yBAAyB,SAAS;;;;;CAK5E;QACG,sBAAsB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiD3B;QACG,qCAAqC,EAAE;;;IAGvC,OAAO,CAAC,iBAAiB;EAC3B,SAAS;;;;;aAKE,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DxB;QACG,+BAA+B,EAAE;;;;yBAIZ,OAAO,CAAC,iBAAiB;EAChD,SAAS;;;;;;;;;;eAUI,cAAc;;CAE5B;QACG,sCAAsC,EAAE;;;;;;;gBAO5B,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;yCA0Ba,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtD;KACE,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files.d.ts

@@ -6,6 +6,7 @@ export interface WorkspaceFileOptions {
     deploymentRegion?: string | null;
     frameworkVersion: string;
     name: string;
+    workspaceDeploymentId?: string;
 }
 export declare const BLUEPRINT_TRUST_AUTHORITY_PATH: "tools/blueprint-trust-check.mjs";
 export declare function isRawWorkspaceAuthorityPath(path: string): boolean;