@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/executors/foundation-profile-preflight/production-database-safeguard.d.ts

@@ -0,0 +1,65 @@
+export declare const PRODUCTION_DATABASE_BACKUP_MAX_AGE_MS: number;
+export declare const PRODUCTION_DATABASE_CLOCK_SKEW_MS: number;
+export interface ExistingProductionDatabaseDiscovery {
+    clusterArn: string;
+    clusterIdentifier: string;
+    state: 'existing';
+}
+export type ProductionDatabaseDiscovery = {
+    state: 'absent';
+} | ExistingProductionDatabaseDiscovery;
+export interface ProductionDatabaseDescription {
+    backupRetentionPeriod?: number;
+    clusterArn?: string;
+    clusterIdentifier?: string;
+    deletionProtection?: boolean;
+    latestRestorableTime?: Date;
+    maxCapacity?: number;
+    minCapacity?: number;
+    secondsUntilAutoPause?: number;
+    status?: string;
+}
+export interface ProductionDatabaseCallerIdentity {
+    accountId?: string;
+    arn?: string;
+}
+export interface ProductionDatabaseSafeguardReader {
+    describeCluster: (clusterIdentifier: string) => Promise<ProductionDatabaseDescription | undefined>;
+    destroy: () => void;
+    readCallerIdentity: () => Promise<ProductionDatabaseCallerIdentity>;
+    readDiscovery: () => Promise<ProductionDatabaseDiscovery>;
+}
+export interface ProductionDatabaseLifecycleAttestationOptions {
+    configFilepath?: string;
+    credentialsFilepath?: string;
+    expectedAccountId: string;
+    expectedCapacity?: {
+        max: number;
+        min: number;
+    };
+    expectedRegion: string;
+    expectedRoleArn: string;
+    now: Date;
+    priorDiscovery?: ProductionDatabaseDiscovery;
+    profile?: string;
+    reader?: ProductionDatabaseSafeguardReader;
+    requireExisting: boolean;
+}
+export declare function createProductionDatabaseSafeguardReader(options: {
+    configFilepath?: string;
+    credentialsFilepath?: string;
+    profile?: string;
+    region: string;
+    stage: 'production';
+}): ProductionDatabaseSafeguardReader;
+export declare function assertExistingProductionDatabaseSafeguards(options: {
+    cluster: ProductionDatabaseDescription | undefined;
+    discovery: ExistingProductionDatabaseDiscovery;
+    expectedAccountId: string;
+    expectedRegion: string;
+    now: Date;
+}): void;
+/** Read-only lifecycle boundary attestation. Native SST remains the deployment
+ * engine; this verifies only the protected production properties that IAM
+ * cannot constrain from ModifyDBCluster request fields. */
+export declare function attestProductionDatabaseLifecycle(options: ProductionDatabaseLifecycleAttestationOptions): Promise<ProductionDatabaseDiscovery>;

package/src/executors/foundation-profile-preflight/production-database-safeguard.js

@@ -0,0 +1,223 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRODUCTION_DATABASE_CLOCK_SKEW_MS = exports.PRODUCTION_DATABASE_BACKUP_MAX_AGE_MS = void 0;
+exports.createProductionDatabaseSafeguardReader = createProductionDatabaseSafeguardReader;
+exports.assertExistingProductionDatabaseSafeguards = assertExistingProductionDatabaseSafeguards;
+exports.attestProductionDatabaseLifecycle = attestProductionDatabaseLifecycle;
+const client_rds_1 = require("@aws-sdk/client-rds");
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const client_sts_1 = require("@aws-sdk/client-sts");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const identity_js_1 = require("../../aws/identity.js");
+const discovery_js_1 = require("../../foundation/discovery.js");
+exports.PRODUCTION_DATABASE_BACKUP_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
+exports.PRODUCTION_DATABASE_CLOCK_SKEW_MS = 5 * 60 * 1_000;
+const AWS_READ_TIMEOUT_MS = 20_000;
+function exactString(value) {
+    return typeof value === 'string' && value === value.trim() && value
+        ? value
+        : undefined;
+}
+function withReadTimeout(operation) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), AWS_READ_TIMEOUT_MS);
+    timeout.unref();
+    return operation(controller.signal).finally(() => clearTimeout(timeout));
+}
+function narrowCluster(cluster) {
+    return {
+        backupRetentionPeriod: cluster.BackupRetentionPeriod,
+        clusterArn: cluster.DBClusterArn,
+        clusterIdentifier: cluster.DBClusterIdentifier,
+        deletionProtection: cluster.DeletionProtection,
+        latestRestorableTime: cluster.LatestRestorableTime,
+        maxCapacity: cluster.ServerlessV2ScalingConfiguration?.MaxCapacity,
+        minCapacity: cluster.ServerlessV2ScalingConfiguration?.MinCapacity,
+        secondsUntilAutoPause: cluster.ServerlessV2ScalingConfiguration?.SecondsUntilAutoPause,
+        status: cluster.Status,
+    };
+}
+function createProductionDatabaseSafeguardReader(options) {
+    const profile = options.profile?.trim();
+    const clientOptions = {
+        ...(profile
+            ? {
+                credentials: (0, credential_providers_1.fromIni)({
+                    ...(options.configFilepath
+                        ? { configFilepath: options.configFilepath }
+                        : {}),
+                    ...(options.credentialsFilepath
+                        ? { filepath: options.credentialsFilepath }
+                        : {}),
+                    profile,
+                }),
+            }
+            : {}),
+        maxAttempts: 2,
+        region: options.region,
+    };
+    const ssm = new client_ssm_1.SSMClient({
+        ...clientOptions,
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('ssm', options.region),
+    });
+    const rds = new client_rds_1.RDSClient({
+        ...clientOptions,
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('rds', options.region),
+    });
+    const sts = new client_sts_1.STSClient({
+        ...clientOptions,
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(options.region),
+    });
+    const clusterIdName = (0, discovery_js_1.foundationSsmPath)(options.stage, 'databaseClusterId');
+    const clusterArnName = (0, discovery_js_1.foundationSsmPath)(options.stage, 'databaseClusterArn');
+    return {
+        describeCluster: async (clusterIdentifier) => {
+            const response = await withReadTimeout((abortSignal) => rds.send(new client_rds_1.DescribeDBClustersCommand({
+                DBClusterIdentifier: clusterIdentifier,
+            }), { abortSignal }));
+            const clusters = response.DBClusters ?? [];
+            if (clusters.length > 1) {
+                throw new Error('Production Foundation discovery resolved more than one Aurora cluster.');
+            }
+            return clusters[0] ? narrowCluster(clusters[0]) : undefined;
+        },
+        destroy: () => {
+            ssm.destroy();
+            rds.destroy();
+            sts.destroy();
+        },
+        readCallerIdentity: async () => {
+            const response = await withReadTimeout((abortSignal) => sts.send(new client_sts_1.GetCallerIdentityCommand({}), { abortSignal }));
+            return { accountId: response.Account, arn: response.Arn };
+        },
+        readDiscovery: async () => {
+            const response = await withReadTimeout((abortSignal) => ssm.send(new client_ssm_1.GetParametersCommand({
+                Names: [clusterArnName, clusterIdName],
+                WithDecryption: false,
+            }), { abortSignal }));
+            const values = new Map((response.Parameters ?? []).map((parameter) => [
+                parameter.Name ?? '',
+                exactString(parameter.Value),
+            ]));
+            const invalid = new Set(response.InvalidParameters ?? []);
+            const clusterArn = values.get(clusterArnName);
+            const clusterIdentifier = values.get(clusterIdName);
+            const arnAbsent = invalid.has(clusterArnName) && !clusterArn;
+            const identifierAbsent = invalid.has(clusterIdName) && !clusterIdentifier;
+            if (arnAbsent && identifierAbsent)
+                return { state: 'absent' };
+            if (!clusterArn || !clusterIdentifier || invalid.size > 0) {
+                throw new Error('Production Foundation database discovery is partial or malformed; deployment is blocked.');
+            }
+            return {
+                clusterArn,
+                clusterIdentifier,
+                state: 'existing',
+            };
+        },
+    };
+}
+function parseClusterArn(value) {
+    const match = /^arn:(?:aws|aws-cn|aws-us-gov):rds:([^:]+):(\d{12}):cluster:([A-Za-z0-9][A-Za-z0-9-]{0,62})$/u.exec(value);
+    return match?.[1] && match[2] && match[3]
+        ? {
+            accountId: match[2],
+            clusterIdentifier: match[3],
+            region: match[1],
+        }
+        : undefined;
+}
+function assertExistingProductionDatabaseSafeguards(options) {
+    const discoveredArn = parseClusterArn(options.discovery.clusterArn);
+    if (!discoveredArn ||
+        discoveredArn.accountId !== options.expectedAccountId ||
+        discoveredArn.region !== options.expectedRegion ||
+        discoveredArn.clusterIdentifier !== options.discovery.clusterIdentifier) {
+        throw new Error('Production Foundation database discovery does not match the committed account, Region, and cluster identity.');
+    }
+    const cluster = options.cluster;
+    if (!cluster ||
+        cluster.clusterArn !== options.discovery.clusterArn ||
+        cluster.clusterIdentifier !== options.discovery.clusterIdentifier) {
+        throw new Error('Production Foundation database identity does not match canonical discovery.');
+    }
+    if (cluster.status !== 'available') {
+        throw new Error(`Production Foundation database must be available before deployment; observed ${cluster.status ?? 'missing'}.`);
+    }
+    if (cluster.deletionProtection !== true) {
+        throw new Error('Production Foundation database deletion protection must remain enabled before deployment.');
+    }
+    if (!Number.isInteger(cluster.backupRetentionPeriod) ||
+        (cluster.backupRetentionPeriod ?? 0) < 30) {
+        throw new Error('Production Foundation database backup retention must remain at least 30 days before deployment.');
+    }
+    const latest = cluster.latestRestorableTime?.getTime();
+    const now = options.now.getTime();
+    if (latest === undefined ||
+        !Number.isFinite(latest) ||
+        latest > now + exports.PRODUCTION_DATABASE_CLOCK_SKEW_MS ||
+        now - latest > exports.PRODUCTION_DATABASE_BACKUP_MAX_AGE_MS) {
+        throw new Error('Production Foundation database requires a recent latest-restorable backup signal before deployment.');
+    }
+}
+function assertExactProductionDatabaseCapacity(cluster, expected) {
+    if (cluster.minCapacity !== expected.min ||
+        cluster.maxCapacity !== expected.max ||
+        (expected.min === 0 && cluster.secondsUntilAutoPause !== 300)) {
+        throw new Error(`Production Foundation database Aurora capacity must equal the committed profile ${expected.min}-${expected.max} ACUs${expected.min === 0 ? ' with 300-second auto-pause' : ''} after deployment; observed ${cluster.minCapacity ?? 'missing'}-${cluster.maxCapacity ?? 'missing'}, auto-pause ${cluster.secondsUntilAutoPause ?? 'absent'}.`);
+    }
+}
+/** Read-only lifecycle boundary attestation. Native SST remains the deployment
+ * engine; this verifies only the protected production properties that IAM
+ * cannot constrain from ModifyDBCluster request fields. */
+async function attestProductionDatabaseLifecycle(options) {
+    const reader = options.reader ??
+        createProductionDatabaseSafeguardReader({
+            ...(options.configFilepath
+                ? { configFilepath: options.configFilepath }
+                : {}),
+            ...(options.credentialsFilepath
+                ? { credentialsFilepath: options.credentialsFilepath }
+                : {}),
+            ...(options.profile ? { profile: options.profile } : {}),
+            region: options.expectedRegion,
+            stage: 'production',
+        });
+    try {
+        const caller = await reader.readCallerIdentity();
+        if (caller.accountId !== options.expectedAccountId ||
+            typeof caller.arn !== 'string' ||
+            !(0, identity_js_1.matchesExpectedAssumedRoleArn)(options.expectedAccountId, caller.arn, options.expectedRoleArn)) {
+            throw new Error('Production Foundation database attestation caller does not match the committed account and exact deployment role.');
+        }
+        const discovery = await reader.readDiscovery();
+        if (discovery.state === 'absent') {
+            if (options.requireExisting) {
+                throw new Error('Production Foundation database discovery is absent after native deployment.');
+            }
+            return discovery;
+        }
+        if (options.priorDiscovery?.state === 'existing' &&
+            (options.priorDiscovery.clusterArn !== discovery.clusterArn ||
+                options.priorDiscovery.clusterIdentifier !==
+                    discovery.clusterIdentifier)) {
+            throw new Error('Production Foundation database identity changed during native deployment.');
+        }
+        const cluster = await reader.describeCluster(discovery.clusterIdentifier);
+        assertExistingProductionDatabaseSafeguards({
+            cluster,
+            discovery,
+            expectedAccountId: options.expectedAccountId,
+            expectedRegion: options.expectedRegion,
+            now: options.now,
+        });
+        if (options.expectedCapacity && cluster) {
+            assertExactProductionDatabaseCapacity(cluster, options.expectedCapacity);
+        }
+        return discovery;
+    }
+    finally {
+        reader.destroy();
+    }
+}
+//# sourceMappingURL=production-database-safeguard.js.map

package/src/executors/foundation-profile-preflight/schema.json

@@ -2,20 +2,31 @@
   "$schema": "https://json-schema.org/schema",
   "version": 2,
   "title": "Empire Builder Kit production Foundation profile preflight",
-  "description": "Verify the pinned Aurora Serverless engine is orderable in the selected Region before Foundation mutation.",
+  "description": "Verify the pinned Aurora Serverless engine is orderable and an existing production Foundation database retains its canonical identity, deletion protection, backup retention, and recent restore signal before native SST mutation.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
     "stage": {
       "type": "string",
       "pattern": "^[a-z0-9][a-z0-9-]*$",
-      "default": "development"
+      "description": "SST stage name for non-development lifecycle actions. The dev action rejects this option and derives the personal stage."
     },
     "profile": {
       "type": "string",
-      "description": "Optional local AWS profile. Protected stages are still restricted to the generated GitHub workflow."
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Optional exact AWS profile exposed to the SST child as AWS_PROFILE."
     },
-    "region": { "type": "string" }
+    "expectedRoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+      "description": "Exact temporary-session IAM role expected for local governed deployment. This is verified against STS before mutation."
+    },
+    "region": {
+      "type": "string",
+      "pattern": "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$",
+      "description": "Exact AWS Region used by EBK control-plane preflights. Defaults to AWS_REGION or AWS_DEFAULT_REGION."
+    }
   },
   "required": ["stage"]
 }

package/src/executors/foundation-remove-preflight/foundation-remove-preflight.d.ts

@@ -1,5 +1,7 @@
+import { DescribeParametersCommand, type DescribeParametersCommandInput, type DescribeParametersCommandOutput } from '@aws-sdk/client-ssm';
 import { type PromiseExecutor } from '@nx/devkit';
-interface FoundationRemovePreflightOptions {
+export interface FoundationRemovePreflightOptions {
+    expectedRoleArn?: string;
     profile?: string;
     region?: string;
     stage: string;
@@ -9,5 +11,13 @@ export declare function evaluateFoundationRemoval(foundationStage: string, regis
     success: boolean;
 };
 export declare function productSliceRegistrationName(foundationStage: string, parameterName: string | undefined): string;
+type DescribeParametersPage = Pick<DescribeParametersCommandOutput, 'NextToken' | 'Parameters'>;
+export interface FoundationRemovePreflightDependencies {
+    sendCommand?: (command: DescribeParametersCommand) => Promise<DescribeParametersPage>;
+}
+export declare function inspectProductSliceRegistrations(foundationStage: string, fetchPage: (input: DescribeParametersCommandInput) => Promise<DescribeParametersPage>): Promise<string[]>;
+export declare function runFoundationRemovePreflight(options: FoundationRemovePreflightOptions, dependencies?: FoundationRemovePreflightDependencies): Promise<{
+    success: boolean;
+}>;
 declare const executor: PromiseExecutor<FoundationRemovePreflightOptions>;
 export default executor;

package/src/executors/foundation-remove-preflight/foundation-remove-preflight.js

@@ -2,10 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.evaluateFoundationRemoval = evaluateFoundationRemoval;
 exports.productSliceRegistrationName = productSliceRegistrationName;
+exports.inspectProductSliceRegistrations = inspectProductSliceRegistrations;
+exports.runFoundationRemovePreflight = runFoundationRemovePreflight;
 const client_ssm_1 = require("@aws-sdk/client-ssm");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
 const devkit_1 = require("@nx/devkit");
 const discovery_js_1 = require("../../foundation/discovery.js");
+const stages_js_1 = require("../../foundation/stages.js");
+const index_js_1 = require("../../repository-policy/index.js");
 function evaluateFoundationRemoval(foundationStage, registrationNames) {
     if (registrationNames.length === 0) {
         return {
@@ -28,42 +32,88 @@ function productSliceRegistrationName(foundationStage, parameterName) {
         ? relativeName
         : `[unrecognized registration] ${parameterName}`;
 }
-const executor = async (options) => {
+async function inspectProductSliceRegistrations(foundationStage, fetchPage) {
+    const registrations = [];
+    const prefix = `${(0, discovery_js_1.productSliceRegistrationRoot)(foundationStage)}/`;
+    let nextToken;
+    do {
+        const response = await fetchPage({
+            ...(nextToken ? { NextToken: nextToken } : {}),
+            ParameterFilters: [
+                {
+                    Key: 'Name',
+                    Option: 'BeginsWith',
+                    Values: [prefix],
+                },
+            ],
+        });
+        registrations.push(...(response.Parameters ?? []).map(({ Name }) => productSliceRegistrationName(foundationStage, Name)));
+        nextToken = response.NextToken;
+    } while (nextToken);
+    return registrations.sort();
+}
+async function runFoundationRemovePreflight(options, dependencies = {}) {
     const region = options.region?.trim() ||
         process.env.AWS_REGION?.trim() ||
         process.env.AWS_DEFAULT_REGION?.trim();
-    const client = new client_ssm_1.SSMClient({
-        ...(options.profile
-            ? { credentials: (0, credential_providers_1.fromIni)({ profile: options.profile }) }
-            : {}),
-        ...(region ? { region } : {}),
-    });
-    const registrations = [];
-    let nextToken;
+    const client = dependencies.sendCommand
+        ? undefined
+        : new client_ssm_1.SSMClient({
+            ...(options.profile
+                ? { credentials: (0, credential_providers_1.fromIni)({ profile: options.profile }) }
+                : {}),
+            ...(region ? { region } : {}),
+        });
+    const sendCommand = dependencies.sendCommand ??
+        (async (command) => {
+            if (!client) {
+                throw new Error('SSM client is unavailable.');
+            }
+            return client.send(command);
+        });
+    let registrations;
     try {
-        do {
-            const response = await client.send(new client_ssm_1.GetParametersByPathCommand({
-                NextToken: nextToken,
-                Path: (0, discovery_js_1.productSliceRegistrationRoot)(options.stage),
-                Recursive: true,
-            }));
-            registrations.push(...(response.Parameters ?? []).map(({ Name }) => productSliceRegistrationName(options.stage, Name)));
-            nextToken = response.NextToken;
-        } while (nextToken);
+        registrations = await inspectProductSliceRegistrations(options.stage, (input) => sendCommand(new client_ssm_1.DescribeParametersCommand(input)));
     }
     catch (error) {
         devkit_1.logger.error(`[foundation-remove-preflight] foundationStage=${options.stage}: unable to inspect Product Slice registrations. ${error instanceof Error ? error.message : String(error)}`);
         return { success: false };
     }
     finally {
-        client.destroy();
+        client?.destroy();
     }
-    const result = evaluateFoundationRemoval(options.stage, registrations.sort());
+    const result = evaluateFoundationRemoval(options.stage, registrations);
     if (result.success)
         devkit_1.logger.info(result.message);
     else
         devkit_1.logger.error(result.message);
     return { success: result.success };
+}
+const executor = async (options, context) => {
+    try {
+        const policy = (0, index_js_1.readRepositoryOperatingPolicy)(context.root);
+        const stage = (0, stages_js_1.requireFoundationStage)(options.stage);
+        if (!(0, index_js_1.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
+            throw new Error(`Foundation stage ${stage} is inactive for ${policy.deploymentProfile}.`);
+        }
+        const region = (0, index_js_1.configuredDeploymentRegion)(policy.deploymentRegion);
+        // The dependency executes before the remove child derives its environment.
+        // Bind this read to the same committed Region, never the operator's default.
+        for (const requested of [
+            options.region,
+            process.env.AWS_REGION,
+            process.env.AWS_DEFAULT_REGION,
+        ]) {
+            if (requested?.trim() && requested.trim() !== region) {
+                throw new Error(`Requested Region ${requested.trim()} differs from committed deployment Region ${region}.`);
+            }
+        }
+        return await runFoundationRemovePreflight({ ...options, region, stage });
+    }
+    catch (error) {
+        devkit_1.logger.error(`[foundation-remove-preflight] ${error instanceof Error ? error.message : String(error)}`);
+        return { success: false };
+    }
 };
 exports.default = executor;
 //# sourceMappingURL=foundation-remove-preflight.js.map

package/src/executors/foundation-remove-preflight/schema.json

@@ -11,7 +11,12 @@
       "default": "development"
     },
     "region": { "type": "string" },
-    "profile": { "type": "string" }
+    "profile": { "type": "string" },
+    "expectedRoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+      "description": "Exact stage deployment role forwarded to the governed remove executor. The preflight accepts but does not consume this authority input."
+    }
   },
   "required": ["stage"]
 }

package/src/executors/github-bootstrap/github-bootstrap.d.ts

@@ -1,6 +1,7 @@
 import { type PromiseExecutor } from '@nx/devkit';
 interface GitHubBootstrapExecutorOptions {
     apply?: boolean;
+    immutableOidcTrustAcknowledgement?: string;
     npmPrereleaseReviewerIds?: string;
     productionReviewerIds?: string;
     repository?: string;

package/src/executors/github-bootstrap/github-bootstrap.js

@@ -13,6 +13,9 @@ const executor = async (options, context) => {
         const policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
         const report = await (0, index_js_1.runGitHubBootstrap)({
             apply: options.apply === true,
+            deliveryLane: policy.deliveryLane ?? 'protected-pair',
+            deploymentProfile: policy.deploymentProfile,
+            immutableOidcTrustAcknowledgement: options.immutableOidcTrustAcknowledgement,
             npmPrereleaseReviewerIds: parseReviewerIds(options.npmPrereleaseReviewerIds),
             productionApprovalMode: policy.productionApproval.mode,
             productionReviewerIds: parseReviewerIds(options.productionReviewerIds),

package/src/executors/github-bootstrap/schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/schema",
   "version": 2,
   "title": "Empire Builder Kit GitHub bootstrap",
-  "description": "Report or explicitly apply protected repository rules and environments without creating secrets, branches, or credentials.",
+  "description": "Report or explicitly apply protected repository rules, environments, and the default immutable GitHub OIDC repository subject without creating secrets, branches, or credentials.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -16,6 +16,12 @@
       "default": false,
       "description": "Apply the reported GitHub settings. Omit for the default read-only report."
     },
+    "immutableOidcTrustAcknowledgement": {
+      "type": "string",
+      "pattern": "^aws-trust-ready:repo:",
+      "maxLength": 512,
+      "description": "Required only when --apply would enable GitHub's immutable repository OIDC subject. Supply aws-trust-ready:<reported repositoryIdentity.subjectPrefix> only after the matching AWS trusts have been applied, read back, and verified."
+    },
     "npmPrereleaseReviewerIds": {
       "type": "string",
       "pattern": "^[1-9][0-9]*(,[1-9][0-9]*)*$",