@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/git-policy/github-bootstrap.js

@@ -1,30 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EBK_CODE_OWNER_PLACEHOLDER = exports.EBK_STAGING_PLAN_REPOSITORY_VARIABLES = exports.EBK_PRODUCTION_PLAN_REPOSITORY_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_SECRETS = exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET = exports.EBK_SMOKE_ROLE_SECRET = exports.EBK_RELIABILITY_READ_ROLE_SECRET = exports.EBK_PERFORMANCE_ORIGINS_VARIABLE = exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET = exports.EBK_PERFORMANCE_COST_ROLE_SECRET = exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET = exports.EBK_ASYNC_RECOVERY_ROLE_SECRET = exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET = exports.EBK_DEPLOYMENT_ROLE_SECRET = exports.EBK_REQUIRED_CHECKS = exports.EBK_PROTECTED_BRANCH_RULESET_NAME = void 0;
+exports.EBK_CODE_OWNER_PLACEHOLDER = exports.EBK_OPTIONAL_STAGE_ENVIRONMENT_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_SECRETS = exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET = exports.EBK_PROTECTED_MAIN_RULESET_NAME = exports.EBK_RECORD_MAIN_TOKEN_SECRET = exports.EBK_PERFORMANCE_ORIGINS_VARIABLE = exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET = exports.EBK_PERFORMANCE_COST_ROLE_SECRET = exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET = exports.EBK_ASYNC_RECOVERY_ROLE_SECRET = exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET = exports.EBK_RETIRED_DEPLOYMENT_ROLE_SECRET = exports.EBK_REQUIRED_CHECKS = exports.EBK_PROTECTED_BRANCH_RULESET_NAME = void 0;
+exports.githubEnvironmentTopology = githubEnvironmentTopology;
 exports.runGitHubBootstrap = runGitHubBootstrap;
 const index_js_1 = require("../repository-policy/index.js");
 const deterministic_order_js_1 = require("../deterministic-order.js");
 exports.EBK_PROTECTED_BRANCH_RULESET_NAME = 'Empire Builder Kit protected branches';
 exports.EBK_REQUIRED_CHECKS = ['policy', 'verify'];
-exports.EBK_DEPLOYMENT_ROLE_SECRET = 'AWS_DEPLOY_ROLE_ARN';
+exports.EBK_RETIRED_DEPLOYMENT_ROLE_SECRET = 'AWS_DEPLOY_ROLE_ARN';
 exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET = 'AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN';
 exports.EBK_ASYNC_RECOVERY_ROLE_SECRET = 'AWS_ASYNC_RECOVERY_ROLE_ARN';
 exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET = 'AWS_PERFORMANCE_AGGREGATE_ROLE_ARN';
 exports.EBK_PERFORMANCE_COST_ROLE_SECRET = 'AWS_PERFORMANCE_COST_ROLE_ARN';
 exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET = 'AWS_PERFORMANCE_LOAD_ROLE_ARN';
 exports.EBK_PERFORMANCE_ORIGINS_VARIABLE = 'EBK_PERFORMANCE_ORIGINS_JSON';
-exports.EBK_RELIABILITY_READ_ROLE_SECRET = 'AWS_RELIABILITY_READ_ROLE_ARN';
-exports.EBK_SMOKE_ROLE_SECRET = 'AWS_SMOKE_ROLE_ARN';
+/** Production environment secret that lets trunk promotion fast-forward main. */
+exports.EBK_RECORD_MAIN_TOKEN_SECRET = 'EBK_RECORD_MAIN_TOKEN';
+/** Trunk promotion keeps main behind status checks and fast-forward pushes only. */
+exports.EBK_PROTECTED_MAIN_RULESET_NAME = 'EBK protected main (trunk promotion)';
 exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET = 'AWS_STAGING_PROMOTION_PULL_ROLE_ARN';
 exports.EBK_PROTECTED_ENVIRONMENT_SECRETS = [
     exports.EBK_ASYNC_RECOVERY_ROLE_SECRET,
-    exports.EBK_DEPLOYMENT_ROLE_SECRET,
     exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET,
-    exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET,
-    exports.EBK_PERFORMANCE_COST_ROLE_SECRET,
-    exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET,
-    exports.EBK_RELIABILITY_READ_ROLE_SECRET,
-    exports.EBK_SMOKE_ROLE_SECRET,
+    exports.EBK_RETIRED_DEPLOYMENT_ROLE_SECRET,
     exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET,
 ];
 exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = [
@@ -34,128 +32,133 @@ exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = [
     'AWS_STAGING_PROMOTION_REGION',
     'EBK_ALLOW_PRODUCTION_REMOVE',
     'EBK_FLEET_ORIGIN',
-    exports.EBK_PERFORMANCE_ORIGINS_VARIABLE,
-    'EBK_SMOKE_AUTHORITY_VERSION',
-    'EBK_SMOKE_TARGETS',
+];
+/**
+ * Non-secret stage environment variables an operator may set to request a
+ * machine credential generation or its retirement on a workflow deploy. They
+ * are never required, and a repository- or organization-scoped copy would
+ * silently apply to every stage, so only the stage environment may hold them.
+ */
+exports.EBK_OPTIONAL_STAGE_ENVIRONMENT_VARIABLES = [
+    'EBK_MACHINE_CREDENTIAL_GENERATION',
+    'EBK_MACHINE_RETIRE_PREVIOUS_GENERATION',
 ];
 const FORBIDDEN_NPM_TOKEN_NAMES = [
     'NODE_AUTH_TOKEN',
     'NPM_CONFIG_TOKEN',
     'NPM_TOKEN',
 ];
-exports.EBK_PRODUCTION_PLAN_REPOSITORY_VARIABLES = [
-    'AWS_PRODUCTION_PLAN_EXPECTED_ACCOUNT_ID',
-    'AWS_PRODUCTION_PLAN_GENERATED_OBJECT_ARNS_JSON',
-    'AWS_PRODUCTION_PLAN_GENERATED_PARAMETER_ARNS_JSON',
-    'AWS_PRODUCTION_PLAN_GENERATED_SECRET_ARNS_JSON',
-    'AWS_PRODUCTION_PLAN_PROVIDER_REFRESH_POLICY_JSON',
-    'AWS_PRODUCTION_PLAN_REGION',
-    'AWS_PRODUCTION_PLAN_ROLE_ARN',
-    'AWS_PRODUCTION_PLAN_SST_APPS_JSON',
-    'AWS_PRODUCTION_PLAN_STATE_BUCKET_ARN',
-    'AWS_PRODUCTION_PLAN_STATE_KMS_KEY_ARN',
-    'EBK_PRODUCTION_FLEET_ORIGIN',
-];
-exports.EBK_STAGING_PLAN_REPOSITORY_VARIABLES = [
-    'AWS_STAGING_PLAN_EXPECTED_ACCOUNT_ID',
-    'AWS_STAGING_PLAN_GENERATED_OBJECT_ARNS_JSON',
-    'AWS_STAGING_PLAN_GENERATED_PARAMETER_ARNS_JSON',
-    'AWS_STAGING_PLAN_GENERATED_SECRET_ARNS_JSON',
-    'AWS_STAGING_PLAN_PROVIDER_REFRESH_POLICY_JSON',
-    'AWS_STAGING_PLAN_REGION',
-    'AWS_STAGING_PLAN_ROLE_ARN',
-    'AWS_STAGING_PLAN_SST_APPS_JSON',
-    'AWS_STAGING_PLAN_STATE_BUCKET_ARN',
-    'AWS_STAGING_PLAN_STATE_KMS_KEY_ARN',
-    'EBK_STAGING_FLEET_ORIGIN',
-];
 exports.EBK_CODE_OWNER_PLACEHOLDER = '@REPLACE_WITH_GITHUB_CODE_OWNER';
-const GITHUB_API_VERSION = '2022-11-28';
+const GITHUB_API_VERSION = '2026-03-10';
+const GITHUB_IMMUTABLE_OIDC_CHANGE = 'Use the default immutable GitHub OIDC repository subject.';
+const GITHUB_IMMUTABLE_OIDC_TRUST_ACKNOWLEDGEMENT_PREFIX = 'aws-trust-ready:';
 const PROTECTED_BRANCHES = ['develop', 'main'];
-const ENVIRONMENT_BRANCHES = {
-    'async-recovery-production': 'main',
-    'async-recovery-staging': 'develop',
-    'infrastructure-plan-production': 'main',
-    'infrastructure-plan-staging': 'develop',
-    'performance-cost-production': 'main',
-    'performance-cost-staging': 'develop',
-    'performance-aggregate-production': 'main',
-    'performance-aggregate-staging': 'develop',
-    'performance-load-production': 'main',
-    'performance-load-staging': 'develop',
-    'npm-prerelease': 'main',
-    production: 'main',
-    'reliability-read-production': 'main',
-    'reliability-read-staging': 'develop',
-    staging: 'develop',
-};
-const ENVIRONMENT_SECRET_REQUIREMENTS = {
-    'async-recovery-production': [exports.EBK_ASYNC_RECOVERY_ROLE_SECRET],
-    'async-recovery-staging': [exports.EBK_ASYNC_RECOVERY_ROLE_SECRET],
-    'infrastructure-plan-production': [],
-    'infrastructure-plan-staging': [],
-    'performance-cost-production': [exports.EBK_PERFORMANCE_COST_ROLE_SECRET],
-    'performance-cost-staging': [exports.EBK_PERFORMANCE_COST_ROLE_SECRET],
-    'performance-aggregate-production': [exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET],
-    'performance-aggregate-staging': [exports.EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET],
-    'performance-load-production': [exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET],
-    'performance-load-staging': [exports.EBK_PERFORMANCE_LOAD_ROLE_SECRET],
-    'npm-prerelease': [],
-    production: [
-        exports.EBK_DEPLOYMENT_ROLE_SECRET,
-        exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET,
-        exports.EBK_SMOKE_ROLE_SECRET,
-        exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET,
-    ],
-    'reliability-read-production': [exports.EBK_RELIABILITY_READ_ROLE_SECRET],
-    'reliability-read-staging': [exports.EBK_RELIABILITY_READ_ROLE_SECRET],
-    staging: [
-        exports.EBK_DEPLOYMENT_ROLE_SECRET,
-        exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET,
-        exports.EBK_SMOKE_ROLE_SECRET,
-    ],
-};
+/** The trunk lane protects main alone; the protected pair protects both. */
+function protectedBranchesFor(deliveryLane = 'protected-pair') {
+    return deliveryLane === 'trunk' ? ['main'] : PROTECTED_BRANCHES;
+}
 const BASE_STAGE_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES.filter((variable) => variable !== 'EBK_ALLOW_PRODUCTION_REMOVE' &&
-    variable !== exports.EBK_PERFORMANCE_ORIGINS_VARIABLE &&
     !variable.startsWith('AWS_STAGING_PROMOTION_'));
-const PRODUCTION_STAGE_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES.filter((variable) => variable !== exports.EBK_PERFORMANCE_ORIGINS_VARIABLE);
-const ENVIRONMENT_VARIABLE_REQUIREMENTS = {
-    'async-recovery-production': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'async-recovery-staging': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'infrastructure-plan-production': [],
-    'infrastructure-plan-staging': [],
-    'performance-cost-production': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'performance-cost-staging': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'performance-aggregate-production': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'performance-aggregate-staging': ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
-    'performance-load-production': [
-        'AWS_EXPECTED_ACCOUNT_ID',
-        'AWS_REGION',
-        exports.EBK_PERFORMANCE_ORIGINS_VARIABLE,
-    ],
-    'performance-load-staging': [
-        'AWS_EXPECTED_ACCOUNT_ID',
-        'AWS_REGION',
-        exports.EBK_PERFORMANCE_ORIGINS_VARIABLE,
-    ],
-    'npm-prerelease': [],
-    production: PRODUCTION_STAGE_VARIABLES,
-    'reliability-read-production': [],
-    'reliability-read-staging': [],
-    staging: BASE_STAGE_VARIABLES,
-};
-function environmentStage(environment) {
-    return environment.endsWith('-production') ||
-        environment === 'npm-prerelease' ||
-        environment === 'production'
-        ? 'production'
-        : 'staging';
+const PRODUCTION_STAGE_VARIABLES = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES;
+const AUXILIARY_ENVIRONMENTS = Object.freeze([
+    {
+        name: 'async-recovery',
+        requiredSecrets: [exports.EBK_ASYNC_RECOVERY_ROLE_SECRET],
+        requiredVariables: ['AWS_EXPECTED_ACCOUNT_ID', 'AWS_REGION'],
+    },
+]);
+function stageEnvironmentTopology(stage, deploymentProfile) {
+    const production = stage === 'production';
+    return Object.freeze({
+        branch: production ? 'main' : 'develop',
+        name: stage,
+        optionalVariables: exports.EBK_OPTIONAL_STAGE_ENVIRONMENT_VARIABLES,
+        requiredSecrets: Object.freeze(production
+            ? deploymentProfile === 'starter'
+                ? []
+                : [exports.EBK_STAGING_PROMOTION_PULL_ROLE_SECRET]
+            : []),
+        requiredVariables: Object.freeze(production
+            ? deploymentProfile === 'starter'
+                ? PRODUCTION_STAGE_VARIABLES.filter((variable) => !variable.startsWith('AWS_STAGING_PROMOTION_'))
+                : PRODUCTION_STAGE_VARIABLES
+            : BASE_STAGE_VARIABLES),
+        stage,
+    });
+}
+/**
+ * Exact generated GitHub environment contract for one deployment profile.
+ * Starter uses development as its rehearsal stage; isolated profiles use
+ * staging. Production and npm publication remain present for every profile.
+ */
+function githubEnvironmentTopology(deploymentProfile, deliveryLane = 'protected-pair', productionApprovalMode = 'promotion-pr') {
+    if (deliveryLane === 'trunk') {
+        // Trunk lane: development stays local; only production-stage
+        // environments exist and every one of them binds to main.
+        return githubEnvironmentTopology(deploymentProfile).filter(({ stage }) => stage === 'production');
+    }
+    if (productionApprovalMode === 'trunk-promotion') {
+        // Trunk promotion: the develop run itself promotes and deploys
+        // production, so every production-stage environment also admits
+        // develop, and the production stage holds the record-main token.
+        return githubEnvironmentTopology(deploymentProfile).map((entry) => entry.stage === 'production'
+            ? Object.freeze({
+                ...entry,
+                additionalBranches: Object.freeze(['develop']),
+                requiredSecrets: Object.freeze(entry.name === 'production'
+                    ? [...entry.requiredSecrets, exports.EBK_RECORD_MAIN_TOKEN_SECRET]
+                    : [...entry.requiredSecrets]),
+            })
+            : entry);
+    }
+    const rehearsalStage = deploymentProfile === 'starter' ? 'development' : 'staging';
+    const stages = [
+        'production',
+        rehearsalStage,
+    ];
+    const topology = [];
+    for (const auxiliary of AUXILIARY_ENVIRONMENTS) {
+        for (const stage of stages) {
+            topology.push(Object.freeze({
+                branch: stage === 'production' ? 'main' : 'develop',
+                name: `${auxiliary.name}-${stage}`,
+                requiredSecrets: Object.freeze([...auxiliary.requiredSecrets]),
+                requiredVariables: Object.freeze([...auxiliary.requiredVariables]),
+                stage,
+            }));
+        }
+    }
+    const ecrStages = deploymentProfile === 'starter'
+        ? ['production']
+        : ['staging', 'production'];
+    for (const stage of ecrStages) {
+        topology.push(Object.freeze({
+            branch: stage === 'production' ? 'main' : 'develop',
+            name: `ecr-inspector-${stage}`,
+            requiredSecrets: Object.freeze([
+                exports.EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET,
+            ]),
+            requiredVariables: Object.freeze([
+                'AWS_EXPECTED_ACCOUNT_ID',
+                'AWS_REGION',
+            ]),
+            stage,
+        }));
+    }
+    topology.push(Object.freeze({
+        branch: 'main',
+        name: 'npm-prerelease',
+        requiredSecrets: Object.freeze([]),
+        requiredVariables: Object.freeze([]),
+        stage: 'production',
+    }), stageEnvironmentTopology('production', deploymentProfile), stageEnvironmentTopology(rehearsalStage, deploymentProfile));
+    return Object.freeze(topology);
 }
 function desiredEnvironmentProtection(environment, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds) {
-    const current = state.environments[environment];
-    const stage = environmentStage(environment);
+    const current = state.environments[environment.name];
+    const stage = environment.stage;
     const stageEnvironment = state.environments[stage];
-    if (environment === 'npm-prerelease') {
+    if (environment.name === 'npm-prerelease') {
         if (productionApprovalMode === 'promotion-pr') {
             return {
                 preventSelfReview: false,
@@ -177,19 +180,29 @@ function desiredEnvironmentProtection(environment, state, productionApprovalMode
         preventSelfReview: stage === 'production' &&
             productionApprovalMode === 'environment-reviewer'
             ? true
-            : environment === stage
+            : environment.name === stage
                 ? current.preventSelfReview
                 : stageEnvironment.preventSelfReview,
         reviewers: stage === 'production' &&
             productionApprovalMode === 'environment-reviewer' &&
             productionReviewerIds.length > 0
             ? existingReviewerPayload(productionReviewerIds)
-            : environment === stage
+            : environment.name === stage
                 ? current.reviewers
                 : stageEnvironment.reviewers,
-        waitTimer: environment === stage ? current.waitTimer : stageEnvironment.waitTimer,
+        waitTimer: environment.name === stage
+            ? current.waitTimer
+            : stageEnvironment.waitTimer,
     };
 }
+function requiresImmutableOidcSubjectCutover(state) {
+    return Boolean(state.oidcSubjectCustomization &&
+        (!state.oidcSubjectCustomization.useDefault ||
+            !state.oidcSubjectCustomization.useImmutableSubject));
+}
+function immutableOidcTrustAcknowledgement(identity) {
+    return `${GITHUB_IMMUTABLE_OIDC_TRUST_ACKNOWLEDGEMENT_PREFIX}${identity.subjectPrefix}`;
+}
 const PRIVATE_ENVIRONMENT_REVIEWER_PLANS = new Set([
     'business_plus',
     'enterprise',
@@ -231,9 +244,10 @@ class GitHubApi {
             }
             throw new GitHubApiError(response.status, `GitHub ${method} ${path} failed (${response.status}): ${detail}`);
         }
-        if (response.status === 204)
+        const responseBody = await response.text();
+        if (!responseBody)
             return undefined;
-        return (await response.json());
+        return JSON.parse(responseBody);
     }
 }
 function parseRepository(repository) {
@@ -243,6 +257,58 @@ function parseRepository(repository) {
     }
     return { owner: match[1], repo: match[2] };
 }
+function inspectRepositoryIdentity(repo) {
+    const owner = typeof repo.owner === 'object' && repo.owner !== null
+        ? repo.owner
+        : undefined;
+    const ownerLogin = owner?.login;
+    const ownerId = owner?.id;
+    const repositoryName = repo.name;
+    const repositoryId = repo.id;
+    const fullName = repo.full_name;
+    if (typeof ownerLogin !== 'string' ||
+        !/^[A-Za-z0-9_.-]+$/u.test(ownerLogin) ||
+        typeof ownerId !== 'number' ||
+        !Number.isSafeInteger(ownerId) ||
+        ownerId <= 0 ||
+        typeof repositoryName !== 'string' ||
+        !/^[A-Za-z0-9_.-]+$/u.test(repositoryName) ||
+        typeof repositoryId !== 'number' ||
+        !Number.isSafeInteger(repositoryId) ||
+        repositoryId <= 0 ||
+        typeof fullName !== 'string' ||
+        fullName !== `${ownerLogin}/${repositoryName}`) {
+        return undefined;
+    }
+    const ownerIdString = String(ownerId);
+    const repositoryIdString = String(repositoryId);
+    return {
+        fullName,
+        ownerId: ownerIdString,
+        repositoryId: repositoryIdString,
+        subjectPrefix: `repo:${ownerLogin}@${ownerIdString}/${repositoryName}@${repositoryIdString}`,
+    };
+}
+function inspectOidcSubjectCustomization(value) {
+    const includeClaimKeys = value.include_claim_keys;
+    const useDefault = value.use_default;
+    const useImmutableSubject = value.use_immutable_subject;
+    if (typeof useDefault !== 'boolean' ||
+        (useImmutableSubject !== undefined &&
+            typeof useImmutableSubject !== 'boolean') ||
+        (includeClaimKeys !== undefined &&
+            (!Array.isArray(includeClaimKeys) ||
+                includeClaimKeys.some((key) => typeof key !== 'string')))) {
+        return undefined;
+    }
+    return {
+        includeClaimKeys: Array.isArray(includeClaimKeys)
+            ? [...new Set(includeClaimKeys)].sort(deterministic_order_js_1.compareUtf16)
+            : [],
+        useDefault,
+        useImmutableSubject: useImmutableSubject === true,
+    };
+}
 function asObjects(value) {
     return Array.isArray(value)
         ? value.filter((item) => typeof item === 'object' && item !== null && !Array.isArray(item))
@@ -306,7 +372,7 @@ function refPatternMatches(pattern, ref) {
         .replace(/\?/g, '.');
     return new RegExp(`^${expression}$`).test(ref);
 }
-function rulesetTouchesProtectedBranches(ruleset) {
+function rulesetTouchesProtectedBranches(ruleset, deliveryLane = 'protected-pair') {
     const conditions = typeof ruleset.conditions === 'object' && ruleset.conditions !== null
         ? ruleset.conditions
         : {};
@@ -317,7 +383,7 @@ function rulesetTouchesProtectedBranches(ruleset) {
         return true;
     const include = asStrings(refName.include);
     const exclude = asStrings(refName.exclude);
-    return PROTECTED_BRANCHES.some((branch) => {
+    return protectedBranchesFor(deliveryLane).some((branch) => {
         const ref = `refs/heads/${branch}`;
         const included = include.length === 0 ||
             include.some((pattern) => refPatternMatches(pattern, ref));
@@ -325,9 +391,9 @@ function rulesetTouchesProtectedBranches(ruleset) {
         return included && !excluded;
     });
 }
-function conflictsWithMergeCommitContract(ruleset) {
+function conflictsWithMergeCommitContract(ruleset, deliveryLane = 'protected-pair') {
     if (!activeBranchRuleset(ruleset) ||
-        !rulesetTouchesProtectedBranches(ruleset)) {
+        !rulesetTouchesProtectedBranches(ruleset, deliveryLane)) {
         return [];
     }
     const conflicts = [];
@@ -389,13 +455,19 @@ function hasValidCatchAllCodeOwner(contents) {
         effectiveOwners.length > 0 &&
         effectiveOwners.every((owner) => owner.startsWith('@') && owner !== exports.EBK_CODE_OWNER_PLACEHOLDER));
 }
-function desiredRuleset() {
+function desiredRuleset(deliveryLane = 'protected-pair', productionApprovalMode = 'promotion-pr') {
+    // Trunk promotion records main by fast-forward from the deploy run, so
+    // the pull-request rule applies to develop alone and main keeps its own
+    // status-check and fast-forward-only ruleset.
+    const branches = productionApprovalMode === 'trunk-promotion' && deliveryLane !== 'trunk'
+        ? ['develop']
+        : protectedBranchesFor(deliveryLane);
     return {
         bypass_actors: [],
         conditions: {
             ref_name: {
                 exclude: [],
-                include: PROTECTED_BRANCHES.map((branch) => `refs/heads/${branch}`),
+                include: branches.map((branch) => `refs/heads/${branch}`),
             },
         },
         enforcement: 'active',
@@ -427,6 +499,30 @@ function desiredRuleset() {
         target: 'branch',
     };
 }
+function desiredMainRuleset() {
+    return {
+        bypass_actors: [],
+        conditions: {
+            ref_name: { exclude: [], include: ['refs/heads/main'] },
+        },
+        enforcement: 'active',
+        name: exports.EBK_PROTECTED_MAIN_RULESET_NAME,
+        rules: [
+            { type: 'deletion' },
+            { type: 'non_fast_forward' },
+            {
+                parameters: {
+                    required_status_checks: exports.EBK_REQUIRED_CHECKS.map((context) => ({
+                        context,
+                    })),
+                    strict_required_status_checks_policy: true,
+                },
+                type: 'required_status_checks',
+            },
+        ],
+        target: 'branch',
+    };
+}
 async function inspectEnvironment(api, repositoryPath, name) {
     const encoded = encodeURIComponent(name);
     let environment;
@@ -486,9 +582,24 @@ async function inspectEnvironment(api, repositoryPath, name) {
         waitTimer: environmentWaitTimer(environment),
     };
 }
-async function inspect(api, repositoryPath, productionApprovalMode) {
+async function inspect(api, repositoryPath, productionApprovalMode, deploymentProfile, deliveryLane = 'protected-pair') {
     const blockers = [];
     const repo = await api.request('GET', repositoryPath);
+    const repositoryIdentity = inspectRepositoryIdentity(repo);
+    if (!repositoryIdentity) {
+        blockers.push('GitHub repository identity must expose one canonical full name and positive immutable owner and repository IDs.');
+    }
+    let oidcSubjectCustomization;
+    try {
+        const oidcState = await api.request('GET', `${repositoryPath}/actions/oidc/customization/sub`);
+        oidcSubjectCustomization = inspectOidcSubjectCustomization(oidcState);
+        if (!oidcSubjectCustomization) {
+            blockers.push('GitHub repository OIDC subject customization returned an invalid response.');
+        }
+    }
+    catch (error) {
+        blockers.push(`GitHub repository OIDC subject customization could not be inspected: ${error instanceof Error ? error.message : String(error)}`);
+    }
     let ownerPlanName;
     if (productionApprovalMode === 'environment-reviewer' &&
         requiresPrivateEnvironmentCapabilities(repo)) {
@@ -518,7 +629,7 @@ async function inspect(api, repositoryPath, productionApprovalMode) {
             }
         }
     }
-    for (const branch of PROTECTED_BRANCHES) {
+    for (const branch of protectedBranchesFor(deliveryLane)) {
         try {
             const codeOwners = await api.request('GET', `${repositoryPath}/contents/.github/CODEOWNERS?ref=${branch}`);
             const content = codeOwners.content;
@@ -551,7 +662,7 @@ async function inspect(api, repositoryPath, productionApprovalMode) {
     catch (error) {
         blockers.push(`Ruleset enforcement could not be inspected: ${error instanceof Error ? error.message : String(error)}`);
     }
-    for (const branch of PROTECTED_BRANCHES) {
+    for (const branch of protectedBranchesFor(deliveryLane)) {
         try {
             const branchState = await api.request('GET', `${repositoryPath}/branches/${branch}`);
             const commit = typeof branchState.commit === 'object' && branchState.commit !== null
@@ -643,7 +754,7 @@ async function inspect(api, repositoryPath, productionApprovalMode) {
             };
         }
     };
-    const environments = Object.fromEntries(await Promise.all(Object.keys(ENVIRONMENT_BRANCHES).map(async (name) => [name, await inspectNamedEnvironment(name)])));
+    const environments = Object.fromEntries(await Promise.all(githubEnvironmentTopology(deploymentProfile, deliveryLane, productionApprovalMode).map(async ({ name }) => [name, await inspectNamedEnvironment(name)])));
     return {
         blockers,
         state: {
@@ -652,17 +763,21 @@ async function inspect(api, repositoryPath, productionApprovalMode) {
             environments,
             orgSecretNames,
             orgVariableNames,
+            oidcSubjectCustomization,
             ownerPlanName,
+            ownedMainRuleset: rulesets.find((ruleset) => ruleset.name === exports.EBK_PROTECTED_MAIN_RULESET_NAME &&
+                ruleset.source_type !== 'Organization'),
             ownedRuleset: rulesets.find((ruleset) => ruleset.name === exports.EBK_PROTECTED_BRANCH_RULESET_NAME &&
                 ruleset.source_type !== 'Organization'),
             repo,
+            repositoryIdentity,
             repositorySecretNames,
             repositoryVariableNames,
             rulesets,
         },
     };
 }
-function evaluate(repository, state, inspectionBlockers, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds) {
+function evaluate(repository, state, inspectionBlockers, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds, deploymentProfile = 'fully-isolated', deliveryLane = 'protected-pair') {
     const blockers = [...inspectionBlockers];
     const changes = [];
     const warnings = [];
@@ -682,6 +797,9 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
     if (state.repo.allow_rebase_merge !== false) {
         changes.push('Disable repository rebase merging.');
     }
+    if (requiresImmutableOidcSubjectCutover(state)) {
+        changes.push(GITHUB_IMMUTABLE_OIDC_CHANGE);
+    }
     if (state.actionsCanApprovePullRequests !== true) {
         blockers.push('GitHub Actions is not permitted to create or approve pull requests for managed sync-back.');
     }
@@ -701,6 +819,7 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
     }
     for (const variable of [
         ...exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES,
+        ...exports.EBK_OPTIONAL_STAGE_ENVIRONMENT_VARIABLES,
         ...FORBIDDEN_NPM_TOKEN_NAMES,
     ]) {
         if (state.repositoryVariableNames.includes(variable)) {
@@ -710,19 +829,8 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
             blockers.push(`${variable} is exposed from organization variable scope instead of its protected environment.`);
         }
     }
-    for (const variable of [
-        ...exports.EBK_STAGING_PLAN_REPOSITORY_VARIABLES,
-        ...exports.EBK_PRODUCTION_PLAN_REPOSITORY_VARIABLES,
-    ]) {
-        if (!state.repositoryVariableNames.includes(variable)) {
-            blockers.push(`Repository variable ${variable} is required for a protected read-only plan job; bootstrap never creates variable values.`);
-        }
-        if (state.orgVariableNames?.includes(variable)) {
-            blockers.push(`${variable} must be repository-bound instead of inherited from organization scope.`);
-        }
-    }
     for (const ruleset of state.rulesets) {
-        const conflicts = conflictsWithMergeCommitContract(ruleset);
+        const conflicts = conflictsWithMergeCommitContract(ruleset, deliveryLane);
         if (conflicts.length > 0) {
             blockers.push(`Active ruleset ${String(ruleset.name ?? ruleset.id ?? 'unknown')} ${conflicts.join(' and ')}.`);
         }
@@ -730,27 +838,44 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
     if (!state.ownedRuleset) {
         changes.push(`Create ruleset ${exports.EBK_PROTECTED_BRANCH_RULESET_NAME}.`);
     }
-    else if (JSON.stringify(normalizeRuleset(state.ownedRuleset)) !==
-        JSON.stringify(normalizeRuleset(desiredRuleset()))) {
+    else if (!rulesetMatchesDesired(state.ownedRuleset, deliveryLane, productionApprovalMode)) {
         changes.push(`Update ruleset ${exports.EBK_PROTECTED_BRANCH_RULESET_NAME}.`);
     }
-    for (const [environment, branch] of Object.entries(ENVIRONMENT_BRANCHES)) {
+    if (productionApprovalMode === 'trunk-promotion') {
+        if (!state.ownedMainRuleset) {
+            changes.push(`Create ruleset ${exports.EBK_PROTECTED_MAIN_RULESET_NAME}.`);
+        }
+        else if (JSON.stringify(normalizeRuleset(state.ownedMainRuleset)) !==
+            JSON.stringify(normalizeRuleset(desiredMainRuleset()))) {
+            changes.push(`Update ruleset ${exports.EBK_PROTECTED_MAIN_RULESET_NAME}.`);
+        }
+        warnings.push('Trunk promotion keeps main behind required status checks and fast-forward-only updates without a pull-request rule; the production environment secret EBK_RECORD_MAIN_TOKEN is the intended writer, and any other contents-write actor could push an already verified commit.');
+    }
+    else if (state.ownedMainRuleset) {
+        changes.push(`Delete ruleset ${exports.EBK_PROTECTED_MAIN_RULESET_NAME}.`);
+    }
+    for (const topology of githubEnvironmentTopology(deploymentProfile, deliveryLane, productionApprovalMode)) {
+        const { branch, name: environment, stage } = topology;
+        const allowedBranches = [branch, ...(topology.additionalBranches ?? [])];
         const current = state.environments[environment];
         if (!current.exists)
             changes.push(`Create ${environment} environment.`);
         if (!current.customBranchPolicies) {
             changes.push(`Enable custom deployment branch policy for ${environment}.`);
         }
-        const extras = current.branchPolicies.filter(({ name, type }) => name !== branch || type !== 'branch');
+        const extras = current.branchPolicies.filter(({ name, type }) => type !== 'branch' ||
+            !allowedBranches.includes(name));
         if (extras.length > 0) {
             blockers.push(`${environment} permits unexpected deployment refs: ${extras
                 .map(({ name, type }) => `${type}:${name}`)
                 .join(', ')}.`);
         }
-        if (!current.branchPolicies.some(({ name, type }) => name === branch && type === 'branch')) {
-            changes.push(`Restrict ${environment} deployment to ${branch}.`);
+        for (const allowed of allowedBranches) {
+            if (!current.branchPolicies.some(({ name, type }) => name === allowed && type === 'branch')) {
+                changes.push(`Restrict ${environment} deployment to ${allowed}.`);
+            }
         }
-        const requiredSecrets = ENVIRONMENT_SECRET_REQUIREMENTS[environment];
+        const requiredSecrets = topology.requiredSecrets;
         for (const secret of requiredSecrets) {
             if (!current.secretNames.includes(secret)) {
                 blockers.push(`${environment} environment is missing ${secret}; bootstrap never creates secret values.`);
@@ -761,20 +886,21 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
                 blockers.push(`${environment} environment exposes ${secret} outside its exact capability boundary.`);
             }
         }
-        const requiredVariables = ENVIRONMENT_VARIABLE_REQUIREMENTS[environment];
+        const requiredVariables = topology.requiredVariables;
         for (const variable of requiredVariables) {
             if (!current.variableNames.includes(variable)) {
                 blockers.push(`${environment} environment is missing required variable ${variable}; bootstrap never creates variable values.`);
             }
         }
+        const optionalVariables = topology.optionalVariables ?? [];
         for (const variable of current.variableNames) {
-            if (!requiredVariables.includes(variable)) {
+            if (!requiredVariables.includes(variable) &&
+                !optionalVariables.includes(variable)) {
                 blockers.push(`${environment} environment exposes ${variable} outside its exact capability boundary.`);
             }
         }
-        const stage = environmentStage(environment);
         if (environment !== stage) {
-            const desired = desiredEnvironmentProtection(environment, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
+            const desired = desiredEnvironmentProtection(topology, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
             if (environment === 'npm-prerelease' &&
                 productionApprovalMode === 'environment-reviewer' &&
                 desired.reviewers.length === 0) {
@@ -816,14 +942,19 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
             }
         }
     }
-    if (state.environments.staging.reviewers.length > 0) {
-        warnings.push('Staging has additional reviewer protection; bootstrap will preserve it.');
+    const rehearsalStage = deploymentProfile === 'starter' ? 'development' : 'staging';
+    if (state.environments[rehearsalStage].reviewers.length > 0) {
+        warnings.push(`${rehearsalStage === 'development' ? 'Development' : 'Staging'} has additional reviewer protection; bootstrap will preserve it.`);
     }
     return {
         blockers: [...new Set(blockers)].sort(),
         changes: [...new Set(changes)].sort(),
+        deploymentProfile,
         ready: blockers.length === 0 && changes.length === 0,
         repository,
+        ...(state.repositoryIdentity
+            ? { repositoryIdentity: state.repositoryIdentity }
+            : {}),
         productionApprovalMode,
         warnings: [...new Set(warnings)].sort(),
     };
@@ -885,11 +1016,14 @@ function normalizeRuleset(ruleset) {
 function existingReviewerPayload(ids) {
     return ids.map((id) => ({ id, type: 'User' }));
 }
-function rulesetMatchesDesired(ruleset) {
+function rulesetMatchesDesired(ruleset, deliveryLane = 'protected-pair', productionApprovalMode = 'promotion-pr') {
     return (JSON.stringify(normalizeRuleset(ruleset)) ===
-        JSON.stringify(normalizeRuleset(desiredRuleset())));
+        JSON.stringify(normalizeRuleset(desiredRuleset(deliveryLane, productionApprovalMode))));
 }
-async function applyChanges(api, repositoryPath, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds) {
+async function applyChanges(api, repositoryPath, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds, deploymentProfile, deliveryLane = 'protected-pair') {
+    if (requiresImmutableOidcSubjectCutover(state)) {
+        await api.request('PUT', `${repositoryPath}/actions/oidc/customization/sub`, { use_default: true, use_immutable_subject: true });
+    }
     if (state.repo.allow_merge_commit !== true ||
         state.repo.allow_rebase_merge !== false ||
         state.repo.allow_squash_merge !== false) {
@@ -899,19 +1033,36 @@ async function applyChanges(api, repositoryPath, state, productionApprovalMode,
             allow_squash_merge: false,
         });
     }
-    const desired = desiredRuleset();
+    const desired = desiredRuleset(deliveryLane, productionApprovalMode);
     if (state.ownedRuleset &&
         typeof state.ownedRuleset.id === 'number' &&
-        !rulesetMatchesDesired(state.ownedRuleset)) {
+        !rulesetMatchesDesired(state.ownedRuleset, deliveryLane, productionApprovalMode)) {
         await api.request('PUT', `${repositoryPath}/rulesets/${state.ownedRuleset.id}`, desired);
     }
     else if (!state.ownedRuleset) {
         await api.request('POST', `${repositoryPath}/rulesets`, desired);
     }
-    for (const [environment, branch] of Object.entries(ENVIRONMENT_BRANCHES)) {
+    if (productionApprovalMode === 'trunk-promotion') {
+        const desiredMain = desiredMainRuleset();
+        if (state.ownedMainRuleset &&
+            typeof state.ownedMainRuleset.id === 'number' &&
+            JSON.stringify(normalizeRuleset(state.ownedMainRuleset)) !==
+                JSON.stringify(normalizeRuleset(desiredMain))) {
+            await api.request('PUT', `${repositoryPath}/rulesets/${state.ownedMainRuleset.id}`, desiredMain);
+        }
+        else if (!state.ownedMainRuleset) {
+            await api.request('POST', `${repositoryPath}/rulesets`, desiredMain);
+        }
+    }
+    else if (state.ownedMainRuleset &&
+        typeof state.ownedMainRuleset.id === 'number') {
+        await api.request('DELETE', `${repositoryPath}/rulesets/${state.ownedMainRuleset.id}`);
+    }
+    for (const topology of githubEnvironmentTopology(deploymentProfile, deliveryLane, productionApprovalMode)) {
+        const { branch, name: environment, stage } = topology;
+        const allowedBranches = [branch, ...(topology.additionalBranches ?? [])];
         const current = state.environments[environment];
-        const stage = environmentStage(environment);
-        const desiredProtection = desiredEnvironmentProtection(environment, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
+        const desiredProtection = desiredEnvironmentProtection(topology, state, productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
         const reviewers = desiredProtection.reviewers;
         const desiredPreventSelfReview = desiredProtection.preventSelfReview;
         const desiredWaitTimer = desiredProtection.waitTimer;
@@ -941,19 +1092,25 @@ async function applyChanges(api, repositoryPath, state, productionApprovalMode,
                     : {}),
             });
         }
-        if (!current.branchPolicies.some(({ name, type }) => name === branch && type === 'branch')) {
-            await api.request('POST', `${repositoryPath}/environments/${encodeURIComponent(environment)}/deployment-branch-policies`, { name: branch, type: 'branch' });
+        for (const allowed of allowedBranches) {
+            if (!current.branchPolicies.some(({ name, type }) => name === allowed && type === 'branch')) {
+                await api.request('POST', `${repositoryPath}/environments/${encodeURIComponent(environment)}/deployment-branch-policies`, { name: allowed, type: 'branch' });
+            }
         }
     }
 }
 async function runGitHubBootstrap(options) {
     const repository = options.repository.trim();
+    const deploymentProfile = options.deploymentProfile ?? 'fully-isolated';
     const { owner, repo } = parseRepository(repository);
     if (!options.token.trim()) {
         throw new Error('GH_TOKEN or GITHUB_TOKEN is required for GitHub bootstrap.');
     }
     if (!index_js_1.PRODUCTION_APPROVAL_MODES.includes(options.productionApprovalMode)) {
-        throw new Error('Production approval mode must be the explicit committed value promotion-pr or environment-reviewer.');
+        throw new Error('Production approval mode must be the explicit committed value promotion-pr, environment-reviewer, or trunk-promotion.');
+    }
+    if (!index_js_1.DEPLOYMENT_PROFILES.includes(deploymentProfile)) {
+        throw new Error('Deployment profile must be starter, production-isolated, or fully-isolated.');
     }
     const productionReviewerIds = [
         ...new Set(options.productionReviewerIds ?? []),
@@ -973,15 +1130,26 @@ async function runGitHubBootstrap(options) {
     }
     const api = new GitHubApi(options.apiBaseUrl?.trim() || 'https://api.github.com', options.token);
     const repositoryPath = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
-    const initial = await inspect(api, repositoryPath, options.productionApprovalMode);
-    const report = evaluate(repository, initial.state, initial.blockers, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
+    const deliveryLane = options.deliveryLane ?? 'protected-pair';
+    const initial = await inspect(api, repositoryPath, options.productionApprovalMode, deploymentProfile, deliveryLane);
+    const report = evaluate(repository, initial.state, initial.blockers, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds, deploymentProfile, deliveryLane);
     if (!options.apply)
         return report;
     if (report.blockers.length > 0) {
         throw new Error(`GitHub bootstrap apply is blocked:\n- ${report.blockers.join('\n- ')}`);
     }
-    await applyChanges(api, repositoryPath, initial.state, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
-    const completed = await inspect(api, repositoryPath, options.productionApprovalMode);
-    return evaluate(repository, completed.state, completed.blockers, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds);
+    if (requiresImmutableOidcSubjectCutover(initial.state)) {
+        const identity = initial.state.repositoryIdentity;
+        if (!identity) {
+            throw new Error('GitHub bootstrap cannot acknowledge immutable OIDC trust without the inspected repository identity.');
+        }
+        const expectedAcknowledgement = immutableOidcTrustAcknowledgement(identity);
+        if (options.immutableOidcTrustAcknowledgement !== expectedAcknowledgement) {
+            throw new Error(`GitHub bootstrap immutable OIDC subject cutover requires the exact AWS-trust readiness acknowledgement ${JSON.stringify(expectedAcknowledgement)}. Apply the matching immutable repository-subject AWS trusts, read them back, and rerun with --immutableOidcTrustAcknowledgement=${JSON.stringify(expectedAcknowledgement)}. No GitHub settings were changed.`);
+        }
+    }
+    await applyChanges(api, repositoryPath, initial.state, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds, deploymentProfile, deliveryLane);
+    const completed = await inspect(api, repositoryPath, options.productionApprovalMode, deploymentProfile, deliveryLane);
+    return evaluate(repository, completed.state, completed.blockers, options.productionApprovalMode, productionReviewerIds, npmPrereleaseReviewerIds, deploymentProfile, deliveryLane);
 }
 //# sourceMappingURL=github-bootstrap.js.map