@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/release/source-authority.js

@@ -4,81 +4,149 @@ exports.validateReviewedReleaseCheckout = validateReviewedReleaseCheckout;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const sst_environment_source_format_js_1 = require("../sst-environment-source-format.js");
 const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u;
-const INFRASTRUCTURE_APPROVAL_PATH = 'operations/infrastructure-approval.json';
+const MAX_TRANSIENT_SST_ENV_FILES = 64;
+const MAX_TRANSIENT_SST_ENV_FILE_BYTES = 1024 * 1024;
+const MAX_TRANSIENT_SST_ENV_PATH_BYTES = 1024;
 function git(repositoryRoot, args) {
     return (0, node_child_process_1.execFileSync)('git', [...args], {
         ...(repositoryRoot === undefined ? {} : { cwd: repositoryRoot }),
         encoding: 'utf8',
     }).trim();
 }
-function gitBytes(repositoryRoot, args) {
-    return (0, node_child_process_1.execFileSync)('git', [...args], {
-        ...(repositoryRoot === undefined ? {} : { cwd: repositoryRoot }),
-        encoding: 'utf8',
-        maxBuffer: 2 * 1024 * 1024,
-    });
-}
 function gitBuffer(repositoryRoot, args) {
     return (0, node_child_process_1.execFileSync)('git', [...args], {
         ...(repositoryRoot === undefined ? {} : { cwd: repositoryRoot }),
         maxBuffer: 2 * 1024 * 1024,
     });
 }
-function normalizeCheckoutLineEndings(bytes) {
-    const normalized = Buffer.allocUnsafe(bytes.byteLength);
-    let writeOffset = 0;
-    for (let readOffset = 0; readOffset < bytes.byteLength; readOffset += 1) {
-        if (bytes[readOffset] === 13 && bytes[readOffset + 1] === 10) {
-            continue;
-        }
-        normalized[writeOffset] = bytes[readOffset] ?? 0;
-        writeOffset += 1;
-    }
-    return normalized.subarray(0, writeOffset);
+function normalizedRelativePath(root, absolutePath) {
+    const path = (0, node_path_1.relative)(root, absolutePath).split('\\').join('/');
+    if (!path ||
+        path === '..' ||
+        path.startsWith('../') ||
+        (0, node_path_1.isAbsolute)(path) ||
+        Buffer.byteLength(path, 'utf8') > MAX_TRANSIENT_SST_ENV_PATH_BYTES) {
+        throw new Error('Reviewed release SST environment source escapes its project boundary.');
+    }
+    return path;
 }
-function validApprovalBatch(value, releaseSourceCommit) {
-    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+function exactTransientSstEnvironmentSource(repositoryRoot, projectRoot, repositoryPath) {
+    const absolutePath = (0, node_path_1.resolve)(repositoryRoot, repositoryPath);
+    if (normalizedRelativePath(repositoryRoot, absolutePath) !== repositoryPath ||
+        normalizedRelativePath(projectRoot, absolutePath) === 'sst-env.d.ts') {
         return false;
     }
-    const batch = value;
-    if (batch.kind !== 'ebk-infrastructure-approval-batch' ||
-        batch.schemaVersion !== 1 ||
-        !['deploy', 'refresh', 'remove'].includes(String(batch.action)) ||
-        !['staging', 'production'].includes(String(batch.stage)) ||
-        !Array.isArray(batch.orderedProjects) ||
-        batch.orderedProjects.length === 0 ||
-        batch.orderedProjects.some((project) => typeof project !== 'string' ||
-            project.length === 0 ||
-            project !== project.trim()) ||
-        new Set(batch.orderedProjects).size !== batch.orderedProjects.length ||
-        batch.projects === null ||
-        typeof batch.projects !== 'object' ||
-        Array.isArray(batch.projects)) {
+    const projectPath = normalizedRelativePath(projectRoot, absolutePath);
+    if (!projectPath.endsWith('/sst-env.d.ts'))
+        return false;
+    const before = (0, node_fs_1.lstatSync)(absolutePath, { bigint: true });
+    if (!before.isFile() ||
+        before.nlink !== 1n ||
+        before.size > BigInt(MAX_TRANSIENT_SST_ENV_FILE_BYTES) ||
+        (0, node_fs_1.realpathSync)(absolutePath) !== absolutePath) {
         return false;
     }
-    const projects = batch.projects;
-    if (JSON.stringify(Object.keys(projects).sort()) !==
-        JSON.stringify([...batch.orderedProjects].sort())) {
+    const bytes = (0, node_fs_1.readFileSync)(absolutePath);
+    const after = (0, node_fs_1.lstatSync)(absolutePath, { bigint: true });
+    if (before.birthtimeNs !== after.birthtimeNs ||
+        before.ctimeNs !== after.ctimeNs ||
+        before.dev !== after.dev ||
+        before.ino !== after.ino ||
+        before.mode !== after.mode ||
+        before.mtimeNs !== after.mtimeNs ||
+        before.nlink !== after.nlink ||
+        before.size !== after.size ||
+        BigInt(bytes.byteLength) !== after.size) {
+        return false;
+    }
+    return (0, sst_environment_source_format_js_1.exactGeneratedNestedSstEnvironmentSourceBytes)(absolutePath, (0, node_path_1.join)(projectRoot, 'sst-env.d.ts')).some((expected) => expected.equals(bytes));
+}
+function exactTransientRootSstEnvironmentSource(rootSourcePath) {
+    const before = (0, node_fs_1.lstatSync)(rootSourcePath, { bigint: true });
+    if (!before.isFile() ||
+        before.nlink !== 1n ||
+        before.size > BigInt(MAX_TRANSIENT_SST_ENV_FILE_BYTES) ||
+        (0, node_fs_1.realpathSync)(rootSourcePath) !== rootSourcePath) {
         return false;
     }
-    return Object.values(projects).every((entry) => entry !== null &&
-        typeof entry === 'object' &&
-        !Array.isArray(entry) &&
-        entry.planned !== null &&
-        typeof entry.planned === 'object' &&
-        !Array.isArray(entry.planned) &&
-        entry.planned.sourceCommit === releaseSourceCommit &&
-        entry.approval !== null &&
-        typeof entry.approval === 'object' &&
-        !Array.isArray(entry.approval));
+    const bytes = (0, node_fs_1.readFileSync)(rootSourcePath);
+    const after = (0, node_fs_1.lstatSync)(rootSourcePath, { bigint: true });
+    return (before.birthtimeNs === after.birthtimeNs &&
+        before.ctimeNs === after.ctimeNs &&
+        before.dev === after.dev &&
+        before.ino === after.ino &&
+        before.mode === after.mode &&
+        before.mtimeNs === after.mtimeNs &&
+        before.nlink === after.nlink &&
+        before.size === after.size &&
+        BigInt(bytes.byteLength) === after.size &&
+        (0, sst_environment_source_format_js_1.isExactGeneratedRootSstEnvironmentSourceBytes)(bytes));
+}
+function exactTransientRootSstPythonSource(rootPythonSourcePath) {
+    const before = (0, node_fs_1.lstatSync)(rootPythonSourcePath, { bigint: true });
+    if (!before.isFile() ||
+        before.nlink !== 1n ||
+        before.size > BigInt(MAX_TRANSIENT_SST_ENV_FILE_BYTES) ||
+        (0, node_fs_1.realpathSync)(rootPythonSourcePath) !== rootPythonSourcePath) {
+        return false;
+    }
+    const bytes = (0, node_fs_1.readFileSync)(rootPythonSourcePath);
+    const after = (0, node_fs_1.lstatSync)(rootPythonSourcePath, { bigint: true });
+    return (before.birthtimeNs === after.birthtimeNs &&
+        before.ctimeNs === after.ctimeNs &&
+        before.dev === after.dev &&
+        before.ino === after.ino &&
+        before.mode === after.mode &&
+        before.mtimeNs === after.mtimeNs &&
+        before.nlink === after.nlink &&
+        before.size === after.size &&
+        BigInt(bytes.byteLength) === after.size &&
+        (0, sst_environment_source_format_js_1.isExactGeneratedRootSstPythonSourceBytes)(bytes));
+}
+function exactTransientSstEnvironmentCheckout(input) {
+    const repositoryRoot = (0, node_fs_1.realpathSync)(input.repositoryRoot);
+    const projectRoot = (0, node_fs_1.realpathSync)(input.projectRoot);
+    normalizedRelativePath(repositoryRoot, projectRoot);
+    const rootSourcePath = (0, node_path_1.join)(projectRoot, 'sst-env.d.ts');
+    const rootPythonSourcePath = (0, node_path_1.join)(projectRoot, 'sst.pyi');
+    const rootSource = (0, node_fs_1.lstatSync)(rootSourcePath, { bigint: true });
+    if (!rootSource.isFile() ||
+        rootSource.nlink !== 1n ||
+        (0, node_fs_1.realpathSync)(rootSourcePath) !== rootSourcePath) {
+        return false;
+    }
+    const rootRepositoryPath = normalizedRelativePath(repositoryRoot, rootSourcePath);
+    const rootPythonRepositoryPath = normalizedRelativePath(repositoryRoot, rootPythonSourcePath);
+    try {
+        git(repositoryRoot, [
+            'ls-files',
+            '--error-unmatch',
+            '--',
+            rootRepositoryPath,
+        ]);
+    }
+    catch {
+        return false;
+    }
+    const fields = input.status.toString('utf8').split('\0');
+    if (fields.pop() !== '' || fields.length > MAX_TRANSIENT_SST_ENV_FILES) {
+        return false;
+    }
+    return (fields.length > 0 &&
+        fields.every((field) => (field === ` M ${rootRepositoryPath}` &&
+            exactTransientRootSstEnvironmentSource(rootSourcePath)) ||
+            (field === `?? ${rootPythonRepositoryPath}` &&
+                exactTransientRootSstPythonSource(rootPythonSourcePath)) ||
+            (field.startsWith('?? ') &&
+                exactTransientSstEnvironmentSource(repositoryRoot, projectRoot, field.slice(3)))));
 }
 /**
  * Proves that protected release evidence can be consumed from the checked-out
- * deployment commit. A different tree is accepted only for the framework's
- * committed infrastructure-approval resume, and only when that exact Git delta
- * contains the approval batch which binds every project back to the immutable
- * release source.
+ * deployment commit. Merge commits are supported through reviewedSourceCommit,
+ * but all three commits must resolve to the same exact source tree. Committed
+ * approval descendants and other source mutations are never release authority.
  */
 function validateReviewedReleaseCheckout(input) {
     const deploymentSourceCommit = input.deploymentSourceCommit?.trim() ?? '';
@@ -93,13 +161,29 @@ function validateReviewedReleaseCheckout(input) {
     if (currentCommit !== deploymentSourceCommit) {
         throw new Error('Reviewed release checkout differs from the deployment source commit.');
     }
-    if (gitBytes(input.repositoryRoot, [
+    const status = gitBuffer(input.repositoryRoot, [
         'status',
         '--porcelain=v1',
+        '-z',
         '--untracked-files=all',
-    ]).length !== 0) {
+    ]);
+    if (status.length !== 0 &&
+        (input.sstEnvironmentProjectRoot === undefined ||
+            !exactTransientSstEnvironmentCheckout({
+                projectRoot: input.sstEnvironmentProjectRoot,
+                repositoryRoot: input.repositoryRoot ??
+                    git(undefined, ['rev-parse', '--show-toplevel']),
+                status,
+            }))) {
         throw new Error('Reviewed release checkout must be completely clean.');
     }
+    const tracked = gitBuffer(input.repositoryRoot, ['ls-files', '-v', '-z'])
+        .toString('utf8')
+        .split('\0');
+    if (tracked.pop() !== '' ||
+        tracked.some((entry) => !entry.startsWith('H '))) {
+        throw new Error('Reviewed release checkout contains hidden or skipped tracked state.');
+    }
     const deploymentTree = git(input.repositoryRoot, [
         'rev-parse',
         `${deploymentSourceCommit}^{tree}`,
@@ -116,79 +200,12 @@ function validateReviewedReleaseCheckout(input) {
     if (deploymentTree !== reviewedTree) {
         throw new Error('Reviewed release source tree differs from the deployment checkout.');
     }
-    if (reviewedTree === releaseTree) {
-        return {
-            deploymentSourceCommit,
-            mode: 'exact-tree',
-            releaseSourceCommit,
-        };
-    }
-    const ancestry = (0, node_child_process_1.spawnSync)('git', ['merge-base', '--is-ancestor', releaseSourceCommit, reviewedCommit], {
-        ...(input.repositoryRoot === undefined
-            ? {}
-            : { cwd: input.repositoryRoot }),
-        encoding: 'utf8',
-    });
-    if (ancestry.status !== 0) {
-        throw new Error('Reviewed deployment commit does not descend from its release source.');
-    }
-    const changes = git(input.repositoryRoot, [
-        'diff',
-        '--name-status',
-        '--no-renames',
-        releaseSourceCommit,
-        reviewedCommit,
-        '--',
-    ])
-        .split('\n')
-        .filter(Boolean);
-    if (changes.length !== 1 ||
-        !/^[AM]\toperations\/infrastructure-approval\.json$/u.test(changes[0] ?? '')) {
-        throw new Error('Reviewed deployment differs from its release source beyond the infrastructure approval batch.');
-    }
-    const approvalEntry = git(input.repositoryRoot, [
-        'ls-tree',
-        reviewedCommit,
-        '--',
-        INFRASTRUCTURE_APPROVAL_PATH,
-    ]);
-    if (!/^100(?:644|755) blob [a-f0-9]+\toperations\/infrastructure-approval\.json$/u.test(approvalEntry)) {
-        throw new Error('Infrastructure approval batch must be one regular Git blob.');
-    }
-    const repositoryRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.repositoryRoot ?? git(undefined, ['rev-parse', '--show-toplevel'])));
-    const approvalPath = (0, node_path_1.resolve)(repositoryRoot, INFRASTRUCTURE_APPROVAL_PATH);
-    const approvalMetadata = (0, node_fs_1.lstatSync)(approvalPath);
-    if (!approvalMetadata.isFile() ||
-        approvalMetadata.isSymbolicLink() ||
-        (0, node_fs_1.realpathSync)(approvalPath) !== approvalPath) {
-        throw new Error('Infrastructure approval batch must be one canonical regular checkout file.');
-    }
-    const approvalBytes = gitBuffer(input.repositoryRoot, [
-        'show',
-        `${reviewedCommit}:${INFRASTRUCTURE_APPROVAL_PATH}`,
-    ]);
-    if (approvalMetadata.size > 1024 * 1024 ||
-        approvalBytes.byteLength > 1024 * 1024) {
-        throw new Error('Infrastructure approval batch exceeds its size bound.');
-    }
-    const approvalCheckoutBytes = (0, node_fs_1.readFileSync)(approvalPath);
-    if (!approvalCheckoutBytes.equals(approvalBytes) &&
-        !normalizeCheckoutLineEndings(approvalCheckoutBytes).equals(approvalBytes)) {
-        throw new Error('Infrastructure approval checkout bytes differ from the reviewed Git blob.');
-    }
-    let approval;
-    try {
-        approval = JSON.parse(approvalBytes.toString('utf8'));
-    }
-    catch {
-        throw new Error('Infrastructure approval batch is not valid JSON.');
-    }
-    if (!validApprovalBatch(approval, releaseSourceCommit)) {
-        throw new Error('Infrastructure approval batch does not bind the immutable release source.');
+    if (reviewedTree !== releaseTree) {
+        throw new Error('Reviewed release source tree differs from the immutable release source.');
     }
     return {
         deploymentSourceCommit,
-        mode: 'infrastructure-approval-only',
+        mode: 'exact-tree',
         releaseSourceCommit,
     };
 }

package/src/repository-policy/aurora-preflight.d.ts

@@ -7,7 +7,7 @@ export interface AuroraProfileCapabilityReport {
 }
 export declare function createAuroraProfileCapabilityReader(options: {
     profile?: string;
-    region?: string;
+    region: string;
 }): {
     read: () => Promise<string[]>;
     resolveRegion: () => Promise<string>;

package/src/repository-policy/aurora-preflight.js

@@ -4,12 +4,15 @@ exports.createAuroraProfileCapabilityReader = createAuroraProfileCapabilityReade
 exports.evaluateAuroraProfileCapability = evaluateAuroraProfileCapability;
 const client_rds_1 = require("@aws-sdk/client-rds");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
+const identity_js_1 = require("../aws/identity.js");
 const foundation_profile_js_1 = require("./foundation-profile.js");
 function createAuroraProfileCapabilityReader(options) {
     const profile = options.profile?.trim();
+    const region = options.region.trim();
     const client = new client_rds_1.RDSClient({
         ...(profile ? { credentials: (0, credential_providers_1.fromIni)({ profile }) } : {}),
-        ...(options.region?.trim() ? { region: options.region.trim() } : {}),
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('rds', region),
+        region,
     });
     return {
         read: async () => {

package/src/repository-policy/capacity-migration.d.ts

@@ -0,0 +1,3 @@
+export declare const CAPACITY_MIGRATION_GUIDANCE = "The existing cost-optimized policy means 0.5\u20134 warm ACUs. Before upgrading or deploying, explicitly preserve that behavior with: pnpm nx g @empire-builder-kit/nx:repository-policy --profile=balanced --apply. After the managed upgrade, select --profile=cost-optimized separately only to opt into 0\u20132 ACUs and five-minute auto-pause. Policy changes do not deploy AWS resources.";
+export declare function assertCapacityMigrationChoice(profile: string, costs: unknown): void;
+export declare function assertWorkspaceCapacityMigrationChoice(root: string, profile: string): void;

package/src/repository-policy/capacity-migration.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CAPACITY_MIGRATION_GUIDANCE = void 0;
+exports.assertCapacityMigrationChoice = assertCapacityMigrationChoice;
+exports.assertWorkspaceCapacityMigrationChoice = assertWorkspaceCapacityMigrationChoice;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+exports.CAPACITY_MIGRATION_GUIDANCE = 'The existing cost-optimized policy means 0.5–4 warm ACUs. Before upgrading or deploying, explicitly preserve that behavior with: pnpm nx g @empire-builder-kit/nx:repository-policy --profile=balanced --apply. After the managed upgrade, select --profile=cost-optimized separately only to opt into 0–2 ACUs and five-minute auto-pause. Policy changes do not deploy AWS resources.';
+function assertCapacityMigrationChoice(profile, costs) {
+    const previous = costs?.productionProfiles?.['cost-optimized']?.aurora;
+    if (profile === 'cost-optimized' && previous?.min === '0.5 ACU') {
+        throw new Error(exports.CAPACITY_MIGRATION_GUIDANCE);
+    }
+}
+function assertWorkspaceCapacityMigrationChoice(root, profile) {
+    const path = (0, node_path_1.join)(root, 'packages/foundation/contracts/costs.json');
+    if ((0, node_fs_1.existsSync)(path)) {
+        assertCapacityMigrationChoice(profile, JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8')));
+    }
+}
+//# sourceMappingURL=capacity-migration.js.map

package/src/repository-policy/deployment-plan.d.ts

@@ -1,4 +1,4 @@
-import type { ProductionApprovalMode, ProductionFoundationProfile, RepositoryOperatingPolicy } from './policy.js';
+import type { ConfiguredDeploymentAccounts, DeploymentProfile, ProductionApprovalMode, ProductionFoundationProfile, RepositoryOperatingPolicy } from './policy.js';
 export declare const PROTECTED_DEPLOYMENT_ACTIONS: readonly ["deploy", "refresh", "remove", "unlock"];
 export declare const PROTECTED_DEPLOYMENT_STAGES: readonly ["staging", "production"];
 export type ProtectedDeploymentAction = (typeof PROTECTED_DEPLOYMENT_ACTIONS)[number];
@@ -10,6 +10,9 @@ export interface DeploymentPlanProject {
 }
 export interface ProtectedDeploymentPlan {
     action: ProtectedDeploymentAction;
+    deploymentAccounts: ConfiguredDeploymentAccounts;
+    deploymentProfile: DeploymentProfile;
+    deploymentRegion: string;
     effectiveProductionProfile?: ProductionFoundationProfile;
     foundationProject?: string;
     orderedProjects: string[];

package/src/repository-policy/deployment-plan.js

@@ -20,6 +20,9 @@ function compareCodePoints(left, right) {
     return left.name < right.name ? -1 : left.name > right.name ? 1 : 0;
 }
 function createProtectedDeploymentPlan(policy, options) {
+    (0, policy_js_1.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, options.stage);
+    const deploymentAccounts = { ...policy.deploymentAccounts };
+    const deploymentRegion = (0, policy_js_1.configuredDeploymentRegion)(policy.deploymentRegion);
     const foundations = options.projects.filter((project) => hasTag(project, 'scope:foundation') &&
         supportsAction(project, options.action));
     if (foundations.length !== 1) {
@@ -56,6 +59,9 @@ function createProtectedDeploymentPlan(policy, options) {
         }
         return {
             action: options.action,
+            deploymentAccounts,
+            deploymentProfile: policy.deploymentProfile,
+            deploymentRegion,
             ...(decision.effectiveProductionProfile
                 ? {
                     effectiveProductionProfile: decision.effectiveProductionProfile,
@@ -108,6 +114,9 @@ function createProtectedDeploymentPlan(policy, options) {
     }
     return {
         action: options.action,
+        deploymentAccounts,
+        deploymentProfile: policy.deploymentProfile,
+        deploymentRegion,
         ...(decision.effectiveProductionProfile
             ? {
                 effectiveProductionProfile: decision.effectiveProductionProfile,

package/src/repository-policy/foundation-profile.js

@@ -10,7 +10,7 @@ exports.FOUNDATION_AURORA_ENGINE_VERSION = '17.4';
 exports.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS = {
     'cost-optimized': {
         aurora: {
-            max: '4 ACU',
+            max: '2 ACU',
             min: '0 ACU',
             pauseAfter: '5 minutes',
         },
@@ -18,6 +18,15 @@ exports.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS = {
         deletionProtection: true,
         nat: 'managed',
     },
+    balanced: {
+        aurora: {
+            max: '4 ACU',
+            min: '0.5 ACU',
+        },
+        backupRetentionDays: 30,
+        deletionProtection: true,
+        nat: 'managed',
+    },
     standard: {
         aurora: {
             max: '16 ACU',

package/src/repository-policy/policy.d.ts

@@ -3,18 +3,53 @@ export declare const REPOSITORY_POLICY_FILE: "ebk.repository-policy.json";
 export declare const REPOSITORY_POLICY_SCHEMA_VERSION: 1;
 export declare const REPOSITORY_POLICY_SCHEMA_URL: "./node_modules/@empire-builder-kit/nx/schemas/repository-policy-v1.json";
 export declare const PRODUCTION_ACCESS_VALUES: readonly ["disabled", "controlled"];
-export declare const PRODUCTION_APPROVAL_MODES: readonly ["promotion-pr", "environment-reviewer"];
-export declare const PRODUCTION_FOUNDATION_PROFILES: readonly ["cost-optimized", "standard"];
+export declare const PRODUCTION_APPROVAL_MODES: readonly ["promotion-pr", "environment-reviewer", "trunk-promotion"];
+export declare const PRODUCTION_FOUNDATION_PROFILES: readonly ["cost-optimized", "balanced", "standard"];
 export declare const DEFAULT_RECOVERY_PRODUCTION_FOUNDATION_PROFILE: "standard";
 export declare const SLICE_PRODUCTION_STATUSES: readonly ["blocked", "pilot", "ready"];
 export declare const REPOSITORY_MODE_PRESETS: readonly ["incubation", "controlled-production", "operational"];
+export declare const DEPLOYMENT_PROFILES: readonly ["starter", "production-isolated", "fully-isolated"];
+/** How work reaches production. protected-pair keeps develop and main with a
+ * promotion pull request and sync-back; trunk protects main alone and deploys
+ * production from every merged main push (starter fast lane). */
+export declare const DELIVERY_LANES: readonly ["protected-pair", "trunk"];
+export type DeliveryLane = (typeof DELIVERY_LANES)[number];
+export declare const DEFAULT_DELIVERY_LANE: DeliveryLane;
+export declare function deliveryLaneOf(policy: {
+    deliveryLane?: DeliveryLane;
+}): DeliveryLane;
 export type ProductionAccess = (typeof PRODUCTION_ACCESS_VALUES)[number];
 export type ProductionApprovalMode = (typeof PRODUCTION_APPROVAL_MODES)[number];
 export type ProductionFoundationProfile = (typeof PRODUCTION_FOUNDATION_PROFILES)[number];
 export type SliceProductionStatus = (typeof SLICE_PRODUCTION_STATUSES)[number];
 export type RepositoryModePreset = (typeof REPOSITORY_MODE_PRESETS)[number];
+export type DeploymentProfile = (typeof DEPLOYMENT_PROFILES)[number];
+export type CanonicalDeploymentStage = 'development' | 'staging' | 'production';
+export interface DeploymentAccountTopology {
+    development: string;
+    production: string;
+    staging: string | null;
+}
+export interface ConfiguredDeploymentAccounts {
+    development: string | null;
+    production: string | null;
+    staging: string | null;
+}
+export declare function normalizeDeploymentAccountId(value: string | number, label: string): string;
+export declare function requiresGithubDeployment(profile: DeploymentProfile, stage: CanonicalDeploymentStage): boolean;
+export declare function activeDeploymentStages(profile: DeploymentProfile): readonly CanonicalDeploymentStage[];
+export declare function isActiveDeploymentStage(profile: DeploymentProfile, stage: string): stage is CanonicalDeploymentStage;
+export declare function productionRehearsalStage(profile: DeploymentProfile): 'development' | 'staging';
+export declare function validateDeploymentAccountTopology(profile: DeploymentProfile, accounts: DeploymentAccountTopology): DeploymentAccountTopology;
+export declare function configuredDeploymentAccountTopology(profile: DeploymentProfile, accounts: ConfiguredDeploymentAccounts): DeploymentAccountTopology;
+export declare function configuredDeploymentAccountForStage(profile: DeploymentProfile, accounts: ConfiguredDeploymentAccounts, stage: CanonicalDeploymentStage): string;
+export declare function configuredDeploymentRegion(region: string | null): string;
 export interface RepositoryOperatingPolicy {
     $schema?: string;
+    deliveryLane?: DeliveryLane;
+    deploymentAccounts: ConfiguredDeploymentAccounts;
+    deploymentProfile: DeploymentProfile;
+    deploymentRegion: string | null;
     productionAccess: ProductionAccess;
     productionApproval: {
         mode: ProductionApprovalMode;
@@ -26,6 +61,16 @@ export interface RepositoryOperatingPolicy {
     slices: Record<string, {
         productionStatus: SliceProductionStatus;
     }>;
+    workspaceDeploymentId: string;
+    workspaceDeploymentProvenance: {
+        kind: 'fresh';
+        schemaVersion: 1;
+    } | {
+        evidencePath: string;
+        evidenceSha256: string;
+        kind: 'migrated';
+        schemaVersion: 1;
+    };
 }
 export type RepositoryPolicyLifecycleAction = 'deploy' | 'dev' | 'migrate' | 'refresh' | 'remove' | 'unlock';
 export interface RepositoryPolicyProject {
@@ -43,6 +88,10 @@ export interface RepositoryPolicyDecision {
     reasons: string[];
 }
 export interface RepositoryPolicyChange {
+    deliveryLane?: DeliveryLane;
+    deploymentAccounts?: Partial<DeploymentAccountTopology>;
+    deploymentProfile?: DeploymentProfile;
+    deploymentRegion?: string;
     preset?: RepositoryModePreset;
     productionAccess?: ProductionAccess;
     productionApprovalMode?: ProductionApprovalMode;
@@ -52,8 +101,13 @@ export interface RepositoryPolicyChange {
 export declare function validateRepositoryOperatingPolicy(value: unknown): ValidationResult<RepositoryOperatingPolicy>;
 export declare function formatRepositoryPolicyIssues(issues: ReadonlyArray<ValidationIssue>): string;
 export declare function parseRepositoryOperatingPolicy(contents: string, source?: string): RepositoryOperatingPolicy;
+export declare function validateRepositoryOperatingPolicyMigrationProvenance(input: {
+    evidenceBytes: string;
+    evidenceSource: string;
+    policy: RepositoryOperatingPolicy;
+}): void;
 export declare function readRepositoryOperatingPolicy(workspaceRoot: string): RepositoryOperatingPolicy;
-export declare function createIncubationRepositoryPolicy(): RepositoryOperatingPolicy;
+export declare function createIncubationRepositoryPolicy(deploymentProfile?: DeploymentProfile, workspaceDeploymentId?: string): RepositoryOperatingPolicy;
 export declare function applyRepositoryPolicyChange(current: RepositoryOperatingPolicy, change: RepositoryPolicyChange): RepositoryOperatingPolicy;
 export declare function evaluateRepositoryPolicyRequest(policy: RepositoryOperatingPolicy, request: RepositoryPolicyRequest): RepositoryPolicyDecision;
 export declare function assertRepositoryPolicyRequest(workspaceRoot: string, request: RepositoryPolicyRequest): RepositoryPolicyDecision;