@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.1

package/scripts/web-surface-core.mjs

@@ -317,6 +317,7 @@ function mutableCacheControlArgs({ artifactRoot, bucket, objectPrefix, cacheCont
 
 const PUBLICATION_ARCHIVE_POLICY_CONTRACT = "kungfu-buildchain-publication-archive-policy";
 const OBSERVED_EVIDENCE_OWNERSHIP_CONTRACT = "kungfu-buildchain-observed-evidence-ownership";
+const PUBLICATION_FAST_PATH_CONTRACT = "kungfu-buildchain-publication-package-pin-fast-path";
 
 function immutablePrefix(value, label) {
   const raw = String(value || "").trim().replaceAll("\\", "/");
@@ -330,6 +331,98 @@ function immutablePrefix(value, label) {
   return normalized;
 }
 
+function publicationFastPathScope({ artifactRoot, bindings }) {
+  const manifestFile = path.join(artifactRoot, "manifest.json");
+  if (!fs.existsSync(manifestFile)) return null;
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestFile, "utf8"));
+  } catch (error) {
+    throw new Error(`invalid web-surface artifact manifest: ${error.message}`);
+  }
+  const raw = manifest?.publicationFastPath;
+  if (raw === undefined || raw === null) return null;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("publicationFastPath must be an object");
+  }
+  if (raw.contract !== PUBLICATION_FAST_PATH_CONTRACT || raw.mode !== "package-pin-only") {
+    throw new Error("publicationFastPath contract or mode is unsupported");
+  }
+  const targetSurface = String(raw.targetSurface || "").trim();
+  const binding = bindings.find((entry) => entry.surface === targetSurface);
+  if (!binding) {
+    throw new Error(`publicationFastPath target surface is not declared: ${targetSurface}`);
+  }
+  const qualificationRoot = String(raw.qualificationRoot || "").trim();
+  if (!/^sha256:[a-f0-9]{64}$/.test(qualificationRoot)) {
+    throw new Error("publicationFastPath qualificationRoot must be an exact SHA-256 root");
+  }
+  const surfaceRoot = surfaceArtifactRootFor({ artifactRoot, binding });
+  const immutablePrefixes = [...new Set((raw.immutablePrefixes || []).map((entry) =>
+    immutablePrefix(entry, "publicationFastPath immutable prefix"),
+  ))].sort();
+  if (immutablePrefixes.length === 0) {
+    throw new Error("publicationFastPath must declare immutablePrefixes");
+  }
+  const mutableFiles = [...new Set((raw.mutableFiles || []).map((entry) => {
+    const normalized = normalizeS3Key(entry);
+    const candidate = path.join(surfaceRoot, normalized);
+    if (
+      !normalized
+      || String(entry).includes("..")
+      || !fs.statSync(candidate, { throwIfNoEntry: false })?.isFile()
+    ) {
+      throw new Error(`invalid or missing publicationFastPath mutable file: ${entry}`);
+    }
+    return normalized;
+  }))].sort();
+  if (mutableFiles.length === 0) {
+    throw new Error("publicationFastPath must declare mutableFiles");
+  }
+  if (mutableFiles.some((file) =>
+    immutablePrefixes.some((prefix) => file === prefix || file.startsWith(`${prefix}/`)))) {
+    throw new Error("publicationFastPath mutable files cannot overlap immutable prefixes");
+  }
+  for (const prefix of immutablePrefixes) {
+    if (!fs.statSync(path.join(surfaceRoot, prefix), { throwIfNoEntry: false })?.isDirectory()) {
+      throw new Error(`publicationFastPath immutable prefix does not exist: ${prefix}`);
+    }
+  }
+  const invalidationPaths = [...new Set((raw.invalidationPaths || []).map((entry) => {
+    const value = String(entry || "").trim();
+    if (!value.startsWith("/") || value.includes("..")) {
+      throw new Error(`invalid publicationFastPath invalidation path: ${entry}`);
+    }
+    return value;
+  }))].sort();
+  if (invalidationPaths.length === 0) {
+    throw new Error("publicationFastPath must declare invalidationPaths");
+  }
+  return {
+    contract: PUBLICATION_FAST_PATH_CONTRACT,
+    mode: "package-pin-only",
+    targetSurface,
+    qualificationRoot,
+    immutablePrefixes,
+    mutableFiles,
+    invalidationPaths,
+  };
+}
+
+function applyPublicationFastPathScope(bindings, { cwd, artifactPath }) {
+  const artifactRoot = path.resolve(cwd, artifactPath);
+  const scope = publicationFastPathScope({ artifactRoot, bindings });
+  if (!scope) {
+    return { bindings, scope: null };
+  }
+  return {
+    bindings: bindings
+      .filter((binding) => binding.surface === scope.targetSurface)
+      .map((binding) => ({ ...binding, publicationFastPath: scope })),
+    scope,
+  };
+}
+
 function publicationImmutablePolicy({ artifactRoot, binding }) {
   const surfaceRoot = surfaceArtifactRootFor({ artifactRoot, binding });
   const manifestFile = path.join(surfaceRoot, "manifest.json");
@@ -341,22 +434,41 @@ function publicationImmutablePolicy({ artifactRoot, binding }) {
     throw new Error(`invalid publication archive manifest ${toPosix(path.relative(artifactRoot, manifestFile))}: ${error.message}`);
   }
   if (manifest?.archivePolicy?.contract !== PUBLICATION_ARCHIVE_POLICY_CONTRACT) return null;
-  const declaredPrefixes = [...new Set((manifest.publications || []).flatMap((publication) =>
-    (publication.versions || []).map((version) => immutablePrefix(
-      version.immutablePath,
-      `publication ${publication.id || "unknown"} immutablePath`,
-    )),
-  ))].sort();
+  const declaredVersions = (manifest.publications || []).flatMap((publication) =>
+    (publication.versions || []).map((version) => ({
+      prefix: immutablePrefix(
+        version.immutablePath,
+        `publication ${publication.id || "unknown"} immutablePath`,
+      ),
+      materialized: Object.hasOwn(version, "immutableIndex"),
+    })),
+  );
+  const declaredPrefixes = [...new Set(declaredVersions.map((entry) => entry.prefix))].sort();
   if (declaredPrefixes.length === 0) {
     throw new Error("publication archive policy must declare at least one immutable version prefix");
   }
-  for (const prefix of declaredPrefixes) {
+  const hasMaterializationEnvelope = declaredVersions.some((entry) => entry.materialized);
+  const materializedPrefixes = [...new Set(
+    (hasMaterializationEnvelope
+      ? declaredVersions.filter((entry) => entry.materialized)
+      : declaredVersions
+    ).map((entry) => entry.prefix),
+  )].sort();
+  for (const prefix of materializedPrefixes) {
     if (!fs.existsSync(path.join(surfaceRoot, prefix))) {
-      throw new Error(`declared immutable publication prefix does not exist in artifact: ${prefix}`);
+      throw new Error(`materialized immutable publication prefix does not exist in artifact: ${prefix}`);
     }
   }
   const preservedRoots = declaredPrefixes;
-  const files = preservedRoots
+  const uploadRoots = binding.publicationFastPath?.immutablePrefixes || materializedPrefixes;
+  if (binding.publicationFastPath) {
+    for (const prefix of uploadRoots) {
+      if (!declaredPrefixes.includes(prefix)) {
+        throw new Error(`publicationFastPath immutable prefix is not declared by the archive manifest: ${prefix}`);
+      }
+    }
+  }
+  const files = uploadRoots
     .flatMap((root) => listFiles(surfaceRoot, root))
     .map((filePath) => ({
       path: toPosix(path.relative(surfaceRoot, filePath)),
@@ -371,7 +483,10 @@ function publicationImmutablePolicy({ artifactRoot, binding }) {
     manifestPath: toPosix(path.relative(artifactRoot, manifestFile)),
     preservedRoots,
     declaredPrefixes,
+    materializedPrefixes,
+    uploadRoots,
     files,
+    fastPath: binding.publicationFastPath || undefined,
   };
 }
 
@@ -1152,7 +1267,11 @@ export function planWebSurfaceDeploy({
   if (installerEvidence) {
     manifest.installerPublicationEvidence = installerEvidence;
   }
-  const surfaceBindings = withImmutablePublicationPolicies(withSurfaceRoutingEvidence(manifest.surfaceBindings, {
+  const scoped = applyPublicationFastPathScope(manifest.surfaceBindings, {
+    cwd,
+    artifactPath: artifactPath || deployConfig.artifactPath || ".",
+  });
+  const surfaceBindings = withImmutablePublicationPolicies(withSurfaceRoutingEvidence(scoped.bindings, {
     artifactPath: artifactPath || deployConfig.artifactPath || ".",
     files: resolvedArtifact.files,
   }), {
@@ -1169,6 +1288,10 @@ export function planWebSurfaceDeploy({
     }
   }
   manifest.surfaceBindings = surfaceBindings;
+  if (scoped.scope) {
+    manifest.publicationFastPath = scoped.scope;
+    manifest.url = surfaceBindings[0].url;
+  }
   return {
     schemaVersion: 1,
     contract: "kungfu-buildchain-web-surface-deploy-plan",
@@ -1185,6 +1308,7 @@ export function planWebSurfaceDeploy({
     },
     manifest,
     surfaceBindings,
+    publicationFastPath: scoped.scope || undefined,
     steps: planAdapterSteps(deployConfig.adapter, deployConfig, manifest),
   };
 }
@@ -1196,7 +1320,18 @@ export function verifyWebSurfaceArtifactChannelFacts({ cwd = process.cwd(), plan
     try { return new URL(binding.url).host; } catch { return ""; }
   }).filter(Boolean));
   const observed = [];
-  for (const filePath of listFiles(artifactRoot, artifactRoot).filter((entry) => entry.endsWith(".json"))) {
+  const scopedPrefix = normalizeS3Key(
+    resolvedPlan.publicationFastPath
+      ? resolvedPlan.surfaceBindings?.[0]?.artifactPathPrefix || ""
+      : "",
+  );
+  for (const filePath of listFiles(artifactRoot, artifactRoot)
+    .filter((entry) => entry.endsWith(".json"))
+    .filter((entry) => {
+      if (!scopedPrefix) return true;
+      const relative = normalizeS3Key(path.relative(artifactRoot, entry));
+      return relative === scopedPrefix || relative.startsWith(`${scopedPrefix}/`);
+    })) {
     let value;
     try { value = JSON.parse(fs.readFileSync(filePath, "utf8")); } catch { continue; }
     if (!value || typeof value !== "object" || Array.isArray(value) || !String(value.contract || "").includes("manifest")) continue;
@@ -1281,7 +1416,7 @@ export function applyWebSurfaceDeploy({
     ...bindingOperations.filter((operation) => operation.action === "verify-immutable-artifact-before-upload"),
     ...bindingOperations.filter((operation) => operation.action === "sync-immutable-artifact"),
     ...bindingOperations.filter((operation) => operation.action === "verify-immutable-artifact-after-upload"),
-    ...cloudFrontDirectoryIndexRewriteOperations(bindings),
+    ...cloudFrontDirectoryIndexRewriteOperations(bindings.filter((binding) => !binding.publicationFastPath)),
     ...bindingOperations.filter((operation) => ![
       "verify-immutable-artifact-before-upload",
       "sync-immutable-artifact",
@@ -1291,7 +1426,10 @@ export function applyWebSurfaceDeploy({
   const primaryBinding = bindings[0] || {};
   const objectPrefix = primaryBinding.objectPrefix || objectPrefixFor(deployConfig, resolvedPlan.manifest.alias || resolvedPlan.manifest.channel);
   const manifestKey = primaryBinding.manifestKey || deployManifestKey(deployConfig, resolvedPlan.manifest);
-  const invalidationPaths = bindings.flatMap((binding) => [viewerWildcardPath(binding), cdnPath(binding.manifestKey)]);
+  const invalidationPaths = bindings.flatMap((binding) =>
+    binding.publicationFastPath
+      ? [...binding.publicationFastPath.invalidationPaths, cdnPath(binding.manifestKey)]
+      : [viewerWildcardPath(binding), cdnPath(binding.manifestKey)]);
   const operationResults = runAdapterOperations({ operations, dryRun, commandRunner });
   const immutablePreservation = bindings
     .filter((binding) => binding.immutablePublication)
@@ -1303,10 +1441,12 @@ export function applyWebSurfaceDeploy({
           "sync-immutable-artifact",
           "verify-immutable-artifact-after-upload",
           "sync-static-artifact",
+          "sync-publication-fast-path",
         ].includes(operation.action),
       );
       const expectedOperationCount = (binding.immutablePublication.files.length * 2) +
-        binding.immutablePublication.preservedRoots.length + 1;
+        binding.immutablePublication.uploadRoots.length +
+        (binding.publicationFastPath ? binding.publicationFastPath.mutableFiles.length : 1);
       const complete = relevant.length === expectedOperationCount;
       return {
         surface: binding.surface,
@@ -1341,6 +1481,7 @@ export function applyWebSurfaceDeploy({
     objectPrefix,
     manifestKey,
     invalidationPaths,
+    publicationFastPath: resolvedPlan.publicationFastPath || resolvedPlan.manifest.publicationFastPath,
     manifest: resolvedPlan.manifest,
     surfaceBindings: bindings,
     immutablePreservation,
@@ -1612,11 +1753,6 @@ function htmlLikeResponse(response, url = "") {
   return String(contentType).toLowerCase().includes("text/html") || /\/$|\.html(?:$|[?#])/.test(String(url || ""));
 }
 
-const managedNetworkRequiredEvidence = [
-  "sync-static-artifact",
-  "write-deployment-manifest",
-];
-
 function operationEvidenceStatus(operation, { plannedEvidence = false } = {}) {
   if (plannedEvidence && operation.status === undefined) {
     return true;
@@ -1625,6 +1761,12 @@ function operationEvidenceStatus(operation, { plannedEvidence = false } = {}) {
 }
 
 function managedNetworkHealthEvidence({ target, result, plan }) {
+  const requiredActions = [
+    target.publicationFastPath
+      ? "sync-publication-fast-path"
+      : "sync-static-artifact",
+    "write-deployment-manifest",
+  ];
   const operationSource = Array.isArray(result?.operations) && result.operations.length > 0
     ? "apply-result"
     : "deploy-plan";
@@ -1637,7 +1779,7 @@ function managedNetworkHealthEvidence({ target, result, plan }) {
       .filter((operation) => operationEvidenceStatus(operation, { plannedEvidence: operationSource === "deploy-plan" }))
       .map((operation) => operation.action),
   );
-  const missingActions = managedNetworkRequiredEvidence.filter((action) => !presentActions.has(action));
+  const missingActions = requiredActions.filter((action) => !presentActions.has(action));
   const missingFields = [];
   if (!target.manifestKey) missingFields.push("manifestKey");
   if (!target.bucket) missingFields.push("bucket");
@@ -1645,7 +1787,7 @@ function managedNetworkHealthEvidence({ target, result, plan }) {
   return {
     source: operationSource,
     actions: [...presentActions].sort(),
-    requiredActions: managedNetworkRequiredEvidence,
+    requiredActions,
     missingActions,
     missingFields,
     status: missingActions.length === 0 && missingFields.length === 0 ? "pass" : "fail",
@@ -1825,6 +1967,7 @@ export async function checkWebSurfaceHealth({
           manifestKey: binding.manifestKey || "",
           bucket: binding.bucket || "",
           objectPrefix: binding.objectPrefix || "",
+          publicationFastPath: binding.publicationFastPath || null,
         }));
       })
     : Object.entries(urls).map(([surface, url]) => ({
@@ -1928,19 +2071,23 @@ export async function checkWebSurfaceHealth({
     const operationSource = Array.isArray(result?.operations) && result.operations.length > 0
       ? result.operations
       : (Array.isArray(plan?.steps) ? plan.steps : []);
-    const requiredActions = [
-      "verify-immutable-artifact-before-upload",
-      "sync-immutable-artifact",
-      "verify-immutable-artifact-after-upload",
-      "sync-static-artifact",
-    ];
     const preservationBindings = immutableBindings.map((binding) => {
+      const requiredActions = [
+        "verify-immutable-artifact-before-upload",
+        "sync-immutable-artifact",
+        "verify-immutable-artifact-after-upload",
+        binding.publicationFastPath
+          ? "sync-publication-fast-path"
+          : "sync-static-artifact",
+      ];
       const actions = new Set(operationSource
         .filter((operation) => operation.surface === binding.surface)
         .filter((operation) => operationEvidenceStatus(operation, { plannedEvidence: !result }))
         .map((operation) => operation.action));
       const missingActions = requiredActions.filter((action) => !actions.has(action));
-      const coveringBindings = (binding.immutablePublication.coveringBindings || []).map((covering) => {
+      const coveringBindings = binding.publicationFastPath
+        ? []
+        : (binding.immutablePublication.coveringBindings || []).map((covering) => {
         const sync = operationSource.find((operation) =>
           operation.surface === covering.surface &&
           operation.action === "sync-static-artifact" &&
@@ -1953,7 +2100,7 @@ export async function checkWebSurfaceHealth({
             ? "pass"
             : "fail",
         };
-      });
+          });
       return {
         surface: binding.surface,
         manifestPath: binding.immutablePublication.manifestPath,
@@ -2085,7 +2232,7 @@ function deployBindingOperations({ artifactRoot, deployConfig, manifest, binding
       sha256: file.sha256,
     },
   }));
-  const syncImmutable = (immutable?.preservedRoots || []).map((root) => {
+  const syncImmutable = (immutable?.uploadRoots || immutable?.preservedRoots || []).map((root) => {
     const isInstallerRoot = Boolean(installerBinding && root === installerRoot);
     const immutableMetadataArgs = isInstallerRoot
       ? [
@@ -2140,48 +2287,73 @@ function deployBindingOperations({ artifactRoot, deployConfig, manifest, binding
       cacheControl: "public,max-age=300,must-revalidate",
     },
   }));
+  const fastPathMutable = (binding.publicationFastPath?.mutableFiles || []).map((file) => ({
+    action: "sync-publication-fast-path",
+    surface: binding.surface,
+    command: "aws",
+    args: [
+      "s3",
+      "cp",
+      path.join(surfaceArtifactRoot, file),
+      s3Uri(bucket, joinS3Key(binding.objectPrefix, file)),
+      "--checksum-algorithm",
+      "SHA256",
+    ],
+    publicationFastPath: {
+      qualificationRoot: binding.publicationFastPath.qualificationRoot,
+      path: file,
+      overwriteBoundary: "declared-mutable-file-only",
+    },
+  }));
+  const mutableSync = binding.publicationFastPath
+    ? fastPathMutable
+    : [
+      {
+        action: "sync-static-artifact",
+        surface: binding.surface,
+        command: "aws",
+        args: syncStaticArtifactArgs({
+          artifactRoot: surfaceArtifactRoot,
+          bucket,
+          objectPrefix: binding.objectPrefix,
+          deleteExcludes: binding.mutableDeleteExcludes || [],
+          cacheControl: binding.cacheControl?.default || "",
+        }),
+        routing: binding.routing,
+        preservation: binding.mutableDeleteExcludes?.length > 0
+          ? {
+              contract: "kungfu-buildchain-web-surface-immutable-delete-exclusion",
+              mutableDeleteExcludes: binding.mutableDeleteExcludes,
+            }
+          : undefined,
+      },
+      ...(binding.cacheControl?.mutable
+        ? [{
+            action: "apply-mutable-cache-control",
+            surface: binding.surface,
+            command: "aws",
+            args: mutableCacheControlArgs({
+              artifactRoot: surfaceArtifactRoot,
+              bucket,
+              objectPrefix: binding.objectPrefix,
+              cacheControl: binding.cacheControl.mutable,
+              excludePatterns: binding.mutableDeleteExcludes || [],
+            }),
+            cacheControl: binding.cacheControl.mutable,
+            patterns: ["*.html", "*.json", "*.xml"],
+            excludes: binding.mutableDeleteExcludes || [],
+          }]
+        : []),
+    ];
   const operations = [
     ...verifyImmutable("before-upload"),
     ...syncImmutable,
     ...verifyImmutable("after-upload"),
-    {
-      action: "sync-static-artifact",
-      surface: binding.surface,
-      command: "aws",
-      args: syncStaticArtifactArgs({
-        artifactRoot: surfaceArtifactRoot,
-        bucket,
-        objectPrefix: binding.objectPrefix,
-        deleteExcludes: binding.mutableDeleteExcludes || [],
-        cacheControl: binding.cacheControl?.default || "",
-      }),
-      routing: binding.routing,
-      preservation: binding.mutableDeleteExcludes?.length > 0
-        ? {
-            contract: "kungfu-buildchain-web-surface-immutable-delete-exclusion",
-            mutableDeleteExcludes: binding.mutableDeleteExcludes,
-          }
-        : undefined,
-    },
-    ...(binding.cacheControl?.mutable
-      ? [{
-          action: "apply-mutable-cache-control",
-          surface: binding.surface,
-          command: "aws",
-          args: mutableCacheControlArgs({
-            artifactRoot: surfaceArtifactRoot,
-            bucket,
-            objectPrefix: binding.objectPrefix,
-            cacheControl: binding.cacheControl.mutable,
-            excludePatterns: binding.mutableDeleteExcludes || [],
-          }),
-          cacheControl: binding.cacheControl.mutable,
-          patterns: ["*.html", "*.json", "*.xml"],
-          excludes: binding.mutableDeleteExcludes || [],
-        }]
-      : []),
+    ...mutableSync,
     ...publishFriendlyInstallers,
-    ...directoryIndexAliasOperations({ surfaceArtifactRoot, bucket, binding }),
+    ...(binding.publicationFastPath
+      ? []
+      : directoryIndexAliasOperations({ surfaceArtifactRoot, bucket, binding })),
     {
       action: "write-deployment-manifest",
       surface: binding.surface,
@@ -2206,6 +2378,8 @@ function deployBindingOperations({ artifactRoot, deployConfig, manifest, binding
     },
   ];
   if (distribution) {
+    const invalidationPaths = binding.publicationFastPath?.invalidationPaths
+      || [viewerWildcardPath(binding)];
     operations.push({
       action: "invalidate-cdn",
       surface: binding.surface,
@@ -2216,7 +2390,7 @@ function deployBindingOperations({ artifactRoot, deployConfig, manifest, binding
         "--distribution-id",
         distribution,
         "--paths",
-        viewerWildcardPath(binding),
+        ...invalidationPaths,
         cdnPath(binding.manifestKey),
       ],
     });
@@ -2237,7 +2411,7 @@ function planAdapterSteps(adapter, deployConfig, manifest) {
             {
               action: "sync-immutable-artifact",
               surface: binding.surface,
-              roots: binding.immutablePublication.preservedRoots,
+              roots: binding.immutablePublication.uploadRoots,
               overwrite: false,
             },
             {
@@ -2247,23 +2421,32 @@ function planAdapterSteps(adapter, deployConfig, manifest) {
             },
           ]
         : []),
-      {
-        action: "sync-static-artifact",
-        surface: binding.surface,
-        target: binding.bucket,
-        prefix: binding.objectPrefix,
-        deleteExcludes: binding.mutableDeleteExcludes || [],
-        cacheControl: binding.cacheControl || undefined,
-      },
-      ...(binding.cacheControl?.mutable
-        ? [{
-            action: "apply-mutable-cache-control",
+      ...(binding.publicationFastPath
+        ? binding.publicationFastPath.mutableFiles.map((file) => ({
+            action: "sync-publication-fast-path",
             surface: binding.surface,
-            cacheControl: binding.cacheControl.mutable,
-            patterns: ["*.html", "*.json", "*.xml"],
-            excludes: binding.mutableDeleteExcludes || [],
-          }]
-        : []),
+            target: binding.bucket,
+            path: file,
+            qualificationRoot: binding.publicationFastPath.qualificationRoot,
+          }))
+        : [{
+            action: "sync-static-artifact",
+            surface: binding.surface,
+            target: binding.bucket,
+            prefix: binding.objectPrefix,
+            deleteExcludes: binding.mutableDeleteExcludes || [],
+            cacheControl: binding.cacheControl || undefined,
+          },
+          ...(binding.cacheControl?.mutable
+            ? [{
+                action: "apply-mutable-cache-control",
+                surface: binding.surface,
+                cacheControl: binding.cacheControl.mutable,
+                patterns: ["*.html", "*.json", "*.xml"],
+                excludes: binding.mutableDeleteExcludes || [],
+              }]
+            : []),
+        ]),
       {
         action: "write-deployment-manifest",
         surface: binding.surface,
@@ -2274,13 +2457,16 @@ function planAdapterSteps(adapter, deployConfig, manifest) {
         action: "invalidate-cdn",
         surface: binding.surface,
         distribution: binding.distributionId,
+        paths: binding.publicationFastPath?.invalidationPaths,
       },
     ]);
     return [
       ...bindingSteps.filter((step) => step.action === "verify-immutable-artifact-before-upload"),
       ...bindingSteps.filter((step) => step.action === "sync-immutable-artifact"),
       ...bindingSteps.filter((step) => step.action === "verify-immutable-artifact-after-upload"),
-      ...cloudFrontDirectoryIndexRewriteOperations(manifest.surfaceBindings || []).map((operation) => ({
+      ...cloudFrontDirectoryIndexRewriteOperations(
+        (manifest.surfaceBindings || []).filter((binding) => !binding.publicationFastPath),
+      ).map((operation) => ({
         action: operation.action,
         distribution: operation.routing.distributionId,
         functionName: operation.routing.functionName,

package/scripts/web-surface-production-decision.mjs

@@ -37,9 +37,7 @@ export function resolveWebSurfaceProductionDecision({
       reason: trusted ? "trusted-manual-dispatch" : "manual-actor-permission-insufficient",
     });
   }
-  const reviewedReleaseEvent =
-    (eventName === "push" && refName === "main") ||
-    (eventName === "pull_request" && eventAction === "closed");
+  const reviewedReleaseEvent = eventName === "push" && refName === "main";
   if (
     reviewedReleaseEvent &&
     productionApply === true &&
@@ -57,6 +55,24 @@ export function resolveWebSurfaceProductionDecision({
       reason: "reviewed-release-pr-merged",
     });
   }
+  if (
+    eventName === "pull_request" &&
+    eventAction === "closed" &&
+    productionApply === true &&
+    productionReleaseOnMain === true &&
+    releaseApproved === true
+  ) {
+    return createWebSurfaceProductionDecision({
+      approved: false,
+      kind: "none",
+      repository,
+      sourceSha,
+      actor,
+      releasePr,
+      releaseSource,
+      reason: "release-pr-verified-awaiting-main-push",
+    });
+  }
   return createWebSurfaceProductionDecision({
     approved: false,
     kind: "none",