@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/NOTICE

@@ -3,3 +3,9 @@ Copyright 2026 Gupta-Leary Technology Consulting LLC
 
 This product includes software developed by Gupta-Leary Technology Consulting
 LLC and its contributors.
+
+This repository contains selected SST v4.17.1 source files solely in
+`tools/consumer-smoke/fixtures/sst-v4.17.1/` for offline compatibility
+verification. SST is Copyright (c) 2024 SST and licensed under the MIT License;
+see that directory's `LICENSE` and `PROVENANCE.json`. This test-only snapshot is
+not included in the published Empire Builder Kit packages.

package/README.md

@@ -19,15 +19,125 @@ generated-file ownership, ownership-aware agent work-marker reporting and
 protected-promotion enforcement, and Nx-wrapped SST lifecycle executors.
 Consumers should never invoke SST lifecycle commands directly.
 
+The workspace-pinned `ebk` binary is the single framework CLI. It owns local
+development, bounded Developer-Agent inspection/planning, external Blueprint
+receipt review, and the human-only personal secret ceremony. Nx remains the
+workspace graph and owning-target authority behind generated work.
+
+`ebk agent context --json` is the sole full structured context transport. The
+generated root `developer-context` Nx target remains a read-only compatibility
+and graph-authority route: human mode emits concise prose, while `--json`
+emits only a deterministic, digest-bound fingerprint of the fully validated
+canonical context. This keeps Nx task output bounded even when a valid context
+is larger than its task-output transport ceiling.
+
+External Blueprint receipt review has one public entry:
+
+```bash
+ebk blueprint verification-review
+```
+
+`ebk` must resolve to this workspace's installed launcher. Use
+`./node_modules/.bin/ebk` on POSIX or `node_modules\.bin\ebk.cmd` on Windows
+when it is not already on `PATH`; receipt review refuses `pnpm exec` and `npx`.
+
+The installed dependency-light launcher enters a clean Node child before
+loading receipt authority. No generated Nx receipt target exists. The command
+requires an exact protected commit retaining the static approval, runs the
+closed approved roots directly, and leaves receipts for a separate protected
+retention commit.
+Receipt retention is create-only, and the command refuses before root execution
+if any canonical path in the complete receipt set already exists.
+Reauthorization requires a protected successor deleting that complete stale
+set, the installed CLI minting replacements from the exact clean protected tip,
+and a separate later protected commit retaining the replacement receipts.
+External verification targets use the structured, no-shell
+`@empire-builder-kit/nx:blueprint-verification` executor. Receipt review and
+direct Nx execution share its private runner; review additionally binds the
+protected tree and writes the receipt. Developer-Agent inspection exposes a
+recurring target only after retention and after recomputing its portable
+package authority from the protected target, manifests, and lockfile. Exact
+Node declarations and the full lockfile digest are receipt-bound as well. A
+human may invoke the structured Nx target without a receipt. Neither path is
+cryptographic or hosted attestation.
+
+The external manifest's sole recurring root is named exactly `verify`.
+Generated project configurations are whole-file managed, canonically rooted
+at their Slice-relative locations, and exactly enumerated by the generator
+result. Agent inspection classifies every graph project beneath a current or
+historically external Slice ownership root as external without trusting tags
+or that publisher-authored inventory; historical roots and identities remain
+external after deletion or relabeling. Only the protected-reviewed chain is
+exposed. Read-only fleet status and logs remain available, but agent planning
+withholds local lifecycle operations for external Slices in v1.
+
+Independently of Blueprint provenance, Developer-Agent inspection performs a
+bounded repository-wide Nx-configuration preflight before graph loading. Each
+`project.json` must declare its exact containing root, declared project names
+cannot cross roots, and package-level `nx` configuration is confined to its own
+root. External Blueprint output cannot declare package-level `nx`. An unowned
+configuration file therefore cannot redirect its root or identity into a
+managed project and borrow a reviewed signature. This does not prohibit every
+plugin or `targetDefaults` edit in a built-in-only workspace; the stricter Nx
+authority boundary below applies once external ownership exists, existed in
+the inspected history, or cannot be proved absent.
+
+External-Blueprint inspection and recurring execution require the non-daemon
+local-default Nx runner (`neverConnectToCloud: true`,
+`useDaemonProcess: false`) and refuse ambient daemon activation, a local
+`.nx/installation`, plugins, custom runners, global synchronization, extension,
+and cloud authority. That pre-graph restriction becomes permanent when
+external ownership appears currently or anywhere in the bounded first-parent
+histories of HEAD, protected develop, or protected main; mutable
+`nx.json.defaultBase` cannot redirect the inventory. A missing protected ref
+makes the inventory incomplete and activates the same strict boundary; a
+shallow clone does likewise because hidden history cannot prove absence. While
+that inventory is incomplete, every graph project under `packages/` except the
+sole canonical `foundation` project at `packages/foundation` is treated as
+externally owned. The Foundation tag cannot create that exception: its project
+name, declared root, and canonical directory are checked together. Read-only
+discovery and logs remain available, but agent-planned lifecycle authority is
+withheld until protected history is complete. Every recurring target snapshots
+its exact workspace and
+configuration authority at entry and fails after the child if it changed, so
+Nx cannot continue the approved dependency chain. The executor reports but
+does not roll back such writes; same-UID mutation after a bounded check remains
+outside the local-evidence claim. That includes mutation between the
+repository-wide configuration inventory and Nx graph loading; the preflight is
+not an immutable repository snapshot.
+
+The human-only personal secret commands are:
+
+```bash
+ebk secret set <slice> <logical-name>
+ebk secret remove <slice> <logical-name>
+```
+
+These commands derive the personal stage, use the profile and Region saved by
+`ebk dev configure`, verify the development Foundation account, and accept
+values only from a hidden local TTY. Agents and CI must never invoke them.
+
 Generated workspaces expose `work-markers` as both a direct target and part of
 workspace health. The generated `AGENTS.md`, `CLAUDE.md`, and runbook define how
 deterministic generators and updates can hand contextual work to agents without
 placing markers in managed output. The public `formatWorkMarkerComment` helper
 keeps Blueprint and repository-update handoffs on the same canonical syntax.
 
-External Blueprints must be exact-version packages allowed by the workspace
-trust policy. Their generator runs in a bounded child process, which is a
-failure boundary rather than a security sandbox.
+External Blueprints must be exact-version packages allowed by protected trust
+history. Publisher generators run in the framework's digest-pinned,
+no-network Linux container with only a private read-only package closure
+mounted; the adopter workspace, Git metadata, host credentials, and Docker
+socket are absent. An explicitly mapped local publisher root may lack registry
+SRI, but each dependency must still resolve from the canonical pnpm virtual
+store with exact lockfile registry integrity; sibling, `file:`, `link:`, and
+other workspace dependency closure is refused. Returned bytes remain untrusted.
+Local receipt evidence
+still has an explicit same-user Node/Git/installed-package boundary. The
+installed shim and initial interpreter run before the controlled child and may
+resolve through ambient `PATH`; neither the shim nor the resulting local receipt
+is host attestation. Fixed child markers and the stdin entry prevent accidental
+alternate routes but do not authenticate the same UID, which can reproduce
+them and invoke internal source manually.
 
 See the [architecture](../../docs/architecture.md),
 [Foundation contract](../../docs/foundation.md), and

package/executors.json

@@ -1,5 +1,20 @@
 {
   "executors": {
+    "blueprint-trust": {
+      "implementation": "./src/executors/blueprint-trust/blueprint-trust",
+      "schema": "./src/executors/blueprint-trust/schema.json",
+      "description": "Invoke Blueprint trust checks without a shell or inherited executable-loader configuration."
+    },
+    "blueprint-verification": {
+      "implementation": "./src/executors/blueprint-verification/blueprint-verification",
+      "schema": "./src/executors/blueprint-verification/schema.json",
+      "description": "Execute structured external Blueprint verification without a shell or bare executable lookup."
+    },
+    "developer-context": {
+      "implementation": "./src/executors/developer-context/developer-context",
+      "schema": "./src/executors/developer-context/schema.json",
+      "description": "Inspect Developer-Agent repository context without mutation and emit human output or a bounded canonical-context fingerprint."
+    },
     "fleet": {
       "implementation": "./src/executors/fleet/fleet",
       "schema": "./src/executors/fleet/schema.json",
@@ -20,6 +35,11 @@
       "schema": "./src/executors/deployment-plan/schema.json",
       "description": "Atomically validate and select the complete protected deployment set before AWS access."
     },
+    "infrastructure-plan": {
+      "implementation": "./src/executors/infrastructure-plan/infrastructure-plan",
+      "schema": "./src/executors/infrastructure-plan/schema.json",
+      "description": "Run a pinned SST resource diff and fail closed on unapproved, stale, locked, drifted, or unknown protected plans."
+    },
     "work-markers": {
       "implementation": "./src/executors/work-markers/work-markers",
       "schema": "./src/executors/work-markers/schema.json",
@@ -45,6 +65,16 @@
       "schema": "./src/executors/foundation-remove-preflight/schema.json",
       "description": "Block Foundation removal while Product Slice registrations remain."
     },
+    "secret-metadata": {
+      "implementation": "./src/executors/secret-metadata/secret-metadata",
+      "schema": "./src/executors/secret-metadata/schema.json",
+      "description": "Report or explicitly apply value-blind operator-secret container metadata for one Product Slice."
+    },
+    "secret-guardrails": {
+      "implementation": "./src/executors/secret-guardrails/secret-guardrails",
+      "schema": "./src/executors/secret-guardrails/schema.json",
+      "description": "Reject client, environment, direct SST, fallback, placeholder, and generated-output secret paths in one Product Slice."
+    },
     "deploy": {
       "implementation": "./src/executors/deploy/deploy",
       "schema": "./src/executors/sst-lifecycle/schema.json",

package/package.json

@@ -1,9 +1,24 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-beta.9",
+  "version": "1.0.0-rc.2",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
+  "keywords": [
+    "aws",
+    "nx",
+    "nx-plugin",
+    "sst",
+    "typescript",
+    "generators",
+    "executors",
+    "blueprints",
+    "infrastructure"
+  ],
+  "author": "Gupta-Leary Technology Consulting LLC",
   "license": "Apache-2.0",
   "type": "commonjs",
+  "bin": {
+    "ebk": "./src/cli/bootstrap.js"
+  },
   "main": "./src/index.js",
   "types": "./src/index.d.ts",
   "exports": {
@@ -16,14 +31,38 @@
       "types": "./src/blueprints/index.d.ts",
       "default": "./src/blueprints/index.js"
     },
+    "./api-contract": {
+      "types": "./src/api-contract/index.d.ts",
+      "default": "./src/api-contract/index.js"
+    },
+    "./authorization": {
+      "types": "./src/authorization/index.d.ts",
+      "default": "./src/authorization/index.js"
+    },
+    "./database-retirement": {
+      "types": "./src/database-retirement/index.d.ts",
+      "default": "./src/database-retirement/index.js"
+    },
+    "./data-lifecycle": {
+      "types": "./src/data-lifecycle/index.d.ts",
+      "default": "./src/data-lifecycle/index.js"
+    },
     "./foundation": {
       "types": "./src/foundation/index.d.ts",
       "default": "./src/foundation/index.js"
     },
+    "./frontend-security": {
+      "types": "./src/frontend-security/index.d.ts",
+      "default": "./src/frontend-security/index.js"
+    },
     "./git-policy": {
       "types": "./src/git-policy/index.d.ts",
       "default": "./src/git-policy/index.js"
     },
+    "./infrastructure-change": {
+      "types": "./src/infrastructure-change/index.d.ts",
+      "default": "./src/infrastructure-change/index.js"
+    },
     "./local-dev": {
       "types": "./src/local-dev/index.d.ts",
       "default": "./src/local-dev/index.js"
@@ -32,20 +71,52 @@
       "types": "./src/ownership/index.d.ts",
       "default": "./src/ownership/index.js"
     },
+    "./performance": {
+      "types": "./src/performance/index.d.ts",
+      "default": "./src/performance/index.js"
+    },
     "./repository-policy": {
       "types": "./src/repository-policy/index.d.ts",
       "default": "./src/repository-policy/index.js"
     },
+    "./release": {
+      "types": "./src/release/index.d.ts",
+      "default": "./src/release/index.js"
+    },
+    "./secrets": {
+      "types": "./src/secrets/index.d.ts",
+      "default": "./src/secrets/index.js"
+    },
+    "./supply-chain": {
+      "types": "./src/supply-chain/index.d.ts",
+      "default": "./src/supply-chain/index.js"
+    },
+    "./testing-evidence": {
+      "types": "./src/testing-evidence/index.d.ts",
+      "default": "./src/testing-evidence/index.js"
+    },
     "./work-markers": {
       "types": "./src/work-markers/index.d.ts",
       "default": "./src/work-markers/index.js"
     },
+    "./workload-roles": {
+      "types": "./src/workload-roles/index.d.ts",
+      "default": "./src/workload-roles/index.js"
+    },
     "./schemas/blueprint-v1.json": "./src/schemas/blueprint-v1.json",
+    "./schemas/aggregate-count-evidence-v1.json": "./src/schemas/aggregate-count-evidence-v1.json",
     "./schemas/blueprint-input-schema-v1.json": "./src/schemas/blueprint-input-schema-v1.json",
+    "./schemas/api-contract-baseline-v1.json": "./src/schemas/api-contract-baseline-v1.json",
+    "./schemas/api-contract-compatibility-report-v1.json": "./src/schemas/api-contract-compatibility-report-v1.json",
+    "./schemas/aws-billing-actual-evidence-v1.json": "./src/schemas/aws-billing-actual-evidence-v1.json",
+    "./schemas/data-lifecycle-policy-v1.json": "./src/schemas/data-lifecycle-policy-v1.json",
     "./schemas/foundation-requirement-v1.json": "./src/schemas/foundation-requirement-v1.json",
     "./schemas/foundation-ownership-v2.json": "./src/schemas/foundation-ownership-v2.json",
     "./schemas/generated-ownership-v2.json": "./src/schemas/generated-ownership-v2.json",
+    "./schemas/performance-policy-v1.json": "./src/schemas/performance-policy-v1.json",
     "./schemas/repository-policy-v1.json": "./src/schemas/repository-policy-v1.json",
+    "./schemas/testing-evidence-result-v1.json": "./src/schemas/testing-evidence-result-v1.json",
+    "./schemas/testing-evidence-quarantine-v1.json": "./src/schemas/testing-evidence-quarantine-v1.json",
     "./schemas/workspace-ownership-v2.json": "./src/schemas/workspace-ownership-v2.json"
   },
   "generators": "./generators.json",
@@ -55,15 +126,21 @@
     "provenance": false
   },
   "dependencies": {
+    "@empire-builder-kit/runtime": "1.0.0-rc.2",
+    "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
+    "@aws-sdk/client-iam": "^3.700.0",
     "@nx/devkit": "23.1.0",
     "@aws-sdk/client-rds": "^3.700.0",
-    "@aws-sdk/client-rds-data": "^3.700.0",
+    "@aws-sdk/client-s3": "^3.700.0",
+    "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-ssm": "^3.700.0",
+    "@aws-sdk/client-sts": "^3.700.0",
     "@aws-sdk/credential-providers": "^3.700.0",
-    "ajv": "8.17.1",
+    "ajv": "8.20.0",
     "prettier": "^3.8.2",
     "semver": "7.7.4",
-    "tslib": "^2.3.0"
+    "tslib": "^2.3.0",
+    "yaml": "2.9.0"
   },
   "repository": {
     "type": "git",
@@ -76,5 +153,6 @@
   "homepage": "https://github.com/empire-builder-kit/empire-builder-kit#readme",
   "engines": {
     "node": ">=22.12.0"
-  }
-}
+  },
+  "gitHead": "daa31d9fc11699516d1a85072ca46548cd929e50"
+}

package/src/api-contract/baseline-update.d.ts

@@ -0,0 +1,82 @@
+import { type ApiContractCompatibilityClassification, type ApiContractCompatibilityReportV1 } from './compatibility.js';
+import { type ApiContractBaselineV1 } from './model.js';
+export declare const API_CONTRACT_BASELINE_UPDATE_PLAN_SCHEMA_VERSION: 1;
+export declare const API_CONTRACT_BASELINE_UPDATE_PLAN_KIND: "api-contract-baseline-update-plan";
+export declare const API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_SCHEMA_VERSION: 1;
+export declare const API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_KIND: "api-contract-baseline-update-authorization";
+export declare const API_CONTRACT_BASELINE_UPDATE_DISPOSITIONS: readonly ["no-change", "compatible-update", "semantic-review-required", "breaking-migration-required"];
+export type ApiContractBaselineUpdateDisposition = (typeof API_CONTRACT_BASELINE_UPDATE_DISPOSITIONS)[number];
+export interface ApiContractBaselineUpdatePlanV1 {
+    baseline: {
+        baseline: ApiContractBaselineV1;
+        digest: string;
+        version: string;
+    };
+    candidate: {
+        baseline: ApiContractBaselineV1;
+        digest: string;
+        json: string;
+        version: string;
+    };
+    comparison: ApiContractCompatibilityReportV1;
+    disposition: ApiContractBaselineUpdateDisposition;
+    explicitAcceptanceRequired: boolean;
+    kind: typeof API_CONTRACT_BASELINE_UPDATE_PLAN_KIND;
+    schemaVersion: typeof API_CONTRACT_BASELINE_UPDATE_PLAN_SCHEMA_VERSION;
+    writesBaseline: false;
+}
+interface ApiContractBaselineUpdateApprovalBase {
+    acceptedClassification: ApiContractCompatibilityClassification;
+    candidateDigest: string;
+    reason: string;
+}
+export interface ApiContractBaselineEvidenceReferenceV1 {
+    digest: string;
+    name: string;
+}
+export interface ApiContractBaselineRolloutPlanReferenceV1 {
+    digest: string;
+    identity: string;
+}
+export type ApiContractBaselineUpdateApproval = (ApiContractBaselineUpdateApprovalBase & {
+    acceptedClassification: 'compatible';
+}) | (ApiContractBaselineUpdateApprovalBase & {
+    acceptedClassification: 'conditionally-compatible';
+    semanticReviewEvidence: readonly ApiContractBaselineEvidenceReferenceV1[];
+}) | (ApiContractBaselineUpdateApprovalBase & {
+    acceptedClassification: 'breaking';
+    consumerEvidence: readonly ApiContractBaselineEvidenceReferenceV1[];
+    rolloutEvidence: readonly ApiContractBaselineEvidenceReferenceV1[];
+    rolloutPlan: ApiContractBaselineRolloutPlanReferenceV1;
+});
+export interface ApiContractBaselineUpdateAuthorizationV1 {
+    acceptedClassification: ApiContractCompatibilityClassification;
+    baselineDigest: string;
+    candidateDigest: string;
+    candidateJson: string;
+    consumerEvidence?: readonly ApiContractBaselineEvidenceReferenceV1[];
+    kind: typeof API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_KIND;
+    reason: string;
+    rolloutEvidence?: readonly ApiContractBaselineEvidenceReferenceV1[];
+    rolloutPlan?: ApiContractBaselineRolloutPlanReferenceV1;
+    schemaVersion: typeof API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_SCHEMA_VERSION;
+    semanticReviewEvidence?: readonly ApiContractBaselineEvidenceReferenceV1[];
+}
+export type ApiContractBaselineUpdateFailureClassification = 'api-contract-baseline-update-not-required' | 'api-contract-baseline-update-approval-invalid' | 'api-contract-baseline-update-version-invalid';
+export declare class ApiContractBaselineUpdateError extends Error {
+    readonly classification: ApiContractBaselineUpdateFailureClassification;
+    readonly pointer: string;
+    constructor(classification: ApiContractBaselineUpdateFailureClassification, pointer: string, message: string);
+}
+/**
+ * Produces a review artifact only. It never writes or mutates the accepted
+ * baseline, even for a compatible candidate.
+ */
+export declare function planApiContractBaselineUpdate(baselineInput: unknown, candidateInput: unknown): ApiContractBaselineUpdatePlanV1;
+/**
+ * Pins a human/agent approval to the exact candidate and classification. The
+ * result is still data for a caller-controlled write; this function performs
+ * no filesystem mutation.
+ */
+export declare function authorizeApiContractBaselineUpdate(plan: ApiContractBaselineUpdatePlanV1, approval: ApiContractBaselineUpdateApproval): ApiContractBaselineUpdateAuthorizationV1;
+export {};

package/src/api-contract/baseline-update.js

@@ -0,0 +1,225 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiContractBaselineUpdateError = exports.API_CONTRACT_BASELINE_UPDATE_DISPOSITIONS = exports.API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_KIND = exports.API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_SCHEMA_VERSION = exports.API_CONTRACT_BASELINE_UPDATE_PLAN_KIND = exports.API_CONTRACT_BASELINE_UPDATE_PLAN_SCHEMA_VERSION = void 0;
+exports.planApiContractBaselineUpdate = planApiContractBaselineUpdate;
+exports.authorizeApiContractBaselineUpdate = authorizeApiContractBaselineUpdate;
+const compatibility_js_1 = require("./compatibility.js");
+const model_js_1 = require("./model.js");
+exports.API_CONTRACT_BASELINE_UPDATE_PLAN_SCHEMA_VERSION = 1;
+exports.API_CONTRACT_BASELINE_UPDATE_PLAN_KIND = 'api-contract-baseline-update-plan';
+exports.API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_SCHEMA_VERSION = 1;
+exports.API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_KIND = 'api-contract-baseline-update-authorization';
+exports.API_CONTRACT_BASELINE_UPDATE_DISPOSITIONS = [
+    'no-change',
+    'compatible-update',
+    'semantic-review-required',
+    'breaking-migration-required',
+];
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+class ApiContractBaselineUpdateError extends Error {
+    classification;
+    pointer;
+    constructor(classification, pointer, message) {
+        super(`${pointer}: ${message}`);
+        this.classification = classification;
+        this.pointer = pointer;
+        this.name = 'ApiContractBaselineUpdateError';
+    }
+}
+exports.ApiContractBaselineUpdateError = ApiContractBaselineUpdateError;
+const EVIDENCE_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const EVIDENCE_NAME_PATTERN = /^[A-Za-z0-9@][A-Za-z0-9._:@/-]{0,255}$/;
+function approvalError(pointer, message) {
+    throw new ApiContractBaselineUpdateError('api-contract-baseline-update-approval-invalid', pointer, message);
+}
+function semanticVersionParts(value) {
+    const [major = '0', minor = '0', patch = '0'] = value.split('.');
+    return [BigInt(major), BigInt(minor), BigInt(patch)];
+}
+function compareSemanticVersions(left, right) {
+    const leftParts = semanticVersionParts(left);
+    const rightParts = semanticVersionParts(right);
+    for (let index = 0; index < leftParts.length; index += 1) {
+        const leftPart = leftParts[index];
+        const rightPart = rightParts[index];
+        if (leftPart !== rightPart)
+            return leftPart < rightPart ? -1 : 1;
+    }
+    return 0;
+}
+function requireVersionTransition(baseline, candidate, comparison) {
+    if (comparison.baseline.digest === comparison.candidate.digest)
+        return;
+    if (compareSemanticVersions(candidate.version, baseline.version) <= 0) {
+        throw new ApiContractBaselineUpdateError('api-contract-baseline-update-version-invalid', '/candidate/version', 'changed contract content requires a strictly advanced version');
+    }
+    if (comparison.classification === 'breaking' &&
+        semanticVersionParts(candidate.version)[0] <=
+            semanticVersionParts(baseline.version)[0]) {
+        throw new ApiContractBaselineUpdateError('api-contract-baseline-update-version-invalid', '/candidate/version', 'breaking contract content requires an advanced major version');
+    }
+}
+function normalizeEvidenceReferences(value, pointer) {
+    if (!Array.isArray(value) || value.length === 0 || value.length > 64) {
+        approvalError(pointer, 'must contain from 1 through 64 evidence references');
+    }
+    const references = value.map((entry, index) => {
+        const entryPointer = `${pointer}/${index}`;
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+            approvalError(entryPointer, 'must be an evidence reference object');
+        }
+        const input = entry;
+        if (Object.keys(input).some((key) => !['digest', 'name'].includes(key)) ||
+            !EVIDENCE_DIGEST_PATTERN.test(input.digest) ||
+            !EVIDENCE_NAME_PATTERN.test(input.name)) {
+            approvalError(entryPointer, 'must contain only an exact SHA-256 digest and bounded evidence name');
+        }
+        return {
+            digest: input.digest,
+            name: input.name,
+        };
+    });
+    const identities = references.map(({ digest, name }) => `${name}\0${digest}`);
+    if (new Set(identities).size !== identities.length) {
+        approvalError(pointer, 'must not repeat an evidence reference');
+    }
+    return references.sort((left, right) => compareStrings(left.name, right.name) ||
+        compareStrings(left.digest, right.digest));
+}
+function normalizeRolloutPlanReference(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        approvalError('/rolloutPlan', 'must be an exact rollout-plan reference');
+    }
+    const input = value;
+    if (Object.keys(input).some((key) => !['digest', 'identity'].includes(key)) ||
+        !EVIDENCE_DIGEST_PATTERN.test(input.digest) ||
+        !EVIDENCE_NAME_PATTERN.test(input.identity)) {
+        approvalError('/rolloutPlan', 'must contain only a bounded identity and exact SHA-256 digest');
+    }
+    return {
+        digest: input.digest,
+        identity: input.identity,
+    };
+}
+function dispositionFor(comparison) {
+    if (comparison.baseline.digest === comparison.candidate.digest) {
+        return 'no-change';
+    }
+    if (comparison.classification === 'breaking') {
+        return 'breaking-migration-required';
+    }
+    if (comparison.classification === 'conditionally-compatible') {
+        return 'semantic-review-required';
+    }
+    return 'compatible-update';
+}
+/**
+ * Produces a review artifact only. It never writes or mutates the accepted
+ * baseline, even for a compatible candidate.
+ */
+function planApiContractBaselineUpdate(baselineInput, candidateInput) {
+    const baseline = (0, model_js_1.normalizeApiContractBaseline)(baselineInput);
+    const candidate = (0, model_js_1.createApiContractBaseline)(candidateInput);
+    const comparison = (0, compatibility_js_1.compareApiContracts)(baseline, candidate);
+    requireVersionTransition(baseline, candidate, comparison);
+    const disposition = dispositionFor(comparison);
+    return {
+        baseline: {
+            baseline,
+            digest: (0, model_js_1.digestApiContractBaseline)(baseline),
+            version: baseline.version,
+        },
+        candidate: {
+            baseline: candidate,
+            digest: (0, model_js_1.digestApiContractBaseline)(candidate),
+            json: (0, model_js_1.canonicalApiContractBaselineJson)(candidate),
+            version: candidate.version,
+        },
+        comparison,
+        disposition,
+        explicitAcceptanceRequired: disposition !== 'no-change',
+        kind: exports.API_CONTRACT_BASELINE_UPDATE_PLAN_KIND,
+        schemaVersion: exports.API_CONTRACT_BASELINE_UPDATE_PLAN_SCHEMA_VERSION,
+        writesBaseline: false,
+    };
+}
+/**
+ * Pins a human/agent approval to the exact candidate and classification. The
+ * result is still data for a caller-controlled write; this function performs
+ * no filesystem mutation.
+ */
+function authorizeApiContractBaselineUpdate(plan, approval) {
+    const plannedBaselineDigest = (0, model_js_1.digestApiContractBaseline)(plan.baseline.baseline);
+    const plannedCandidateDigest = (0, model_js_1.digestApiContractBaseline)(plan.candidate.baseline);
+    const recomputedComparison = (0, compatibility_js_1.compareApiContracts)(plan.baseline.baseline, plan.candidate.baseline);
+    requireVersionTransition(plan.baseline.baseline, plan.candidate.baseline, recomputedComparison);
+    const expectedDisposition = dispositionFor(recomputedComparison);
+    if (plan.kind !== exports.API_CONTRACT_BASELINE_UPDATE_PLAN_KIND ||
+        plan.schemaVersion !== exports.API_CONTRACT_BASELINE_UPDATE_PLAN_SCHEMA_VERSION ||
+        plan.writesBaseline !== false ||
+        plan.baseline.digest !== plannedBaselineDigest ||
+        plan.baseline.version !== plan.baseline.baseline.version ||
+        plan.candidate.digest !== plannedCandidateDigest ||
+        plan.candidate.version !== plan.candidate.baseline.version ||
+        plan.candidate.json !==
+            (0, model_js_1.canonicalApiContractBaselineJson)(plan.candidate.baseline) ||
+        plan.comparison.candidate.digest !== plan.candidate.digest ||
+        plan.comparison.baseline.digest !== plan.baseline.digest ||
+        JSON.stringify(plan.comparison) !== JSON.stringify(recomputedComparison) ||
+        plan.disposition !== expectedDisposition) {
+        approvalError('/plan', 'must be an internally consistent v1 update plan');
+    }
+    if (plan.disposition === 'no-change') {
+        throw new ApiContractBaselineUpdateError('api-contract-baseline-update-not-required', '/disposition', 'the candidate already matches the accepted baseline');
+    }
+    if (approval.candidateDigest !== plan.candidate.digest) {
+        throw new ApiContractBaselineUpdateError('api-contract-baseline-update-approval-invalid', '/candidateDigest', 'must match the planned candidate digest');
+    }
+    if (approval.acceptedClassification !== plan.comparison.classification) {
+        throw new ApiContractBaselineUpdateError('api-contract-baseline-update-approval-invalid', '/acceptedClassification', 'must match the compatibility report classification');
+    }
+    const allowedApprovalKeys = new Set([
+        'acceptedClassification',
+        'candidateDigest',
+        'reason',
+        ...(approval.acceptedClassification === 'conditionally-compatible'
+            ? ['semanticReviewEvidence']
+            : approval.acceptedClassification === 'breaking'
+                ? ['consumerEvidence', 'rolloutEvidence', 'rolloutPlan']
+                : []),
+    ]);
+    if (Object.keys(approval).some((key) => !allowedApprovalKeys.has(key))) {
+        approvalError('', 'contains fields outside the selected classification approval contract');
+    }
+    if (!approval || typeof approval !== 'object') {
+        approvalError('', 'must be an approval object');
+    }
+    const reason = typeof approval.reason === 'string' ? approval.reason.trim() : '';
+    if (reason.length === 0 || reason.length > 1024) {
+        throw new ApiContractBaselineUpdateError('api-contract-baseline-update-approval-invalid', '/reason', 'must be a non-empty reason of at most 1024 characters');
+    }
+    const classificationEvidence = approval.acceptedClassification === 'conditionally-compatible'
+        ? {
+            semanticReviewEvidence: normalizeEvidenceReferences(approval.semanticReviewEvidence, '/semanticReviewEvidence'),
+        }
+        : approval.acceptedClassification === 'breaking'
+            ? {
+                consumerEvidence: normalizeEvidenceReferences(approval.consumerEvidence, '/consumerEvidence'),
+                rolloutEvidence: normalizeEvidenceReferences(approval.rolloutEvidence, '/rolloutEvidence'),
+                rolloutPlan: normalizeRolloutPlanReference(approval.rolloutPlan),
+            }
+            : {};
+    return {
+        acceptedClassification: approval.acceptedClassification,
+        baselineDigest: plan.baseline.digest,
+        candidateDigest: plan.candidate.digest,
+        candidateJson: plan.candidate.json,
+        kind: exports.API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_KIND,
+        reason,
+        ...classificationEvidence,
+        schemaVersion: exports.API_CONTRACT_BASELINE_UPDATE_AUTHORIZATION_SCHEMA_VERSION,
+    };
+}
+//# sourceMappingURL=baseline-update.js.map