@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/repository-policy/policy.js

@@ -1,27 +1,48 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REPOSITORY_MODE_PRESETS = exports.SLICE_PRODUCTION_STATUSES = exports.DEFAULT_RECOVERY_PRODUCTION_FOUNDATION_PROFILE = exports.PRODUCTION_FOUNDATION_PROFILES = exports.PRODUCTION_APPROVAL_MODES = exports.PRODUCTION_ACCESS_VALUES = exports.REPOSITORY_POLICY_SCHEMA_URL = exports.REPOSITORY_POLICY_SCHEMA_VERSION = exports.REPOSITORY_POLICY_FILE = void 0;
+exports.DEFAULT_DELIVERY_LANE = exports.DELIVERY_LANES = exports.DEPLOYMENT_PROFILES = exports.REPOSITORY_MODE_PRESETS = exports.SLICE_PRODUCTION_STATUSES = exports.DEFAULT_RECOVERY_PRODUCTION_FOUNDATION_PROFILE = exports.PRODUCTION_FOUNDATION_PROFILES = exports.PRODUCTION_APPROVAL_MODES = exports.PRODUCTION_ACCESS_VALUES = exports.REPOSITORY_POLICY_SCHEMA_URL = exports.REPOSITORY_POLICY_SCHEMA_VERSION = exports.REPOSITORY_POLICY_FILE = void 0;
+exports.deliveryLaneOf = deliveryLaneOf;
+exports.normalizeDeploymentAccountId = normalizeDeploymentAccountId;
+exports.requiresGithubDeployment = requiresGithubDeployment;
+exports.activeDeploymentStages = activeDeploymentStages;
+exports.isActiveDeploymentStage = isActiveDeploymentStage;
+exports.productionRehearsalStage = productionRehearsalStage;
+exports.validateDeploymentAccountTopology = validateDeploymentAccountTopology;
+exports.configuredDeploymentAccountTopology = configuredDeploymentAccountTopology;
+exports.configuredDeploymentAccountForStage = configuredDeploymentAccountForStage;
+exports.configuredDeploymentRegion = configuredDeploymentRegion;
 exports.validateRepositoryOperatingPolicy = validateRepositoryOperatingPolicy;
 exports.formatRepositoryPolicyIssues = formatRepositoryPolicyIssues;
 exports.parseRepositoryOperatingPolicy = parseRepositoryOperatingPolicy;
+exports.validateRepositoryOperatingPolicyMigrationProvenance = validateRepositoryOperatingPolicyMigrationProvenance;
 exports.readRepositoryOperatingPolicy = readRepositoryOperatingPolicy;
 exports.createIncubationRepositoryPolicy = createIncubationRepositoryPolicy;
 exports.applyRepositoryPolicyChange = applyRepositoryPolicyChange;
 exports.evaluateRepositoryPolicyRequest = evaluateRepositoryPolicyRequest;
 exports.assertRepositoryPolicyRequest = assertRepositoryPolicyRequest;
+const node_crypto_1 = require("node:crypto");
+const capacity_migration_js_1 = require("./capacity-migration.js");
+const node_buffer_1 = require("node:buffer");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const validation_js_1 = require("../validation.js");
+const identity_js_1 = require("../workspace-deployment/identity.js");
+const migration_evidence_js_1 = require("../workspace-deployment/migration-evidence.js");
 exports.REPOSITORY_POLICY_FILE = 'ebk.repository-policy.json';
 exports.REPOSITORY_POLICY_SCHEMA_VERSION = 1;
+const MAX_REPOSITORY_POLICY_BYTES = 1024 * 1024;
+const MAX_WORKSPACE_DEPLOYMENT_MIGRATION_EVIDENCE_BYTES = 128 * 1024;
+const UNSUPPORTED_AWS_PARTITION_REGION = /^(?:us-iso-|us-isob-|eu-isoe-|us-isof-)/u;
 exports.REPOSITORY_POLICY_SCHEMA_URL = './node_modules/@empire-builder-kit/nx/schemas/repository-policy-v1.json';
 exports.PRODUCTION_ACCESS_VALUES = ['disabled', 'controlled'];
 exports.PRODUCTION_APPROVAL_MODES = [
     'promotion-pr',
     'environment-reviewer',
+    'trunk-promotion',
 ];
 exports.PRODUCTION_FOUNDATION_PROFILES = [
     'cost-optimized',
+    'balanced',
     'standard',
 ];
 exports.DEFAULT_RECOVERY_PRODUCTION_FOUNDATION_PROFILE = 'standard';
@@ -31,21 +52,161 @@ exports.REPOSITORY_MODE_PRESETS = [
     'controlled-production',
     'operational',
 ];
+exports.DEPLOYMENT_PROFILES = [
+    'starter',
+    'production-isolated',
+    'fully-isolated',
+];
+/** How work reaches production. protected-pair keeps develop and main with a
+ * promotion pull request and sync-back; trunk protects main alone and deploys
+ * production from every merged main push (starter fast lane). */
+exports.DELIVERY_LANES = ['protected-pair', 'trunk'];
+exports.DEFAULT_DELIVERY_LANE = 'protected-pair';
+function deliveryLaneOf(policy) {
+    return policy.deliveryLane ?? exports.DEFAULT_DELIVERY_LANE;
+}
+const DEPLOYMENT_STAGES_BY_PROFILE = {
+    starter: ['development', 'production'],
+    'production-isolated': ['development', 'staging', 'production'],
+    'fully-isolated': ['development', 'staging', 'production'],
+};
+function normalizeDeploymentAccountId(value, label) {
+    if (typeof value === 'string' && /^\d{12}$/.test(value))
+        return value;
+    if (typeof value === 'number' &&
+        Number.isSafeInteger(value) &&
+        value >= 100_000_000_000 &&
+        value <= 999_999_999_999) {
+        return String(value);
+    }
+    throw new Error(`${label} must be an exact 12-digit AWS account ID.`);
+}
+function requiresGithubDeployment(profile, stage) {
+    return ((profile === 'production-isolated' && stage === 'production') ||
+        (profile === 'fully-isolated' && stage === 'staging') ||
+        (profile === 'fully-isolated' && stage === 'production'));
+}
+function activeDeploymentStages(profile) {
+    return DEPLOYMENT_STAGES_BY_PROFILE[profile];
+}
+function isActiveDeploymentStage(profile, stage) {
+    return activeDeploymentStages(profile).includes(stage);
+}
+function productionRehearsalStage(profile) {
+    return profile === 'starter' ? 'development' : 'staging';
+}
+function validateDeploymentAccountTopology(profile, accounts) {
+    for (const stage of ['development', 'production']) {
+        if (!/^\d{12}$/.test(accounts[stage])) {
+            throw new Error(`Deployment account for ${stage} must be an exact 12-digit AWS account ID.`);
+        }
+    }
+    if (profile === 'starter') {
+        if (accounts.staging !== null) {
+            throw new Error('The starter deployment profile has no staging stage; its staging deployment account must be null.');
+        }
+        if (accounts.development !== accounts.production) {
+            throw new Error('The starter deployment profile requires one shared development and production AWS account.');
+        }
+        return { ...accounts };
+    }
+    if (accounts.staging === null || !/^\d{12}$/.test(accounts.staging)) {
+        throw new Error('Deployment account for staging must be an exact 12-digit AWS account ID.');
+    }
+    const unique = new Set(Object.values(accounts));
+    if (profile === 'production-isolated' &&
+        (accounts.development !== accounts.staging ||
+            accounts.production === accounts.staging)) {
+        throw new Error('The production-isolated deployment profile requires one shared development/staging account and one distinct production account.');
+    }
+    if (profile === 'fully-isolated' && unique.size !== 3) {
+        throw new Error('The fully-isolated deployment profile requires three distinct AWS accounts.');
+    }
+    return { ...accounts };
+}
+function configuredDeploymentAccountTopology(profile, accounts) {
+    if (accounts.development === null || accounts.production === null) {
+        throw new Error('Deployment account topology is incomplete; configure exact development and production AWS account IDs before deployment.');
+    }
+    if (profile !== 'starter' && accounts.staging === null) {
+        throw new Error('Deployment account topology is incomplete; isolated profiles require an exact staging AWS account ID.');
+    }
+    return validateDeploymentAccountTopology(profile, {
+        development: accounts.development,
+        production: accounts.production,
+        staging: accounts.staging,
+    });
+}
+function validateConfiguredIsolatedAccounts(accounts) {
+    const configured = new Set();
+    for (const stage of ['development', 'staging', 'production']) {
+        const account = accounts[stage];
+        if (account === null)
+            continue;
+        if (typeof account !== 'string' || !/^\d{12}$/.test(account)) {
+            throw new Error(`Deployment account for ${stage} must be null or an exact 12-digit AWS account ID.`);
+        }
+        if (configured.has(account)) {
+            throw new Error('The fully-isolated deployment profile requires distinct configured AWS accounts.');
+        }
+        configured.add(account);
+    }
+}
+function configuredDeploymentAccountForStage(profile, accounts, stage) {
+    if (!isActiveDeploymentStage(profile, stage)) {
+        throw new Error(`Deployment stage ${stage} is inactive for the ${profile} deployment profile.`);
+    }
+    // Fresh isolated accounts can be provisioned independently. This does not
+    // relax production rehearsal or migrated-workspace tuple requirements.
+    if (profile === 'fully-isolated' && stage !== 'production') {
+        validateConfiguredIsolatedAccounts(accounts);
+        const account = accounts[stage];
+        if (account === null) {
+            throw new Error(`Deployment account for active stage ${stage} is not configured.`);
+        }
+        return account;
+    }
+    const topology = configuredDeploymentAccountTopology(profile, accounts);
+    const account = topology[stage];
+    if (account === null) {
+        throw new Error(`Deployment account for active stage ${stage} is not configured.`);
+    }
+    return account;
+}
+function configuredDeploymentRegion(region) {
+    if (region === null ||
+        !/^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/.test(region) ||
+        UNSUPPORTED_AWS_PARTITION_REGION.test(region)) {
+        throw new Error('Deployment Region is incomplete or belongs to an unsupported AWS partition; configure one exact commercial, China, or GovCloud AWS Region before deployment.');
+    }
+    return region;
+}
 const SLICE_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const POLICY_PROPERTIES = new Set([
     '$schema',
+    'deliveryLane',
+    'deploymentAccounts',
+    'deploymentProfile',
+    'deploymentRegion',
     'productionAccess',
     'productionApproval',
     'productionFoundation',
     'schemaVersion',
     'slices',
+    'workspaceDeploymentId',
+    'workspaceDeploymentProvenance',
 ]);
 const REQUIRED_POLICY_PROPERTIES = [
+    'deploymentAccounts',
+    'deploymentProfile',
+    'deploymentRegion',
     'productionAccess',
     'productionApproval',
     'productionFoundation',
     'schemaVersion',
     'slices',
+    'workspaceDeploymentId',
+    'workspaceDeploymentProvenance',
 ];
 function rejectUnknownProperties(value, allowed, path, issues) {
     for (const property of Object.keys(value)) {
@@ -79,6 +240,153 @@ function validateRepositoryOperatingPolicy(value) {
             path: 'policy.$schema',
         });
     }
+    if (value.deliveryLane !== undefined &&
+        !isOneOf(value.deliveryLane, exports.DELIVERY_LANES)) {
+        issues.push({
+            message: 'must be protected-pair or trunk',
+            path: 'policy.deliveryLane',
+        });
+    }
+    if (value.deliveryLane === 'trunk' && value.deploymentProfile !== 'starter') {
+        issues.push({
+            message: 'trunk delivery requires the starter deployment profile',
+            path: 'policy.deliveryLane',
+        });
+    }
+    if ((0, validation_js_1.isRecord)(value.productionApproval) &&
+        value.productionApproval.mode === 'trunk-promotion' &&
+        (value.deploymentProfile === 'starter' || value.deliveryLane === 'trunk')) {
+        issues.push({
+            message: 'trunk-promotion requires an isolated deployment profile on the protected pair; the starter profile uses the trunk delivery lane instead',
+            path: 'policy.productionApproval.mode',
+        });
+    }
+    if (!(0, validation_js_1.isRecord)(value.workspaceDeploymentProvenance)) {
+        issues.push({
+            message: 'must declare exact fresh or migrated provenance',
+            path: 'policy.workspaceDeploymentProvenance',
+        });
+    }
+    else {
+        const provenance = value.workspaceDeploymentProvenance;
+        const provenancePath = 'policy.workspaceDeploymentProvenance';
+        if (provenance.kind === 'fresh') {
+            rejectUnknownProperties(provenance, new Set(['kind', 'schemaVersion']), provenancePath, issues);
+            if (provenance.schemaVersion !== 1) {
+                issues.push({
+                    message: 'must equal 1',
+                    path: `${provenancePath}.schemaVersion`,
+                });
+            }
+        }
+        else if (provenance.kind === 'migrated') {
+            rejectUnknownProperties(provenance, new Set(['evidencePath', 'evidenceSha256', 'kind', 'schemaVersion']), provenancePath, issues);
+            const evidencePath = provenance.evidencePath;
+            const pathSegments = typeof evidencePath === 'string' ? evidencePath.split('/') : [];
+            if (typeof evidencePath !== 'string' ||
+                !/^docs\/adoption\/[A-Za-z0-9._/-]+[.]json$/u.test(evidencePath) ||
+                (0, node_path_1.isAbsolute)(evidencePath) ||
+                evidencePath.includes('\\') ||
+                evidencePath.includes('//') ||
+                pathSegments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+                issues.push({
+                    message: 'must be one normalized JSON path beneath docs/adoption without traversal',
+                    path: `${provenancePath}.evidencePath`,
+                });
+            }
+            if (typeof provenance.evidenceSha256 !== 'string' ||
+                !/^[a-f0-9]{64}$/u.test(provenance.evidenceSha256)) {
+                issues.push({
+                    message: 'must be one lowercase SHA-256 digest',
+                    path: `${provenancePath}.evidenceSha256`,
+                });
+            }
+            if (provenance.schemaVersion !== 1) {
+                issues.push({
+                    message: 'must equal 1',
+                    path: `${provenancePath}.schemaVersion`,
+                });
+            }
+        }
+        else {
+            issues.push({
+                message: 'kind must equal fresh or migrated',
+                path: `${provenancePath}.kind`,
+            });
+        }
+    }
+    if (typeof value.workspaceDeploymentId !== 'string' ||
+        !identity_js_1.WORKSPACE_DEPLOYMENT_ID_PATTERN.test(value.workspaceDeploymentId)) {
+        issues.push({
+            message: 'must be ebkws- followed by exactly 128 bits of lowercase hexadecimal identity',
+            path: 'policy.workspaceDeploymentId',
+        });
+    }
+    if (!isOneOf(value.deploymentProfile, exports.DEPLOYMENT_PROFILES)) {
+        issues.push({
+            message: `must equal ${exports.DEPLOYMENT_PROFILES.join(', ')}`,
+            path: 'policy.deploymentProfile',
+        });
+    }
+    if (value.deploymentRegion !== null &&
+        (typeof value.deploymentRegion !== 'string' ||
+            !/^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/.test(value.deploymentRegion) ||
+            UNSUPPORTED_AWS_PARTITION_REGION.test(value.deploymentRegion))) {
+        issues.push({
+            message: 'must be null or one exact commercial, China, or GovCloud AWS Region',
+            path: 'policy.deploymentRegion',
+        });
+    }
+    if (!(0, validation_js_1.isRecord)(value.deploymentAccounts)) {
+        issues.push({
+            message: 'must be an object with development, staging, and production account decisions',
+            path: 'policy.deploymentAccounts',
+        });
+    }
+    else {
+        rejectUnknownProperties(value.deploymentAccounts, new Set(['development', 'staging', 'production']), 'policy.deploymentAccounts', issues);
+        for (const stage of ['development', 'staging', 'production']) {
+            const account = value.deploymentAccounts[stage];
+            if (account !== null &&
+                (typeof account !== 'string' || !/^\d{12}$/.test(account))) {
+                issues.push({
+                    message: 'must be null or an exact 12-digit AWS account ID',
+                    path: `policy.deploymentAccounts.${stage}`,
+                });
+            }
+        }
+        if (value.deploymentProfile === 'fully-isolated' &&
+            Object.values(value.deploymentAccounts).some((account) => account === null)) {
+            try {
+                validateConfiguredIsolatedAccounts(value.deploymentAccounts);
+            }
+            catch (error) {
+                issues.push({
+                    message: error instanceof Error ? error.message : String(error),
+                    path: 'policy.deploymentAccounts',
+                });
+            }
+        }
+        if (isOneOf(value.deploymentProfile, exports.DEPLOYMENT_PROFILES) &&
+            typeof value.deploymentAccounts.development === 'string' &&
+            typeof value.deploymentAccounts.production === 'string' &&
+            (value.deploymentAccounts.staging === null ||
+                typeof value.deploymentAccounts.staging === 'string')) {
+            try {
+                validateDeploymentAccountTopology(value.deploymentProfile, {
+                    development: value.deploymentAccounts.development,
+                    production: value.deploymentAccounts.production,
+                    staging: value.deploymentAccounts.staging,
+                });
+            }
+            catch (error) {
+                issues.push({
+                    message: error instanceof Error ? error.message : String(error),
+                    path: 'policy.deploymentAccounts',
+                });
+            }
+        }
+    }
     if (!isOneOf(value.productionAccess, exports.PRODUCTION_ACCESS_VALUES)) {
         issues.push({
             message: `must equal ${exports.PRODUCTION_ACCESS_VALUES.join(' or ')}`,
@@ -87,7 +395,7 @@ function validateRepositoryOperatingPolicy(value) {
     }
     if (!(0, validation_js_1.isRecord)(value.productionApproval)) {
         issues.push({
-            message: 'must be an object with an explicit promotion-pr or environment-reviewer mode',
+            message: 'must be an object with an explicit promotion-pr, environment-reviewer, or trunk-promotion mode',
             path: 'policy.productionApproval',
         });
     }
@@ -151,7 +459,7 @@ function missingPolicyDecisionGuidance(value) {
     const missing = REQUIRED_POLICY_PROPERTIES.filter((property) => !Object.prototype.hasOwnProperty.call(value, property));
     if (missing.length === 0)
         return '';
-    return `\nMissing required top-level policy members: ${missing.join(', ')}.\nClean regeneration required: regenerate the workspace from the current exact packed candidate, then deliberately reapply the reviewed production-access, approval-mode, Foundation-profile, and per-Slice decisions. Missing decisions are not inferred or amended in place.`;
+    return `\nMissing required top-level policy members: ${missing.join(', ')}.\nClean regeneration required: regenerate the workspace from the current exact packed candidate, then deliberately reapply the reviewed deployment-profile, production-access, approval-mode, Foundation-profile, and per-Slice decisions. Existing prerelease repositories must explicitly migrate a stable workspaceDeploymentId and required migrated provenance with bounded, version-controlled tuple occupancy evidence; a legacy profile migration also requires --deploymentProfile=fully-isolated. Then commit exact development, staging, and production AWS account IDs plus deploymentRegion before any deployment. Migration preserves the reviewed authority model and workspace ownership assertion, not deployability; all-null account topology remains fail closed. Missing decisions are not inferred or amended in place.`;
 }
 function parseRepositoryOperatingPolicy(contents, source = exports.REPOSITORY_POLICY_FILE) {
     let value;
@@ -167,27 +475,173 @@ function parseRepositoryOperatingPolicy(contents, source = exports.REPOSITORY_PO
     }
     return result.value;
 }
-function readRepositoryOperatingPolicy(workspaceRoot) {
-    const path = (0, node_path_1.join)(workspaceRoot, exports.REPOSITORY_POLICY_FILE);
-    let contents;
+function workspaceDeploymentMigrationCoordinates(policy) {
+    const region = configuredDeploymentRegion(policy.deploymentRegion);
+    const accounts = configuredDeploymentAccountTopology(policy.deploymentProfile, policy.deploymentAccounts);
+    return activeDeploymentStages(policy.deploymentProfile)
+        .map((stage) => ({ accountId: accounts[stage], region, stage }))
+        .sort((left, right) => left.stage < right.stage ? -1 : left.stage > right.stage ? 1 : 0);
+}
+function validateRepositoryOperatingPolicyMigrationProvenance(input) {
+    if (input.policy.workspaceDeploymentProvenance.kind !== 'migrated')
+        return;
+    if (node_buffer_1.Buffer.byteLength(input.evidenceBytes, 'utf8') > 131_072) {
+        throw new Error(`Workspace deployment migration evidence at ${input.evidenceSource} exceeds the 128 KiB retention bound.`);
+    }
+    const actualDigest = (0, node_crypto_1.createHash)('sha256')
+        .update(input.evidenceBytes, 'utf8')
+        .digest('hex');
+    if (actualDigest !== input.policy.workspaceDeploymentProvenance.evidenceSha256) {
+        throw new Error(`Workspace deployment migration evidence at ${input.evidenceSource} does not match the committed SHA-256 binding.`);
+    }
+    let evidence;
+    try {
+        evidence = JSON.parse(input.evidenceBytes);
+    }
+    catch (error) {
+        throw new Error(`Workspace deployment migration evidence at ${input.evidenceSource} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    (0, migration_evidence_js_1.validateWorkspaceDeploymentMigrationEvidence)({
+        evidence,
+        expectedCoordinates: workspaceDeploymentMigrationCoordinates(input.policy),
+        workspaceDeploymentId: input.policy.workspaceDeploymentId,
+    });
+}
+function isContainedFilesystemPath(root, path) {
+    const fromRoot = (0, node_path_1.relative)(root, path);
+    return (fromRoot === '' ||
+        (!fromRoot.startsWith(`..${node_path_1.sep}`) &&
+            fromRoot !== '..' &&
+            !(0, node_path_1.isAbsolute)(fromRoot)));
+}
+function repositoryPolicyWorkspaceRoot(workspaceRoot) {
     try {
-        contents = (0, node_fs_1.readFileSync)(path, 'utf8');
+        const root = (0, node_fs_1.realpathSync)(workspaceRoot);
+        if (!(0, node_fs_1.lstatSync)(root).isDirectory()) {
+            throw new Error('workspace root is not a directory');
+        }
+        return root;
     }
     catch (error) {
-        throw new Error(`Repository Operating Policy is required at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+        throw new Error(`Repository Operating Policy workspace root is unavailable at ${workspaceRoot}: ${error instanceof Error ? error.message : String(error)}`);
     }
-    return parseRepositoryOperatingPolicy(contents, path);
 }
-function createIncubationRepositoryPolicy() {
+function readBoundedContainedRepositoryFile(input) {
+    const segments = input.relativePath.split('/');
+    if (input.relativePath.length === 0 ||
+        input.relativePath.includes('\0') ||
+        input.relativePath.includes('\\') ||
+        (0, node_path_1.isAbsolute)(input.relativePath) ||
+        segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        throw new Error(`${input.label} path escaped the workspace: ${input.relativePath}`);
+    }
+    const path = (0, node_path_1.resolve)(input.workspaceRoot, ...segments);
+    if (!isContainedFilesystemPath(input.workspaceRoot, path)) {
+        throw new Error(`${input.label} path escaped the workspace: ${path}`);
+    }
+    let descriptor;
+    try {
+        const pathMetadata = (0, node_fs_1.lstatSync)(path);
+        if (pathMetadata.isSymbolicLink() || !pathMetadata.isFile()) {
+            throw new Error('path is not one regular non-symlink file');
+        }
+        const resolvedPath = (0, node_fs_1.realpathSync)(path);
+        if (!isContainedFilesystemPath(input.workspaceRoot, resolvedPath)) {
+            throw new Error(`${input.label} path escaped the workspace through a parent path`);
+        }
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const metadata = (0, node_fs_1.fstatSync)(descriptor);
+        if (!metadata.isFile() ||
+            metadata.dev !== pathMetadata.dev ||
+            metadata.ino !== pathMetadata.ino) {
+            throw new Error('path changed before it could be read safely');
+        }
+        if (metadata.size > input.maximumBytes) {
+            throw new Error(`file exceeds ${input.maximumDescription}`);
+        }
+        const capacity = Math.min(input.maximumBytes + 1, metadata.size + 1);
+        const buffer = node_buffer_1.Buffer.alloc(capacity);
+        let offset = 0;
+        while (offset < buffer.byteLength) {
+            const count = (0, node_fs_1.readSync)(descriptor, buffer, offset, buffer.byteLength - offset, null);
+            if (count === 0)
+                break;
+            offset += count;
+        }
+        const finalMetadata = (0, node_fs_1.fstatSync)(descriptor);
+        if (offset !== metadata.size ||
+            finalMetadata.size !== metadata.size ||
+            finalMetadata.mtimeMs !== metadata.mtimeMs ||
+            finalMetadata.ctimeMs !== metadata.ctimeMs) {
+            throw new Error('file changed while it was read or exceeded its fixed byte bound');
+        }
+        const finalPathMetadata = (0, node_fs_1.lstatSync)(path);
+        const finalResolvedPath = (0, node_fs_1.realpathSync)(path);
+        if (finalPathMetadata.isSymbolicLink() ||
+            !finalPathMetadata.isFile() ||
+            finalPathMetadata.dev !== metadata.dev ||
+            finalPathMetadata.ino !== metadata.ino ||
+            !isContainedFilesystemPath(input.workspaceRoot, finalResolvedPath)) {
+            throw new Error('path changed after it was read safely');
+        }
+        return {
+            contents: buffer.subarray(0, offset).toString('utf8'),
+            path: finalResolvedPath,
+        };
+    }
+    catch (error) {
+        throw new Error(`${input.label} is required as a bounded contained regular non-symlink file at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        if (descriptor !== undefined)
+            (0, node_fs_1.closeSync)(descriptor);
+    }
+}
+function readRepositoryOperatingPolicy(workspaceRoot) {
+    const workspace = repositoryPolicyWorkspaceRoot(workspaceRoot);
+    const policySource = readBoundedContainedRepositoryFile({
+        label: 'Repository Operating Policy',
+        maximumBytes: MAX_REPOSITORY_POLICY_BYTES,
+        maximumDescription: 'its 1 MiB control-file bound',
+        relativePath: exports.REPOSITORY_POLICY_FILE,
+        workspaceRoot: workspace,
+    });
+    const policy = parseRepositoryOperatingPolicy(policySource.contents, policySource.path);
+    if (policy.workspaceDeploymentProvenance.kind === 'migrated') {
+        const evidenceSource = readBoundedContainedRepositoryFile({
+            label: 'Workspace deployment migration evidence',
+            maximumBytes: MAX_WORKSPACE_DEPLOYMENT_MIGRATION_EVIDENCE_BYTES,
+            maximumDescription: 'the 128 KiB retention bound',
+            relativePath: policy.workspaceDeploymentProvenance.evidencePath,
+            workspaceRoot: workspace,
+        });
+        validateRepositoryOperatingPolicyMigrationProvenance({
+            evidenceBytes: evidenceSource.contents,
+            evidenceSource: evidenceSource.path,
+            policy,
+        });
+    }
+    return policy;
+}
+function createIncubationRepositoryPolicy(deploymentProfile = 'starter', workspaceDeploymentId = (0, identity_js_1.createWorkspaceDeploymentId)()) {
     return {
         $schema: exports.REPOSITORY_POLICY_SCHEMA_URL,
+        deploymentAccounts: {
+            development: null,
+            production: null,
+            staging: null,
+        },
+        deploymentProfile,
+        deploymentRegion: null,
         productionAccess: 'disabled',
         productionApproval: { mode: 'promotion-pr' },
         productionFoundation: {
-            profile: exports.DEFAULT_RECOVERY_PRODUCTION_FOUNDATION_PROFILE,
+            profile: 'cost-optimized',
         },
         schemaVersion: exports.REPOSITORY_POLICY_SCHEMA_VERSION,
         slices: {},
+        workspaceDeploymentId,
+        workspaceDeploymentProvenance: { kind: 'fresh', schemaVersion: 1 },
     };
 }
 function applyRepositoryPolicyChange(current, change) {
@@ -209,9 +663,32 @@ function applyRepositoryPolicyChange(current, change) {
     if (change.productionAccess !== undefined) {
         next.productionAccess = change.productionAccess;
     }
+    if (change.deploymentProfile !== undefined) {
+        next.deploymentProfile = change.deploymentProfile;
+        if (change.deploymentProfile === 'starter') {
+            next.deploymentAccounts.staging = null;
+        }
+    }
+    if (change.deploymentAccounts !== undefined) {
+        next.deploymentAccounts = {
+            ...next.deploymentAccounts,
+            ...change.deploymentAccounts,
+        };
+    }
+    if (change.deploymentRegion !== undefined) {
+        next.deploymentRegion = change.deploymentRegion;
+    }
     if (change.productionApprovalMode !== undefined) {
         next.productionApproval = { mode: change.productionApprovalMode };
     }
+    if (change.deliveryLane !== undefined) {
+        if (change.deliveryLane === exports.DEFAULT_DELIVERY_LANE) {
+            delete next.deliveryLane;
+        }
+        else {
+            next.deliveryLane = change.deliveryLane;
+        }
+    }
     if (change.productionFoundationProfile !== undefined) {
         next.productionFoundation = {
             profile: change.productionFoundationProfile,
@@ -238,6 +715,12 @@ function evaluateRepositoryPolicyRequest(policy, request) {
         }
         projectNames.add(project.name);
     }
+    if ((request.stage === 'development' ||
+        request.stage === 'staging' ||
+        request.stage === 'production') &&
+        !isActiveDeploymentStage(policy.deploymentProfile, request.stage)) {
+        reasons.push(`Stage ${request.stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
+    }
     if (request.stage !== 'production') {
         return { allowed: reasons.length === 0, reasons };
     }
@@ -269,6 +752,9 @@ function evaluateRepositoryPolicyRequest(policy, request) {
 }
 function assertRepositoryPolicyRequest(workspaceRoot, request) {
     const policy = readRepositoryOperatingPolicy(workspaceRoot);
+    if (request.action === 'deploy' && request.stage === 'production') {
+        (0, capacity_migration_js_1.assertWorkspaceCapacityMigrationChoice)(workspaceRoot, policy.productionFoundation.profile);
+    }
     const decision = evaluateRepositoryPolicyRequest(policy, request);
     if (!decision.allowed) {
         throw new Error(`Repository Operating Policy rejected ${request.action} for ${request.stage}:\n${decision.reasons.map((reason) => `- ${reason}`).join('\n')}`);

package/src/schemas/blueprint-v1.json

@@ -13,15 +13,16 @@
         "capabilities": {
           "items": {
             "enum": [
-              "network",
+              "key-value",
               "routing",
-              "container-compute",
-              "postgres",
               "identity",
               "events",
               "observability",
               "configuration",
-              "deployment"
+              "deployment",
+              "network",
+              "container-compute",
+              "postgres"
             ],
             "type": "string"
           },

package/src/schemas/foundation-requirement-v1.json

@@ -6,15 +6,16 @@
     "capabilities": {
       "items": {
         "enum": [
-          "network",
+          "key-value",
           "routing",
-          "container-compute",
-          "postgres",
           "identity",
           "events",
           "observability",
           "configuration",
-          "deployment"
+          "deployment",
+          "network",
+          "container-compute",
+          "postgres"
         ],
         "type": "string"
       },