# Publication-scope policy — owned by the netkingdom security-infrastructure domain,
# enforced by secrets-engine.
#
# Binds npm package *publication scope* to package *maturity*, and GATES the
# graduated (relaxed) scoping behind netkingdom itself reaching production grade.
#
# Design intent (proves policy-bound secret handling):
#   - A repo's maturity translates into the maturity tag of the package it ships
#     (maturity-build / maturity-test / maturity-prod).
#   - Each maturity tag is restricted by the publication scope its token carries.
#   - Low-stakes build artifacts may publish with a BROAD shared token; high-stakes
#     production publishes require a TIGHT, repo-scoped token. Scope narrows as
#     stakes rise.
#   - The graduated table is DORMANT until netkingdom is production grade. While
#     dormant, every lane clamps to the safest scope (repo) — fail-safe, never
#     fail-open.
domain: netkingdom
policy: publication-scope
version: "0.1.0"

# netkingdom's own maturity. `production_grade` is derived: it is true only when
# this equals "maturity-prod". Today netkingdom is at maturity-build.
netkingdom_maturity: maturity-build

# When ACTIVE (production_grade == true): package maturity tag -> required scope.
maturity_scope:
  maturity-build: gitea     # gitea-wide publication rights
  maturity-test:  org       # org-wide publication rights
  maturity-prod:  repo      # repo-scoped publication rights

# Safe scope applied while DORMANT, and the floor that cannot be exceeded before
# netkingdom is production grade.
dormant_scope: repo

# Token env-var naming convention by effective scope. {ORG}/{SCOPE}/{REPO} are
# upper-cased, de-hyphenated forms of the lane's org / npm-scope / repo.
#   org  coulomb         -> COULOMB
#   scope @whynot        -> WHYNOT     (npm scope = "project"; defined, NOT used by policy)
#   repo whynot-design   -> WHYNOTDESIGN
# The default repo-scope name is the bare NPM_AUTH_TOKEN; the explicit per-repo
# form (NPM_AUTH_{REPO}) is available when a lane overrides it.
token_env:
  gitea: "NPM_AUTH_GITEA_TOKEN"
  org:   "NPM_AUTH_{ORG}_TOKEN"
  scope: "NPM_AUTH_{SCOPE}_TOKEN"
  repo:  "NPM_AUTH_TOKEN"