@fourier-labs/harbour-contracts 0.10.0 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/contract-release.json +17 -16
- package/dist/gen-ts/contract-release.d.ts +7 -7
- package/dist/gen-ts/contract-release.js +7 -7
- package/dist/gen-ts/promotion-request.d.ts +2 -2
- package/dist/gen-ts/sanitized-binding-evidence.d.ts +2 -2
- package/fixtures/ai/adversarial-sanitized-binding-relabel.json +6 -2
- package/fixtures/ai/valid-binding-classification-subject.json +5 -1
- package/fixtures/ai/valid-sanitized-binding-evidence-byo-source.json +36 -0
- package/fixtures/ai/valid-sanitized-binding-evidence.json +6 -2
- package/gen-ts/contract-release.ts +7 -7
- package/gen-ts/promotion-request.ts +2 -2
- package/gen-ts/sanitized-binding-evidence.ts +2 -2
- package/package.json +1 -1
- package/schema/promotion-request.schema.json +3 -3
- package/schema/sanitized-binding-evidence.schema.json +2 -2
package/contract-release.json
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema": "harbour.contract-release/1.0",
|
|
3
|
-
"repositoryVersion": "0.
|
|
4
|
-
"publishVersion": "0.
|
|
5
|
-
"publishTag": "v0.
|
|
6
|
-
"schemasDigest": "sha256:
|
|
7
|
-
"aiFixturesDigest": "sha256:
|
|
8
|
-
"generatedGoDigest": "sha256:
|
|
9
|
-
"generatedTypeScriptDigest": "sha256:
|
|
3
|
+
"repositoryVersion": "0.11.0.0",
|
|
4
|
+
"publishVersion": "0.11.0",
|
|
5
|
+
"publishTag": "v0.11.0",
|
|
6
|
+
"schemasDigest": "sha256:76b4a8c59792cf8a986af9c5ec4848a7ec3292c933c9ecb35e73cd96dcddcd57",
|
|
7
|
+
"aiFixturesDigest": "sha256:8bea1c670c5e12d362fa590e4eb33dd0acf03a5e3305a5214f3a718723e9073a",
|
|
8
|
+
"generatedGoDigest": "sha256:7768cee30edf5bad65d76a881d618e14a6759ac481df3f680dc622b627c7d00a",
|
|
9
|
+
"generatedTypeScriptDigest": "sha256:106e9421a0329d355a71ad1a0a4154f05dc600bcb8733b33ae2e763f5b558142",
|
|
10
10
|
"generatedExclusions": {
|
|
11
11
|
"gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
|
|
12
12
|
"gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
|
|
@@ -47,17 +47,17 @@
|
|
|
47
47
|
"schema/error-category.enum.json": "sha256:e215fe3dc254cf7fca6785f3a12aaeee9d28811b6625916630adda1ed5fc1a14",
|
|
48
48
|
"schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
|
|
49
49
|
"schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
|
|
50
|
-
"schema/promotion-request.schema.json": "sha256:
|
|
50
|
+
"schema/promotion-request.schema.json": "sha256:560460b57fc639d248fa657a2a1e3d88d27ab9139faf17ee58633b671f8b5072",
|
|
51
51
|
"schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
|
|
52
|
-
"schema/sanitized-binding-evidence.schema.json": "sha256:
|
|
52
|
+
"schema/sanitized-binding-evidence.schema.json": "sha256:e5ae90ea18950deaefb21c2f05cc28af705cbab447b784dbaf7235b8bcfc9fd6",
|
|
53
53
|
"schema/secret-reference.schema.json": "sha256:966f7a6d2575b46a4b54804d06dc05c6229ebbcbd9200fe6a6c8d3b4ffb90f9f",
|
|
54
54
|
"schema/transform-report.schema.json": "sha256:10ba5faa915b3a9327909b0444a163f8e31f51b9f1b3d049ea341e8cedc521e1",
|
|
55
55
|
"schema/version-state.schema.json": "sha256:e7c4b2e7b615ebb07f36d0df22ded51b2c9688ef9e9bfe79de1d5cd94de9ae40"
|
|
56
56
|
},
|
|
57
57
|
"aiFixtures": {
|
|
58
58
|
"fixtures/ai/adversarial-binding-classification-value.json": "sha256:ca009f3f6162a9d93b4ab416d52c1fba12a8a15aca5aed956c5fdcf2171b1e28",
|
|
59
|
-
"fixtures/ai/adversarial-sanitized-binding-relabel.json": "sha256:
|
|
60
|
-
"fixtures/ai/valid-binding-classification-subject.json": "sha256:
|
|
59
|
+
"fixtures/ai/adversarial-sanitized-binding-relabel.json": "sha256:5deba053e91be027588e0a921bc7fcd75363044587b651b9fbb3f986b3a8bc85",
|
|
60
|
+
"fixtures/ai/valid-binding-classification-subject.json": "sha256:ca40d605f3351d44a4b37b598d033d129861443b65044fc056ca4406f07717c6",
|
|
61
61
|
"fixtures/ai/valid-blocked-trace-event.json": "sha256:c72e753f5ed805d97b47af5cc57ea2fe9034f27b133bf0f5c6565fbc0c6693c1",
|
|
62
62
|
"fixtures/ai/valid-budget-ledger-event.json": "sha256:f56ee5339e549da44be1a30ac9ab08e209ff06749910bedfd66f47ef37c92877",
|
|
63
63
|
"fixtures/ai/valid-classification-stamp.json": "sha256:bf8256cec5626031b4cf5acfe9ffde73100150ba19259c36b274e1be0820bb73",
|
|
@@ -73,7 +73,8 @@
|
|
|
73
73
|
"fixtures/ai/valid-pricing-revision.json": "sha256:ff7bfdccc1fd4173cf0cf0800fb953e60de55286b0bba557fac9c6a4e5984f81",
|
|
74
74
|
"fixtures/ai/valid-runtime-binding.json": "sha256:df971a518b8e680bb5260e801e7a0b03dd05076aeb11258205ec5ec205719f53",
|
|
75
75
|
"fixtures/ai/valid-runtime-contract.json": "sha256:a6af61297f2612679112675e9d401685966e58b891720014e3a5176426850006",
|
|
76
|
-
"fixtures/ai/valid-sanitized-binding-evidence.json": "sha256:
|
|
76
|
+
"fixtures/ai/valid-sanitized-binding-evidence-byo-source.json": "sha256:77f258fdb6cb7232b78a62fc035e293c6d604bed438ca35c54ab398064bc053a",
|
|
77
|
+
"fixtures/ai/valid-sanitized-binding-evidence.json": "sha256:19a4994b9a562305854945643a588f4f7c098db4bc3653da26df6e4284b00190",
|
|
77
78
|
"fixtures/ai/valid-source-revision-digest.json": "sha256:ec32021dbb636de9a1e47d560bfe59c21451e88f67d647387968aba48691409d",
|
|
78
79
|
"fixtures/ai/valid-trace-event-v2.json": "sha256:001bc0bfb64bb2c161e10e49347727887302fba067c7a1ced511f17457867451",
|
|
79
80
|
"fixtures/ai/valid-trace-event.json": "sha256:42451ebfb0dc0c475baf6bc1acc3d1006cc2294df37174764e936519b7d64100",
|
|
@@ -83,14 +84,14 @@
|
|
|
83
84
|
},
|
|
84
85
|
"generatedGo": {
|
|
85
86
|
"gen-go/ai_composite_policy_digest_helper.go": "sha256:31b4d9b4afd965b9869acbd3a58527949402f6711f624f2a4f02b3c6e406f71f",
|
|
86
|
-
"gen-go/ai_contracts_test.go": "sha256:
|
|
87
|
+
"gen-go/ai_contracts_test.go": "sha256:5b5aaa331155958ce21d540e9c77a9ef4ca7d072c4ef6f7d9061add1449a7541",
|
|
87
88
|
"gen-go/ai_gateway_key_token.go": "sha256:859c34383955f21c22589158214df074b74de6907a54bee7c781acfa9dad8679",
|
|
88
89
|
"gen-go/binding_digest_helpers.go": "sha256:50462ba2beb16c7931dfc7e10302c12c90bf8111788991f74f08a718125dfbfb",
|
|
89
90
|
"gen-go/contracts_test.go": "sha256:f15c34da8758ab4f81c4ea3f03382010a1a5a83159dd0dc18abc9c543d77951e",
|
|
90
91
|
"gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
|
|
91
92
|
"gen-go/error_category.go": "sha256:e36745796e32f753cf153a76c5f77c4bdf37a6a228e6607abcf95cac6f4a934b",
|
|
92
93
|
"gen-go/schema_documents.go": "sha256:c0399930c719b93d850847b257186f08d69a527f3ac1286ed0c49b66327b315a",
|
|
93
|
-
"gen-go/types.go": "sha256:
|
|
94
|
+
"gen-go/types.go": "sha256:803fea3111bcd1a76e3b7852e49039f3a1156c8b3b987b79a0d14c28dae39c5a",
|
|
94
95
|
"gen-go/version_state.go": "sha256:827f8768359998409b86ea02d9ba1a149981928bae7161e4dc95fe0520ce7410"
|
|
95
96
|
},
|
|
96
97
|
"generatedTypeScript": {
|
|
@@ -134,10 +135,10 @@
|
|
|
134
135
|
"gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
|
|
135
136
|
"gen-ts/index.ts": "sha256:cf2c63faf3af73a0b4fb7bac7f51f18b4c72d854a78aef8e4c7625dfc96a27f7",
|
|
136
137
|
"gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
|
|
137
|
-
"gen-ts/promotion-request.ts": "sha256:
|
|
138
|
+
"gen-ts/promotion-request.ts": "sha256:d0f08925341c4a36d8b049be95682037cb6ee6daaf589a191f6731af4eca17ae",
|
|
138
139
|
"gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
|
|
139
140
|
"gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
|
|
140
|
-
"gen-ts/sanitized-binding-evidence.ts": "sha256:
|
|
141
|
+
"gen-ts/sanitized-binding-evidence.ts": "sha256:f4b6c31dd9454350da00f443a8a4563e28d21cab6507fbc647cb33118155224c",
|
|
141
142
|
"gen-ts/secret-reference.ts": "sha256:a8b65de72705b6f51f57cd8ca58881483108005b1fa4d19106c3e9cf1fa877e7",
|
|
142
143
|
"gen-ts/transform-report.ts": "sha256:154617c0bc4b8e36d7edd07640454c89fad8ec34b02aa85c904c9acd9855a6c3",
|
|
143
144
|
"gen-ts/version-state-machine.ts": "sha256:4371bc7e2bde86b0447f5242104c576cc160dfd7dae1885acbfb63540f230bdd",
|
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
export declare const ContractRepositoryVersion: "0.
|
|
2
|
-
export declare const ContractPublishVersion: "0.
|
|
3
|
-
export declare const ContractPublishTag: "v0.
|
|
4
|
-
export declare const ContractSchemasDigest: "sha256:
|
|
5
|
-
export declare const ContractAiFixturesDigest: "sha256:
|
|
6
|
-
export declare const ContractGeneratedGoDigest: "sha256:
|
|
7
|
-
export declare const ContractGeneratedTypeScriptDigest: "sha256:
|
|
1
|
+
export declare const ContractRepositoryVersion: "0.11.0.0";
|
|
2
|
+
export declare const ContractPublishVersion: "0.11.0";
|
|
3
|
+
export declare const ContractPublishTag: "v0.11.0";
|
|
4
|
+
export declare const ContractSchemasDigest: "sha256:76b4a8c59792cf8a986af9c5ec4848a7ec3292c933c9ecb35e73cd96dcddcd57";
|
|
5
|
+
export declare const ContractAiFixturesDigest: "sha256:8bea1c670c5e12d362fa590e4eb33dd0acf03a5e3305a5214f3a718723e9073a";
|
|
6
|
+
export declare const ContractGeneratedGoDigest: "sha256:7768cee30edf5bad65d76a881d618e14a6759ac481df3f680dc622b627c7d00a";
|
|
7
|
+
export declare const ContractGeneratedTypeScriptDigest: "sha256:106e9421a0329d355a71ad1a0a4154f05dc600bcb8733b33ae2e763f5b558142";
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
/* eslint-disable */
|
|
2
2
|
// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
|
|
3
|
-
export const ContractRepositoryVersion = "0.
|
|
4
|
-
export const ContractPublishVersion = "0.
|
|
5
|
-
export const ContractPublishTag = "v0.
|
|
6
|
-
export const ContractSchemasDigest = "sha256:
|
|
7
|
-
export const ContractAiFixturesDigest = "sha256:
|
|
8
|
-
export const ContractGeneratedGoDigest = "sha256:
|
|
9
|
-
export const ContractGeneratedTypeScriptDigest = "sha256:
|
|
3
|
+
export const ContractRepositoryVersion = "0.11.0.0";
|
|
4
|
+
export const ContractPublishVersion = "0.11.0";
|
|
5
|
+
export const ContractPublishTag = "v0.11.0";
|
|
6
|
+
export const ContractSchemasDigest = "sha256:76b4a8c59792cf8a986af9c5ec4848a7ec3292c933c9ecb35e73cd96dcddcd57";
|
|
7
|
+
export const ContractAiFixturesDigest = "sha256:8bea1c670c5e12d362fa590e4eb33dd0acf03a5e3305a5214f3a718723e9073a";
|
|
8
|
+
export const ContractGeneratedGoDigest = "sha256:7768cee30edf5bad65d76a881d618e14a6759ac481df3f680dc622b627c7d00a";
|
|
9
|
+
export const ContractGeneratedTypeScriptDigest = "sha256:106e9421a0329d355a71ad1a0a4154f05dc600bcb8733b33ae2e763f5b558142";
|
|
@@ -37,7 +37,7 @@ export interface PromotionRequestEnvironmentBindings {
|
|
|
37
37
|
bindings: PromotionRequestSecretBinding[];
|
|
38
38
|
}
|
|
39
39
|
/**
|
|
40
|
-
* One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only
|
|
40
|
+
* One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only app secrets, app-scoped minted data-source credentials and tenant-scoped source credentials from an approved BYO grant; integration and provider credentials remain unrepresentable.
|
|
41
41
|
*/
|
|
42
42
|
export interface PromotionRequestSecretBinding {
|
|
43
43
|
/**
|
|
@@ -45,7 +45,7 @@ export interface PromotionRequestSecretBinding {
|
|
|
45
45
|
*/
|
|
46
46
|
name: string;
|
|
47
47
|
/**
|
|
48
|
-
* Governance reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it.
|
|
48
|
+
* Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it.
|
|
49
49
|
*/
|
|
50
50
|
secretRef: string;
|
|
51
51
|
}
|
|
@@ -9,13 +9,13 @@ export type SanitizedRuntimeBinding = {
|
|
|
9
9
|
*/
|
|
10
10
|
value?: string;
|
|
11
11
|
/**
|
|
12
|
-
* Value-free app
|
|
12
|
+
* Value-free app secret, app-scoped minted data-source credential, or approved tenant-source credential reference. Integration and provider credential references are outside this contract.
|
|
13
13
|
*/
|
|
14
14
|
secretRef?: string;
|
|
15
15
|
};
|
|
16
16
|
export type SanitizedBindingProviderId = 'openai' | 'anthropic' | 'gemini' | 'openrouter';
|
|
17
17
|
/**
|
|
18
|
-
* Immutable DCP allocation receipt and sanitized runtime-binding set for one exact allocated version and normalized source revision. DCP persists this evidence atomically with version admission before publish or provisioning. classificationDigest chains to the caller's pre-allocation BindingClassificationSubject; bindings contain only approved configuration or
|
|
18
|
+
* Immutable DCP allocation receipt and sanitized runtime-binding set for one exact allocated version and normalized source revision. DCP persists this evidence atomically with version admission before publish or provisioning. classificationDigest chains to the caller's pre-allocation BindingClassificationSubject; bindings contain only approved configuration, app secrets or approved data-source credential references and never an AI-mapping-owned provider credential.
|
|
19
19
|
*/
|
|
20
20
|
export interface SanitizedBindingEvidence {
|
|
21
21
|
schema: 'harbour.sanitized-binding-evidence/1.0';
|
|
@@ -7,8 +7,12 @@
|
|
|
7
7
|
"sourceRef": "https://github.com/Fourier-Labs-AI/support-copilot",
|
|
8
8
|
"sourceRevision": "git-sha1:0123456789abcdef0123456789abcdef01234567",
|
|
9
9
|
"sourceRevisionDigest": "sha256:79520355eb30e88bb0c6656008dd301d8f3d7cef6c14a96882557f13f7c512d9",
|
|
10
|
-
"classificationDigest": "sha256:
|
|
10
|
+
"classificationDigest": "sha256:7964fa768ff21ffa49336ee7a205efd6fdb72b6a888e165e1facbff24dfd8b24",
|
|
11
11
|
"bindings": {
|
|
12
|
+
"DATABASE_URL": {
|
|
13
|
+
"kind": "secret",
|
|
14
|
+
"secretRef": "secretref://tenant/fourier/app/support-copilot/source/warehouse"
|
|
15
|
+
},
|
|
12
16
|
"LOG_LEVEL": {
|
|
13
17
|
"kind": "configuration",
|
|
14
18
|
"value": "debug"
|
|
@@ -28,5 +32,5 @@
|
|
|
28
32
|
"providerId": "openai"
|
|
29
33
|
}
|
|
30
34
|
},
|
|
31
|
-
"sanitizedBindingDigest": "sha256:
|
|
35
|
+
"sanitizedBindingDigest": "sha256:c5e6463a88949e6693a2c398a27e4eb48434654d9136f9a8c589d244102ec600"
|
|
32
36
|
}
|
|
@@ -16,6 +16,10 @@
|
|
|
16
16
|
"category": "api_key",
|
|
17
17
|
"requestedAiMappingId": "anthropic-messages-v1"
|
|
18
18
|
},
|
|
19
|
+
"DATABASE_URL": {
|
|
20
|
+
"kind": "secret",
|
|
21
|
+
"confidence": "high"
|
|
22
|
+
},
|
|
19
23
|
"LOG_LEVEL": {
|
|
20
24
|
"kind": "configuration",
|
|
21
25
|
"confidence": "high"
|
|
@@ -42,5 +46,5 @@
|
|
|
42
46
|
"providerId": "openai"
|
|
43
47
|
}
|
|
44
48
|
},
|
|
45
|
-
"classificationDigest": "sha256:
|
|
49
|
+
"classificationDigest": "sha256:7964fa768ff21ffa49336ee7a205efd6fdb72b6a888e165e1facbff24dfd8b24"
|
|
46
50
|
}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
{
|
|
2
|
+
"schema": "harbour.sanitized-binding-evidence/1.0",
|
|
3
|
+
"tenantId": "fourier",
|
|
4
|
+
"appId": "support-copilot",
|
|
5
|
+
"environment": "preview",
|
|
6
|
+
"versionId": "fourier#support-copilot#preview#123456",
|
|
7
|
+
"sourceRef": "https://github.com/Fourier-Labs-AI/support-copilot",
|
|
8
|
+
"sourceRevision": "git-sha1:0123456789abcdef0123456789abcdef01234567",
|
|
9
|
+
"sourceRevisionDigest": "sha256:79520355eb30e88bb0c6656008dd301d8f3d7cef6c14a96882557f13f7c512d9",
|
|
10
|
+
"classificationDigest": "sha256:7964fa768ff21ffa49336ee7a205efd6fdb72b6a888e165e1facbff24dfd8b24",
|
|
11
|
+
"bindings": {
|
|
12
|
+
"DATABASE_URL": {
|
|
13
|
+
"kind": "secret",
|
|
14
|
+
"secretRef": "secretref://tenant/fourier/source/warehouse"
|
|
15
|
+
},
|
|
16
|
+
"LOG_LEVEL": {
|
|
17
|
+
"kind": "configuration",
|
|
18
|
+
"value": "debug"
|
|
19
|
+
},
|
|
20
|
+
"STRIPE_API_KEY": {
|
|
21
|
+
"kind": "secret",
|
|
22
|
+
"secretRef": "secretref://tenant/fourier/app/support-copilot/secret/STRIPE_API_KEY"
|
|
23
|
+
}
|
|
24
|
+
},
|
|
25
|
+
"requiredAiMappings": {
|
|
26
|
+
"anthropic-messages-v1": {
|
|
27
|
+
"mappingVersion": "1.0.0",
|
|
28
|
+
"providerId": "anthropic"
|
|
29
|
+
},
|
|
30
|
+
"openai-responses-v1": {
|
|
31
|
+
"mappingVersion": "1.0.0",
|
|
32
|
+
"providerId": "openai"
|
|
33
|
+
}
|
|
34
|
+
},
|
|
35
|
+
"sanitizedBindingDigest": "sha256:181ecf7a3bab337755da186c04a3d5dcacb47efb8a01559f53242a3c66132aa5"
|
|
36
|
+
}
|
|
@@ -7,8 +7,12 @@
|
|
|
7
7
|
"sourceRef": "https://github.com/Fourier-Labs-AI/support-copilot",
|
|
8
8
|
"sourceRevision": "git-sha1:0123456789abcdef0123456789abcdef01234567",
|
|
9
9
|
"sourceRevisionDigest": "sha256:79520355eb30e88bb0c6656008dd301d8f3d7cef6c14a96882557f13f7c512d9",
|
|
10
|
-
"classificationDigest": "sha256:
|
|
10
|
+
"classificationDigest": "sha256:7964fa768ff21ffa49336ee7a205efd6fdb72b6a888e165e1facbff24dfd8b24",
|
|
11
11
|
"bindings": {
|
|
12
|
+
"DATABASE_URL": {
|
|
13
|
+
"kind": "secret",
|
|
14
|
+
"secretRef": "secretref://tenant/fourier/app/support-copilot/source/warehouse"
|
|
15
|
+
},
|
|
12
16
|
"LOG_LEVEL": {
|
|
13
17
|
"kind": "configuration",
|
|
14
18
|
"value": "debug"
|
|
@@ -28,5 +32,5 @@
|
|
|
28
32
|
"providerId": "openai"
|
|
29
33
|
}
|
|
30
34
|
},
|
|
31
|
-
"sanitizedBindingDigest": "sha256:
|
|
35
|
+
"sanitizedBindingDigest": "sha256:c5e6463a88949e6693a2c398a27e4eb48434654d9136f9a8c589d244102ec600"
|
|
32
36
|
}
|
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
/* eslint-disable */
|
|
2
2
|
// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
|
|
3
3
|
|
|
4
|
-
export const ContractRepositoryVersion = "0.
|
|
5
|
-
export const ContractPublishVersion = "0.
|
|
6
|
-
export const ContractPublishTag = "v0.
|
|
7
|
-
export const ContractSchemasDigest = "sha256:
|
|
8
|
-
export const ContractAiFixturesDigest = "sha256:
|
|
9
|
-
export const ContractGeneratedGoDigest = "sha256:
|
|
10
|
-
export const ContractGeneratedTypeScriptDigest = "sha256:
|
|
4
|
+
export const ContractRepositoryVersion = "0.11.0.0" as const;
|
|
5
|
+
export const ContractPublishVersion = "0.11.0" as const;
|
|
6
|
+
export const ContractPublishTag = "v0.11.0" as const;
|
|
7
|
+
export const ContractSchemasDigest = "sha256:76b4a8c59792cf8a986af9c5ec4848a7ec3292c933c9ecb35e73cd96dcddcd57" as const;
|
|
8
|
+
export const ContractAiFixturesDigest = "sha256:8bea1c670c5e12d362fa590e4eb33dd0acf03a5e3305a5214f3a718723e9073a" as const;
|
|
9
|
+
export const ContractGeneratedGoDigest = "sha256:7768cee30edf5bad65d76a881d618e14a6759ac481df3f680dc622b627c7d00a" as const;
|
|
10
|
+
export const ContractGeneratedTypeScriptDigest = "sha256:106e9421a0329d355a71ad1a0a4154f05dc600bcb8733b33ae2e763f5b558142" as const;
|
|
@@ -41,7 +41,7 @@ export interface PromotionRequestEnvironmentBindings {
|
|
|
41
41
|
bindings: PromotionRequestSecretBinding[];
|
|
42
42
|
}
|
|
43
43
|
/**
|
|
44
|
-
* One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only
|
|
44
|
+
* One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only app secrets, app-scoped minted data-source credentials and tenant-scoped source credentials from an approved BYO grant; integration and provider credentials remain unrepresentable.
|
|
45
45
|
*/
|
|
46
46
|
export interface PromotionRequestSecretBinding {
|
|
47
47
|
/**
|
|
@@ -49,7 +49,7 @@ export interface PromotionRequestSecretBinding {
|
|
|
49
49
|
*/
|
|
50
50
|
name: string;
|
|
51
51
|
/**
|
|
52
|
-
* Governance reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it.
|
|
52
|
+
* Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it.
|
|
53
53
|
*/
|
|
54
54
|
secretRef: string;
|
|
55
55
|
}
|
|
@@ -12,14 +12,14 @@ export type SanitizedRuntimeBinding = {
|
|
|
12
12
|
*/
|
|
13
13
|
value?: string;
|
|
14
14
|
/**
|
|
15
|
-
* Value-free app
|
|
15
|
+
* Value-free app secret, app-scoped minted data-source credential, or approved tenant-source credential reference. Integration and provider credential references are outside this contract.
|
|
16
16
|
*/
|
|
17
17
|
secretRef?: string;
|
|
18
18
|
};
|
|
19
19
|
export type SanitizedBindingProviderId = 'openai' | 'anthropic' | 'gemini' | 'openrouter';
|
|
20
20
|
|
|
21
21
|
/**
|
|
22
|
-
* Immutable DCP allocation receipt and sanitized runtime-binding set for one exact allocated version and normalized source revision. DCP persists this evidence atomically with version admission before publish or provisioning. classificationDigest chains to the caller's pre-allocation BindingClassificationSubject; bindings contain only approved configuration or
|
|
22
|
+
* Immutable DCP allocation receipt and sanitized runtime-binding set for one exact allocated version and normalized source revision. DCP persists this evidence atomically with version admission before publish or provisioning. classificationDigest chains to the caller's pre-allocation BindingClassificationSubject; bindings contain only approved configuration, app secrets or approved data-source credential references and never an AI-mapping-owned provider credential.
|
|
23
23
|
*/
|
|
24
24
|
export interface SanitizedBindingEvidence {
|
|
25
25
|
schema: 'harbour.sanitized-binding-evidence/1.0';
|
package/package.json
CHANGED
|
@@ -58,11 +58,11 @@
|
|
|
58
58
|
},
|
|
59
59
|
"secretRef": {
|
|
60
60
|
"type": "string",
|
|
61
|
-
"pattern": "^secretref://tenant/[A-Za-z0-9._-]+/app/[A-Za-z0-9._-]+/secret/[A-Z][A-Z0-9_]{0,127}$",
|
|
62
|
-
"description": "Governance reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it."
|
|
61
|
+
"pattern": "^secretref://tenant/[A-Za-z0-9._-]+/(?:app/[A-Za-z0-9._-]+/(?:secret/[A-Z][A-Z0-9_]{0,127}|source/[a-z0-9][a-z0-9._-]{0,63})|source/[a-z0-9][a-z0-9._-]{0,63})$",
|
|
62
|
+
"description": "Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it."
|
|
63
63
|
}
|
|
64
64
|
},
|
|
65
|
-
"description": "One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only
|
|
65
|
+
"description": "One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only app secrets, app-scoped minted data-source credentials and tenant-scoped source credentials from an approved BYO grant; integration and provider credentials remain unrepresentable."
|
|
66
66
|
}
|
|
67
67
|
}
|
|
68
68
|
}
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
3
|
"$id": "https://schemas.harbour.dev/sanitized-binding-evidence.schema.json",
|
|
4
4
|
"title": "SanitizedBindingEvidence",
|
|
5
|
-
"description": "Immutable DCP allocation receipt and sanitized runtime-binding set for one exact allocated version and normalized source revision. DCP persists this evidence atomically with version admission before publish or provisioning. classificationDigest chains to the caller's pre-allocation BindingClassificationSubject; bindings contain only approved configuration or
|
|
5
|
+
"description": "Immutable DCP allocation receipt and sanitized runtime-binding set for one exact allocated version and normalized source revision. DCP persists this evidence atomically with version admission before publish or provisioning. classificationDigest chains to the caller's pre-allocation BindingClassificationSubject; bindings contain only approved configuration, app secrets or approved data-source credential references and never an AI-mapping-owned provider credential.",
|
|
6
6
|
"type": "object",
|
|
7
7
|
"additionalProperties": false,
|
|
8
8
|
"required": ["schema", "tenantId", "appId", "environment", "versionId", "sourceRef", "sourceRevision", "sourceRevisionDigest", "classificationDigest", "bindings", "requiredAiMappings", "sanitizedBindingDigest"],
|
|
@@ -80,7 +80,7 @@
|
|
|
80
80
|
"properties": {
|
|
81
81
|
"kind": { "type": "string", "enum": ["configuration", "secret"] },
|
|
82
82
|
"value": { "type": "string", "minLength": 1, "maxLength": 4096, "description": "Approved non-secret configuration literal. Provider-credential values are never approved or persisted here." },
|
|
83
|
-
"secretRef": { "type": "string", "pattern": "^secretref://tenant/[A-Za-z0-9._-]+/app/[A-Za-z0-9._-]+/secret/[A-Z][A-Z0-9_]{0,127}$", "description": "Value-free app
|
|
83
|
+
"secretRef": { "type": "string", "pattern": "^secretref://tenant/[A-Za-z0-9._-]+/(?:app/[A-Za-z0-9._-]+/(?:secret/[A-Z][A-Z0-9_]{0,127}|source/[a-z0-9][a-z0-9._-]{0,63})|source/[a-z0-9][a-z0-9._-]{0,63})$", "description": "Value-free app secret, app-scoped minted data-source credential, or approved tenant-source credential reference. Integration and provider credential references are outside this contract." }
|
|
84
84
|
},
|
|
85
85
|
"allOf": [
|
|
86
86
|
{
|