@fourier-labs/harbour-contracts 0.19.0 → 0.22.0

package/contract-release.json

@@ -1,19 +1,19 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.19.0.0",
-  "publishVersion": "0.19.0",
-  "publishTag": "v0.19.0",
-  "schemasDigest": "sha256:3263c4ee323353316aeecc8741ce8dc7a740652a73e35587123fbf2330926b28",
+  "repositoryVersion": "0.22.0.0",
+  "publishVersion": "0.22.0",
+  "publishTag": "v0.22.0",
+  "schemasDigest": "sha256:2b762d34e5f5549a90b78f304a47f98b6165cf938a2ca776b1c055db8f04fce1",
   "aiFixturesDigest": "sha256:5d68828a1364dc63cafbb3c2d3f5c5f6c232d5333e7668a9c79e7652e5144b42",
-  "generatedGoDigest": "sha256:ef74356afbc6a36a543f6f6fe572b77dc3691ce2201f0654644d2a7f29a4ced4",
-  "generatedTypeScriptDigest": "sha256:6bb6b13ea4722e3ec9e9d91c672461ec24b29076aeae0b14b62380cced658e92",
+  "generatedGoDigest": "sha256:0541904aad85c418a20de003bef68a42c8876d6cf8fe9f165472a5e77f81e045",
+  "generatedTypeScriptDigest": "sha256:bbbba7c14c480030e9a44b94a746a0978efe7f008788817d31e137007bf89c38",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
   },
   "schemas": {
     "schema/ai-budget-ledger-event.schema.json": "sha256:92770bc5358e03a3aae6cd261dad02dfcbbb06a6203566da2c6c7a5e63dd671c",
-    "schema/ai-callsite-inventory.schema.json": "sha256:b15899a97cf108e4cd1bfd31ec40c57b341590ddb9c118fdaa904215dbe01859",
+    "schema/ai-callsite-inventory.schema.json": "sha256:dda9251352a1c28e95927f75e5ed4d78cf863806bdac29238de03f79c7229082",
     "schema/ai-classification-stamp.schema.json": "sha256:ad7f01dc8bb9a1cd619fce470227914aa3ef2ad57d34bfeaa0c6ef753aa6781d",
     "schema/ai-composite-policy-digest.schema.json": "sha256:3efccc249327e59f67a37fd954b524ee727a3e28a3c557a46d6ec1f15d69b34e",
     "schema/ai-deployment-gate-decision.schema.json": "sha256:bae1bdf91777b9a78f8da5a29f06b5de7f1e235789cf16b1bb507e85ad0243ff",
@@ -21,22 +21,22 @@
     "schema/ai-gateway-key-lookup.schema.json": "sha256:e994d4782c9bc4f14d3a1c35c9ac1e7a5ec84284cde5b3af7e3e6022130ddbb3",
     "schema/ai-governance-decision.schema.json": "sha256:fab63e1b869b0e821efe9c27ee63f87fc7023a01d99bc810bad12049b968b788",
     "schema/ai-metering-policy.schema.json": "sha256:044115938d254d914feac162219d20ee48f741cd7ad32df4613b45f9c862fe8c",
-    "schema/ai-policy-snapshot.schema.json": "sha256:bf0d0c834285ac942f4c0cb09a33549a06045a034be18b5ffbaa9120e961422e",
-    "schema/ai-pricing-revision.schema.json": "sha256:ff6b2115e98e278fd425164887f41911e3f0345e008ebc988a5f00b93c1c99ee",
+    "schema/ai-policy-snapshot.schema.json": "sha256:a866146c953a0577680ff12ec7baff04ddca687783661feaa65f52415b21bce2",
+    "schema/ai-pricing-revision.schema.json": "sha256:5ddb40c23712c0cec37b733678e4bb34811f5db44a233773c21a7dfaec188375",
     "schema/ai-runtime-binding.schema.json": "sha256:e86cac2f70a474997bdef1577ca15f22982ec0ce866921df3f763c4d7f7fa191",
-    "schema/ai-runtime-contract.schema.json": "sha256:a9c8b1329193c1eac7887e9ad6b442d127968fc9de78dcdc18289d8901f091bd",
+    "schema/ai-runtime-contract.schema.json": "sha256:338fbf576d67934592648aff9a9c8ae05a54993e8080c90172b00f346a15db02",
     "schema/ai-trace-event-v2.schema.json": "sha256:b479199bb6e44ea23a1da53f69943cb8f3886c433914fdb9bf9e9bdbc3dd767d",
-    "schema/ai-trace-event.schema.json": "sha256:994f8e350e3f2c3f857a198cdc1ee45d68c6b8f9265af74f17e70957b5e12f48",
+    "schema/ai-trace-event.schema.json": "sha256:313af995b72dd19d3d33997ba2d270bd163ce3752000fd7d8a6c18bff137af32",
     "schema/ai-transform-event.schema.json": "sha256:b845762e653b19afdaf959f7bd1624db490cd10c760daa9aaa61fb83f2a86b6e",
     "schema/ai-transform-result.schema.json": "sha256:244e380a36957ab2dcb526ea22aaecb56b53664ce1fda6934d0021c084c99133",
     "schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
     "schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
-    "schema/artifact-contract.schema.json": "sha256:f4d14d71ed754c9c8c2b03babd4666ace7d94dd4851ee548227bf1235404a814",
-    "schema/binding-classification-subject.schema.json": "sha256:fd038b42c6d85c50f7fced159690f820f59aee7a1e96efd8abd0250653cabe46",
+    "schema/artifact-contract.schema.json": "sha256:4415be59f669bf660f54ab32da68f3b7d95fef567c968501e2eb6afb53bad048",
+    "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/data-dependency.schema.json": "sha256:89ba8481ccabc935e7dab5d13871c985839a751ad1586710d8382a15e1f3340c",
     "schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
     "schema/data-source.schema.json": "sha256:5a809171cc97f5778ca37db300d454098ce1c2d9071d2380550707b049899a75",
-    "schema/deploy-request.schema.json": "sha256:84274acd7629a20a074a69a32152a53f273d91122e46ec3157a9fd0623cf8068",
+    "schema/deploy-request.schema.json": "sha256:2018aa710a46bc694e0ceb628028faea6c31223f9d9b8d2db66809814f63ea8d",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
     "schema/deployment-environment.schema.json": "sha256:3f1325d5579b3fc47d02c83b6ac0657108909b1dfb901f68203c9c8b668c2ef4",
     "schema/deployment-source.schema.json": "sha256:256988b1efbfc90bd0e1ae31a2c5d69b20ef1e4471dc24c9f9aa759278270fbe",
@@ -49,9 +49,9 @@
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
     "schema/promotion-request.schema.json": "sha256:560460b57fc639d248fa657a2a1e3d88d27ab9139faf17ee58633b671f8b5072",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
-    "schema/sanitized-binding-evidence.schema.json": "sha256:e05bb19a3be0463af038501a31c65981f58bc6aa86b93a487cdb119a05ce6ac0",
+    "schema/sanitized-binding-evidence.schema.json": "sha256:b03bcc1911c99c69fda50eb656fc3e115f88fe2990c1708fbb5cd3542f4b8bba",
     "schema/secret-reference.schema.json": "sha256:966f7a6d2575b46a4b54804d06dc05c6229ebbcbd9200fe6a6c8d3b4ffb90f9f",
-    "schema/transform-report.schema.json": "sha256:10ba5faa915b3a9327909b0444a163f8e31f51b9f1b3d049ea341e8cedc521e1",
+    "schema/transform-report.schema.json": "sha256:afbcb940d8e6cb32fd6199c03236bc1717d4ad6adb2e334f3e54d436d5349778",
     "schema/version-state.schema.json": "sha256:e7c4b2e7b615ebb07f36d0df22ded51b2c9688ef9e9bfe79de1d5cd94de9ae40"
   },
   "aiFixtures": {
@@ -90,13 +90,13 @@
     "gen-go/contracts_test.go": "sha256:105f72ed711a34778d875b5a957bae3d8afbe67ed006e4809b8031b4cc303ec0",
     "gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
     "gen-go/error_category.go": "sha256:e36745796e32f753cf153a76c5f77c4bdf37a6a228e6607abcf95cac6f4a934b",
-    "gen-go/schema_documents.go": "sha256:c0399930c719b93d850847b257186f08d69a527f3ac1286ed0c49b66327b315a",
-    "gen-go/types.go": "sha256:548bfbd495c67cfa041efc5554fad6a5b88afa7db7f4636787364fdebe60d321",
+    "gen-go/schema_documents.go": "sha256:e4b7d0b819a6b9e4b4c37be14caad4586bab3a7cbfd6b716d072635295295fc2",
+    "gen-go/types.go": "sha256:63aa621cecfe32867c6fab014ce68e11d2c98ff76d4c96c04ba72b0e197ef0c0",
     "gen-go/version_state.go": "sha256:827f8768359998409b86ea02d9ba1a149981928bae7161e4dc95fe0520ce7410"
   },
   "generatedTypeScript": {
     "gen-ts/ai-budget-ledger-event.ts": "sha256:64448d98a394e6eb103927cd35ce8a33e30176c0d5ee5afcdd8444f8aa051809",
-    "gen-ts/ai-callsite-inventory.ts": "sha256:2665ffe965056b85a7f03db22071d56ce6d21d306a82a876908d0727ef2315dc",
+    "gen-ts/ai-callsite-inventory.ts": "sha256:350a1aca0e60f678a780d02c21d5a8dad13e1442662bb9f66aceb6b76a24f87e",
     "gen-ts/ai-classification-stamp.ts": "sha256:dce78efba03df86a0986a16fd54c52066d322ff515d2463dbc45cafad82ecb44",
     "gen-ts/ai-composite-policy-digest-helper.ts": "sha256:d6c51d0c35599ee4f81d605b71773f4fff41a0bb46499ff0c6185072fedf53ce",
     "gen-ts/ai-composite-policy-digest.ts": "sha256:26b72227ca511d744c0f27fa0c85eb1ba6451ee380e38371e58a810898cfae96",
@@ -106,23 +106,23 @@
     "gen-ts/ai-gateway-key-token.ts": "sha256:ff6551ad3332cc665878d7ec93f42ce185c375e637531b2fbc82c697b877e784",
     "gen-ts/ai-governance-decision.ts": "sha256:cd9f24d6381cffe73f08532cf556eaa9ecb815b23218f7ac504f3bc26e686b2b",
     "gen-ts/ai-metering-policy.ts": "sha256:dd261d57646a509cd46efaefac4aad58d018c7f7da98326dd8859e4ce951c56a",
-    "gen-ts/ai-policy-snapshot.ts": "sha256:8e9dcc01ba3121f0c834d7d953b4115503f312d21bd1fdde6685322a1e7e9c8e",
-    "gen-ts/ai-pricing-revision.ts": "sha256:5a6743db7a782cc87e2087aaa245e8083bc54f5a6275d280b65214328aaa8ac6",
+    "gen-ts/ai-policy-snapshot.ts": "sha256:20e7a5d01d0ff0c00229357db1f15443f3ee876c9d8a6e570b83889846e6cdd9",
+    "gen-ts/ai-pricing-revision.ts": "sha256:48afdea7fb09b9a392147a0a62bcee013157a9d536c07e0782ef28781a3000de",
     "gen-ts/ai-runtime-binding.ts": "sha256:176c830d400ce44c508f8d249bb3c9724b2d595b78262615487cdafc4790263e",
-    "gen-ts/ai-runtime-contract.ts": "sha256:8c4b9c071dfe33df30d9861953d9ee88ea509a7fc6eadc1c804f3cdcc5614d18",
+    "gen-ts/ai-runtime-contract.ts": "sha256:f34533728dfcf7ce8d2e959b55379650f317a06e29e316caf86e131667891ddc",
     "gen-ts/ai-trace-event-v2.ts": "sha256:8c994355f290864da1cf42850c3eceb0e4a1567b45ed989de865213430d3ce0e",
-    "gen-ts/ai-trace-event.ts": "sha256:0711e3eb45510013e9a947209c3e1a2ca969124ad4df65a86b93853e1b9cbae2",
+    "gen-ts/ai-trace-event.ts": "sha256:657b144e6bc258c465850130a299c0f6d13fd2d0c2920c6667fc4eea39df77c4",
     "gen-ts/ai-transform-event.ts": "sha256:c8b520e01ce12b0e3a5ebe03a3ca63cc83368f26e1eef933de732c4fc1c504f9",
     "gen-ts/ai-transform-result.ts": "sha256:208c66b2aeb425c0cbcc18b7191f6e8989443f2b2c1690648e0e06cc1448ce25",
     "gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
     "gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
-    "gen-ts/artifact-contract.ts": "sha256:2c1b3986e3561553c53db1a6f406924e7bb22205dce969d8aecaa238707a2072",
+    "gen-ts/artifact-contract.ts": "sha256:b9c91d0582993cf1208448f6502cc63a813b17d0aab3d2d4f4ec8bda1d607d37",
     "gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
-    "gen-ts/binding-classification-subject.ts": "sha256:4c734cc3152384800178fa29cb7f0f538dcfdb51d9d00238df773ab7ac216811",
+    "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
     "gen-ts/data-dependency.ts": "sha256:0572c31d7ae9088eccc104eee1a205bf176d1d6dacfaf0f290d666024e284966",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
     "gen-ts/data-source.ts": "sha256:71be83b050468c2ea8c5830d28f1837c2b5929d23b4fdf6661bc5bfe8999904c",
-    "gen-ts/deploy-request.ts": "sha256:fce5ee4c71687d785723c3b7bb09ffb9b44f7139a639214f70af911fb77e1926",
+    "gen-ts/deploy-request.ts": "sha256:4d4c28a97249089712449b9632dcfef9217cd35200fec59c10afcaa17e178a9b",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
     "gen-ts/deployment-environment.ts": "sha256:bbd6eec3a1631b13a8de6e6b95081696f7be01d0bd2bf1b7a9e3a1db809a727c",
     "gen-ts/deployment-source.ts": "sha256:8ccb55aaa7260eb6d19a00987d6a20a4b514e343564da13f27cd7fee8013500a",
@@ -135,12 +135,12 @@
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
     "gen-ts/index.ts": "sha256:cf2c63faf3af73a0b4fb7bac7f51f18b4c72d854a78aef8e4c7625dfc96a27f7",
     "gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
-    "gen-ts/promotion-request.ts": "sha256:344081ff99add085787be73449eafa3c99e2740a985d8c0dd2cf69b38a35d501",
+    "gen-ts/promotion-request.ts": "sha256:6ef4612172202bca918a6260d40f2a1a8739845c6c0f747dd1ce5e520e081011",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
-    "gen-ts/sanitized-binding-evidence.ts": "sha256:8e796ee8be8a52470e7d4fc0276838edb6bff3a1ded41ad24859e68dd5c0e6f1",
+    "gen-ts/sanitized-binding-evidence.ts": "sha256:4db7e9ed83f563a46e337815a55bbd6433864c41d9ec8e8a80810a16e3095ebb",
     "gen-ts/secret-reference.ts": "sha256:a8b65de72705b6f51f57cd8ca58881483108005b1fa4d19106c3e9cf1fa877e7",
-    "gen-ts/transform-report.ts": "sha256:154617c0bc4b8e36d7edd07640454c89fad8ec34b02aa85c904c9acd9855a6c3",
+    "gen-ts/transform-report.ts": "sha256:407d7cf1ddf78868c14d91cad10d8df17d61d973a923c613d2bb094af20dbfeb",
     "gen-ts/version-state-machine.ts": "sha256:4371bc7e2bde86b0447f5242104c576cc160dfd7dae1885acbfb63540f230bdd",
     "gen-ts/version-state.ts": "sha256:a835112930299e7b593a1b8810b7414f6c9e809da2092306c743128170a3b702"
   }

package/dist/gen-ts/ai-callsite-inventory.d.ts

@@ -29,7 +29,7 @@ export interface AiInventoryCallsite {
     sourceFileSha256: AiInventoryDigest;
     line: number;
     language: 'javascript' | 'typescript' | 'python' | 'go' | 'unknown';
-    sdk: 'openai' | 'openai-compatible' | 'anthropic' | 'google-genai' | 'mistral' | 'bedrock' | 'cohere' | 'ollama' | 'legacy-gemini' | 'direct-provider-rest' | 'unknown';
+    sdk: 'openai' | 'openai-compatible' | 'anthropic' | 'google-genai' | 'mistral' | 'bedrock' | 'cohere' | 'ollama' | 'legacy-gemini' | 'direct-provider-rest' | 'deepgram' | 'unknown';
     method: string;
     requestedModel?: string;
     strategy: 'deployment_injection' | 'deterministic_adapter' | 'unsupported';

package/dist/gen-ts/ai-policy-snapshot.d.ts

@@ -89,7 +89,7 @@ export interface AiPolicyClassificationMinimum {
 }
 export interface AiPolicyProvider {
     id: AiPolicyIdentifier;
-    provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram';
+    provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram' | 'higgsfield';
     baseUrl?: string;
     credentialSecretRef: string;
     enabled: boolean;

package/dist/gen-ts/ai-pricing-revision.d.ts

@@ -6,7 +6,7 @@ export type AiPricingDigest = string;
 export interface AiPricingRevision {
     schema: 'harbour.ai-pricing-revision/2.0';
     revisionId: AiPricingIdentifier;
-    provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram';
+    provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram' | 'higgsfield';
     providerModel: string;
     region?: AiPricingIdentifier;
     currency: 'USD';

package/dist/gen-ts/ai-runtime-contract.d.ts

@@ -29,6 +29,13 @@ export interface AiRuntimeContract {
         realtime?: AiRuntimeModelAlias;
     };
     policyDigest: AiRuntimeDigest;
+    /**
+     * Optional value-free descriptors for reviewed non-standard client environment boundaries. Mapping IDs are unique within a contract.
+     *
+     * @minItems 1
+     * @maxItems 16
+     */
+    configurationMappings?: AiConfigurationMappingDescriptor[];
     runtimeBinding?: AiRuntimeContractBinding;
     /**
      * @minItems 1
@@ -36,6 +43,17 @@ export interface AiRuntimeContract {
      */
     requiredStrategies: ('deployment_injection' | 'deterministic_adapter')[];
 }
+/**
+ * Value-free descriptor for one registered OpenAI-compatible client environment boundary. Secret values are never part of this descriptor.
+ */
+export interface AiConfigurationMappingDescriptor {
+    mappingId: string;
+    version: string;
+    protocol: 'openai-chat';
+    providerId: string;
+    apiKeyEnvironmentName: string;
+    baseUrlEnvironmentName: string;
+}
 /**
  * Optional additive platform-neutral binding. Existing 1.0 records without it remain valid.
  */
@@ -46,3 +64,5 @@ export interface AiRuntimeContractBinding {
     secretRef: AiRuntimeContractSafeReference;
     runtimeBindingDigest: AiRuntimeDigest;
 }
+/** True iff configurationMappings contains no repeated mappingId values. */
+export declare function hasUniqueAiRuntimeContractConfigurationMappings(input: AiRuntimeContract): boolean;

package/dist/gen-ts/ai-runtime-contract.js

@@ -1,3 +1,13 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export {};
+/** True iff configurationMappings contains no repeated mappingId values. */
+export function hasUniqueAiRuntimeContractConfigurationMappings(input) {
+    const seen = new Set();
+    for (const item of input.configurationMappings ?? []) {
+        const value = item.mappingId;
+        if (seen.has(value))
+            return false;
+        seen.add(value);
+    }
+    return true;
+}

package/dist/gen-ts/ai-trace-event.d.ts

@@ -14,7 +14,7 @@ export type AiTraceEvent = {
     routeRevision?: string;
     requestedModel?: string;
     governedModelAlias?: string;
-    provider?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram';
+    provider?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram' | 'higgsfield';
     providerModel?: string;
     outcome: 'succeeded' | 'blocked' | 'failed' | 'cancelled';
     usage?: AiTraceUsage;
@@ -42,7 +42,7 @@ export type AiTraceIdentifier = string;
 export type AiTraceDigest = string;
 export type AiTraceAttempt = {
     attempt: number;
-    provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram';
+    provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram' | 'higgsfield';
     providerModel: string;
     priceRevision: AiTraceIdentifier;
     outcome: 'succeeded' | 'failed' | 'timed_out' | 'cancelled';

package/dist/gen-ts/artifact-contract.d.ts

@@ -17,6 +17,10 @@ export interface ArtifactContract {
         ref: string;
         entrypoint: string;
         runtime: string;
+        /**
+         * Optional reviewed runtime features selected for the standard application image. Unknown and duplicate features are rejected.
+         */
+        runtime_features?: 'chromium'[];
     };
     static: {
         /**
@@ -68,6 +72,31 @@ export interface ArtifactContract {
      * MVP emits an empty array.
      */
     scheduled_tasks: {}[];
+    /**
+     * Optional bounded runtime profile and background-job mode for the application workload. Omitted resource_profile uses the standard profile and omitted background_jobs uses none.
+     */
+    workload?: {
+        /**
+         * Reviewed CPU/memory profile selected for the application container.
+         */
+        resource_profile?: 'standard' | 'memory-1g';
+        /**
+         * Background-job execution mode. The sqs mode enables the governed application job queue and queue-aware scale-to-zero.
+         */
+        background_jobs?: 'none' | 'sqs';
+    };
+    /**
+     * Optional method/path authentication policy compiled by the transformation. The default is SSO; listed routes preserve the application's own token, signature, or callback authorization.
+     */
+    route_auth?: {
+        version: 1;
+        default: 'sso_required';
+        rules: {
+            path: string;
+            methods: ('GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS')[];
+            mode: 'application_authorized';
+        }[];
+    };
     transform_report: {
         /**
          * Transformed surfaces, e.g. ["secrets","storage.sql"].

package/dist/gen-ts/binding-classification-subject.d.ts

@@ -15,7 +15,7 @@ export type BindingClassificationEntry = {
     category?: BindingClassificationCredentialCategory;
     requestedAiMappingId?: BindingClassificationIdentifier;
 };
-export type BindingClassificationProviderId = 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+export type BindingClassificationProviderId = 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
 /**
  * Closed current credential category. Add a reviewed contract version before supporting another credential mechanism.
  */

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.19.0.0";
-export declare const ContractPublishVersion: "0.19.0";
-export declare const ContractPublishTag: "v0.19.0";
-export declare const ContractSchemasDigest: "sha256:3263c4ee323353316aeecc8741ce8dc7a740652a73e35587123fbf2330926b28";
+export declare const ContractRepositoryVersion: "0.22.0.0";
+export declare const ContractPublishVersion: "0.22.0";
+export declare const ContractPublishTag: "v0.22.0";
+export declare const ContractSchemasDigest: "sha256:2b762d34e5f5549a90b78f304a47f98b6165cf938a2ca776b1c055db8f04fce1";
 export declare const ContractAiFixturesDigest: "sha256:5d68828a1364dc63cafbb3c2d3f5c5f6c232d5333e7668a9c79e7652e5144b42";
-export declare const ContractGeneratedGoDigest: "sha256:ef74356afbc6a36a543f6f6fe572b77dc3691ce2201f0654644d2a7f29a4ced4";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:6bb6b13ea4722e3ec9e9d91c672461ec24b29076aeae0b14b62380cced658e92";
+export declare const ContractGeneratedGoDigest: "sha256:0541904aad85c418a20de003bef68a42c8876d6cf8fe9f165472a5e77f81e045";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:bbbba7c14c480030e9a44b94a746a0978efe7f008788817d31e137007bf89c38";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.19.0.0";
-export const ContractPublishVersion = "0.19.0";
-export const ContractPublishTag = "v0.19.0";
-export const ContractSchemasDigest = "sha256:3263c4ee323353316aeecc8741ce8dc7a740652a73e35587123fbf2330926b28";
+export const ContractRepositoryVersion = "0.22.0.0";
+export const ContractPublishVersion = "0.22.0";
+export const ContractPublishTag = "v0.22.0";
+export const ContractSchemasDigest = "sha256:2b762d34e5f5549a90b78f304a47f98b6165cf938a2ca776b1c055db8f04fce1";
 export const ContractAiFixturesDigest = "sha256:5d68828a1364dc63cafbb3c2d3f5c5f6c232d5333e7668a9c79e7652e5144b42";
-export const ContractGeneratedGoDigest = "sha256:ef74356afbc6a36a543f6f6fe572b77dc3691ce2201f0654644d2a7f29a4ced4";
-export const ContractGeneratedTypeScriptDigest = "sha256:6bb6b13ea4722e3ec9e9d91c672461ec24b29076aeae0b14b62380cced658e92";
+export const ContractGeneratedGoDigest = "sha256:0541904aad85c418a20de003bef68a42c8876d6cf8fe9f165472a5e77f81e045";
+export const ContractGeneratedTypeScriptDigest = "sha256:bbbba7c14c480030e9a44b94a746a0978efe7f008788817d31e137007bf89c38";

package/dist/gen-ts/deploy-request.d.ts

@@ -21,7 +21,7 @@ export type DeployRequestEnvironmentBinding1 = {
 type BindingClassificationEntry = {
     kind: 'configuration' | 'secret' | 'provider_credential';
     confidence: 'high' | 'low';
-    providerId?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+    providerId?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
     /**
      * Closed current credential category. Add a reviewed contract version before supporting another credential mechanism.
      */
@@ -50,6 +50,10 @@ export interface DeployRequest {
      */
     idempotencyKey?: string;
     environmentBindings?: DeployRequestEnvironmentBindings;
+    /**
+     * Preview-only. When true, the transformed code is NOT committed back to the source branch (benchmark deploys). Ignored outside preview.
+     */
+    benchRun?: boolean;
     bindingClassification: BindingClassificationSubject;
 }
 export interface DeployRequestSource {
@@ -109,6 +113,6 @@ interface BindingClassificationSubject {
 }
 interface BindingClassificationAiMapping {
     mappingVersion: string;
-    providerId: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+    providerId: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
 }
 export {};

package/dist/gen-ts/promotion-request.d.ts

@@ -1,7 +1,7 @@
 type BindingClassificationEntry = {
     kind: 'configuration' | 'secret' | 'provider_credential';
     confidence: 'high' | 'low';
-    providerId?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+    providerId?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
     /**
      * Closed current credential category. Add a reviewed contract version before supporting another credential mechanism.
      */
@@ -87,6 +87,6 @@ interface BindingClassificationSubject {
 }
 interface BindingClassificationAiMapping {
     mappingVersion: string;
-    providerId: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+    providerId: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
 }
 export {};

package/dist/gen-ts/sanitized-binding-evidence.d.ts

@@ -13,7 +13,7 @@ export type SanitizedRuntimeBinding = {
      */
     secretRef?: string;
 };
-export type SanitizedBindingProviderId = 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+export type SanitizedBindingProviderId = 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
 /**
  * Immutable DCP allocation receipt and sanitized runtime-binding set for one exact allocated version and normalized source revision. DCP persists this evidence atomically with version admission before publish or provisioning. classificationDigest chains to the caller's pre-allocation BindingClassificationSubject; bindings contain only approved configuration, app secrets or approved data-source credential references and never an AI-mapping-owned provider credential.
  */

package/dist/gen-ts/transform-report.d.ts

@@ -57,6 +57,10 @@ export interface TransformReport {
     };
     application: {
         runtime: string;
+        /**
+         * Optional reviewed runtime features selected for the standard application image. The first release supports Chromium for Node runtimes only.
+         */
+        runtimeFeatures?: 'chromium'[];
         buildKind: 'container' | 'static';
         topology: 'static' | 'backend' | 'frontend_and_backend';
         entrypoint: string;

package/dist/resolver/index.d.ts

@@ -42,7 +42,7 @@ export type { AiPolicySnapshot, AiPolicyGuardrailRule, AiPolicyGuardrailParamete
  * revision rather than guessed at. Bump on ANY change to the merge rules, the
  * platform baseline, or the classification minimums. */
 export declare const RESOLVER_VERSION = "1.0.0";
-export type AiProviderType = "openai" | "anthropic" | "gemini" | "openrouter" | "deepseek" | "elevenlabs" | "deepgram";
+export type AiProviderType = "openai" | "anthropic" | "gemini" | "openrouter" | "deepseek" | "elevenlabs" | "deepgram" | "higgsfield";
 export type AiCaptureMode = "OFF" | "BEST_EFFORT" | "REQUIRED";
 export type AiDataClassification = "Green" | "Yellow" | "Orange" | "Red";
 export type AiGuardrailAction = "ALLOW" | "OBSERVE" | "REDACT" | "BLOCK";

package/dist/resolver/index.js

@@ -47,7 +47,7 @@ export const AI_PLATFORM_BASELINE = {
     schema: "harbour.ai-platform-baseline/1.0",
     artifactVersion: "1.0.0",
     controls: {
-        permittedProviderTypes: ["anthropic", "gemini", "openai", "openrouter"],
+        permittedProviderTypes: ["anthropic", "gemini", "higgsfield", "openai", "openrouter"],
         requireApprovedModels: false,
         maxCaptureMode: "BEST_EFFORT",
         maxRetentionDays: 90,
@@ -70,7 +70,7 @@ export const AI_CLASSIFICATION_MINIMUMS = {
     defaultClassification: "Yellow",
     classes: {
         Green: {
-            permittedProviderTypes: ["anthropic", "gemini", "openai", "openrouter"],
+            permittedProviderTypes: ["anthropic", "gemini", "higgsfield", "openai", "openrouter"],
             requireApprovedModels: false,
             maxCaptureMode: "BEST_EFFORT",
             maxRetentionDays: 90,
@@ -84,7 +84,7 @@ export const AI_CLASSIFICATION_MINIMUMS = {
             requiredGuardrails: [],
         },
         Yellow: {
-            permittedProviderTypes: ["anthropic", "gemini", "openai", "openrouter"],
+            permittedProviderTypes: ["anthropic", "gemini", "higgsfield", "openai", "openrouter"],
             requireApprovedModels: true,
             maxCaptureMode: "BEST_EFFORT",
             maxRetentionDays: 60,

package/gen-ts/ai-callsite-inventory.ts

@@ -44,6 +44,7 @@ export interface AiInventoryCallsite {
     | 'ollama'
     | 'legacy-gemini'
     | 'direct-provider-rest'
+    | 'deepgram'
     | 'unknown';
   method: string;
   requestedModel?: string;

package/gen-ts/ai-policy-snapshot.ts

@@ -93,7 +93,7 @@ export interface AiPolicyClassificationMinimum {
 }
 export interface AiPolicyProvider {
   id: AiPolicyIdentifier;
-  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram';
+  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram' | 'higgsfield';
   baseUrl?: string;
   credentialSecretRef: string;
   enabled: boolean;

package/gen-ts/ai-pricing-revision.ts

@@ -10,7 +10,7 @@ export type AiPricingDigest = string;
 export interface AiPricingRevision {
   schema: 'harbour.ai-pricing-revision/2.0';
   revisionId: AiPricingIdentifier;
-  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram';
+  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram' | 'higgsfield';
   providerModel: string;
   region?: AiPricingIdentifier;
   currency: 'USD';

package/gen-ts/ai-runtime-contract.ts

@@ -33,6 +33,13 @@ export interface AiRuntimeContract {
     realtime?: AiRuntimeModelAlias;
   };
   policyDigest: AiRuntimeDigest;
+  /**
+   * Optional value-free descriptors for reviewed non-standard client environment boundaries. Mapping IDs are unique within a contract.
+   *
+   * @minItems 1
+   * @maxItems 16
+   */
+  configurationMappings?: AiConfigurationMappingDescriptor[];
   runtimeBinding?: AiRuntimeContractBinding;
   /**
    * @minItems 1
@@ -40,6 +47,17 @@ export interface AiRuntimeContract {
    */
   requiredStrategies: ('deployment_injection' | 'deterministic_adapter')[];
 }
+/**
+ * Value-free descriptor for one registered OpenAI-compatible client environment boundary. Secret values are never part of this descriptor.
+ */
+export interface AiConfigurationMappingDescriptor {
+  mappingId: string;
+  version: string;
+  protocol: 'openai-chat';
+  providerId: string;
+  apiKeyEnvironmentName: string;
+  baseUrlEnvironmentName: string;
+}
 /**
  * Optional additive platform-neutral binding. Existing 1.0 records without it remain valid.
  */
@@ -50,3 +68,11 @@ export interface AiRuntimeContractBinding {
   secretRef: AiRuntimeContractSafeReference;
   runtimeBindingDigest: AiRuntimeDigest;
 }
+
+
+/** True iff configurationMappings contains no repeated mappingId values. */
+export function hasUniqueAiRuntimeContractConfigurationMappings(input: AiRuntimeContract): boolean {
+  const seen = new Set<string>();
+  for (const item of input.configurationMappings ?? []) { const value = item.mappingId; if (seen.has(value)) return false; seen.add(value); }
+  return true;
+}

package/gen-ts/ai-trace-event.ts

@@ -17,7 +17,7 @@ export type AiTraceEvent = {
   routeRevision?: string;
   requestedModel?: string;
   governedModelAlias?: string;
-  provider?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram';
+  provider?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram' | 'higgsfield';
   providerModel?: string;
   outcome: 'succeeded' | 'blocked' | 'failed' | 'cancelled';
   usage?: AiTraceUsage;
@@ -45,7 +45,7 @@ export type AiTraceIdentifier = string;
 export type AiTraceDigest = string;
 export type AiTraceAttempt = {
   attempt: number;
-  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram';
+  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'elevenlabs' | 'deepgram' | 'higgsfield';
   providerModel: string;
   priceRevision: AiTraceIdentifier;
   outcome: 'succeeded' | 'failed' | 'timed_out' | 'cancelled';

package/gen-ts/artifact-contract.ts

@@ -20,6 +20,10 @@ export interface ArtifactContract {
     ref: string;
     entrypoint: string;
     runtime: string;
+    /**
+     * Optional reviewed runtime features selected for the standard application image. Unknown and duplicate features are rejected.
+     */
+    runtime_features?: 'chromium'[];
   };
   static: {
     /**
@@ -71,6 +75,31 @@ export interface ArtifactContract {
    * MVP emits an empty array.
    */
   scheduled_tasks: {}[];
+  /**
+   * Optional bounded runtime profile and background-job mode for the application workload. Omitted resource_profile uses the standard profile and omitted background_jobs uses none.
+   */
+  workload?: {
+    /**
+     * Reviewed CPU/memory profile selected for the application container.
+     */
+    resource_profile?: 'standard' | 'memory-1g';
+    /**
+     * Background-job execution mode. The sqs mode enables the governed application job queue and queue-aware scale-to-zero.
+     */
+    background_jobs?: 'none' | 'sqs';
+  };
+  /**
+   * Optional method/path authentication policy compiled by the transformation. The default is SSO; listed routes preserve the application's own token, signature, or callback authorization.
+   */
+  route_auth?: {
+    version: 1;
+    default: 'sso_required';
+    rules: {
+      path: string;
+      methods: ('GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS')[];
+      mode: 'application_authorized';
+    }[];
+  };
   transform_report: {
     /**
      * Transformed surfaces, e.g. ["secrets","storage.sql"].

package/gen-ts/binding-classification-subject.ts

@@ -19,7 +19,7 @@ export type BindingClassificationEntry = {
   requestedAiMappingId?: BindingClassificationIdentifier;
 };
 export type BindingClassificationProviderId =
-  'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+  'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
 /**
  * Closed current credential category. Add a reviewed contract version before supporting another credential mechanism.
  */

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.19.0.0" as const;
-export const ContractPublishVersion = "0.19.0" as const;
-export const ContractPublishTag = "v0.19.0" as const;
-export const ContractSchemasDigest = "sha256:3263c4ee323353316aeecc8741ce8dc7a740652a73e35587123fbf2330926b28" as const;
+export const ContractRepositoryVersion = "0.22.0.0" as const;
+export const ContractPublishVersion = "0.22.0" as const;
+export const ContractPublishTag = "v0.22.0" as const;
+export const ContractSchemasDigest = "sha256:2b762d34e5f5549a90b78f304a47f98b6165cf938a2ca776b1c055db8f04fce1" as const;
 export const ContractAiFixturesDigest = "sha256:5d68828a1364dc63cafbb3c2d3f5c5f6c232d5333e7668a9c79e7652e5144b42" as const;
-export const ContractGeneratedGoDigest = "sha256:ef74356afbc6a36a543f6f6fe572b77dc3691ce2201f0654644d2a7f29a4ced4" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:6bb6b13ea4722e3ec9e9d91c672461ec24b29076aeae0b14b62380cced658e92" as const;
+export const ContractGeneratedGoDigest = "sha256:0541904aad85c418a20de003bef68a42c8876d6cf8fe9f165472a5e77f81e045" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:bbbba7c14c480030e9a44b94a746a0978efe7f008788817d31e137007bf89c38" as const;

package/gen-ts/deploy-request.ts

@@ -24,7 +24,7 @@ export type DeployRequestEnvironmentBinding1 = {
 type BindingClassificationEntry = {
   kind: 'configuration' | 'secret' | 'provider_credential';
   confidence: 'high' | 'low';
-  providerId?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+  providerId?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
   /**
    * Closed current credential category. Add a reviewed contract version before supporting another credential mechanism.
    */
@@ -54,6 +54,10 @@ export interface DeployRequest {
    */
   idempotencyKey?: string;
   environmentBindings?: DeployRequestEnvironmentBindings;
+  /**
+   * Preview-only. When true, the transformed code is NOT committed back to the source branch (benchmark deploys). Ignored outside preview.
+   */
+  benchRun?: boolean;
   bindingClassification: BindingClassificationSubject;
 }
 export interface DeployRequestSource {
@@ -113,5 +117,5 @@ interface BindingClassificationSubject {
 }
 interface BindingClassificationAiMapping {
   mappingVersion: string;
-  providerId: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+  providerId: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
 }

package/gen-ts/promotion-request.ts

@@ -4,7 +4,7 @@
 type BindingClassificationEntry = {
   kind: 'configuration' | 'secret' | 'provider_credential';
   confidence: 'high' | 'low';
-  providerId?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+  providerId?: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
   /**
    * Closed current credential category. Add a reviewed contract version before supporting another credential mechanism.
    */
@@ -91,5 +91,5 @@ interface BindingClassificationSubject {
 }
 interface BindingClassificationAiMapping {
   mappingVersion: string;
-  providerId: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+  providerId: 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
 }

package/gen-ts/sanitized-binding-evidence.ts

@@ -16,7 +16,8 @@ export type SanitizedRuntimeBinding = {
    */
   secretRef?: string;
 };
-export type SanitizedBindingProviderId = 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram';
+export type SanitizedBindingProviderId =
+  'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'deepseek' | 'deepgram' | 'higgsfield';
 
 /**
  * Immutable DCP allocation receipt and sanitized runtime-binding set for one exact allocated version and normalized source revision. DCP persists this evidence atomically with version admission before publish or provisioning. classificationDigest chains to the caller's pre-allocation BindingClassificationSubject; bindings contain only approved configuration, app secrets or approved data-source credential references and never an AI-mapping-owned provider credential.

package/gen-ts/transform-report.ts

@@ -60,6 +60,10 @@ export interface TransformReport {
   };
   application: {
     runtime: string;
+    /**
+     * Optional reviewed runtime features selected for the standard application image. The first release supports Chromium for Node runtimes only.
+     */
+    runtimeFeatures?: 'chromium'[];
     buildKind: 'container' | 'static';
     topology: 'static' | 'backend' | 'frontend_and_backend';
     entrypoint: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.19.0",
+  "version": "0.22.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Harbour components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/ai-callsite-inventory.schema.json

@@ -115,6 +115,7 @@
             "ollama",
             "legacy-gemini",
             "direct-provider-rest",
+            "deepgram",
             "unknown"
           ]
         },

package/schema/ai-policy-snapshot.schema.json

@@ -108,7 +108,7 @@
       "required": ["id", "provider", "credentialSecretRef", "enabled"],
       "properties": {
         "id": { "$ref": "#/definitions/AiPolicyIdentifier" },
-        "provider": { "type": "string", "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "elevenlabs", "deepgram"] },
+        "provider": { "type": "string", "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "elevenlabs", "deepgram", "higgsfield"] },
         "baseUrl": { "type": "string", "format": "uri", "maxLength": 512 },
         "credentialSecretRef": {
           "type": "string",

package/schema/ai-pricing-revision.schema.json

@@ -9,7 +9,7 @@
   "properties": {
     "schema": { "type": "string", "const": "harbour.ai-pricing-revision/2.0" },
     "revisionId": { "$ref": "#/definitions/AiPricingIdentifier" },
-    "provider": { "type": "string", "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "elevenlabs", "deepgram"] },
+    "provider": { "type": "string", "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "elevenlabs", "deepgram", "higgsfield"] },
     "providerModel": { "type": "string", "minLength": 1, "maxLength": 256 },
     "region": { "$ref": "#/definitions/AiPricingIdentifier" },
     "currency": { "type": "string", "const": "USD" },

package/schema/ai-runtime-contract.schema.json

@@ -59,6 +59,14 @@
       }
     },
     "policyDigest": { "$ref": "#/definitions/AiRuntimeDigest" },
+    "configurationMappings": {
+      "description": "Optional value-free descriptors for reviewed non-standard client environment boundaries. Mapping IDs are unique within a contract.",
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 16,
+      "uniqueItems": true,
+      "items": { "$ref": "#/definitions/AiConfigurationMappingDescriptor" }
+    },
     "runtimeBinding": { "$ref": "#/definitions/AiRuntimeContractBinding" },
     "requiredStrategies": {
       "type": "array",
@@ -88,6 +96,20 @@
       "maxLength": 160,
       "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9][A-Za-z0-9_./-]*$"
     },
+    "AiConfigurationMappingDescriptor": {
+      "description": "Value-free descriptor for one registered OpenAI-compatible client environment boundary. Secret values are never part of this descriptor.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mappingId", "version", "protocol", "providerId", "apiKeyEnvironmentName", "baseUrlEnvironmentName"],
+      "properties": {
+        "mappingId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$" },
+        "version": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" },
+        "protocol": { "type": "string", "const": "openai-chat" },
+        "providerId": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[a-z][a-z0-9_.-]{0,63}$" },
+        "apiKeyEnvironmentName": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Z][A-Z0-9_]{0,127}$" },
+        "baseUrlEnvironmentName": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Z][A-Z0-9_]{0,127}$" }
+      }
+    },
     "AiRuntimeContractBinding": {
       "description": "Optional additive platform-neutral binding. Existing 1.0 records without it remain valid.",
       "type": "object",
@@ -108,6 +130,7 @@
       "pattern": "^(?:aws-sm|iam-role|k8s-sa|secretref|spiffe|vault|vault-v2)://[A-Za-z0-9][A-Za-z0-9._-]{0,127}(?:/[A-Za-z0-9][A-Za-z0-9._~+=-]{0,255})*$"
     }
   },
+  "x-unique-array-by": [{ "field": "configurationMappings", "key": "mappingId" }],
   "x-safe-reference-pattern": "^(?:aws-sm|iam-role|k8s-sa|secretref|spiffe|vault|vault-v2)://[A-Za-z0-9][A-Za-z0-9._-]{0,127}(?:/[A-Za-z0-9][A-Za-z0-9._~+=-]{0,255})*$",
   "x-approved-reference-schemes": ["aws-sm", "iam-role", "k8s-sa", "secretref", "spiffe", "vault", "vault-v2"]
 }

package/schema/ai-trace-event.schema.json

@@ -42,7 +42,7 @@
     "routeRevision": { "type": "string", "minLength": 1, "maxLength": 256 },
     "requestedModel": { "type": "string", "minLength": 1, "maxLength": 256 },
     "governedModelAlias": { "type": "string", "minLength": 1, "maxLength": 160 },
-    "provider": { "type": "string", "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "elevenlabs", "deepgram"] },
+    "provider": { "type": "string", "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "elevenlabs", "deepgram", "higgsfield"] },
     "providerModel": { "type": "string", "minLength": 1, "maxLength": 256 },
     "outcome": { "type": "string", "enum": ["succeeded", "blocked", "failed", "cancelled"] },
     "usage": { "$ref": "#/definitions/AiTraceUsage" },
@@ -134,7 +134,7 @@
       "required": ["attempt", "provider", "providerModel", "priceRevision", "outcome", "usage", "costMicroUsd", "latencyMs"],
       "properties": {
         "attempt": { "type": "integer", "minimum": 1, "maximum": 32 },
-        "provider": { "type": "string", "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "elevenlabs", "deepgram"] },
+        "provider": { "type": "string", "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "elevenlabs", "deepgram", "higgsfield"] },
         "providerModel": { "type": "string", "minLength": 1, "maxLength": 256 },
         "priceRevision": { "$ref": "#/definitions/AiTraceIdentifier" },
         "outcome": { "type": "string", "enum": ["succeeded", "failed", "timed_out", "cancelled"] },

package/schema/artifact-contract.schema.json

@@ -36,7 +36,16 @@
         "type": { "type": "string", "enum": ["oci-image", "zip"] },
         "ref": { "type": "string", "minLength": 1, "description": "ECR uri@digest (oci-image) or S3 key (zip)." },
         "entrypoint": { "type": "string", "minLength": 1 },
-        "runtime": { "type": "string", "minLength": 1 }
+        "runtime": { "type": "string", "minLength": 1 },
+        "runtime_features": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": ["chromium"]
+          },
+          "description": "Optional reviewed runtime features selected for the standard application image. Unknown and duplicate features are rejected."
+        }
       }
     },
     "static": {
@@ -109,6 +118,55 @@
       "description": "MVP emits an empty array.",
       "items": { "type": "object" }
     },
+    "workload": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Optional bounded runtime profile and background-job mode for the application workload. Omitted resource_profile uses the standard profile and omitted background_jobs uses none.",
+      "properties": {
+        "resource_profile": {
+          "type": "string",
+          "enum": ["standard", "memory-1g"],
+          "description": "Reviewed CPU/memory profile selected for the application container."
+        },
+        "background_jobs": {
+          "type": "string",
+          "enum": ["none", "sqs"],
+          "description": "Background-job execution mode. The sqs mode enables the governed application job queue and queue-aware scale-to-zero."
+        }
+      }
+    },
+    "route_auth": {
+      "description": "Optional method/path authentication policy compiled by the transformation. The default is SSO; listed routes preserve the application's own token, signature, or callback authorization.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "default", "rules"],
+      "properties": {
+        "version": { "type": "integer", "const": 1 },
+        "default": { "type": "string", "const": "sso_required" },
+        "rules": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["path", "methods", "mode"],
+            "properties": {
+              "path": {
+                "type": "string",
+                "pattern": "^/(?:[A-Za-z0-9._~-]+/)*(?:[A-Za-z0-9._~-]+|\\*)$"
+              },
+              "methods": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
+                }
+              },
+              "mode": { "type": "string", "const": "application_authorized" }
+            }
+          }
+        }
+      }
+    },
     "transform_report": {
       "type": "object",
       "additionalProperties": false,

package/schema/binding-classification-subject.schema.json

@@ -64,7 +64,7 @@
     },
     "BindingClassificationProviderId": {
       "type": "string",
-      "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "deepgram"]
+      "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "deepgram", "higgsfield"]
     },
     "BindingClassificationCredentialCategory": {
       "description": "Closed current credential category. Add a reviewed contract version before supporting another credential mechanism.",

package/schema/deploy-request.schema.json

@@ -34,6 +34,11 @@
     "environmentBindings": {
       "$ref": "#/definitions/DeployRequestEnvironmentBindings"
     },
+    "benchRun": {
+      "type": "boolean",
+      "default": false,
+      "description": "Preview-only. When true, the transformed code is NOT committed back to the source branch (benchmark deploys). Ignored outside preview."
+    },
     "bindingClassification": {
       "$ref": "binding-classification-subject.schema.json",
       "description": "Complete pre-allocation, value-free binding-name classification. DCP verifies its tenant/app/environment/source identity and exact name coverage before minting the versionId."

package/schema/sanitized-binding-evidence.schema.json

@@ -62,7 +62,7 @@
     },
     "SanitizedBindingProviderId": {
       "type": "string",
-      "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "deepgram"]
+      "enum": ["openai", "anthropic", "gemini", "openrouter", "deepseek", "deepgram", "higgsfield"]
     },
     "SanitizedBindingAiMapping": {
       "type": "object",

package/schema/transform-report.schema.json

@@ -126,6 +126,15 @@
           "type": "string",
           "pattern": "^(?:nodejs|python)[0-9]+(?:\\.[0-9]+)?$"
         },
+        "runtimeFeatures": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": ["chromium"]
+          },
+          "description": "Optional reviewed runtime features selected for the standard application image. The first release supports Chromium for Node runtimes only."
+        },
         "buildKind": { "type": "string", "enum": ["container", "static"] },
         "topology": {
           "type": "string",