@fourier-labs/harbour-contracts 0.27.0 → 0.29.0

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.27.0.0",
-  "publishVersion": "0.27.0",
-  "publishTag": "v0.27.0",
-  "schemasDigest": "sha256:115fb3009d3e71f3ca46f0d74a88f4ff1164a387d2e8b5696bb6815010f1784d",
+  "repositoryVersion": "0.29.0.0",
+  "publishVersion": "0.29.0",
+  "publishTag": "v0.29.0",
+  "schemasDigest": "sha256:4b21ea9a6b13193a189d2499f6cc8f24975db18686e64d2042490a85dca669fc",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:f458ed606d14e968baeada0ae3d0244a37c4a5c947c549578c970d9f8fdaef87",
-  "generatedTypeScriptDigest": "sha256:59516d76fb1d1f007dbc38ccc09751d459a2d0885f3ff13c96b9993153c76cec",
+  "generatedGoDigest": "sha256:6e5af7342005ceb5b2a175b3d5c3eb27e06fe5bfa57e74e2e854038b5f8cbad6",
+  "generatedTypeScriptDigest": "sha256:b6201aeb54e733aaf4f33c2bdf75054b3e10b1616e031620cce15ee72fb37770",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -47,13 +47,13 @@
     "schema/error-category.enum.json": "sha256:693f8ce67d5554358f89b76132024cb8a082216f192d80a66bc4dc64e8983332",
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
-    "schema/promotion-request.schema.json": "sha256:560460b57fc639d248fa657a2a1e3d88d27ab9139faf17ee58633b671f8b5072",
+    "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
     "schema/sanitized-binding-evidence.schema.json": "sha256:b03bcc1911c99c69fda50eb656fc3e115f88fe2990c1708fbb5cd3542f4b8bba",
     "schema/secret-reference.schema.json": "sha256:966f7a6d2575b46a4b54804d06dc05c6229ebbcbd9200fe6a6c8d3b4ffb90f9f",
     "schema/security-scan-input.schema.json": "sha256:9f9c9e6131c1abee454320b77e4332e3780c0c63f108f54f75c93194a32ccff7",
     "schema/security-verdict.schema.json": "sha256:ec3c2d5c9df3601aeed0909b36c7f427469c7f0eeb3295c5809b96d09bf3fc26",
-    "schema/transform-report.schema.json": "sha256:821755a9d13be24139b168cc11d494c080194eb5a85950dd4878049a59557cea",
+    "schema/transform-report.schema.json": "sha256:815e764445fb41b912d0c0468f00621ad61f941fb4c7b9364e3f204ad47cdf7f",
     "schema/version-state.schema.json": "sha256:e7c4b2e7b615ebb07f36d0df22ded51b2c9688ef9e9bfe79de1d5cd94de9ae40"
   },
   "aiFixtures": {
@@ -92,8 +92,8 @@
     "gen-go/contracts_test.go": "sha256:7c7ee46f2b4277e22b1ee21af9f17d201eb83067c613b049749f932706ed24f8",
     "gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
     "gen-go/error_category.go": "sha256:a8b64524be3716e62ca6016e56f2332a56fa5e16e42647421e516aa01a7d6806",
-    "gen-go/schema_documents.go": "sha256:10fcbf0966bca7d81fc1456afe8744a94d4ebf7d2863b49e6f4f179cbfb69f7e",
-    "gen-go/types.go": "sha256:766a4967e49cf5347137308b2df09dcc1c74cc271af601012b31f84f89ea6555",
+    "gen-go/schema_documents.go": "sha256:4b9094aaf0acc4bae4b65784954853f0888572a53fa1a1dc354f97c88ded805f",
+    "gen-go/types.go": "sha256:bf6906826f4d1c490954cc4354322bf508c392cfc4b72a9a6fe9890f6b5a8d99",
     "gen-go/version_state.go": "sha256:827f8768359998409b86ea02d9ba1a149981928bae7161e4dc95fe0520ce7410"
   },
   "generatedTypeScript": {
@@ -137,14 +137,14 @@
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
     "gen-ts/index.ts": "sha256:bb37bf7838034dcf410562855582ae3bfbf24ee43d506bbc514ad512557016b5",
     "gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
-    "gen-ts/promotion-request.ts": "sha256:6ef4612172202bca918a6260d40f2a1a8739845c6c0f747dd1ce5e520e081011",
+    "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:4db7e9ed83f563a46e337815a55bbd6433864c41d9ec8e8a80810a16e3095ebb",
     "gen-ts/secret-reference.ts": "sha256:a8b65de72705b6f51f57cd8ca58881483108005b1fa4d19106c3e9cf1fa877e7",
     "gen-ts/security-scan-input.ts": "sha256:5d9bde7394d8b34cca1d36b51ce17bf73cfccd9cfd7cab810f83d4de58f22285",
     "gen-ts/security-verdict.ts": "sha256:fea950cddbd12fe0218e2573c9a29c6748d56612a464559f1e6d688fa97f68c7",
-    "gen-ts/transform-report.ts": "sha256:c59e2e3c91c8ef6727a030a0e0763e3b57aa0c80f1873ddcf1a34a3c82cd0f99",
+    "gen-ts/transform-report.ts": "sha256:6c54b579884d98135d73945d00980820b136f269622db27fa56a1c4c0e57d3b6",
     "gen-ts/version-state-machine.ts": "sha256:4371bc7e2bde86b0447f5242104c576cc160dfd7dae1885acbfb63540f230bdd",
     "gen-ts/version-state.ts": "sha256:a835112930299e7b593a1b8810b7414f6c9e809da2092306c743128170a3b702"
   }

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.27.0.0";
-export declare const ContractPublishVersion: "0.27.0";
-export declare const ContractPublishTag: "v0.27.0";
-export declare const ContractSchemasDigest: "sha256:115fb3009d3e71f3ca46f0d74a88f4ff1164a387d2e8b5696bb6815010f1784d";
+export declare const ContractRepositoryVersion: "0.29.0.0";
+export declare const ContractPublishVersion: "0.29.0";
+export declare const ContractPublishTag: "v0.29.0";
+export declare const ContractSchemasDigest: "sha256:4b21ea9a6b13193a189d2499f6cc8f24975db18686e64d2042490a85dca669fc";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:f458ed606d14e968baeada0ae3d0244a37c4a5c947c549578c970d9f8fdaef87";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:59516d76fb1d1f007dbc38ccc09751d459a2d0885f3ff13c96b9993153c76cec";
+export declare const ContractGeneratedGoDigest: "sha256:6e5af7342005ceb5b2a175b3d5c3eb27e06fe5bfa57e74e2e854038b5f8cbad6";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:b6201aeb54e733aaf4f33c2bdf75054b3e10b1616e031620cce15ee72fb37770";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.27.0.0";
-export const ContractPublishVersion = "0.27.0";
-export const ContractPublishTag = "v0.27.0";
-export const ContractSchemasDigest = "sha256:115fb3009d3e71f3ca46f0d74a88f4ff1164a387d2e8b5696bb6815010f1784d";
+export const ContractRepositoryVersion = "0.29.0.0";
+export const ContractPublishVersion = "0.29.0";
+export const ContractPublishTag = "v0.29.0";
+export const ContractSchemasDigest = "sha256:4b21ea9a6b13193a189d2499f6cc8f24975db18686e64d2042490a85dca669fc";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:f458ed606d14e968baeada0ae3d0244a37c4a5c947c549578c970d9f8fdaef87";
-export const ContractGeneratedTypeScriptDigest = "sha256:59516d76fb1d1f007dbc38ccc09751d459a2d0885f3ff13c96b9993153c76cec";
+export const ContractGeneratedGoDigest = "sha256:6e5af7342005ceb5b2a175b3d5c3eb27e06fe5bfa57e74e2e854038b5f8cbad6";
+export const ContractGeneratedTypeScriptDigest = "sha256:b6201aeb54e733aaf4f33c2bdf75054b3e10b1616e031620cce15ee72fb37770";

package/dist/gen-ts/promotion-request.d.ts

@@ -1,3 +1,23 @@
+/**
+ * One runtime binding: exactly one of secretRef or plain value, as in preview. The legacy type name is retained for consumers. Secret references remain limited to app secrets and approved data-source credentials; integration and provider credentials remain unrepresentable.
+ */
+export type PromotionRequestSecretBinding = {
+    /**
+     * Environment-variable name the app reads.
+     */
+    name: string;
+    /**
+     * Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The credential value never appears in this request.
+     */
+    secretRef?: string;
+    /**
+     * Approved plain configuration, not a credential. Its classification must be configuration.
+     */
+    value?: string;
+} & PromotionRequestSecretBinding1;
+export type PromotionRequestSecretBinding1 = {
+    [k: string]: unknown;
+};
 type BindingClassificationEntry = {
     kind: 'configuration' | 'secret' | 'provider_credential';
     confidence: 'high' | 'low';
@@ -28,27 +48,14 @@ export interface PromotionRequest {
     bindingClassification: BindingClassificationSubject;
 }
 /**
- * Optional secret bindings for the production version. Additive: promotions without it remain valid, and a deployment plane that ignores the field behaves exactly as before. Named environmentBindings to match deploy-request.schema.json, whose preview counterpart this mirrors.
+ * Optional runtime bindings for the production version, matching the preview secret-reference or plain-configuration shape. Credentials remain secret references; classification covers every binding name.
  */
 export interface PromotionRequestEnvironmentBindings {
     /**
-     * Secret bindings for the production version. An empty array is meaningful: it says the caller looked and the app declares no secrets.
+     * Approved runtime bindings for the production version. An empty array means the caller checked and found no bindings.
      */
     bindings: PromotionRequestSecretBinding[];
 }
-/**
- * One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only app secrets, app-scoped minted data-source credentials and tenant-scoped source credentials from an approved BYO grant; integration and provider credentials remain unrepresentable.
- */
-export interface PromotionRequestSecretBinding {
-    /**
-     * Environment-variable name the app reads.
-     */
-    name: string;
-    /**
-     * Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it.
-     */
-    secretRef: string;
-}
 /**
  * Complete pre-allocation, value-free classification for the exact production source revision and declared production binding names. It intentionally has no production versionId; DCP allocates that identity atomically.
  */

package/dist/gen-ts/transform-report.d.ts

@@ -66,6 +66,27 @@ export type TransformReport = {
          * Optional reviewed runtime features selected for the standard application image. The first release supports Chromium for Node runtimes only.
          */
         runtimeFeatures?: 'chromium'[];
+        /**
+         * Optional bounded workload requirements, carried into the deployment plan and artifact. Null or omitted preserves standard HTTP serving. SQS jobs require platform-selected Kubernetes compute.
+         */
+        workload?: {
+            resourceProfile: 'standard' | 'memory-1g';
+            backgroundJobs: 'none' | 'sqs';
+        } | null;
+        /**
+         * Build-only bootstrap for authenticated browser validation. Use null when the application does not require a local database user. When local authorization resolves Harbour identity to an application-owned user or membership row, declare an idempotent command that creates the fixed validation identity in the throwaway database. Reuse an existing seed command when available; otherwise add the smallest validation-only script using the application's existing database layer. The command is never run during production deployment.
+         */
+        validationSeed?: {
+            /**
+             * @minItems 1
+             * @maxItems 64
+             */
+            command: string[];
+            /**
+             * Existing application-owned environment variable that receives the trusted browser probe email, for example ADMIN_EMAIL.
+             */
+            identityEmailEnvironmentVariable: string;
+        } | null;
         buildKind?: 'container' | 'static';
         topology?: 'static' | 'backend' | 'frontend_and_backend';
         entrypoint?: string;

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.27.0.0" as const;
-export const ContractPublishVersion = "0.27.0" as const;
-export const ContractPublishTag = "v0.27.0" as const;
-export const ContractSchemasDigest = "sha256:115fb3009d3e71f3ca46f0d74a88f4ff1164a387d2e8b5696bb6815010f1784d" as const;
+export const ContractRepositoryVersion = "0.29.0.0" as const;
+export const ContractPublishVersion = "0.29.0" as const;
+export const ContractPublishTag = "v0.29.0" as const;
+export const ContractSchemasDigest = "sha256:4b21ea9a6b13193a189d2499f6cc8f24975db18686e64d2042490a85dca669fc" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:f458ed606d14e968baeada0ae3d0244a37c4a5c947c549578c970d9f8fdaef87" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:59516d76fb1d1f007dbc38ccc09751d459a2d0885f3ff13c96b9993153c76cec" as const;
+export const ContractGeneratedGoDigest = "sha256:6e5af7342005ceb5b2a175b3d5c3eb27e06fe5bfa57e74e2e854038b5f8cbad6" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:b6201aeb54e733aaf4f33c2bdf75054b3e10b1616e031620cce15ee72fb37770" as const;

package/gen-ts/promotion-request.ts

@@ -1,6 +1,26 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
+/**
+ * One runtime binding: exactly one of secretRef or plain value, as in preview. The legacy type name is retained for consumers. Secret references remain limited to app secrets and approved data-source credentials; integration and provider credentials remain unrepresentable.
+ */
+export type PromotionRequestSecretBinding = {
+  /**
+   * Environment-variable name the app reads.
+   */
+  name: string;
+  /**
+   * Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The credential value never appears in this request.
+   */
+  secretRef?: string;
+  /**
+   * Approved plain configuration, not a credential. Its classification must be configuration.
+   */
+  value?: string;
+} & PromotionRequestSecretBinding1;
+export type PromotionRequestSecretBinding1 = {
+  [k: string]: unknown;
+};
 type BindingClassificationEntry = {
   kind: 'configuration' | 'secret' | 'provider_credential';
   confidence: 'high' | 'low';
@@ -32,27 +52,14 @@ export interface PromotionRequest {
   bindingClassification: BindingClassificationSubject;
 }
 /**
- * Optional secret bindings for the production version. Additive: promotions without it remain valid, and a deployment plane that ignores the field behaves exactly as before. Named environmentBindings to match deploy-request.schema.json, whose preview counterpart this mirrors.
+ * Optional runtime bindings for the production version, matching the preview secret-reference or plain-configuration shape. Credentials remain secret references; classification covers every binding name.
  */
 export interface PromotionRequestEnvironmentBindings {
   /**
-   * Secret bindings for the production version. An empty array is meaningful: it says the caller looked and the app declares no secrets.
+   * Approved runtime bindings for the production version. An empty array means the caller checked and found no bindings.
    */
   bindings: PromotionRequestSecretBinding[];
 }
-/**
- * One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only app secrets, app-scoped minted data-source credentials and tenant-scoped source credentials from an approved BYO grant; integration and provider credentials remain unrepresentable.
- */
-export interface PromotionRequestSecretBinding {
-  /**
-   * Environment-variable name the app reads.
-   */
-  name: string;
-  /**
-   * Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it.
-   */
-  secretRef: string;
-}
 /**
  * Complete pre-allocation, value-free classification for the exact production source revision and declared production binding names. It intentionally has no production versionId; DCP allocates that identity atomically.
  */

package/gen-ts/transform-report.ts

@@ -69,6 +69,27 @@ export type TransformReport = {
      * Optional reviewed runtime features selected for the standard application image. The first release supports Chromium for Node runtimes only.
      */
     runtimeFeatures?: 'chromium'[];
+    /**
+     * Optional bounded workload requirements, carried into the deployment plan and artifact. Null or omitted preserves standard HTTP serving. SQS jobs require platform-selected Kubernetes compute.
+     */
+    workload?: {
+      resourceProfile: 'standard' | 'memory-1g';
+      backgroundJobs: 'none' | 'sqs';
+    } | null;
+    /**
+     * Build-only bootstrap for authenticated browser validation. Use null when the application does not require a local database user. When local authorization resolves Harbour identity to an application-owned user or membership row, declare an idempotent command that creates the fixed validation identity in the throwaway database. Reuse an existing seed command when available; otherwise add the smallest validation-only script using the application's existing database layer. The command is never run during production deployment.
+     */
+    validationSeed?: {
+      /**
+       * @minItems 1
+       * @maxItems 64
+       */
+      command: string[];
+      /**
+       * Existing application-owned environment variable that receives the trusted browser probe email, for example ADMIN_EMAIL.
+       */
+      identityEmailEnvironmentVariable: string;
+    } | null;
     buildKind?: 'container' | 'static';
     topology?: 'static' | 'backend' | 'frontend_and_backend';
     entrypoint?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Harbour components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/promotion-request.schema.json

@@ -41,15 +41,15 @@
           "items": {
             "$ref": "#/definitions/PromotionRequestSecretBinding"
           },
-          "description": "Secret bindings for the production version. An empty array is meaningful: it says the caller looked and the app declares no secrets."
+          "description": "Approved runtime bindings for the production version. An empty array means the caller checked and found no bindings."
         }
       },
-      "description": "Optional secret bindings for the production version. Additive: promotions without it remain valid, and a deployment plane that ignores the field behaves exactly as before. Named environmentBindings to match deploy-request.schema.json, whose preview counterpart this mirrors."
+      "description": "Optional runtime bindings for the production version, matching the preview secret-reference or plain-configuration shape. Credentials remain secret references; classification covers every binding name."
     },
     "PromotionRequestSecretBinding": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["name", "secretRef"],
+      "required": ["name"],
       "properties": {
         "name": {
           "type": "string",
@@ -59,10 +59,20 @@
         "secretRef": {
           "type": "string",
           "pattern": "^secretref://tenant/[A-Za-z0-9._-]+/(?:app/[A-Za-z0-9._-]+/(?:secret/[A-Z][A-Z0-9_]{0,127}|source/[a-z0-9][a-z0-9._-]{0,63})|source/[a-z0-9][a-z0-9._-]{0,63})$",
-          "description": "Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it."
+          "description": "Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The credential value never appears in this request."
+        },
+        "value": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "Approved plain configuration, not a credential. Its classification must be configuration."
         }
       },
-      "description": "One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only app secrets, app-scoped minted data-source credentials and tenant-scoped source credentials from an approved BYO grant; integration and provider credentials remain unrepresentable."
+      "oneOf": [
+        { "required": ["secretRef"] },
+        { "required": ["value"] }
+      ],
+      "description": "One runtime binding: exactly one of secretRef or plain value, as in preview. The legacy type name is retained for consumers. Secret references remain limited to app secrets and approved data-source credentials; integration and provider credentials remain unrepresentable."
     }
   }
 }

package/schema/transform-report.schema.json

@@ -129,6 +129,45 @@
           },
           "description": "Optional reviewed runtime features selected for the standard application image. The first release supports Chromium for Node runtimes only."
         },
+        "workload": {
+          "description": "Optional bounded workload requirements, carried into the deployment plan and artifact. Null or omitted preserves standard HTTP serving. SQS jobs require platform-selected Kubernetes compute.",
+          "anyOf": [
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["resourceProfile", "backgroundJobs"],
+              "properties": {
+                "resourceProfile": { "type": "string", "enum": ["standard", "memory-1g"] },
+                "backgroundJobs": { "type": "string", "enum": ["none", "sqs"] }
+              }
+            },
+            { "type": "null" }
+          ]
+        },
+        "validationSeed": {
+          "description": "Build-only bootstrap for authenticated browser validation. Use null when the application does not require a local database user. When local authorization resolves Harbour identity to an application-owned user or membership row, declare an idempotent command that creates the fixed validation identity in the throwaway database. Reuse an existing seed command when available; otherwise add the smallest validation-only script using the application's existing database layer. The command is never run during production deployment.",
+          "anyOf": [
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["command", "identityEmailEnvironmentVariable"],
+              "properties": {
+                "command": {
+                  "type": "array",
+                  "minItems": 1,
+                  "maxItems": 64,
+                  "items": { "type": "string", "minLength": 1, "maxLength": 1024 }
+                },
+                "identityEmailEnvironmentVariable": {
+                  "type": "string",
+                  "pattern": "^[A-Z][A-Z0-9_]{0,127}$",
+                  "description": "Existing application-owned environment variable that receives the trusted browser probe email, for example ADMIN_EMAIL."
+                }
+              }
+            },
+            { "type": "null" }
+          ]
+        },
         "buildKind": { "type": "string", "enum": ["container", "static"] },
         "topology": {
           "type": "string",