@fourier-labs/harbour-contracts 0.29.0 → 0.30.0

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.29.0.0",
-  "publishVersion": "0.29.0",
-  "publishTag": "v0.29.0",
-  "schemasDigest": "sha256:4b21ea9a6b13193a189d2499f6cc8f24975db18686e64d2042490a85dca669fc",
+  "repositoryVersion": "0.30.0.0",
+  "publishVersion": "0.30.0",
+  "publishTag": "v0.30.0",
+  "schemasDigest": "sha256:f2fac98b4ea48578a3a7cc15008b0bc2db5c771fd46c68613159b5c8ac000887",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:6e5af7342005ceb5b2a175b3d5c3eb27e06fe5bfa57e74e2e854038b5f8cbad6",
-  "generatedTypeScriptDigest": "sha256:b6201aeb54e733aaf4f33c2bdf75054b3e10b1616e031620cce15ee72fb37770",
+  "generatedGoDigest": "sha256:da46f772799e1eb8fd530c3eb34937a8cfbf218f5ea6288f6614fe69cd3b3bc3",
+  "generatedTypeScriptDigest": "sha256:5e6ce1d6fb4b8dbcbab57b4495707fe323abd8d8a0433438aee16f57a000932c",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -51,7 +51,7 @@
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
     "schema/sanitized-binding-evidence.schema.json": "sha256:b03bcc1911c99c69fda50eb656fc3e115f88fe2990c1708fbb5cd3542f4b8bba",
     "schema/secret-reference.schema.json": "sha256:966f7a6d2575b46a4b54804d06dc05c6229ebbcbd9200fe6a6c8d3b4ffb90f9f",
-    "schema/security-scan-input.schema.json": "sha256:9f9c9e6131c1abee454320b77e4332e3780c0c63f108f54f75c93194a32ccff7",
+    "schema/security-scan-input.schema.json": "sha256:83502dffb3c07ac2e0698928e6dc123f454fc667d4aacd336bcad6944ef2ac3d",
     "schema/security-verdict.schema.json": "sha256:ec3c2d5c9df3601aeed0909b36c7f427469c7f0eeb3295c5809b96d09bf3fc26",
     "schema/transform-report.schema.json": "sha256:815e764445fb41b912d0c0468f00621ad61f941fb4c7b9364e3f204ad47cdf7f",
     "schema/version-state.schema.json": "sha256:e7c4b2e7b615ebb07f36d0df22ded51b2c9688ef9e9bfe79de1d5cd94de9ae40"
@@ -93,7 +93,7 @@
     "gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
     "gen-go/error_category.go": "sha256:a8b64524be3716e62ca6016e56f2332a56fa5e16e42647421e516aa01a7d6806",
     "gen-go/schema_documents.go": "sha256:4b9094aaf0acc4bae4b65784954853f0888572a53fa1a1dc354f97c88ded805f",
-    "gen-go/types.go": "sha256:bf6906826f4d1c490954cc4354322bf508c392cfc4b72a9a6fe9890f6b5a8d99",
+    "gen-go/types.go": "sha256:fccee4956ef19c796aae7c9f6ed346b6ccdedbb35f4d801f5970ff8ecb96a2c3",
     "gen-go/version_state.go": "sha256:827f8768359998409b86ea02d9ba1a149981928bae7161e4dc95fe0520ce7410"
   },
   "generatedTypeScript": {
@@ -142,7 +142,7 @@
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:4db7e9ed83f563a46e337815a55bbd6433864c41d9ec8e8a80810a16e3095ebb",
     "gen-ts/secret-reference.ts": "sha256:a8b65de72705b6f51f57cd8ca58881483108005b1fa4d19106c3e9cf1fa877e7",
-    "gen-ts/security-scan-input.ts": "sha256:5d9bde7394d8b34cca1d36b51ce17bf73cfccd9cfd7cab810f83d4de58f22285",
+    "gen-ts/security-scan-input.ts": "sha256:b31f048be04c34b40f49d3b3ba53277e473cd435ae9216ba3a3b4dac69fb5685",
     "gen-ts/security-verdict.ts": "sha256:fea950cddbd12fe0218e2573c9a29c6748d56612a464559f1e6d688fa97f68c7",
     "gen-ts/transform-report.ts": "sha256:6c54b579884d98135d73945d00980820b136f269622db27fa56a1c4c0e57d3b6",
     "gen-ts/version-state-machine.ts": "sha256:4371bc7e2bde86b0447f5242104c576cc160dfd7dae1885acbfb63540f230bdd",

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.29.0.0";
-export declare const ContractPublishVersion: "0.29.0";
-export declare const ContractPublishTag: "v0.29.0";
-export declare const ContractSchemasDigest: "sha256:4b21ea9a6b13193a189d2499f6cc8f24975db18686e64d2042490a85dca669fc";
+export declare const ContractRepositoryVersion: "0.30.0.0";
+export declare const ContractPublishVersion: "0.30.0";
+export declare const ContractPublishTag: "v0.30.0";
+export declare const ContractSchemasDigest: "sha256:f2fac98b4ea48578a3a7cc15008b0bc2db5c771fd46c68613159b5c8ac000887";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:6e5af7342005ceb5b2a175b3d5c3eb27e06fe5bfa57e74e2e854038b5f8cbad6";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:b6201aeb54e733aaf4f33c2bdf75054b3e10b1616e031620cce15ee72fb37770";
+export declare const ContractGeneratedGoDigest: "sha256:da46f772799e1eb8fd530c3eb34937a8cfbf218f5ea6288f6614fe69cd3b3bc3";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:5e6ce1d6fb4b8dbcbab57b4495707fe323abd8d8a0433438aee16f57a000932c";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.29.0.0";
-export const ContractPublishVersion = "0.29.0";
-export const ContractPublishTag = "v0.29.0";
-export const ContractSchemasDigest = "sha256:4b21ea9a6b13193a189d2499f6cc8f24975db18686e64d2042490a85dca669fc";
+export const ContractRepositoryVersion = "0.30.0.0";
+export const ContractPublishVersion = "0.30.0";
+export const ContractPublishTag = "v0.30.0";
+export const ContractSchemasDigest = "sha256:f2fac98b4ea48578a3a7cc15008b0bc2db5c771fd46c68613159b5c8ac000887";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:6e5af7342005ceb5b2a175b3d5c3eb27e06fe5bfa57e74e2e854038b5f8cbad6";
-export const ContractGeneratedTypeScriptDigest = "sha256:b6201aeb54e733aaf4f33c2bdf75054b3e10b1616e031620cce15ee72fb37770";
+export const ContractGeneratedGoDigest = "sha256:da46f772799e1eb8fd530c3eb34937a8cfbf218f5ea6288f6614fe69cd3b3bc3";
+export const ContractGeneratedTypeScriptDigest = "sha256:5e6ce1d6fb4b8dbcbab57b4495707fe323abd8d8a0433438aee16f57a000932c";

package/dist/gen-ts/security-scan-input.d.ts

@@ -1,9 +1,9 @@
 /**
- * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). M1 runs the SOURCE phase only; ARTIFACT is reserved in the enum so the contract is stable through M2. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance.
+ * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
  */
 export interface SecurityScanInput {
     /**
-     * Scan phase. M1 implements SOURCE only; ARTIFACT is reserved for M2 (image scan against an ECR digest) and is rejected by the machine until then.
+     * Scan phase. SOURCE (M1) scans the ingested snapshot for the commit; ARTIFACT (M2) scans built outputs named by imageDigest/bundleRef/infraRefs — at least one of which must be present.
      */
     phase: 'SOURCE' | 'ARTIFACT';
     /**
@@ -34,4 +34,55 @@ export interface SecurityScanInput {
      * Data classification of the app. Optional in v1 (decided 2026-08-27): when ABSENT the machine assumes the STANDARD profile and stamps classificationDefaulted: true in the verdict provenance. An invalid value still fails closed — only absence defaults. No classifier exists until M4; until then callers state it or accept the default.
      */
     classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
+    /**
+     * ARTIFACT phase: container image to scan, as either a digest-qualified ECR reference (<ecr-uri>@sha256:<64-hex>) or a bare sha256:<64-hex> digest. Digest-addressed only — tags are not accepted, so the scanned bytes are the deployed bytes.
+     */
+    imageDigest?: string;
+    bundleRef?: S3Ref;
+    /**
+     * ARTIFACT phase: S3 locations of synthesized infrastructure documents (e.g. CloudFormation templates) evaluated by policy (OPA/rego) checks.
+     *
+     * @minItems 1
+     */
+    infraRefs?: S3Ref1[];
+    /**
+     * Optional build-source provenance for ARTIFACT calls where the top-level repo/commit describe the source of the build rather than the artifact itself; stamped into verdict provenance verbatim.
+     */
+    provenance?: {
+        /**
+         * GitHub owner/name of the build-source repository.
+         */
+        repo: string;
+        /**
+         * Full 40-hex lowercase commit SHA the artifact was built from.
+         */
+        commit: string;
+        /**
+         * Branch the artifact was built from, caller-supplied provenance.
+         */
+        branch?: string;
+    };
+}
+/**
+ * ARTIFACT phase: S3 location of the built deployable bundle to scan.
+ */
+export interface S3Ref {
+    /**
+     * S3 bucket name.
+     */
+    bucket: string;
+    /**
+     * S3 object key.
+     */
+    key: string;
+}
+export interface S3Ref1 {
+    /**
+     * S3 bucket name.
+     */
+    bucket: string;
+    /**
+     * S3 object key.
+     */
+    key: string;
 }

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.29.0.0" as const;
-export const ContractPublishVersion = "0.29.0" as const;
-export const ContractPublishTag = "v0.29.0" as const;
-export const ContractSchemasDigest = "sha256:4b21ea9a6b13193a189d2499f6cc8f24975db18686e64d2042490a85dca669fc" as const;
+export const ContractRepositoryVersion = "0.30.0.0" as const;
+export const ContractPublishVersion = "0.30.0" as const;
+export const ContractPublishTag = "v0.30.0" as const;
+export const ContractSchemasDigest = "sha256:f2fac98b4ea48578a3a7cc15008b0bc2db5c771fd46c68613159b5c8ac000887" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:6e5af7342005ceb5b2a175b3d5c3eb27e06fe5bfa57e74e2e854038b5f8cbad6" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:b6201aeb54e733aaf4f33c2bdf75054b3e10b1616e031620cce15ee72fb37770" as const;
+export const ContractGeneratedGoDigest = "sha256:da46f772799e1eb8fd530c3eb34937a8cfbf218f5ea6288f6614fe69cd3b3bc3" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:5e6ce1d6fb4b8dbcbab57b4495707fe323abd8d8a0433438aee16f57a000932c" as const;

package/gen-ts/security-scan-input.ts

@@ -2,11 +2,11 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). M1 runs the SOURCE phase only; ARTIFACT is reserved in the enum so the contract is stable through M2. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance.
+ * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
  */
 export interface SecurityScanInput {
   /**
-   * Scan phase. M1 implements SOURCE only; ARTIFACT is reserved for M2 (image scan against an ECR digest) and is rejected by the machine until then.
+   * Scan phase. SOURCE (M1) scans the ingested snapshot for the commit; ARTIFACT (M2) scans built outputs named by imageDigest/bundleRef/infraRefs — at least one of which must be present.
    */
   phase: 'SOURCE' | 'ARTIFACT';
   /**
@@ -37,4 +37,55 @@ export interface SecurityScanInput {
    * Data classification of the app. Optional in v1 (decided 2026-08-27): when ABSENT the machine assumes the STANDARD profile and stamps classificationDefaulted: true in the verdict provenance. An invalid value still fails closed — only absence defaults. No classifier exists until M4; until then callers state it or accept the default.
    */
   classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
+  /**
+   * ARTIFACT phase: container image to scan, as either a digest-qualified ECR reference (<ecr-uri>@sha256:<64-hex>) or a bare sha256:<64-hex> digest. Digest-addressed only — tags are not accepted, so the scanned bytes are the deployed bytes.
+   */
+  imageDigest?: string;
+  bundleRef?: S3Ref;
+  /**
+   * ARTIFACT phase: S3 locations of synthesized infrastructure documents (e.g. CloudFormation templates) evaluated by policy (OPA/rego) checks.
+   *
+   * @minItems 1
+   */
+  infraRefs?: S3Ref1[];
+  /**
+   * Optional build-source provenance for ARTIFACT calls where the top-level repo/commit describe the source of the build rather than the artifact itself; stamped into verdict provenance verbatim.
+   */
+  provenance?: {
+    /**
+     * GitHub owner/name of the build-source repository.
+     */
+    repo: string;
+    /**
+     * Full 40-hex lowercase commit SHA the artifact was built from.
+     */
+    commit: string;
+    /**
+     * Branch the artifact was built from, caller-supplied provenance.
+     */
+    branch?: string;
+  };
+}
+/**
+ * ARTIFACT phase: S3 location of the built deployable bundle to scan.
+ */
+export interface S3Ref {
+  /**
+   * S3 bucket name.
+   */
+  bucket: string;
+  /**
+   * S3 object key.
+   */
+  key: string;
+}
+export interface S3Ref1 {
+  /**
+   * S3 bucket name.
+   */
+  bucket: string;
+  /**
+   * S3 object key.
+   */
+  key: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Harbour components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/security-scan-input.schema.json

@@ -2,15 +2,23 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/security-scan-input.schema.json",
   "title": "SecurityScanInput",
-  "description": "Input to the Harbour Security Assurance machine (Security Assurance LLD §2). M1 runs the SOURCE phase only; ARTIFACT is reserved in the enum so the contract is stable through M2. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance.",
+  "description": "Input to the Harbour Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.",
   "type": "object",
   "additionalProperties": false,
   "required": ["phase", "org", "app", "env", "repo", "commit", "branch"],
+  "if": { "properties": { "phase": { "const": "ARTIFACT" } }, "required": ["phase"] },
+  "then": {
+    "anyOf": [
+      { "required": ["imageDigest"] },
+      { "required": ["bundleRef"] },
+      { "required": ["infraRefs"] }
+    ]
+  },
   "properties": {
     "phase": {
       "type": "string",
       "enum": ["SOURCE", "ARTIFACT"],
-      "description": "Scan phase. M1 implements SOURCE only; ARTIFACT is reserved for M2 (image scan against an ECR digest) and is rejected by the machine until then."
+      "description": "Scan phase. SOURCE (M1) scans the ingested snapshot for the commit; ARTIFACT (M2) scans built outputs named by imageDigest/bundleRef/infraRefs — at least one of which must be present."
     },
     "org": {
       "type": "string",
@@ -47,6 +55,56 @@
       "type": "string",
       "enum": ["GREEN", "YELLOW", "ORANGE", "RED"],
       "description": "Data classification of the app. Optional in v1 (decided 2026-08-27): when ABSENT the machine assumes the STANDARD profile and stamps classificationDefaulted: true in the verdict provenance. An invalid value still fails closed — only absence defaults. No classifier exists until M4; until then callers state it or accept the default."
+    },
+    "imageDigest": {
+      "type": "string",
+      "pattern": "^([^@\\s]+@)?sha256:[0-9a-f]{64}$",
+      "description": "ARTIFACT phase: container image to scan, as either a digest-qualified ECR reference (<ecr-uri>@sha256:<64-hex>) or a bare sha256:<64-hex> digest. Digest-addressed only — tags are not accepted, so the scanned bytes are the deployed bytes."
+    },
+    "bundleRef": {
+      "$ref": "#/definitions/S3Ref",
+      "description": "ARTIFACT phase: S3 location of the built deployable bundle to scan."
+    },
+    "infraRefs": {
+      "type": "array",
+      "items": { "$ref": "#/definitions/S3Ref" },
+      "minItems": 1,
+      "description": "ARTIFACT phase: S3 locations of synthesized infrastructure documents (e.g. CloudFormation templates) evaluated by policy (OPA/rego) checks."
+    },
+    "provenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repo", "commit"],
+      "properties": {
+        "repo": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^[^/\\s]+/[^/\\s]+$",
+          "description": "GitHub owner/name of the build-source repository."
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40}$",
+          "description": "Full 40-hex lowercase commit SHA the artifact was built from."
+        },
+        "branch": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Branch the artifact was built from, caller-supplied provenance."
+        }
+      },
+      "description": "Optional build-source provenance for ARTIFACT calls where the top-level repo/commit describe the source of the build rather than the artifact itself; stamped into verdict provenance verbatim."
+    }
+  },
+  "definitions": {
+    "S3Ref": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["bucket", "key"],
+      "properties": {
+        "bucket": { "type": "string", "minLength": 1, "description": "S3 bucket name." },
+        "key": { "type": "string", "minLength": 1, "description": "S3 object key." }
+      }
     }
   }
 }