@fourier-labs/harbour-contracts 0.30.0 → 0.33.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -2
- package/contract-release.json +26 -24
- package/dist/gen-ts/ai-governance-decision.d.ts +18 -0
- package/dist/gen-ts/artifact-contract.d.ts +8 -0
- package/dist/gen-ts/contract-release.d.ts +6 -6
- package/dist/gen-ts/contract-release.js +6 -6
- package/dist/gen-ts/deploy-request.d.ts +2 -2
- package/dist/gen-ts/deployment-status-response.d.ts +14 -0
- package/dist/gen-ts/error-category-registry.js +1 -1
- package/dist/gen-ts/index.d.ts +1 -0
- package/dist/gen-ts/index.js +1 -0
- package/dist/gen-ts/version-state-machine.js +2 -1
- package/dist/gen-ts/well-defined-app-manifest.d.ts +66 -0
- package/dist/gen-ts/well-defined-app-manifest.js +3 -0
- package/gen-ts/ai-governance-decision.ts +18 -0
- package/gen-ts/artifact-contract.ts +8 -0
- package/gen-ts/contract-release.ts +6 -6
- package/gen-ts/deploy-request.ts +2 -2
- package/gen-ts/deployment-status-response.ts +14 -0
- package/gen-ts/error-category-registry.ts +1 -1
- package/gen-ts/index.ts +1 -0
- package/gen-ts/version-state-machine.ts +2 -1
- package/gen-ts/well-defined-app-manifest.ts +70 -0
- package/package.json +1 -1
- package/schema/ai-governance-decision.schema.json +22 -0
- package/schema/artifact-contract.schema.json +11 -0
- package/schema/deploy-request.schema.json +2 -2
- package/schema/deployment-status-response.schema.json +22 -0
- package/schema/error-category.enum.json +1 -1
- package/schema/version-state.schema.json +5 -1
- package/schema/well-defined-app-manifest.schema.json +152 -0
package/README.md
CHANGED
|
@@ -21,16 +21,18 @@ exist here first.
|
|
|
21
21
|
|
|
22
22
|
| File | Shape | LLD |
|
|
23
23
|
|---|---|---|
|
|
24
|
-
| `deploy-request.schema.json` | MCP `deploy(app, {commit, branch})` payload | §7 |
|
|
24
|
+
| `deploy-request.schema.json` | MCP `deploy(app, {commit, branch})` payload; new preview deploys default to `branch_select` unless `sequential` is explicit | §7 |
|
|
25
25
|
| `error-envelope.schema.json` | The failure envelope emitted once per FAILED transition | §2.1 |
|
|
26
26
|
| `error-category.enum.json` | Closed failure-category enum + per-category `retryable` registry | §2.2 |
|
|
27
|
-
| `artifact-contract.schema.json` | Build output contract (the provider-portability seam) | §3 |
|
|
27
|
+
| `artifact-contract.schema.json` | Build output contract (the provider-portability seam), including the digest-pinned well-defined app manifest reference | §3 |
|
|
28
|
+
| `well-defined-app-manifest.schema.json` | Versioned runtime wiring for static, full-stack, and browser-first apps: workloads, schedules, queues, and service bindings | Well-defined apps P0 |
|
|
28
29
|
| `version-state.schema.json` | State machine T1a — states, legal transitions, versionId format | §1 |
|
|
29
30
|
| `env-bindings.schema.json` | `EnvBindings` / `Target` / `Binding` (BYOC-complete) | §4.2.2 |
|
|
30
31
|
| `kvs-routing-entry.schema.json` | CloudFront KVS routing value (`{static, api}`) | §8 |
|
|
31
32
|
| `ai-composite-policy-digest.schema.json` | Ordered composite-policy digest identity and generated Go/TS helpers | AI governance §5.1 |
|
|
32
33
|
| `ai-classification-stamp.schema.json` | Immutable exact-version classification evidence | AI governance §5.2 |
|
|
33
34
|
| `ai-deployment-gate-decision.schema.json` | Append-only explicit deployment gate decision | AI governance §5.2 |
|
|
35
|
+
| `ai-governance-decision.schema.json` | AI governance decision, including value-free descriptors for reviewed OpenAI-compatible client configuration boundaries | AI governance §5 |
|
|
34
36
|
| `ai-gateway-key-lifecycle-event.schema.json` | Value-free version-key lifecycle evidence | AI governance §7 |
|
|
35
37
|
| `ai-runtime-binding.schema.json` | Platform-neutral workload identity/secret binding | AI governance §5.8 |
|
|
36
38
|
| `binding-classification-subject.schema.json` | Complete value-free binding-name classification before version allocation | AI governance §5.7 / SEC-UP-01 |
|
package/contract-release.json
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema": "harbour.contract-release/1.0",
|
|
3
|
-
"repositoryVersion": "0.
|
|
4
|
-
"publishVersion": "0.
|
|
5
|
-
"publishTag": "v0.
|
|
6
|
-
"schemasDigest": "sha256:
|
|
3
|
+
"repositoryVersion": "0.33.0.0",
|
|
4
|
+
"publishVersion": "0.33.0",
|
|
5
|
+
"publishTag": "v0.33.0",
|
|
6
|
+
"schemasDigest": "sha256:dd106c711981c50f8ab49cf6c54bf201aa27f36a40d6c108aa0a1c2916d1d72c",
|
|
7
7
|
"aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
|
|
8
|
-
"generatedGoDigest": "sha256:
|
|
9
|
-
"generatedTypeScriptDigest": "sha256:
|
|
8
|
+
"generatedGoDigest": "sha256:64d1d6efa060927f70394bd1d4758ca1008c1ccff30b34c1b50c518d27155a3b",
|
|
9
|
+
"generatedTypeScriptDigest": "sha256:dc9111b80945f2a233e382bc462140dca0de45dd29ffc824124d9b555fd769c7",
|
|
10
10
|
"generatedExclusions": {
|
|
11
11
|
"gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
|
|
12
12
|
"gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
"schema/ai-deployment-gate-decision.schema.json": "sha256:bae1bdf91777b9a78f8da5a29f06b5de7f1e235789cf16b1bb507e85ad0243ff",
|
|
20
20
|
"schema/ai-gateway-key-lifecycle-event.schema.json": "sha256:ba5cb862abe73227bee714b25247b4cacb34f11fdd1476bb5f920923fd75e2a9",
|
|
21
21
|
"schema/ai-gateway-key-lookup.schema.json": "sha256:e994d4782c9bc4f14d3a1c35c9ac1e7a5ec84284cde5b3af7e3e6022130ddbb3",
|
|
22
|
-
"schema/ai-governance-decision.schema.json": "sha256:
|
|
22
|
+
"schema/ai-governance-decision.schema.json": "sha256:d650762a428350748deafd6b251cbd4a03ba564650e74204f1a77bbe923e145f",
|
|
23
23
|
"schema/ai-metering-policy.schema.json": "sha256:044115938d254d914feac162219d20ee48f741cd7ad32df4613b45f9c862fe8c",
|
|
24
24
|
"schema/ai-policy-snapshot.schema.json": "sha256:8229b855861e029c7792c4c43d42c209055f175af747f437570d42c5008f70d8",
|
|
25
25
|
"schema/ai-pricing-revision.schema.json": "sha256:5ddb40c23712c0cec37b733678e4bb34811f5db44a233773c21a7dfaec188375",
|
|
@@ -31,20 +31,20 @@
|
|
|
31
31
|
"schema/ai-transform-result.schema.json": "sha256:244e380a36957ab2dcb526ea22aaecb56b53664ce1fda6934d0021c084c99133",
|
|
32
32
|
"schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
|
|
33
33
|
"schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
|
|
34
|
-
"schema/artifact-contract.schema.json": "sha256:
|
|
34
|
+
"schema/artifact-contract.schema.json": "sha256:dddfeb765c7ee510bc3781689bef21e12689df50f6eabb41806083d6793cbfc5",
|
|
35
35
|
"schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
|
|
36
36
|
"schema/data-dependency.schema.json": "sha256:89ba8481ccabc935e7dab5d13871c985839a751ad1586710d8382a15e1f3340c",
|
|
37
37
|
"schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
|
|
38
38
|
"schema/data-source.schema.json": "sha256:5a809171cc97f5778ca37db300d454098ce1c2d9071d2380550707b049899a75",
|
|
39
|
-
"schema/deploy-request.schema.json": "sha256:
|
|
39
|
+
"schema/deploy-request.schema.json": "sha256:971575fa250eaed300337ecd262a5f2ace0fe4c32de5aa51cd6a995fc3f5cb41",
|
|
40
40
|
"schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
|
|
41
41
|
"schema/deployment-environment.schema.json": "sha256:3f1325d5579b3fc47d02c83b6ac0657108909b1dfb901f68203c9c8b668c2ef4",
|
|
42
42
|
"schema/deployment-source.schema.json": "sha256:256988b1efbfc90bd0e1ae31a2c5d69b20ef1e4471dc24c9f9aa759278270fbe",
|
|
43
43
|
"schema/deployment-status-failure.schema.json": "sha256:1a182e603d22467a4be507a37fd10698f6f3178d314d33eaf5de2c7f687c9412",
|
|
44
44
|
"schema/deployment-status-request.schema.json": "sha256:1f9f87adc947a252b53b61f71ae17f8c1b8fbc1166f31301a043d11ac257dc66",
|
|
45
|
-
"schema/deployment-status-response.schema.json": "sha256:
|
|
45
|
+
"schema/deployment-status-response.schema.json": "sha256:ce6b4e10a4302dff75c8958a3555f3a323e407e8cd2d2dce58550e7cb6cff1c8",
|
|
46
46
|
"schema/env-bindings.schema.json": "sha256:ae09bc4ca5508afa698ef854a59153c4c6f99b07017b48cb9b07ce05abad12f2",
|
|
47
|
-
"schema/error-category.enum.json": "sha256:
|
|
47
|
+
"schema/error-category.enum.json": "sha256:92b29448d5336797e73a854e134dd6a58c4c03c5f80a3c4e81024144e1f881b8",
|
|
48
48
|
"schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
|
|
49
49
|
"schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
|
|
50
50
|
"schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
|
|
@@ -54,7 +54,8 @@
|
|
|
54
54
|
"schema/security-scan-input.schema.json": "sha256:83502dffb3c07ac2e0698928e6dc123f454fc667d4aacd336bcad6944ef2ac3d",
|
|
55
55
|
"schema/security-verdict.schema.json": "sha256:ec3c2d5c9df3601aeed0909b36c7f427469c7f0eeb3295c5809b96d09bf3fc26",
|
|
56
56
|
"schema/transform-report.schema.json": "sha256:815e764445fb41b912d0c0468f00621ad61f941fb4c7b9364e3f204ad47cdf7f",
|
|
57
|
-
"schema/version-state.schema.json": "sha256:
|
|
57
|
+
"schema/version-state.schema.json": "sha256:3b190007e2f8e3821c41ef11c6f5b226da7d5a18d34d4077f4618004846fd444",
|
|
58
|
+
"schema/well-defined-app-manifest.schema.json": "sha256:d863433d7b68260a08aa0d33f897526c8f74f5f0ee8d242a6dd6c0bb23e60987"
|
|
58
59
|
},
|
|
59
60
|
"aiFixtures": {
|
|
60
61
|
"fixtures/ai/adversarial-binding-classification-value.json": "sha256:ca009f3f6162a9d93b4ab416d52c1fba12a8a15aca5aed956c5fdcf2171b1e28",
|
|
@@ -89,12 +90,12 @@
|
|
|
89
90
|
"gen-go/ai_contracts_test.go": "sha256:17ce967139e39c291ee7ebad3f66cc0495324abc4e56885279f7e5cc74994036",
|
|
90
91
|
"gen-go/ai_gateway_key_token.go": "sha256:859c34383955f21c22589158214df074b74de6907a54bee7c781acfa9dad8679",
|
|
91
92
|
"gen-go/binding_digest_helpers.go": "sha256:50462ba2beb16c7931dfc7e10302c12c90bf8111788991f74f08a718125dfbfb",
|
|
92
|
-
"gen-go/contracts_test.go": "sha256:
|
|
93
|
+
"gen-go/contracts_test.go": "sha256:56376287cb1548be1b35ab4c65d6f0b558c5d34885f7a47cb3d9e8d786607bf5",
|
|
93
94
|
"gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
|
|
94
|
-
"gen-go/error_category.go": "sha256:
|
|
95
|
+
"gen-go/error_category.go": "sha256:dbbc54e04b988a23b08cc5f6f368555e1b8e9c3633261f593fa9fda8b29a537e",
|
|
95
96
|
"gen-go/schema_documents.go": "sha256:4b9094aaf0acc4bae4b65784954853f0888572a53fa1a1dc354f97c88ded805f",
|
|
96
|
-
"gen-go/types.go": "sha256:
|
|
97
|
-
"gen-go/version_state.go": "sha256:
|
|
97
|
+
"gen-go/types.go": "sha256:3e61602b15af478141ec368bc2208b4f496d686004bbcbb4910bdc93a0901b08",
|
|
98
|
+
"gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
|
|
98
99
|
},
|
|
99
100
|
"generatedTypeScript": {
|
|
100
101
|
"gen-ts/ai-budget-ledger-event.ts": "sha256:64448d98a394e6eb103927cd35ce8a33e30176c0d5ee5afcdd8444f8aa051809",
|
|
@@ -106,7 +107,7 @@
|
|
|
106
107
|
"gen-ts/ai-gateway-key-lifecycle-event.ts": "sha256:8f1ab4774be1959e82c97da20ec8b293f3f10262f95393d2ae57e4c7817353cb",
|
|
107
108
|
"gen-ts/ai-gateway-key-lookup.ts": "sha256:e55fc9a2252d5e7e1a383a58c8b92f22d8147ee4862a893a6cfe815b4225fc00",
|
|
108
109
|
"gen-ts/ai-gateway-key-token.ts": "sha256:ff6551ad3332cc665878d7ec93f42ce185c375e637531b2fbc82c697b877e784",
|
|
109
|
-
"gen-ts/ai-governance-decision.ts": "sha256:
|
|
110
|
+
"gen-ts/ai-governance-decision.ts": "sha256:4a04e116f2ec281104e616a8ba414f23a9d34d398f850888d27510173e39c5c3",
|
|
110
111
|
"gen-ts/ai-metering-policy.ts": "sha256:dd261d57646a509cd46efaefac4aad58d018c7f7da98326dd8859e4ce951c56a",
|
|
111
112
|
"gen-ts/ai-policy-snapshot.ts": "sha256:05f5cea100e43a5cc6c1e8c7c07edea974ea0e6785730f622e824e40128f1ebc",
|
|
112
113
|
"gen-ts/ai-pricing-revision.ts": "sha256:48afdea7fb09b9a392147a0a62bcee013157a9d536c07e0782ef28781a3000de",
|
|
@@ -118,24 +119,24 @@
|
|
|
118
119
|
"gen-ts/ai-transform-result.ts": "sha256:208c66b2aeb425c0cbcc18b7191f6e8989443f2b2c1690648e0e06cc1448ce25",
|
|
119
120
|
"gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
|
|
120
121
|
"gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
|
|
121
|
-
"gen-ts/artifact-contract.ts": "sha256:
|
|
122
|
+
"gen-ts/artifact-contract.ts": "sha256:e14be765244303e311bf97004d70d8d40d37da5accfcc084765257f69b5ca15c",
|
|
122
123
|
"gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
|
|
123
124
|
"gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
|
|
124
125
|
"gen-ts/data-dependency.ts": "sha256:0572c31d7ae9088eccc104eee1a205bf176d1d6dacfaf0f290d666024e284966",
|
|
125
126
|
"gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
|
|
126
127
|
"gen-ts/data-source.ts": "sha256:71be83b050468c2ea8c5830d28f1837c2b5929d23b4fdf6661bc5bfe8999904c",
|
|
127
|
-
"gen-ts/deploy-request.ts": "sha256:
|
|
128
|
+
"gen-ts/deploy-request.ts": "sha256:6bc33531f8d18611dff10f4efd75da56cdd9a773655047db26af9d832a6ac48a",
|
|
128
129
|
"gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
|
|
129
130
|
"gen-ts/deployment-environment.ts": "sha256:bbd6eec3a1631b13a8de6e6b95081696f7be01d0bd2bf1b7a9e3a1db809a727c",
|
|
130
131
|
"gen-ts/deployment-source.ts": "sha256:8ccb55aaa7260eb6d19a00987d6a20a4b514e343564da13f27cd7fee8013500a",
|
|
131
132
|
"gen-ts/deployment-status-failure.ts": "sha256:3ffe268e32240f9da3172b161b8e99e06aa2d21d8c37b30f340506a337c64047",
|
|
132
133
|
"gen-ts/deployment-status-request.ts": "sha256:7ddccd07ab9f6d0821903a291ab35f903bb055727e03a058b99165ec048f6483",
|
|
133
|
-
"gen-ts/deployment-status-response.ts": "sha256:
|
|
134
|
+
"gen-ts/deployment-status-response.ts": "sha256:1a082b43663b9d7e6f2377c91713bf0792d52060beed5f2bad7879d0ac718bd3",
|
|
134
135
|
"gen-ts/env-bindings.ts": "sha256:a167cfe9842352c9fec6412ff0d82bda9c5f5c3a1af541bd5c27a57f54fd0941",
|
|
135
|
-
"gen-ts/error-category-registry.ts": "sha256:
|
|
136
|
+
"gen-ts/error-category-registry.ts": "sha256:c28e9a6c532ec326f9832edee1432436e01ff6a7c5a4c066a7a465318dddebe2",
|
|
136
137
|
"gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
|
|
137
138
|
"gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
|
|
138
|
-
"gen-ts/index.ts": "sha256:
|
|
139
|
+
"gen-ts/index.ts": "sha256:4aecbb1044a210bf5813deb645c623eefa7bb6af2a8e2557b76ed9ba1d95eba9",
|
|
139
140
|
"gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
|
|
140
141
|
"gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
|
|
141
142
|
"gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
|
|
@@ -145,7 +146,8 @@
|
|
|
145
146
|
"gen-ts/security-scan-input.ts": "sha256:b31f048be04c34b40f49d3b3ba53277e473cd435ae9216ba3a3b4dac69fb5685",
|
|
146
147
|
"gen-ts/security-verdict.ts": "sha256:fea950cddbd12fe0218e2573c9a29c6748d56612a464559f1e6d688fa97f68c7",
|
|
147
148
|
"gen-ts/transform-report.ts": "sha256:6c54b579884d98135d73945d00980820b136f269622db27fa56a1c4c0e57d3b6",
|
|
148
|
-
"gen-ts/version-state-machine.ts": "sha256:
|
|
149
|
-
"gen-ts/version-state.ts": "sha256:a835112930299e7b593a1b8810b7414f6c9e809da2092306c743128170a3b702"
|
|
149
|
+
"gen-ts/version-state-machine.ts": "sha256:c67af3e86ac306743345b850dfd3ae5201c19d10c40e2c149cf8c38258320d5f",
|
|
150
|
+
"gen-ts/version-state.ts": "sha256:a835112930299e7b593a1b8810b7414f6c9e809da2092306c743128170a3b702",
|
|
151
|
+
"gen-ts/well-defined-app-manifest.ts": "sha256:0c5c2fed747ad7f4c1034104c1acd9bb2e316f2c0b08a4ff3e2fab486f576a2f"
|
|
150
152
|
}
|
|
151
153
|
}
|
|
@@ -76,6 +76,13 @@ export interface AiDecisionRuntimeContract {
|
|
|
76
76
|
realtime?: string;
|
|
77
77
|
};
|
|
78
78
|
policyDigest: AiDecisionDigest;
|
|
79
|
+
/**
|
|
80
|
+
* Optional value-free descriptors for reviewed non-standard client environment boundaries. Mapping IDs are unique within a contract.
|
|
81
|
+
*
|
|
82
|
+
* @minItems 1
|
|
83
|
+
* @maxItems 16
|
|
84
|
+
*/
|
|
85
|
+
configurationMappings?: AiDecisionConfigurationMappingDescriptor[];
|
|
79
86
|
runtimeBinding?: AiDecisionRuntimeBinding;
|
|
80
87
|
/**
|
|
81
88
|
* @minItems 1
|
|
@@ -83,6 +90,17 @@ export interface AiDecisionRuntimeContract {
|
|
|
83
90
|
*/
|
|
84
91
|
requiredStrategies: ('deployment_injection' | 'deterministic_adapter')[];
|
|
85
92
|
}
|
|
93
|
+
/**
|
|
94
|
+
* Value-free descriptor for one registered OpenAI-compatible client environment boundary. Secret values are never part of this descriptor.
|
|
95
|
+
*/
|
|
96
|
+
export interface AiDecisionConfigurationMappingDescriptor {
|
|
97
|
+
mappingId: string;
|
|
98
|
+
version: string;
|
|
99
|
+
protocol: 'openai-chat';
|
|
100
|
+
providerId: string;
|
|
101
|
+
apiKeyEnvironmentName: string;
|
|
102
|
+
baseUrlEnvironmentName: string;
|
|
103
|
+
}
|
|
86
104
|
export interface AiDecisionRuntimeBinding {
|
|
87
105
|
schema: 'harbour.ai-runtime-binding/1.0';
|
|
88
106
|
platform: string;
|
|
@@ -85,6 +85,14 @@ export interface ArtifactContract {
|
|
|
85
85
|
*/
|
|
86
86
|
background_jobs?: 'none' | 'sqs';
|
|
87
87
|
};
|
|
88
|
+
/**
|
|
89
|
+
* Optional digest-pinned P0 well-defined application manifest. Provisioning reads the referenced document without re-analyzing source.
|
|
90
|
+
*/
|
|
91
|
+
well_defined_app?: {
|
|
92
|
+
version: 1;
|
|
93
|
+
path: '.harbour/app-manifest.json';
|
|
94
|
+
sha256: string;
|
|
95
|
+
};
|
|
88
96
|
/**
|
|
89
97
|
* Optional method/path authentication policy compiled by the transformation. The default is SSO; listed routes preserve the application's own token, signature, or callback authorization.
|
|
90
98
|
*/
|
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
export declare const ContractRepositoryVersion: "0.
|
|
2
|
-
export declare const ContractPublishVersion: "0.
|
|
3
|
-
export declare const ContractPublishTag: "v0.
|
|
4
|
-
export declare const ContractSchemasDigest: "sha256:
|
|
1
|
+
export declare const ContractRepositoryVersion: "0.33.0.0";
|
|
2
|
+
export declare const ContractPublishVersion: "0.33.0";
|
|
3
|
+
export declare const ContractPublishTag: "v0.33.0";
|
|
4
|
+
export declare const ContractSchemasDigest: "sha256:dd106c711981c50f8ab49cf6c54bf201aa27f36a40d6c108aa0a1c2916d1d72c";
|
|
5
5
|
export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
|
|
6
|
-
export declare const ContractGeneratedGoDigest: "sha256:
|
|
7
|
-
export declare const ContractGeneratedTypeScriptDigest: "sha256:
|
|
6
|
+
export declare const ContractGeneratedGoDigest: "sha256:64d1d6efa060927f70394bd1d4758ca1008c1ccff30b34c1b50c518d27155a3b";
|
|
7
|
+
export declare const ContractGeneratedTypeScriptDigest: "sha256:dc9111b80945f2a233e382bc462140dca0de45dd29ffc824124d9b555fd769c7";
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
/* eslint-disable */
|
|
2
2
|
// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
|
|
3
|
-
export const ContractRepositoryVersion = "0.
|
|
4
|
-
export const ContractPublishVersion = "0.
|
|
5
|
-
export const ContractPublishTag = "v0.
|
|
6
|
-
export const ContractSchemasDigest = "sha256:
|
|
3
|
+
export const ContractRepositoryVersion = "0.33.0.0";
|
|
4
|
+
export const ContractPublishVersion = "0.33.0";
|
|
5
|
+
export const ContractPublishTag = "v0.33.0";
|
|
6
|
+
export const ContractSchemasDigest = "sha256:dd106c711981c50f8ab49cf6c54bf201aa27f36a40d6c108aa0a1c2916d1d72c";
|
|
7
7
|
export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
|
|
8
|
-
export const ContractGeneratedGoDigest = "sha256:
|
|
9
|
-
export const ContractGeneratedTypeScriptDigest = "sha256:
|
|
8
|
+
export const ContractGeneratedGoDigest = "sha256:64d1d6efa060927f70394bd1d4758ca1008c1ccff30b34c1b50c518d27155a3b";
|
|
9
|
+
export const ContractGeneratedTypeScriptDigest = "sha256:dc9111b80945f2a233e382bc462140dca0de45dd29ffc824124d9b555fd769c7";
|
|
@@ -77,11 +77,11 @@ export interface DeployRequestEnvironmentBindings {
|
|
|
77
77
|
bindings: DeployRequestEnvironmentBinding[];
|
|
78
78
|
}
|
|
79
79
|
/**
|
|
80
|
-
* Optional transformation-engine selection.
|
|
80
|
+
* Optional transformation-engine selection. New preview deployments default to branch_select; set sequential explicitly for the legacy engine.
|
|
81
81
|
*/
|
|
82
82
|
export interface DeployRequestTransform {
|
|
83
83
|
/**
|
|
84
|
-
* Transformation engine. Omit to
|
|
84
|
+
* Transformation engine. Omit to use branch_select for a newly admitted preview deployment.
|
|
85
85
|
*/
|
|
86
86
|
strategy?: 'sequential' | 'branch_select';
|
|
87
87
|
}
|
|
@@ -25,6 +25,7 @@ export interface DeploymentStatusResponse {
|
|
|
25
25
|
* @maxItems 50
|
|
26
26
|
*/
|
|
27
27
|
progress?: StatusProgressEvent[];
|
|
28
|
+
deployTarget?: StatusDeployTarget;
|
|
28
29
|
}
|
|
29
30
|
export interface StatusFailureProjection {
|
|
30
31
|
category: string;
|
|
@@ -64,3 +65,16 @@ export interface StatusProgressEvent {
|
|
|
64
65
|
remainingMs?: number;
|
|
65
66
|
origin?: 'initial' | 'widen';
|
|
66
67
|
}
|
|
68
|
+
/**
|
|
69
|
+
* The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means harbour-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.
|
|
70
|
+
*/
|
|
71
|
+
export interface StatusDeployTarget {
|
|
72
|
+
/**
|
|
73
|
+
* AWS account id the version deploys into.
|
|
74
|
+
*/
|
|
75
|
+
account: string;
|
|
76
|
+
/**
|
|
77
|
+
* AWS region the version deploys into, e.g. eu-west-1.
|
|
78
|
+
*/
|
|
79
|
+
region: string;
|
|
80
|
+
}
|
|
@@ -56,7 +56,7 @@ const retryableExact = {
|
|
|
56
56
|
"storage.sqlite-misclassified": false,
|
|
57
57
|
"storage.mapping-drift": false,
|
|
58
58
|
"storage.unavailable": true,
|
|
59
|
-
"transform.deadline-exceeded":
|
|
59
|
+
"transform.deadline-exceeded": true,
|
|
60
60
|
"transform.validation-failed": true,
|
|
61
61
|
"frontend.env-inlined-unfixable": false,
|
|
62
62
|
"build.recipe-failed": false,
|
package/dist/gen-ts/index.d.ts
CHANGED
package/dist/gen-ts/index.js
CHANGED
|
@@ -32,7 +32,8 @@ const legalTransitions = {
|
|
|
32
32
|
"PROMOTING": { "LIVE": true, "FAILED": true },
|
|
33
33
|
},
|
|
34
34
|
"prod": {
|
|
35
|
-
"QUEUED": { "PROMOTING": true, "FAILED": true },
|
|
35
|
+
"QUEUED": { "PROMOTING": true, "GATING": true, "FAILED": true },
|
|
36
|
+
"GATING": { "PROMOTING": true, "FAILED": true, "STALE": true },
|
|
36
37
|
"PROMOTING": { "LIVE": true, "FAILED": true },
|
|
37
38
|
},
|
|
38
39
|
};
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
export type Workload = {
|
|
2
|
+
name: string;
|
|
3
|
+
kind: 'web' | 'action' | 'worker' | 'cron' | 'job';
|
|
4
|
+
command: Command;
|
|
5
|
+
resourceProfile: ResourceProfile;
|
|
6
|
+
port?: number;
|
|
7
|
+
alwaysOn?: boolean;
|
|
8
|
+
queueConsumer?: QueueConsumer;
|
|
9
|
+
schedule?: Schedule;
|
|
10
|
+
runPolicy?: RunPolicy;
|
|
11
|
+
};
|
|
12
|
+
/**
|
|
13
|
+
* @minItems 1
|
|
14
|
+
* @maxItems 32
|
|
15
|
+
*/
|
|
16
|
+
export type Command = string[];
|
|
17
|
+
export type ResourceProfile = 'standard' | 'memory-1g';
|
|
18
|
+
/**
|
|
19
|
+
* Versioned provisioning input emitted by Harbour Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.
|
|
20
|
+
*/
|
|
21
|
+
export interface WellDefinedAppManifest {
|
|
22
|
+
version: 1;
|
|
23
|
+
architecture: 'static-v1' | 'fullstack-v1' | 'spa-harbour-data-v1';
|
|
24
|
+
/**
|
|
25
|
+
* Required only when transformed browser code uses @harbour/app-sdk.
|
|
26
|
+
*/
|
|
27
|
+
sdkMajor?: 1;
|
|
28
|
+
/**
|
|
29
|
+
* @maxItems 64
|
|
30
|
+
*/
|
|
31
|
+
workloads: Workload[];
|
|
32
|
+
/**
|
|
33
|
+
* @maxItems 128
|
|
34
|
+
*/
|
|
35
|
+
bindings: WorkloadBinding[];
|
|
36
|
+
}
|
|
37
|
+
export interface QueueConsumer {
|
|
38
|
+
logicalName: string;
|
|
39
|
+
minReplicas: number;
|
|
40
|
+
maxReplicas: number;
|
|
41
|
+
cooldownSeconds: number;
|
|
42
|
+
}
|
|
43
|
+
export interface Schedule {
|
|
44
|
+
cron: string;
|
|
45
|
+
timeZone: string;
|
|
46
|
+
concurrencyPolicy: 'Allow' | 'Forbid' | 'Replace';
|
|
47
|
+
startingDeadlineSeconds: number;
|
|
48
|
+
timeoutSeconds: number;
|
|
49
|
+
retries: number;
|
|
50
|
+
successfulHistoryLimit: number;
|
|
51
|
+
failedHistoryLimit: number;
|
|
52
|
+
}
|
|
53
|
+
export interface RunPolicy {
|
|
54
|
+
timeoutSeconds: number;
|
|
55
|
+
retries: number;
|
|
56
|
+
ttlSecondsAfterFinished: number;
|
|
57
|
+
}
|
|
58
|
+
export interface WorkloadBinding {
|
|
59
|
+
kind: 'database' | 'files' | 'queue' | 'secret' | 'external';
|
|
60
|
+
logicalName: string;
|
|
61
|
+
provider: 'aurora-postgresql' | 's3-private' | 'nats-jetstream' | 'secrets-manager' | 'external-https';
|
|
62
|
+
/**
|
|
63
|
+
* Value-free control-plane identifier. Never a credential or provider URL.
|
|
64
|
+
*/
|
|
65
|
+
reference?: string;
|
|
66
|
+
}
|
|
@@ -80,6 +80,13 @@ export interface AiDecisionRuntimeContract {
|
|
|
80
80
|
realtime?: string;
|
|
81
81
|
};
|
|
82
82
|
policyDigest: AiDecisionDigest;
|
|
83
|
+
/**
|
|
84
|
+
* Optional value-free descriptors for reviewed non-standard client environment boundaries. Mapping IDs are unique within a contract.
|
|
85
|
+
*
|
|
86
|
+
* @minItems 1
|
|
87
|
+
* @maxItems 16
|
|
88
|
+
*/
|
|
89
|
+
configurationMappings?: AiDecisionConfigurationMappingDescriptor[];
|
|
83
90
|
runtimeBinding?: AiDecisionRuntimeBinding;
|
|
84
91
|
/**
|
|
85
92
|
* @minItems 1
|
|
@@ -87,6 +94,17 @@ export interface AiDecisionRuntimeContract {
|
|
|
87
94
|
*/
|
|
88
95
|
requiredStrategies: ('deployment_injection' | 'deterministic_adapter')[];
|
|
89
96
|
}
|
|
97
|
+
/**
|
|
98
|
+
* Value-free descriptor for one registered OpenAI-compatible client environment boundary. Secret values are never part of this descriptor.
|
|
99
|
+
*/
|
|
100
|
+
export interface AiDecisionConfigurationMappingDescriptor {
|
|
101
|
+
mappingId: string;
|
|
102
|
+
version: string;
|
|
103
|
+
protocol: 'openai-chat';
|
|
104
|
+
providerId: string;
|
|
105
|
+
apiKeyEnvironmentName: string;
|
|
106
|
+
baseUrlEnvironmentName: string;
|
|
107
|
+
}
|
|
90
108
|
export interface AiDecisionRuntimeBinding {
|
|
91
109
|
schema: 'harbour.ai-runtime-binding/1.0';
|
|
92
110
|
platform: string;
|
|
@@ -88,6 +88,14 @@ export interface ArtifactContract {
|
|
|
88
88
|
*/
|
|
89
89
|
background_jobs?: 'none' | 'sqs';
|
|
90
90
|
};
|
|
91
|
+
/**
|
|
92
|
+
* Optional digest-pinned P0 well-defined application manifest. Provisioning reads the referenced document without re-analyzing source.
|
|
93
|
+
*/
|
|
94
|
+
well_defined_app?: {
|
|
95
|
+
version: 1;
|
|
96
|
+
path: '.harbour/app-manifest.json';
|
|
97
|
+
sha256: string;
|
|
98
|
+
};
|
|
91
99
|
/**
|
|
92
100
|
* Optional method/path authentication policy compiled by the transformation. The default is SSO; listed routes preserve the application's own token, signature, or callback authorization.
|
|
93
101
|
*/
|
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
/* eslint-disable */
|
|
2
2
|
// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
|
|
3
3
|
|
|
4
|
-
export const ContractRepositoryVersion = "0.
|
|
5
|
-
export const ContractPublishVersion = "0.
|
|
6
|
-
export const ContractPublishTag = "v0.
|
|
7
|
-
export const ContractSchemasDigest = "sha256:
|
|
4
|
+
export const ContractRepositoryVersion = "0.33.0.0" as const;
|
|
5
|
+
export const ContractPublishVersion = "0.33.0" as const;
|
|
6
|
+
export const ContractPublishTag = "v0.33.0" as const;
|
|
7
|
+
export const ContractSchemasDigest = "sha256:dd106c711981c50f8ab49cf6c54bf201aa27f36a40d6c108aa0a1c2916d1d72c" as const;
|
|
8
8
|
export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
|
|
9
|
-
export const ContractGeneratedGoDigest = "sha256:
|
|
10
|
-
export const ContractGeneratedTypeScriptDigest = "sha256:
|
|
9
|
+
export const ContractGeneratedGoDigest = "sha256:64d1d6efa060927f70394bd1d4758ca1008c1ccff30b34c1b50c518d27155a3b" as const;
|
|
10
|
+
export const ContractGeneratedTypeScriptDigest = "sha256:dc9111b80945f2a233e382bc462140dca0de45dd29ffc824124d9b555fd769c7" as const;
|
package/gen-ts/deploy-request.ts
CHANGED
|
@@ -81,11 +81,11 @@ export interface DeployRequestEnvironmentBindings {
|
|
|
81
81
|
bindings: DeployRequestEnvironmentBinding[];
|
|
82
82
|
}
|
|
83
83
|
/**
|
|
84
|
-
* Optional transformation-engine selection.
|
|
84
|
+
* Optional transformation-engine selection. New preview deployments default to branch_select; set sequential explicitly for the legacy engine.
|
|
85
85
|
*/
|
|
86
86
|
export interface DeployRequestTransform {
|
|
87
87
|
/**
|
|
88
|
-
* Transformation engine. Omit to
|
|
88
|
+
* Transformation engine. Omit to use branch_select for a newly admitted preview deployment.
|
|
89
89
|
*/
|
|
90
90
|
strategy?: 'sequential' | 'branch_select';
|
|
91
91
|
}
|
|
@@ -40,6 +40,7 @@ export interface DeploymentStatusResponse {
|
|
|
40
40
|
* @maxItems 50
|
|
41
41
|
*/
|
|
42
42
|
progress?: StatusProgressEvent[];
|
|
43
|
+
deployTarget?: StatusDeployTarget;
|
|
43
44
|
}
|
|
44
45
|
export interface StatusFailureProjection {
|
|
45
46
|
category: string;
|
|
@@ -79,3 +80,16 @@ export interface StatusProgressEvent {
|
|
|
79
80
|
remainingMs?: number;
|
|
80
81
|
origin?: 'initial' | 'widen';
|
|
81
82
|
}
|
|
83
|
+
/**
|
|
84
|
+
* The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means harbour-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.
|
|
85
|
+
*/
|
|
86
|
+
export interface StatusDeployTarget {
|
|
87
|
+
/**
|
|
88
|
+
* AWS account id the version deploys into.
|
|
89
|
+
*/
|
|
90
|
+
account: string;
|
|
91
|
+
/**
|
|
92
|
+
* AWS region the version deploys into, e.g. eu-west-1.
|
|
93
|
+
*/
|
|
94
|
+
region: string;
|
|
95
|
+
}
|
|
@@ -58,7 +58,7 @@ const retryableExact: Record<string, boolean> = {
|
|
|
58
58
|
"storage.sqlite-misclassified": false,
|
|
59
59
|
"storage.mapping-drift": false,
|
|
60
60
|
"storage.unavailable": true,
|
|
61
|
-
"transform.deadline-exceeded":
|
|
61
|
+
"transform.deadline-exceeded": true,
|
|
62
62
|
"transform.validation-failed": true,
|
|
63
63
|
"frontend.env-inlined-unfixable": false,
|
|
64
64
|
"build.recipe-failed": false,
|
package/gen-ts/index.ts
CHANGED
|
@@ -37,7 +37,8 @@ const legalTransitions: Record<string, Record<string, Record<string, true>>> = {
|
|
|
37
37
|
"PROMOTING": { "LIVE": true, "FAILED": true },
|
|
38
38
|
},
|
|
39
39
|
"prod": {
|
|
40
|
-
"QUEUED": { "PROMOTING": true, "FAILED": true },
|
|
40
|
+
"QUEUED": { "PROMOTING": true, "GATING": true, "FAILED": true },
|
|
41
|
+
"GATING": { "PROMOTING": true, "FAILED": true, "STALE": true },
|
|
41
42
|
"PROMOTING": { "LIVE": true, "FAILED": true },
|
|
42
43
|
},
|
|
43
44
|
};
|
|
@@ -0,0 +1,70 @@
|
|
|
1
|
+
/* eslint-disable */
|
|
2
|
+
// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
|
|
3
|
+
|
|
4
|
+
export type Workload = {
|
|
5
|
+
name: string;
|
|
6
|
+
kind: 'web' | 'action' | 'worker' | 'cron' | 'job';
|
|
7
|
+
command: Command;
|
|
8
|
+
resourceProfile: ResourceProfile;
|
|
9
|
+
port?: number;
|
|
10
|
+
alwaysOn?: boolean;
|
|
11
|
+
queueConsumer?: QueueConsumer;
|
|
12
|
+
schedule?: Schedule;
|
|
13
|
+
runPolicy?: RunPolicy;
|
|
14
|
+
};
|
|
15
|
+
/**
|
|
16
|
+
* @minItems 1
|
|
17
|
+
* @maxItems 32
|
|
18
|
+
*/
|
|
19
|
+
export type Command = string[];
|
|
20
|
+
export type ResourceProfile = 'standard' | 'memory-1g';
|
|
21
|
+
|
|
22
|
+
/**
|
|
23
|
+
* Versioned provisioning input emitted by Harbour Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.
|
|
24
|
+
*/
|
|
25
|
+
export interface WellDefinedAppManifest {
|
|
26
|
+
version: 1;
|
|
27
|
+
architecture: 'static-v1' | 'fullstack-v1' | 'spa-harbour-data-v1';
|
|
28
|
+
/**
|
|
29
|
+
* Required only when transformed browser code uses @harbour/app-sdk.
|
|
30
|
+
*/
|
|
31
|
+
sdkMajor?: 1;
|
|
32
|
+
/**
|
|
33
|
+
* @maxItems 64
|
|
34
|
+
*/
|
|
35
|
+
workloads: Workload[];
|
|
36
|
+
/**
|
|
37
|
+
* @maxItems 128
|
|
38
|
+
*/
|
|
39
|
+
bindings: WorkloadBinding[];
|
|
40
|
+
}
|
|
41
|
+
export interface QueueConsumer {
|
|
42
|
+
logicalName: string;
|
|
43
|
+
minReplicas: number;
|
|
44
|
+
maxReplicas: number;
|
|
45
|
+
cooldownSeconds: number;
|
|
46
|
+
}
|
|
47
|
+
export interface Schedule {
|
|
48
|
+
cron: string;
|
|
49
|
+
timeZone: string;
|
|
50
|
+
concurrencyPolicy: 'Allow' | 'Forbid' | 'Replace';
|
|
51
|
+
startingDeadlineSeconds: number;
|
|
52
|
+
timeoutSeconds: number;
|
|
53
|
+
retries: number;
|
|
54
|
+
successfulHistoryLimit: number;
|
|
55
|
+
failedHistoryLimit: number;
|
|
56
|
+
}
|
|
57
|
+
export interface RunPolicy {
|
|
58
|
+
timeoutSeconds: number;
|
|
59
|
+
retries: number;
|
|
60
|
+
ttlSecondsAfterFinished: number;
|
|
61
|
+
}
|
|
62
|
+
export interface WorkloadBinding {
|
|
63
|
+
kind: 'database' | 'files' | 'queue' | 'secret' | 'external';
|
|
64
|
+
logicalName: string;
|
|
65
|
+
provider: 'aurora-postgresql' | 's3-private' | 'nats-jetstream' | 'secrets-manager' | 'external-https';
|
|
66
|
+
/**
|
|
67
|
+
* Value-free control-plane identifier. Never a credential or provider URL.
|
|
68
|
+
*/
|
|
69
|
+
reference?: string;
|
|
70
|
+
}
|
package/package.json
CHANGED
|
@@ -75,10 +75,32 @@
|
|
|
75
75
|
}
|
|
76
76
|
},
|
|
77
77
|
"policyDigest": { "$ref": "#/definitions/AiDecisionDigest" },
|
|
78
|
+
"configurationMappings": {
|
|
79
|
+
"description": "Optional value-free descriptors for reviewed non-standard client environment boundaries. Mapping IDs are unique within a contract.",
|
|
80
|
+
"type": "array",
|
|
81
|
+
"minItems": 1,
|
|
82
|
+
"maxItems": 16,
|
|
83
|
+
"uniqueItems": true,
|
|
84
|
+
"items": { "$ref": "#/definitions/AiDecisionConfigurationMappingDescriptor" }
|
|
85
|
+
},
|
|
78
86
|
"runtimeBinding": { "$ref": "#/definitions/AiDecisionRuntimeBinding" },
|
|
79
87
|
"requiredStrategies": { "type": "array", "minItems": 1, "maxItems": 2, "uniqueItems": true, "items": { "type": "string", "enum": ["deployment_injection", "deterministic_adapter"] } }
|
|
80
88
|
}
|
|
81
89
|
},
|
|
90
|
+
"AiDecisionConfigurationMappingDescriptor": {
|
|
91
|
+
"description": "Value-free descriptor for one registered OpenAI-compatible client environment boundary. Secret values are never part of this descriptor.",
|
|
92
|
+
"type": "object",
|
|
93
|
+
"additionalProperties": false,
|
|
94
|
+
"required": ["mappingId", "version", "protocol", "providerId", "apiKeyEnvironmentName", "baseUrlEnvironmentName"],
|
|
95
|
+
"properties": {
|
|
96
|
+
"mappingId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$" },
|
|
97
|
+
"version": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" },
|
|
98
|
+
"protocol": { "type": "string", "const": "openai-chat" },
|
|
99
|
+
"providerId": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[a-z][a-z0-9_.-]{0,63}$" },
|
|
100
|
+
"apiKeyEnvironmentName": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Z][A-Z0-9_]{0,127}$" },
|
|
101
|
+
"baseUrlEnvironmentName": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Z][A-Z0-9_]{0,127}$" }
|
|
102
|
+
}
|
|
103
|
+
},
|
|
82
104
|
"AiDecisionRuntimeBinding": {
|
|
83
105
|
"type": "object",
|
|
84
106
|
"additionalProperties": false,
|
|
@@ -135,6 +135,17 @@
|
|
|
135
135
|
}
|
|
136
136
|
}
|
|
137
137
|
},
|
|
138
|
+
"well_defined_app": {
|
|
139
|
+
"type": "object",
|
|
140
|
+
"additionalProperties": false,
|
|
141
|
+
"required": ["version", "path", "sha256"],
|
|
142
|
+
"properties": {
|
|
143
|
+
"version": { "type": "integer", "const": 1 },
|
|
144
|
+
"path": { "type": "string", "const": ".harbour/app-manifest.json" },
|
|
145
|
+
"sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
|
|
146
|
+
},
|
|
147
|
+
"description": "Optional digest-pinned P0 well-defined application manifest. Provisioning reads the referenced document without re-analyzing source."
|
|
148
|
+
},
|
|
138
149
|
"route_auth": {
|
|
139
150
|
"description": "Optional method/path authentication policy compiled by the transformation. The default is SSO; listed routes preserve the application's own token, signature, or callback authorization.",
|
|
140
151
|
"type": "object",
|
|
@@ -41,7 +41,7 @@
|
|
|
41
41
|
},
|
|
42
42
|
"transform": {
|
|
43
43
|
"$ref": "#/definitions/DeployRequestTransform",
|
|
44
|
-
"description": "Optional transformation-engine selection.
|
|
44
|
+
"description": "Optional transformation-engine selection. New preview deployments default to branch_select; set sequential explicitly for the legacy engine."
|
|
45
45
|
},
|
|
46
46
|
"bindingClassification": {
|
|
47
47
|
"$ref": "binding-classification-subject.schema.json",
|
|
@@ -56,7 +56,7 @@
|
|
|
56
56
|
"strategy": {
|
|
57
57
|
"type": "string",
|
|
58
58
|
"enum": ["sequential", "branch_select"],
|
|
59
|
-
"description": "Transformation engine. Omit to
|
|
59
|
+
"description": "Transformation engine. Omit to use branch_select for a newly admitted preview deployment."
|
|
60
60
|
}
|
|
61
61
|
}
|
|
62
62
|
},
|
|
@@ -63,9 +63,31 @@
|
|
|
63
63
|
"maxItems": 50,
|
|
64
64
|
"description": "Bounded chronological trail (oldest first) of human-renderable progress moments observed while this version deployed. Ephemeral and best-effort: a deploy that recorded none — including every deploy that predates this field — simply omits it, so absence means 'no progress view available', never failure.",
|
|
65
65
|
"items": { "$ref": "#/definitions/StatusProgressEvent" }
|
|
66
|
+
},
|
|
67
|
+
"deployTarget": {
|
|
68
|
+
"$ref": "#/definitions/StatusDeployTarget"
|
|
66
69
|
}
|
|
67
70
|
},
|
|
68
71
|
"definitions": {
|
|
72
|
+
"StatusDeployTarget": {
|
|
73
|
+
"type": "object",
|
|
74
|
+
"additionalProperties": false,
|
|
75
|
+
"required": ["account", "region"],
|
|
76
|
+
"description": "The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means harbour-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.",
|
|
77
|
+
"properties": {
|
|
78
|
+
"account": {
|
|
79
|
+
"type": "string",
|
|
80
|
+
"pattern": "^[0-9]{12}$",
|
|
81
|
+
"description": "AWS account id the version deploys into."
|
|
82
|
+
},
|
|
83
|
+
"region": {
|
|
84
|
+
"type": "string",
|
|
85
|
+
"minLength": 1,
|
|
86
|
+
"maxLength": 32,
|
|
87
|
+
"description": "AWS region the version deploys into, e.g. eu-west-1."
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
},
|
|
69
91
|
"StatusFailureProjection": {
|
|
70
92
|
"type": "object",
|
|
71
93
|
"additionalProperties": false,
|
|
@@ -24,7 +24,7 @@
|
|
|
24
24
|
{ "id": "storage.unsupported-engine", "retryable": false, "family": true, "description": "Storage engine with no Harbour mapping; concrete token names the engine, e.g. storage.unsupported-engine.mongodb." },
|
|
25
25
|
{ "id": "storage.mapping-drift", "retryable": false, "description": "Declared storage binding diverged from detected usage." },
|
|
26
26
|
{ "id": "storage.unavailable", "retryable": true, "description": "The platform's shared application database could not be reached while preparing or provisioning the deploy — e.g. the Aurora cluster dial timing out during a scale-from-zero cold start. Says nothing about the app, so it IS retryable: the same deploy submitted again is expected to succeed once the database is awake. Previously surfaced as uncategorized.deploy (errorType wrapError)." },
|
|
27
|
-
{ "id": "transform.deadline-exceeded", "retryable":
|
|
27
|
+
{ "id": "transform.deadline-exceeded", "retryable": true, "description": "The transform wall deadline was reached before a passing candidate was found. A fresh deployment attempt is safe and may resume from the latest saved transformation checkpoint." },
|
|
28
28
|
{ "id": "transform.non-retryable", "retryable": false, "family": true, "description": "Agent declared the app unconvertible or hit an unsupported construct; fails immediately without burning remaining budget. Concrete token names the reason." },
|
|
29
29
|
{ "id": "transform.validation-failed", "retryable": true, "description": "Transform candidate failed validation with iterable feedback; re-enters TRANSFORMING while deadline remains." },
|
|
30
30
|
{ "id": "frontend.env-inlined-unfixable", "retryable": false, "description": "Client code inlined build-time env/self-URLs in a way transformation cannot rewrite." },
|
|
@@ -36,7 +36,11 @@
|
|
|
36
36
|
"x-terminalStable": ["LIVE", "AWAITING-PROMOTION"],
|
|
37
37
|
"x-transitions": [
|
|
38
38
|
{ "from": "QUEUED", "to": "ANALYZING", "environments": ["preview"], "trigger": "admission: slot free AND commit reachable from branch" },
|
|
39
|
-
{ "from": "QUEUED", "to": "PROMOTING", "environments": ["prod"], "trigger": "production promotion admission: stored preview and source-fidelity guards pass" },
|
|
39
|
+
{ "from": "QUEUED", "to": "PROMOTING", "environments": ["prod"], "trigger": "production promotion admission: stored preview and source-fidelity guards pass (direct path — pipelines not yet opted into security gating)" },
|
|
40
|
+
{ "from": "QUEUED", "to": "GATING", "environments": ["prod"], "trigger": "production promotion admission with security gating enabled: guards pass -> evaluate gates before promoting (M3 security assurance, opt-in)" },
|
|
41
|
+
{ "from": "GATING", "to": "PROMOTING", "environments": ["prod"], "trigger": "all blocking security gates pass -> proceed to promotion" },
|
|
42
|
+
{ "from": "GATING", "to": "FAILED", "environments": ["prod"], "trigger": "a blocking security gate fails; prod alias never moved" },
|
|
43
|
+
{ "from": "GATING", "to": "STALE", "environments": ["prod"], "trigger": "newer promotion request passes its guard while gating" },
|
|
40
44
|
{ "from": "QUEUED", "to": "FAILED", "trigger": "admission validation fails — commit not reachable from branch" },
|
|
41
45
|
{ "from": "ANALYZING", "to": "BUILDING", "environments": ["preview"], "trigger": "nothing to transform (fast path)" },
|
|
42
46
|
{ "from": "ANALYZING", "to": "TRANSFORMING", "environments": ["preview"], "trigger": "transform-relevant findings; 15-min wall deadline stamped" },
|
|
@@ -0,0 +1,152 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"$id": "https://schemas.harbour.dev/well-defined-app-manifest.schema.json",
|
|
4
|
+
"title": "WellDefinedAppManifest",
|
|
5
|
+
"description": "Versioned provisioning input emitted by Harbour Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"additionalProperties": false,
|
|
8
|
+
"required": ["version", "architecture", "workloads", "bindings"],
|
|
9
|
+
"properties": {
|
|
10
|
+
"version": { "type": "integer", "const": 1 },
|
|
11
|
+
"architecture": {
|
|
12
|
+
"type": "string",
|
|
13
|
+
"enum": ["static-v1", "fullstack-v1", "spa-harbour-data-v1"]
|
|
14
|
+
},
|
|
15
|
+
"sdkMajor": {
|
|
16
|
+
"type": "integer",
|
|
17
|
+
"const": 1,
|
|
18
|
+
"description": "Required only when transformed browser code uses @harbour/app-sdk."
|
|
19
|
+
},
|
|
20
|
+
"workloads": {
|
|
21
|
+
"type": "array",
|
|
22
|
+
"maxItems": 64,
|
|
23
|
+
"items": { "$ref": "#/definitions/Workload" }
|
|
24
|
+
},
|
|
25
|
+
"bindings": {
|
|
26
|
+
"type": "array",
|
|
27
|
+
"maxItems": 128,
|
|
28
|
+
"items": { "$ref": "#/definitions/WorkloadBinding" }
|
|
29
|
+
}
|
|
30
|
+
},
|
|
31
|
+
"definitions": {
|
|
32
|
+
"ResourceProfile": {
|
|
33
|
+
"type": "string",
|
|
34
|
+
"enum": ["standard", "memory-1g"]
|
|
35
|
+
},
|
|
36
|
+
"Command": {
|
|
37
|
+
"type": "array",
|
|
38
|
+
"minItems": 1,
|
|
39
|
+
"maxItems": 32,
|
|
40
|
+
"items": { "type": "string", "minLength": 1, "maxLength": 1024 }
|
|
41
|
+
},
|
|
42
|
+
"Workload": {
|
|
43
|
+
"type": "object",
|
|
44
|
+
"additionalProperties": false,
|
|
45
|
+
"required": ["name", "kind", "command", "resourceProfile"],
|
|
46
|
+
"properties": {
|
|
47
|
+
"name": {
|
|
48
|
+
"type": "string",
|
|
49
|
+
"pattern": "^[a-z][a-z0-9-]{0,62}$"
|
|
50
|
+
},
|
|
51
|
+
"kind": {
|
|
52
|
+
"type": "string",
|
|
53
|
+
"enum": ["web", "action", "worker", "cron", "job"]
|
|
54
|
+
},
|
|
55
|
+
"command": { "$ref": "#/definitions/Command" },
|
|
56
|
+
"resourceProfile": { "$ref": "#/definitions/ResourceProfile" },
|
|
57
|
+
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
58
|
+
"alwaysOn": { "type": "boolean" },
|
|
59
|
+
"queueConsumer": { "$ref": "#/definitions/QueueConsumer" },
|
|
60
|
+
"schedule": { "$ref": "#/definitions/Schedule" },
|
|
61
|
+
"runPolicy": { "$ref": "#/definitions/RunPolicy" }
|
|
62
|
+
},
|
|
63
|
+
"allOf": [
|
|
64
|
+
{
|
|
65
|
+
"if": { "properties": { "kind": { "const": "cron" } }, "required": ["kind"] },
|
|
66
|
+
"then": { "required": ["schedule"] },
|
|
67
|
+
"else": { "not": { "required": ["schedule"] } }
|
|
68
|
+
},
|
|
69
|
+
{
|
|
70
|
+
"if": { "required": ["queueConsumer"] },
|
|
71
|
+
"then": { "properties": { "kind": { "enum": ["worker", "job"] } } }
|
|
72
|
+
},
|
|
73
|
+
{
|
|
74
|
+
"if": { "properties": { "kind": { "const": "action" } }, "required": ["kind"] },
|
|
75
|
+
"then": { "properties": { "port": { "const": 8080 } } }
|
|
76
|
+
},
|
|
77
|
+
{
|
|
78
|
+
"if": { "properties": { "kind": { "const": "job" } }, "required": ["kind"] },
|
|
79
|
+
"then": {
|
|
80
|
+
"required": ["queueConsumer", "runPolicy"],
|
|
81
|
+
"properties": {
|
|
82
|
+
"queueConsumer": {
|
|
83
|
+
"allOf": [
|
|
84
|
+
{ "$ref": "#/definitions/QueueConsumer" },
|
|
85
|
+
{ "properties": { "minReplicas": { "const": 0 } } }
|
|
86
|
+
]
|
|
87
|
+
}
|
|
88
|
+
}
|
|
89
|
+
},
|
|
90
|
+
"else": { "not": { "required": ["runPolicy"] } }
|
|
91
|
+
}
|
|
92
|
+
]
|
|
93
|
+
},
|
|
94
|
+
"QueueConsumer": {
|
|
95
|
+
"type": "object",
|
|
96
|
+
"additionalProperties": false,
|
|
97
|
+
"required": ["logicalName", "minReplicas", "maxReplicas", "cooldownSeconds"],
|
|
98
|
+
"properties": {
|
|
99
|
+
"logicalName": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,62}$" },
|
|
100
|
+
"minReplicas": { "type": "integer", "minimum": 0, "maximum": 100 },
|
|
101
|
+
"maxReplicas": { "type": "integer", "minimum": 1, "maximum": 100 },
|
|
102
|
+
"cooldownSeconds": { "type": "integer", "minimum": 0, "maximum": 3600 }
|
|
103
|
+
}
|
|
104
|
+
},
|
|
105
|
+
"Schedule": {
|
|
106
|
+
"type": "object",
|
|
107
|
+
"additionalProperties": false,
|
|
108
|
+
"required": ["cron", "timeZone", "concurrencyPolicy", "startingDeadlineSeconds", "timeoutSeconds", "retries", "successfulHistoryLimit", "failedHistoryLimit"],
|
|
109
|
+
"properties": {
|
|
110
|
+
"cron": { "type": "string", "minLength": 9, "maxLength": 128 },
|
|
111
|
+
"timeZone": { "type": "string", "minLength": 1, "maxLength": 64 },
|
|
112
|
+
"concurrencyPolicy": { "type": "string", "enum": ["Allow", "Forbid", "Replace"] },
|
|
113
|
+
"startingDeadlineSeconds": { "type": "integer", "minimum": 0, "maximum": 86400 },
|
|
114
|
+
"timeoutSeconds": { "type": "integer", "minimum": 1, "maximum": 86400 },
|
|
115
|
+
"retries": { "type": "integer", "minimum": 0, "maximum": 20 },
|
|
116
|
+
"successfulHistoryLimit": { "type": "integer", "minimum": 0, "maximum": 20 },
|
|
117
|
+
"failedHistoryLimit": { "type": "integer", "minimum": 0, "maximum": 20 }
|
|
118
|
+
}
|
|
119
|
+
},
|
|
120
|
+
"RunPolicy": {
|
|
121
|
+
"type": "object",
|
|
122
|
+
"additionalProperties": false,
|
|
123
|
+
"required": ["timeoutSeconds", "retries", "ttlSecondsAfterFinished"],
|
|
124
|
+
"properties": {
|
|
125
|
+
"timeoutSeconds": { "type": "integer", "minimum": 1, "maximum": 86400 },
|
|
126
|
+
"retries": { "type": "integer", "minimum": 0, "maximum": 20 },
|
|
127
|
+
"ttlSecondsAfterFinished": { "type": "integer", "minimum": 60, "maximum": 604800 }
|
|
128
|
+
}
|
|
129
|
+
},
|
|
130
|
+
"WorkloadBinding": {
|
|
131
|
+
"type": "object",
|
|
132
|
+
"additionalProperties": false,
|
|
133
|
+
"required": ["kind", "logicalName", "provider"],
|
|
134
|
+
"properties": {
|
|
135
|
+
"kind": {
|
|
136
|
+
"type": "string",
|
|
137
|
+
"enum": ["database", "files", "queue", "secret", "external"]
|
|
138
|
+
},
|
|
139
|
+
"logicalName": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,62}$" },
|
|
140
|
+
"provider": {
|
|
141
|
+
"type": "string",
|
|
142
|
+
"enum": ["aurora-postgresql", "s3-private", "nats-jetstream", "secrets-manager", "external-https"]
|
|
143
|
+
},
|
|
144
|
+
"reference": {
|
|
145
|
+
"type": "string",
|
|
146
|
+
"pattern": "^[A-Za-z0-9][A-Za-z0-9/_.:-]{0,255}$",
|
|
147
|
+
"description": "Value-free control-plane identifier. Never a credential or provider URL."
|
|
148
|
+
}
|
|
149
|
+
}
|
|
150
|
+
}
|
|
151
|
+
}
|
|
152
|
+
}
|