@fourier-labs/harbour-contracts 0.4.0 → 0.5.0

package/schema/secret-reference.schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://schemas.harbour.dev/secret-reference.schema.json",
+  "title": "SecretReference",
+  "description": "Secret-Manager MVP: a named secret slot an app depends on. Only the reference and its lifecycle cross this boundary — the secret VALUE never appears in any contract. scope=app secrets are shared by the app; scope=personal secrets belong to one builder (ownerBuilderId). origin records whether a builder created the slot or the platform minted it (e.g. for a data grant).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["appId", "name", "scope", "secretRef", "status", "origin"],
+  "properties": {
+    "appId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 255,
+      "description": "App the secret slot belongs to."
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 255,
+      "description": "Slot name as the app references it (typically the environment-variable name)."
+    },
+    "scope": {
+      "$ref": "#/definitions/SecretReferenceScope"
+    },
+    "ownerBuilderId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 255,
+      "description": "Owning builder; present only when scope is personal."
+    },
+    "secretRef": {
+      "type": "string",
+      "pattern": "^secretref://[A-Za-z0-9][A-Za-z0-9/_.:-]*$",
+      "description": "secretref URI of the stored value. The value itself never crosses this boundary."
+    },
+    "status": {
+      "$ref": "#/definitions/SecretReferenceStatus"
+    },
+    "origin": {
+      "$ref": "#/definitions/SecretReferenceOrigin"
+    }
+  },
+  "definitions": {
+    "SecretReferenceScope": {
+      "type": "string",
+      "enum": ["app", "personal"],
+      "description": "app = shared by the whole app; personal = owned by a single builder (ownerBuilderId)."
+    },
+    "SecretReferenceStatus": {
+      "type": "string",
+      "enum": ["SET", "UNSET"],
+      "description": "UNSET slots block promotion until a human sets a value (secrets.unresolvable)."
+    },
+    "SecretReferenceOrigin": {
+      "type": "string",
+      "enum": ["builder", "minted"],
+      "description": "builder = created by a builder; minted = created by the platform (e.g. a data-grant credential)."
+    }
+  },
+  "examples": [
+    {
+      "appId": "reports",
+      "name": "STRIPE_API_KEY",
+      "scope": "app",
+      "secretRef": "secretref://tenants/fourier/apps/reports/STRIPE_API_KEY",
+      "status": "SET",
+      "origin": "builder"
+    }
+  ]
+}