@fourier-labs/harbour-contracts 0.41.0 → 0.43.0

package/README.md

@@ -39,6 +39,10 @@ exist here first.
 | `sanitized-binding-evidence.schema.json` | Exact-version sanitized runtime-binding allocation receipt | AI governance §5.7 / SEC-UP-02 |
 | `ai-pricing-revision`, `ai-metering-policy`, `ai-budget-ledger-event`, `ai-trace-event-v2` | Additive metering v2 records, including media dimensions and P5 trace attribution; v1 records remain readable | AI governance §9 |
 
+Runtime resource profiles are a closed contract shared by transformation, artifacts, and
+well-defined application manifests. The supported profiles are `standard`, `memory-1g`, and
+`memory-2g`; consumers must reject unrecognized raw CPU or memory overrides.
+
 Two schemas carry logic beyond structural types, generated into helpers:
 
 - **`error-category.enum.json`** → `IsRetryable(category)` (Go) / `isRetryable(category)` (TS),

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.41.0.0",
-  "publishVersion": "0.41.0",
-  "publishTag": "v0.41.0",
-  "schemasDigest": "sha256:c4cb346100e76c8936457e0453a6219db10e1240cd71dde33cfef2b672e97e35",
+  "repositoryVersion": "0.43.0.0",
+  "publishVersion": "0.43.0",
+  "publishTag": "v0.43.0",
+  "schemasDigest": "sha256:edf9f584487d94b99e35bbc08f3df1e33cb7329e76baa1938dfb7f3f02b97149",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:b667bd3bb2eb76f268c60ad756de962c32cdb30f56fdedc2693150c6ff5c5feb",
-  "generatedTypeScriptDigest": "sha256:345aa69f8a745e004a50c9203d7abcf365edb6aedeb4e2886f89e3efd916afc9",
+  "generatedGoDigest": "sha256:91de8005eea148fa555ee3a0abb42eed255863ec282740b5cf191727c35cb7ef",
+  "generatedTypeScriptDigest": "sha256:c4bbb442e46e22531586b380689e04448a8c4e04aa7c03d66aceed50754a09c9",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -31,12 +31,12 @@
     "schema/ai-transform-result.schema.json": "sha256:244e380a36957ab2dcb526ea22aaecb56b53664ce1fda6934d0021c084c99133",
     "schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
     "schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
-    "schema/artifact-contract.schema.json": "sha256:bc9683cd5c62c231683906c70307412839458adb6f9273003c37dbab01a1cff3",
+    "schema/artifact-contract.schema.json": "sha256:8047b461a1c6d07bbe867a259c57bdf5cc0fdf282cf842ec7b683a9e93713b10",
     "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/data-dependency.schema.json": "sha256:89ba8481ccabc935e7dab5d13871c985839a751ad1586710d8382a15e1f3340c",
     "schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
     "schema/data-source.schema.json": "sha256:aec8d2497dae9a91886a3df9f6fbbdb3d3fcab44b14fbcacc3f5e99b827f1bba",
-    "schema/deploy-request.schema.json": "sha256:bfcef417bd76dc64ff97264fa42994d7f5856578ba1a0c4feac5349c280abf12",
+    "schema/deploy-request.schema.json": "sha256:32531e21983cdfeec511f8b4cddd4dad6530cd90e4e9fe147225d78d138b6198",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
     "schema/deployment-environment.schema.json": "sha256:3f1325d5579b3fc47d02c83b6ac0657108909b1dfb901f68203c9c8b668c2ef4",
     "schema/deployment-source.schema.json": "sha256:256988b1efbfc90bd0e1ae31a2c5d69b20ef1e4471dc24c9f9aa759278270fbe",
@@ -49,13 +49,13 @@
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
-    "schema/sanitized-binding-evidence.schema.json": "sha256:b03bcc1911c99c69fda50eb656fc3e115f88fe2990c1708fbb5cd3542f4b8bba",
-    "schema/secret-reference.schema.json": "sha256:966f7a6d2575b46a4b54804d06dc05c6229ebbcbd9200fe6a6c8d3b4ffb90f9f",
+    "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
+    "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
     "schema/security-scan-input.schema.json": "sha256:83502dffb3c07ac2e0698928e6dc123f454fc667d4aacd336bcad6944ef2ac3d",
     "schema/security-verdict.schema.json": "sha256:ec3c2d5c9df3601aeed0909b36c7f427469c7f0eeb3295c5809b96d09bf3fc26",
-    "schema/transform-report.schema.json": "sha256:571bbf5112ce5b094caae44cb892ea0ab86392c33fc2d562dabddf28fd28c2a2",
+    "schema/transform-report.schema.json": "sha256:5943c90ad7a8b473119dde5879c59ed384d5dc19253b90bc3507dd1ff4dd9abe",
     "schema/version-state.schema.json": "sha256:3b190007e2f8e3821c41ef11c6f5b226da7d5a18d34d4077f4618004846fd444",
-    "schema/well-defined-app-manifest.schema.json": "sha256:d863433d7b68260a08aa0d33f897526c8f74f5f0ee8d242a6dd6c0bb23e60987"
+    "schema/well-defined-app-manifest.schema.json": "sha256:75a06690411880e670f133066a7a469150b53560b9dafa2f066a04485e4b50a0"
   },
   "aiFixtures": {
     "fixtures/ai/adversarial-binding-classification-value.json": "sha256:ca009f3f6162a9d93b4ab416d52c1fba12a8a15aca5aed956c5fdcf2171b1e28",
@@ -93,8 +93,8 @@
     "gen-go/contracts_test.go": "sha256:56376287cb1548be1b35ab4c65d6f0b558c5d34885f7a47cb3d9e8d786607bf5",
     "gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
     "gen-go/error_category.go": "sha256:b2ddea22dcfa030f1a45e721e635485b0bd816cf1f38e7654628a653f5ed4583",
-    "gen-go/schema_documents.go": "sha256:1269f5f97997661b27e3a6de0373f192be1a08a0c4424d034c9d0860922b1fed",
-    "gen-go/types.go": "sha256:b7fea49ec76820b97d5d1bc1b82800043b315ffa50a5f836a88f68e17a692d45",
+    "gen-go/schema_documents.go": "sha256:b6973afc9e72713062421f4bcc9dee136a971cf998daff4e0724f8be4a2b5051",
+    "gen-go/types.go": "sha256:b064ad533a736bef735bdf9629237b0b635d138cbb099d6d3f23adb679fc3cff",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -119,13 +119,13 @@
     "gen-ts/ai-transform-result.ts": "sha256:208c66b2aeb425c0cbcc18b7191f6e8989443f2b2c1690648e0e06cc1448ce25",
     "gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
     "gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
-    "gen-ts/artifact-contract.ts": "sha256:ad39ac5a2bcc9462e206101c9792e92fd11ef721e26de9a40043a4ba00dd7350",
+    "gen-ts/artifact-contract.ts": "sha256:4a6dc6d2caaeed4bb2066cc8a333e6e09e5a0d4745e0b1038293d54ab9403aeb",
     "gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
     "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
     "gen-ts/data-dependency.ts": "sha256:0572c31d7ae9088eccc104eee1a205bf176d1d6dacfaf0f290d666024e284966",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
     "gen-ts/data-source.ts": "sha256:77d6bb3b0eaa355789c5d97dd1f548734add6950329dc69549350b8d17c8d582",
-    "gen-ts/deploy-request.ts": "sha256:f685210f3f4e48a04e64983d3e040d6601477df404b4f890d6ea49c91c475256",
+    "gen-ts/deploy-request.ts": "sha256:0214faa8be6680f0bfc117d5ce67c1a59fcc18bd0ea4bc840e03e7d051fa9ab6",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
     "gen-ts/deployment-environment.ts": "sha256:bbd6eec3a1631b13a8de6e6b95081696f7be01d0bd2bf1b7a9e3a1db809a727c",
     "gen-ts/deployment-source.ts": "sha256:8ccb55aaa7260eb6d19a00987d6a20a4b514e343564da13f27cd7fee8013500a",
@@ -141,13 +141,13 @@
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
-    "gen-ts/sanitized-binding-evidence.ts": "sha256:4db7e9ed83f563a46e337815a55bbd6433864c41d9ec8e8a80810a16e3095ebb",
-    "gen-ts/secret-reference.ts": "sha256:a8b65de72705b6f51f57cd8ca58881483108005b1fa4d19106c3e9cf1fa877e7",
+    "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
+    "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",
     "gen-ts/security-scan-input.ts": "sha256:b31f048be04c34b40f49d3b3ba53277e473cd435ae9216ba3a3b4dac69fb5685",
     "gen-ts/security-verdict.ts": "sha256:fea950cddbd12fe0218e2573c9a29c6748d56612a464559f1e6d688fa97f68c7",
-    "gen-ts/transform-report.ts": "sha256:efbe396f3f511420a7ee99f1a8fbe8764635b454f799bd3bb5b2ed747ba1e36f",
+    "gen-ts/transform-report.ts": "sha256:a4f7f895342cd63048b2add63393a1251abb3e97f057b00e3ebd3f96fd1a510e",
     "gen-ts/version-state-machine.ts": "sha256:c67af3e86ac306743345b850dfd3ae5201c19d10c40e2c149cf8c38258320d5f",
     "gen-ts/version-state.ts": "sha256:a835112930299e7b593a1b8810b7414f6c9e809da2092306c743128170a3b702",
-    "gen-ts/well-defined-app-manifest.ts": "sha256:0c5c2fed747ad7f4c1034104c1acd9bb2e316f2c0b08a4ff3e2fab486f576a2f"
+    "gen-ts/well-defined-app-manifest.ts": "sha256:f29f8f2d0783e9e49d0546d65c2bedee2a6c2cebba0ec291ad52d9b67cb3a2fa"
   }
 }

package/dist/gen-ts/artifact-contract.d.ts

@@ -83,7 +83,7 @@ export interface ArtifactContract {
         /**
          * Reviewed CPU/memory profile selected for the application container.
          */
-        resource_profile?: 'standard' | 'memory-1g';
+        resource_profile?: 'standard' | 'memory-1g' | 'memory-2g';
         /**
          * Background-job execution mode. The sqs mode enables the governed application job queue and queue-aware scale-to-zero.
          */

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.41.0.0";
-export declare const ContractPublishVersion: "0.41.0";
-export declare const ContractPublishTag: "v0.41.0";
-export declare const ContractSchemasDigest: "sha256:c4cb346100e76c8936457e0453a6219db10e1240cd71dde33cfef2b672e97e35";
+export declare const ContractRepositoryVersion: "0.43.0.0";
+export declare const ContractPublishVersion: "0.43.0";
+export declare const ContractPublishTag: "v0.43.0";
+export declare const ContractSchemasDigest: "sha256:edf9f584487d94b99e35bbc08f3df1e33cb7329e76baa1938dfb7f3f02b97149";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:b667bd3bb2eb76f268c60ad756de962c32cdb30f56fdedc2693150c6ff5c5feb";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:345aa69f8a745e004a50c9203d7abcf365edb6aedeb4e2886f89e3efd916afc9";
+export declare const ContractGeneratedGoDigest: "sha256:91de8005eea148fa555ee3a0abb42eed255863ec282740b5cf191727c35cb7ef";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:c4bbb442e46e22531586b380689e04448a8c4e04aa7c03d66aceed50754a09c9";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.41.0.0";
-export const ContractPublishVersion = "0.41.0";
-export const ContractPublishTag = "v0.41.0";
-export const ContractSchemasDigest = "sha256:c4cb346100e76c8936457e0453a6219db10e1240cd71dde33cfef2b672e97e35";
+export const ContractRepositoryVersion = "0.43.0.0";
+export const ContractPublishVersion = "0.43.0";
+export const ContractPublishTag = "v0.43.0";
+export const ContractSchemasDigest = "sha256:edf9f584487d94b99e35bbc08f3df1e33cb7329e76baa1938dfb7f3f02b97149";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:b667bd3bb2eb76f268c60ad756de962c32cdb30f56fdedc2693150c6ff5c5feb";
-export const ContractGeneratedTypeScriptDigest = "sha256:345aa69f8a745e004a50c9203d7abcf365edb6aedeb4e2886f89e3efd916afc9";
+export const ContractGeneratedGoDigest = "sha256:91de8005eea148fa555ee3a0abb42eed255863ec282740b5cf191727c35cb7ef";
+export const ContractGeneratedTypeScriptDigest = "sha256:c4bbb442e46e22531586b380689e04448a8c4e04aa7c03d66aceed50754a09c9";

package/dist/gen-ts/deploy-request.d.ts

@@ -7,7 +7,7 @@ export type DeployRequestEnvironmentBinding = {
      */
     name: string;
     /**
-     * secretref URI resolved at runtime; the value never appears in the request.
+     * secretref URI resolved at runtime; the value never appears in the request. Multiple unique names may point to the same app-owned secret-bundle reference; each name selects its exact JSON key.
      */
     secretRef?: string;
     /**

package/dist/gen-ts/sanitized-binding-evidence.d.ts

@@ -9,7 +9,7 @@ export type SanitizedRuntimeBinding = {
      */
     value?: string;
     /**
-     * Value-free app secret, app-scoped minted data-source credential, or approved tenant-source credential reference. Integration and provider credential references are outside this contract.
+     * Value-free app secret, shared app-secret bundle, app-scoped minted data-source credential, or approved tenant-source credential reference. A binding name selects the same-named JSON field when this is an app secret-bundle reference. Integration and provider credential references are outside this contract.
      */
     secretRef?: string;
 };

package/dist/gen-ts/secret-reference.d.ts

@@ -28,7 +28,7 @@ export interface SecretReference {
      */
     ownerBuilderId?: string;
     /**
-     * secretref URI of the stored value. The value itself never crosses this boundary.
+     * secretref URI of the stored value. Builder app-secret rows may share one app-owned secret-bundle reference; each row's name selects its JSON key. The value itself never crosses this boundary.
      */
     secretRef: string;
     status: SecretReferenceStatus;

package/dist/gen-ts/transform-report.d.ts

@@ -212,7 +212,7 @@ export type TransformReport = {
          * Optional bounded workload requirements, carried into the deployment plan and artifact. Null or omitted preserves standard HTTP serving. SQS jobs require platform-selected Kubernetes compute.
          */
         workload?: {
-            resourceProfile: 'standard' | 'memory-1g';
+            resourceProfile: 'standard' | 'memory-1g' | 'memory-2g';
             backgroundJobs: 'none' | 'sqs';
         } | null;
         /**

package/dist/gen-ts/well-defined-app-manifest.d.ts

@@ -14,7 +14,7 @@ export type Workload = {
  * @maxItems 32
  */
 export type Command = string[];
-export type ResourceProfile = 'standard' | 'memory-1g';
+export type ResourceProfile = 'standard' | 'memory-1g' | 'memory-2g';
 /**
  * Versioned provisioning input emitted by Harbour Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.
  */

package/gen-ts/artifact-contract.ts

@@ -86,7 +86,7 @@ export interface ArtifactContract {
     /**
      * Reviewed CPU/memory profile selected for the application container.
      */
-    resource_profile?: 'standard' | 'memory-1g';
+    resource_profile?: 'standard' | 'memory-1g' | 'memory-2g';
     /**
      * Background-job execution mode. The sqs mode enables the governed application job queue and queue-aware scale-to-zero.
      */

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.41.0.0" as const;
-export const ContractPublishVersion = "0.41.0" as const;
-export const ContractPublishTag = "v0.41.0" as const;
-export const ContractSchemasDigest = "sha256:c4cb346100e76c8936457e0453a6219db10e1240cd71dde33cfef2b672e97e35" as const;
+export const ContractRepositoryVersion = "0.43.0.0" as const;
+export const ContractPublishVersion = "0.43.0" as const;
+export const ContractPublishTag = "v0.43.0" as const;
+export const ContractSchemasDigest = "sha256:edf9f584487d94b99e35bbc08f3df1e33cb7329e76baa1938dfb7f3f02b97149" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:b667bd3bb2eb76f268c60ad756de962c32cdb30f56fdedc2693150c6ff5c5feb" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:345aa69f8a745e004a50c9203d7abcf365edb6aedeb4e2886f89e3efd916afc9" as const;
+export const ContractGeneratedGoDigest = "sha256:91de8005eea148fa555ee3a0abb42eed255863ec282740b5cf191727c35cb7ef" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:c4bbb442e46e22531586b380689e04448a8c4e04aa7c03d66aceed50754a09c9" as const;

package/gen-ts/deploy-request.ts

@@ -10,7 +10,7 @@ export type DeployRequestEnvironmentBinding = {
    */
   name: string;
   /**
-   * secretref URI resolved at runtime; the value never appears in the request.
+   * secretref URI resolved at runtime; the value never appears in the request. Multiple unique names may point to the same app-owned secret-bundle reference; each name selects its exact JSON key.
    */
   secretRef?: string;
   /**

package/gen-ts/sanitized-binding-evidence.ts

@@ -12,7 +12,7 @@ export type SanitizedRuntimeBinding = {
    */
   value?: string;
   /**
-   * Value-free app secret, app-scoped minted data-source credential, or approved tenant-source credential reference. Integration and provider credential references are outside this contract.
+   * Value-free app secret, shared app-secret bundle, app-scoped minted data-source credential, or approved tenant-source credential reference. A binding name selects the same-named JSON field when this is an app secret-bundle reference. Integration and provider credential references are outside this contract.
    */
   secretRef?: string;
 };

package/gen-ts/secret-reference.ts

@@ -32,7 +32,7 @@ export interface SecretReference {
    */
   ownerBuilderId?: string;
   /**
-   * secretref URI of the stored value. The value itself never crosses this boundary.
+   * secretref URI of the stored value. Builder app-secret rows may share one app-owned secret-bundle reference; each row's name selects its JSON key. The value itself never crosses this boundary.
    */
   secretRef: string;
   status: SecretReferenceStatus;

package/gen-ts/transform-report.ts

@@ -235,7 +235,7 @@ export type TransformReport = {
      * Optional bounded workload requirements, carried into the deployment plan and artifact. Null or omitted preserves standard HTTP serving. SQS jobs require platform-selected Kubernetes compute.
      */
     workload?: {
-      resourceProfile: 'standard' | 'memory-1g';
+      resourceProfile: 'standard' | 'memory-1g' | 'memory-2g';
       backgroundJobs: 'none' | 'sqs';
     } | null;
     /**

package/gen-ts/well-defined-app-manifest.ts

@@ -17,7 +17,7 @@ export type Workload = {
  * @maxItems 32
  */
 export type Command = string[];
-export type ResourceProfile = 'standard' | 'memory-1g';
+export type ResourceProfile = 'standard' | 'memory-1g' | 'memory-2g';
 
 /**
  * Versioned provisioning input emitted by Harbour Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Harbour components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/artifact-contract.schema.json

@@ -130,7 +130,7 @@
       "properties": {
         "resource_profile": {
           "type": "string",
-          "enum": ["standard", "memory-1g"],
+          "enum": ["standard", "memory-1g", "memory-2g"],
           "description": "Reviewed CPU/memory profile selected for the application container."
         },
         "background_jobs": {

package/schema/deploy-request.schema.json

@@ -95,7 +95,7 @@
         "secretRef": {
           "type": "string",
           "pattern": "^secretref://[A-Za-z0-9][A-Za-z0-9/_.:-]*$",
-          "description": "secretref URI resolved at runtime; the value never appears in the request."
+          "description": "secretref URI resolved at runtime; the value never appears in the request. Multiple unique names may point to the same app-owned secret-bundle reference; each name selects its exact JSON key."
         },
         "value": {
           "type": "string",

package/schema/sanitized-binding-evidence.schema.json

@@ -80,7 +80,7 @@
       "properties": {
         "kind": { "type": "string", "enum": ["configuration", "secret"] },
         "value": { "type": "string", "minLength": 1, "maxLength": 4096, "description": "Approved non-secret configuration literal. Provider-credential values are never approved or persisted here." },
-        "secretRef": { "type": "string", "pattern": "^secretref://tenant/[A-Za-z0-9._-]+/(?:app/[A-Za-z0-9._-]+/(?:secret/[A-Z][A-Z0-9_]{0,127}|source/[a-z0-9][a-z0-9._-]{0,63})|source/[a-z0-9][a-z0-9._-]{0,63})$", "description": "Value-free app secret, app-scoped minted data-source credential, or approved tenant-source credential reference. Integration and provider credential references are outside this contract." }
+        "secretRef": { "type": "string", "pattern": "^secretref://tenant/[A-Za-z0-9._-]+/(?:app/[A-Za-z0-9._-]+/(?:secret/[A-Z][A-Z0-9_]{0,127}|secret-bundle|source/[a-z0-9][a-z0-9._-]{0,63})|source/[a-z0-9][a-z0-9._-]{0,63})$", "description": "Value-free app secret, shared app-secret bundle, app-scoped minted data-source credential, or approved tenant-source credential reference. A binding name selects the same-named JSON field when this is an app secret-bundle reference. Integration and provider credential references are outside this contract." }
       },
       "allOf": [
         {

package/schema/secret-reference.schema.json

@@ -31,7 +31,7 @@
     "secretRef": {
       "type": "string",
       "pattern": "^secretref://[A-Za-z0-9][A-Za-z0-9/_.:-]*$",
-      "description": "secretref URI of the stored value. The value itself never crosses this boundary."
+      "description": "secretref URI of the stored value. Builder app-secret rows may share one app-owned secret-bundle reference; each row's name selects its JSON key. The value itself never crosses this boundary."
     },
     "status": {
       "$ref": "#/definitions/SecretReferenceStatus"

package/schema/transform-report.schema.json

@@ -363,7 +363,7 @@
               "additionalProperties": false,
               "required": ["resourceProfile", "backgroundJobs"],
               "properties": {
-                "resourceProfile": { "type": "string", "enum": ["standard", "memory-1g"] },
+                "resourceProfile": { "type": "string", "enum": ["standard", "memory-1g", "memory-2g"] },
                 "backgroundJobs": { "type": "string", "enum": ["none", "sqs"] }
               }
             },

package/schema/well-defined-app-manifest.schema.json

@@ -31,7 +31,7 @@
   "definitions": {
     "ResourceProfile": {
       "type": "string",
-      "enum": ["standard", "memory-1g"]
+      "enum": ["standard", "memory-1g", "memory-2g"]
     },
     "Command": {
       "type": "array",