@fourier-labs/harbour-contracts 0.59.0 → 0.61.0

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.59.0.0",
-  "publishVersion": "0.59.0",
-  "publishTag": "v0.59.0",
-  "schemasDigest": "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409",
+  "repositoryVersion": "0.61.0.0",
+  "publishVersion": "0.61.0",
+  "publishTag": "v0.61.0",
+  "schemasDigest": "sha256:c284a3092527ebffa70a2e95796cad127ab38cbdf30dbf7b13ad40f8e2c362cd",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659",
-  "generatedTypeScriptDigest": "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985",
+  "generatedGoDigest": "sha256:d1d612de9d0191b9612092a4f7eec24b4a4721ad7740e0f6c48aa5a554a7a0b8",
+  "generatedTypeScriptDigest": "sha256:43a874440156c76f797fcedbe0d9bdddb5d43c3265962fc2a7138e422ba590cd",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -41,6 +41,7 @@
     "schema/data-source.schema.json": "sha256:899384f4f11b05d2737766918ab47987b11ed49f1160220a55a367fed96f6f2c",
     "schema/deploy-request.schema.json": "sha256:32531e21983cdfeec511f8b4cddd4dad6530cd90e4e9fe147225d78d138b6198",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
+    "schema/deployment-app-registration.schema.json": "sha256:50bc8e308fca14d014a50d96ef1cf403eeeca5c3caea4a204fe15f0080efed32",
     "schema/deployment-continuation.schema.json": "sha256:55b6945439f2c91cd851dfe4bc9484e67a64091b7763b2d8267354b4a8bfae8c",
     "schema/deployment-environment.schema.json": "sha256:35b26cae07da9ee375a842b5e87c4570c8eca06775e9fd6dd46eb9eb8aa0df6c",
     "schema/deployment-source.schema.json": "sha256:256988b1efbfc90bd0e1ae31a2c5d69b20ef1e4471dc24c9f9aa759278270fbe",
@@ -108,7 +109,7 @@
     "gen-go/integration_execute_input_rules.go": "sha256:52a405aa7a97f7b4e2ed3c314a7bd28b7698cc7883ee72ad4c027637be602ab9",
     "gen-go/integration_execute_input_rules_test.go": "sha256:c437a8406a2f062a0173b9419e4cb176fc6eb54e569506225d5162323f55b40b",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:fdb9107727f78c7ce767456606dfca577d67d1f5534318e64d1c86cddffed4e0",
+    "gen-go/types.go": "sha256:a6c736b5dc1a51dd9289ff4a14ecf1d84196ae5fc3c5fba493db5feb8c3f2b4b",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -144,6 +145,7 @@
     "gen-ts/data-source.ts": "sha256:1a40c252e94ee717d287ba63647e4368668dad9ea731770f8b58deb17d18b311",
     "gen-ts/deploy-request.ts": "sha256:0214faa8be6680f0bfc117d5ce67c1a59fcc18bd0ea4bc840e03e7d051fa9ab6",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
+    "gen-ts/deployment-app-registration.ts": "sha256:07f840a82dddd770e54e1020a034cdbfc84e226a94131e3f5a4cdd5da8acc2f0",
     "gen-ts/deployment-continuation.ts": "sha256:cc9f63af4d0da5086a79103789e4f043783b75b4ed11c6512f044439a551a79c",
     "gen-ts/deployment-environment.ts": "sha256:fc08cabe2e52ebb93cfe84d2019994260f71734c33d0e50e7c63e40ef5b17cef",
     "gen-ts/deployment-source.ts": "sha256:8ccb55aaa7260eb6d19a00987d6a20a4b514e343564da13f27cd7fee8013500a",
@@ -154,7 +156,7 @@
     "gen-ts/error-category-registry.ts": "sha256:7466a502c0723a77db825cdeaa9556a244201b55d9b7acbf2c098e9e84351df1",
     "gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
-    "gen-ts/index.ts": "sha256:1fa78bbfd85f29f777f9018d110b70388af35ab2e428c07f75f6701ff3eaba22",
+    "gen-ts/index.ts": "sha256:ef2cdd3083596e32c68a2b906810183db8f9ae8e50b34f5853251402c606adbd",
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
     "gen-ts/integration-error-details.ts": "sha256:ad7ecec9dd4533a6e86b3508886a7d69937052f52105497285797f77106bcc6f",
     "gen-ts/integration-execute-input-rules.ts": "sha256:0da117ac9f3109462e5862d658edf0f50e4b71fdcbb675d3a9dcb08489bcadd0",

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.59.0.0";
-export declare const ContractPublishVersion: "0.59.0";
-export declare const ContractPublishTag: "v0.59.0";
-export declare const ContractSchemasDigest: "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409";
+export declare const ContractRepositoryVersion: "0.61.0.0";
+export declare const ContractPublishVersion: "0.61.0";
+export declare const ContractPublishTag: "v0.61.0";
+export declare const ContractSchemasDigest: "sha256:c284a3092527ebffa70a2e95796cad127ab38cbdf30dbf7b13ad40f8e2c362cd";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985";
+export declare const ContractGeneratedGoDigest: "sha256:d1d612de9d0191b9612092a4f7eec24b4a4721ad7740e0f6c48aa5a554a7a0b8";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:43a874440156c76f797fcedbe0d9bdddb5d43c3265962fc2a7138e422ba590cd";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.59.0.0";
-export const ContractPublishVersion = "0.59.0";
-export const ContractPublishTag = "v0.59.0";
-export const ContractSchemasDigest = "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409";
+export const ContractRepositoryVersion = "0.61.0.0";
+export const ContractPublishVersion = "0.61.0";
+export const ContractPublishTag = "v0.61.0";
+export const ContractSchemasDigest = "sha256:c284a3092527ebffa70a2e95796cad127ab38cbdf30dbf7b13ad40f8e2c362cd";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659";
-export const ContractGeneratedTypeScriptDigest = "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985";
+export const ContractGeneratedGoDigest = "sha256:d1d612de9d0191b9612092a4f7eec24b4a4721ad7740e0f6c48aa5a554a7a0b8";
+export const ContractGeneratedTypeScriptDigest = "sha256:43a874440156c76f797fcedbe0d9bdddb5d43c3265962fc2a7138e422ba590cd";

package/dist/gen-ts/deployment-app-registration.d.ts

@@ -0,0 +1,18 @@
+/**
+ * IAM/SigV4 POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
+ */
+export interface DeploymentAppRegistration {
+    tenantId: string;
+    appId: string;
+    origin: string;
+    publicHostname?: string;
+    backendHostnames?: string[];
+    apiHostnames?: string[];
+    pathPrefix?: string;
+    environment?: 'preview' | 'production';
+    allowedDomains?: string[];
+    allowedUsers?: string[];
+    allowedGroups?: string[];
+    enabled?: boolean;
+    workloadPrincipalArn?: string;
+}

package/dist/gen-ts/deployment-app-registration.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/index.d.ts

@@ -31,6 +31,7 @@ export * from './data-grant.js';
 export * from './data-source.js';
 export * from './deploy-request.js';
 export * from './deploy-response.js';
+export * from './deployment-app-registration.js';
 export * from './deployment-continuation.js';
 export * from './deployment-environment.js';
 export * from './deployment-source.js';

package/dist/gen-ts/index.js

@@ -33,6 +33,7 @@ export * from './data-grant.js';
 export * from './data-source.js';
 export * from './deploy-request.js';
 export * from './deploy-response.js';
+export * from './deployment-app-registration.js';
 export * from './deployment-continuation.js';
 export * from './deployment-environment.js';
 export * from './deployment-source.js';

package/dist/naming/index.d.ts

@@ -0,0 +1,2 @@
+/** Stable V2 identity label. Do not use it to recover tenant or app identity. */
+export declare function deploymentLabel(org: string, app: string): string;

package/dist/naming/index.js

@@ -0,0 +1,14 @@
+import { createHash } from 'node:crypto';
+const slug = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** Stable V2 identity label. Do not use it to recover tenant or app identity. */
+export function deploymentLabel(org, app) {
+    if (!slug.test(org) || !slug.test(app))
+        throw new Error('org and app must be DNS labels of 1–63 characters');
+    const plain = `${org}-${app}`;
+    // Reserve double hyphens for hashed labels and -api for custom-domain API hosts.
+    if (!org.includes('-') && !plain.includes('--') && !plain.endsWith('-api') && plain.length <= 55)
+        return plain;
+    const digest = createHash('sha256').update(JSON.stringify([org, app])).digest('hex').slice(0, 32);
+    const prefix = plain.slice(0, 19).replace(/-+$/, '');
+    return `h--${prefix}-${digest}`;
+}

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.59.0.0" as const;
-export const ContractPublishVersion = "0.59.0" as const;
-export const ContractPublishTag = "v0.59.0" as const;
-export const ContractSchemasDigest = "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409" as const;
+export const ContractRepositoryVersion = "0.61.0.0" as const;
+export const ContractPublishVersion = "0.61.0" as const;
+export const ContractPublishTag = "v0.61.0" as const;
+export const ContractSchemasDigest = "sha256:c284a3092527ebffa70a2e95796cad127ab38cbdf30dbf7b13ad40f8e2c362cd" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985" as const;
+export const ContractGeneratedGoDigest = "sha256:d1d612de9d0191b9612092a4f7eec24b4a4721ad7740e0f6c48aa5a554a7a0b8" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:43a874440156c76f797fcedbe0d9bdddb5d43c3265962fc2a7138e422ba590cd" as const;

package/gen-ts/deployment-app-registration.ts

@@ -0,0 +1,21 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * IAM/SigV4 POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
+ */
+export interface DeploymentAppRegistration {
+  tenantId: string;
+  appId: string;
+  origin: string;
+  publicHostname?: string;
+  backendHostnames?: string[];
+  apiHostnames?: string[];
+  pathPrefix?: string;
+  environment?: 'preview' | 'production';
+  allowedDomains?: string[];
+  allowedUsers?: string[];
+  allowedGroups?: string[];
+  enabled?: boolean;
+  workloadPrincipalArn?: string;
+}

package/gen-ts/index.ts

@@ -34,6 +34,7 @@ export * from './data-grant.js';
 export * from './data-source.js';
 export * from './deploy-request.js';
 export * from './deploy-response.js';
+export * from './deployment-app-registration.js';
 export * from './deployment-continuation.js';
 export * from './deployment-environment.js';
 export * from './deployment-source.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,
@@ -23,6 +23,10 @@
       "types": "./dist/gen-ts/index.d.ts",
       "default": "./dist/gen-ts/index.js"
     },
+    "./naming": {
+      "types": "./dist/naming/index.d.ts",
+      "default": "./dist/naming/index.js"
+    },
     "./resolver": {
       "types": "./dist/resolver/index.d.ts",
       "default": "./dist/resolver/index.js"
@@ -31,7 +35,7 @@
   "scripts": {
     "gen": "node tools/gen/gen.mjs",
     "build": "tsc -p tsconfig.json",
-    "test": "node --experimental-strip-types --test tools/gen/*.test.mjs resolver/*.test.mjs",
+    "test": "node --experimental-strip-types --test tools/gen/*.test.mjs resolver/*.test.mjs naming/*.test.mjs",
     "verify": "node tools/release/verify-release.mjs && node tools/gen/gen.mjs && { [ -z \"$(git status --porcelain -- gen-ts gen-go contract-release.json)\" ] || { echo 'STALE: generated code or release manifest out of date or uncommitted — run make gen and commit'; exit 1; }; }"
   },
   "devDependencies": {

package/schema/deployment-app-registration.schema.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://contracts.harbour.dev/deployment-app-registration.schema.json",
+  "title": "DeploymentAppRegistration",
+  "description": "IAM/SigV4 POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["tenantId", "appId", "origin"],
+  "properties": {
+    "tenantId": {"type": "string", "minLength": 1},
+    "appId": {"type": "string", "minLength": 1},
+    "origin": {"type": "string", "format": "uri"},
+    "publicHostname": {"type": "string", "format": "hostname"},
+    "backendHostnames": {"type": "array", "uniqueItems": true, "items": {"type": "string", "format": "hostname"}},
+    "apiHostnames": {"type": "array", "uniqueItems": true, "items": {"type": "string", "format": "hostname"}},
+    "pathPrefix": {"type": "string", "pattern": "^/"},
+    "environment": {"type": "string", "enum": ["preview", "production"]},
+    "allowedDomains": {"type": "array", "items": {"type": "string"}},
+    "allowedUsers": {"type": "array", "items": {"type": "string"}},
+    "allowedGroups": {"type": "array", "items": {"type": "string"}},
+    "enabled": {"type": "boolean"},
+    "workloadPrincipalArn": {"type": "string", "pattern": "^arn:aws:(iam|sts)::[0-9]+:"}
+  }
+}