@fourier-labs/harbour-contracts 0.6.0 → 0.10.0

package/gen-ts/ai-budget-ledger-event.ts

@@ -0,0 +1,25 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiBudgetIdentifier = string;
+export type AiBudgetDigest = string;
+
+/**
+ * Append-only v2 committed-exposure ledger event. Amounts are integer micro-USD and replay is identified by idempotencyKey.
+ */
+export interface AiBudgetLedgerEvent {
+  schema: 'harbour.ai-budget-ledger-event/2.0';
+  eventId: AiBudgetIdentifier;
+  idempotencyKey: AiBudgetIdentifier;
+  budgetScope: AiBudgetIdentifier;
+  period: AiBudgetIdentifier;
+  eventType: 'RESERVED' | 'SETTLED' | 'REPAIRED' | 'ADJUSTED';
+  reservationId: AiBudgetIdentifier;
+  requestId?: AiBudgetIdentifier;
+  amountMicroUsd: number;
+  committedMicroUsdAfter: number;
+  pricingRevisionDigest?: AiBudgetDigest;
+  supersedesEventId?: AiBudgetIdentifier;
+  eventDigest: AiBudgetDigest;
+  occurredAt: string;
+}

package/gen-ts/ai-callsite-inventory.ts

@@ -0,0 +1,64 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiInventoryIdentifier = string;
+export type AiInventoryDigest = string;
+
+/**
+ * Immutable, sanitized AI call-site discovery for one exact Harbour deployment version. Inventory records detection only; planning, transformation, and verification outcomes are separate append-only records.
+ */
+export interface AiCallsiteInventory {
+  schema: 'harbour.ai-callsite-inventory/1.0';
+  tenantId: AiInventoryIdentifier;
+  appId: AiInventoryIdentifier;
+  environment: AiInventoryIdentifier;
+  versionId: string;
+  sourceRevision: string;
+  analyzerVersion: string;
+  coverage: 'complete_for_supported_sdks' | 'partial';
+  /**
+   * Required and never defaulted. Unavailable security evidence is not represented as a clean scan.
+   */
+  scanStatus: 'completed' | 'cybersecurity_scan_unavailable';
+  /**
+   * Canonical order is ascending by fingerprint, then path, then line. Producers MUST serialize this order before digesting or publishing the inventory.
+   *
+   * @maxItems 1000
+   */
+  callsites: AiInventoryCallsite[];
+}
+export interface AiInventoryCallsite {
+  fingerprint: AiInventoryDigest;
+  path: string;
+  sourceFileSha256: AiInventoryDigest;
+  line: number;
+  language: 'javascript' | 'typescript' | 'python' | 'go' | 'unknown';
+  sdk:
+    | 'openai'
+    | 'openai-compatible'
+    | 'anthropic'
+    | 'google-genai'
+    | 'mistral'
+    | 'bedrock'
+    | 'cohere'
+    | 'ollama'
+    | 'legacy-gemini'
+    | 'direct-provider-rest'
+    | 'unknown';
+  method: string;
+  requestedModel?: string;
+  strategy: 'deployment_injection' | 'deterministic_adapter' | 'unsupported';
+  status: 'detected';
+  /**
+   * @maxItems 64
+   */
+  securityFindingIds: string[];
+  evidence: AiInventoryEvidence;
+}
+export interface AiInventoryEvidence {
+  fingerprint: AiInventoryDigest;
+  /**
+   * Sanitized single-line evidence; never raw source or a prompt.
+   */
+  excerpt: string;
+}

package/gen-ts/ai-classification-stamp.ts

@@ -0,0 +1,28 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * Immutable, value-free classification evidence for one exact version and source revision. Unavailable evidence is explicit and never interpreted as clean.
+ */
+export type AiClassificationStamp = {
+  schema: 'harbour.ai-classification-stamp/1.0';
+  stampId: AiClassificationIdentifier;
+  tenantId: AiClassificationIdentifier;
+  appId: AiClassificationIdentifier;
+  environment: AiClassificationIdentifier;
+  versionId: string;
+  sourceRevision: string;
+  status: 'AVAILABLE' | 'UNAVAILABLE';
+  classification?: 'Green' | 'Yellow' | 'Orange' | 'Red';
+  classifierId: AiClassificationIdentifier;
+  classifierVersion: string;
+  sourceDigest: AiClassificationDigest;
+  inventoryDigest?: AiClassificationDigest;
+  securityEvidenceDigest?: AiClassificationDigest;
+  evidenceDigest: AiClassificationDigest;
+  stampDigest: AiClassificationDigest;
+  unavailableReason?: AiClassificationIdentifier;
+  stampedAt: string;
+};
+export type AiClassificationIdentifier = string;
+export type AiClassificationDigest = string;

package/gen-ts/ai-composite-policy-digest-helper.ts

@@ -0,0 +1,18 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+import { createHash } from 'node:crypto';
+import type { AiCompositePolicyDigestInput } from './ai-composite-policy-digest.js';
+
+const domain = "harbour.ai-composite-policy-digest/1";
+const absent = "-";
+
+/** Exact UTF-8 digest preimage. Field order is fixed by schema x-digest; absence is the literal hyphen. */
+export function compositePolicyDigestPreimage(input: AiCompositePolicyDigestInput): string {
+  return [domain, input.baselineDigest ?? absent, input.classificationStampDigest ?? absent, input.tenantPolicyDigest ?? absent, input.applicationPolicyDigest ?? absent, input.versionOverrideDigest ?? absent].join('\n');
+}
+
+/** Canonical composite policy digest including sha256: prefix. */
+export function computeCompositePolicyDigest(input: AiCompositePolicyDigestInput): string {
+  return 'sha256:' + createHash('sha256').update(compositePolicyDigestPreimage(input), 'utf8').digest('hex');
+}

package/gen-ts/ai-composite-policy-digest.ts

@@ -0,0 +1,16 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiCompositePolicyDigest = string;
+
+/**
+ * The complete ordered identity input for one composite policy digest. The digest is SHA-256 over the UTF-8 preimage specified by x-digest; missing optional layer digests use the literal hyphen sentinel.
+ */
+export interface AiCompositePolicyDigestInput {
+  schema: 'harbour.ai-composite-policy-digest/1.0';
+  baselineDigest: AiCompositePolicyDigest;
+  classificationStampDigest: AiCompositePolicyDigest;
+  tenantPolicyDigest?: AiCompositePolicyDigest;
+  applicationPolicyDigest?: AiCompositePolicyDigest;
+  versionOverrideDigest?: AiCompositePolicyDigest;
+}

package/gen-ts/ai-deployment-gate-decision.ts

@@ -0,0 +1,30 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * One append-only deployment gate decision. Corrections are new records linked by supersedesDecisionId; existing records are never overwritten.
+ */
+export type AiDeploymentGateDecision = {
+  schema: 'harbour.ai-deployment-gate-decision/1.0';
+  decisionId: AiGateIdentifier;
+  sequence: number;
+  supersedesDecisionId?: AiGateIdentifier;
+  tenantId: AiGateIdentifier;
+  appId: AiGateIdentifier;
+  environment: AiGateIdentifier;
+  versionId: string;
+  sourceRevision: string;
+  decision: 'PASS' | 'BLOCKED';
+  /**
+   * @maxItems 64
+   */
+  reasonCodes: AiGateIdentifier[];
+  classificationStampDigest: AiGateDigest;
+  planDigest: AiGateDigest;
+  policyDigest: AiGateDigest;
+  evidenceDigest: AiGateDigest;
+  decisionDigest: AiGateDigest;
+  decidedAt: string;
+};
+export type AiGateIdentifier = string;
+export type AiGateDigest = string;

package/gen-ts/ai-gateway-key-lifecycle-event.ts

@@ -0,0 +1,81 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * Append-only, value-free lifecycle evidence for one version-scoped Gateway key.
+ */
+export type AiGatewayKeyLifecycleEvent = (
+  | {
+      fromStatus?: 'NONE';
+      toStatus?: 'PENDING';
+    }
+  | {
+      fromStatus?: 'PENDING';
+      toStatus?: 'ACTIVE';
+    }
+  | {
+      fromStatus?: 'PENDING';
+      toStatus?: 'REVOKED';
+    }
+  | {
+      fromStatus?: 'ACTIVE';
+      toStatus?: 'REVOKED';
+    }
+  | {
+      fromStatus?: 'REVOKED';
+      toStatus?: 'DELETION_SCHEDULED';
+    }
+  | {
+      fromStatus?: 'DELETION_SCHEDULED';
+      toStatus?: 'DELETED';
+    }
+) & {
+  schema: 'harbour.ai-gateway-key-lifecycle-event/1.0';
+  eventId: AiKeyLifecycleIdentifier;
+  sequence: number;
+  keyId: string;
+  tenantId: AiKeyLifecycleIdentifier;
+  appId: AiKeyLifecycleIdentifier;
+  environment: AiKeyLifecycleIdentifier;
+  versionId: string;
+  fromStatus: AiKeyLifecycleStatus;
+  toStatus: AiKeyLifecycleStatus;
+  cause:
+    | 'PLAN'
+    | 'ACTIVATION'
+    | 'FAILED'
+    | 'STALE'
+    | 'SUPERSEDED'
+    | 'VERSION_DELETED'
+    | 'MANUAL_REVOKE'
+    | 'OVERLAP_EXPIRED'
+    | 'RECONCILIATION';
+  secretRef?: AiKeyLifecycleSafeReference;
+  overlapExpiresAt?: string;
+  eventDigest: AiKeyLifecycleDigest;
+  occurredAt: string;
+};
+export type AiKeyLifecycleIdentifier = string;
+export type AiKeyLifecycleStatus = 'NONE' | 'PENDING' | 'ACTIVE' | 'REVOKED' | 'DELETION_SCHEDULED' | 'DELETED';
+/**
+ * Value-free hierarchical secret reference using the additive reviewed scheme registry; no userinfo, query, fragment, port or percent encoding.
+ */
+export type AiKeyLifecycleSafeReference = string;
+export type AiKeyLifecycleDigest = string;
+
+const legalAiKeyLifecycleStatusTransitions: Record<string, Record<string, true>> = {
+  "NONE": { "PENDING": true },
+  "PENDING": { "ACTIVE": true, "REVOKED": true },
+  "ACTIVE": { "REVOKED": true },
+  "REVOKED": { "DELETION_SCHEDULED": true },
+  "DELETION_SCHEDULED": { "DELETED": true },
+};
+const terminalAiKeyLifecycleStatusStates = new Set<string>(["DELETED"]);
+
+/** True iff from→to is a legal AiKeyLifecycleStatus edge (schema x-transitions). */
+export function canTransitionAiKeyLifecycleStatus(from: string, to: string): boolean {
+  return Boolean(legalAiKeyLifecycleStatusTransitions[from]?.[to]);
+}
+
+/** True iff the AiKeyLifecycleStatus is terminal (DELETED). */
+export function isTerminalAiKeyLifecycleStatus(state: string): boolean { return terminalAiKeyLifecycleStatusStates.has(state); }

package/gen-ts/ai-gateway-key-lookup.ts

@@ -0,0 +1,23 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * Value-free Gateway authentication metadata for one version-scoped Harbour key.
+ */
+export type AiGatewayKeyLookup = {
+  schema: 'harbour.ai-gateway-key-lookup/1.0';
+  keyId: string;
+  tenantId: AiGatewayKeyIdentifier;
+  appId: AiGatewayKeyIdentifier;
+  environment: AiGatewayKeyIdentifier;
+  versionId: string;
+  tokenPrefix: 'hbr_live_' | 'hbr_test_';
+  status: 'PENDING' | 'ACTIVE' | 'REVOKED';
+  keyMac?: string;
+  createdAt: string;
+  activatedAt?: string;
+  expiresAt?: string;
+  overlapExpiresAt?: string;
+  revokedAt?: string;
+};
+export type AiGatewayKeyIdentifier = string;

package/gen-ts/ai-gateway-key-token.ts

@@ -0,0 +1,7 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export const AiGatewayKeyProductionPrefix = "hbr_live_" as const;
+export const AiGatewayKeyNonProductionPrefix = "hbr_test_" as const;
+export const AiGatewayKeyTokenPatternSource = "^hbr_(live|test)_([0-9a-f]{32})\\.([A-Za-z0-9_-]{43})$" as const;
+export const AiGatewayKeyTokenPattern = new RegExp(AiGatewayKeyTokenPatternSource);

package/gen-ts/ai-governance-decision.ts

@@ -0,0 +1,90 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * Digest-bound PLAN or VERIFY decision returned to the deployment control plane.
+ */
+export type AiGovernanceDecision = {
+  schema: 'harbour.ai-governance-decision/1.0';
+  phase: 'PLAN' | 'VERIFY';
+  tenantId: AiDecisionIdentifier;
+  appId: AiDecisionIdentifier;
+  environment: AiDecisionIdentifier;
+  versionId: string;
+  sourceRevision: string;
+  decision: 'PASS' | 'BLOCKED';
+  interceptionPath: 'NO_AI_CALLS' | 'DEPLOYMENT_INJECTION' | 'DETERMINISTIC_ADAPTER' | 'BLOCKED';
+  /**
+   * @maxItems 64
+   */
+  reasonCodes: AiDecisionIdentifier[];
+  /**
+   * @maxItems 1000
+   */
+  uncoveredCallsiteFingerprints: AiDecisionDigest[];
+  inventoryDigest: AiDecisionDigest;
+  policyDigest: AiDecisionDigest;
+  runtimeContractDigest?: AiDecisionDigest;
+  /**
+   * @maxItems 1000
+   */
+  interceptionPlan: AiInterceptionPlanEntry[];
+  interceptionPlanDigest: AiDecisionDigest;
+  evidenceDigest?: AiDecisionDigest;
+  runtimeContract?: AiDecisionRuntimeContract;
+  decidedAt: string;
+};
+export type AiDecisionIdentifier = string;
+export type AiDecisionDigest = string;
+export type AiInterceptionPlanEntry = {
+  callSiteFingerprint: AiDecisionDigest;
+  sourcePath: string;
+  expectedSourceFileSha256: AiDecisionDigest;
+  strategy: 'deployment_injection' | 'deterministic_adapter';
+  /**
+   * @minItems 1
+   * @maxItems 32
+   */
+  allowedSyntaxKinds: AiDecisionIdentifier[];
+  configurationMappingId?: AiDecisionIdentifier;
+  configurationMappingVersion?: string;
+  transformId?: AiDecisionIdentifier;
+  transformVersion?: string;
+  runtimeShimName?: string;
+  runtimeShimVersion?: string;
+  runtimeShimDigest?: AiDecisionDigest;
+};
+/**
+ * Platform-neutral value-free hierarchical reference using the additive reviewed scheme registry; no userinfo, query, fragment, port or percent encoding.
+ */
+export type AiDecisionSafeReference = string;
+
+export interface AiDecisionRuntimeContract {
+  schema: 'harbour.ai-runtime-contract/1.0';
+  tenantId: AiDecisionIdentifier;
+  appId: AiDecisionIdentifier;
+  environment: AiDecisionIdentifier;
+  versionId: string;
+  sourceRevision: string;
+  mode: 'observe' | 'enforce';
+  gatewayBaseUrl: string;
+  gatewayKeySecretRef: string;
+  modelAliases: {
+    generation?: string;
+    embeddings?: string;
+  };
+  policyDigest: AiDecisionDigest;
+  runtimeBinding?: AiDecisionRuntimeBinding;
+  /**
+   * @minItems 1
+   * @maxItems 2
+   */
+  requiredStrategies: ('deployment_injection' | 'deterministic_adapter')[];
+}
+export interface AiDecisionRuntimeBinding {
+  schema: 'harbour.ai-runtime-binding/1.0';
+  platform: string;
+  workloadIdentityRef: AiDecisionSafeReference;
+  secretRef: AiDecisionSafeReference;
+  runtimeBindingDigest: AiDecisionDigest;
+}

package/gen-ts/ai-metering-policy.ts

@@ -0,0 +1,20 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiMeteringPolicyDigest = string;
+
+/**
+ * Additive v2 metering-policy binding. It binds a composite policy to immutable pricing revisions without changing the v1 policy snapshot.
+ */
+export interface AiMeteringPolicy {
+  schema: 'harbour.ai-metering-policy/2.0';
+  policyDigest: AiMeteringPolicyDigest;
+  /**
+   * @minItems 1
+   * @maxItems 512
+   */
+  pricingRevisionDigests: AiMeteringPolicyDigest[];
+  reservationMode: 'committed_exposure';
+  policyDigestV2: AiMeteringPolicyDigest;
+  publishedAt: string;
+}

package/gen-ts/ai-policy-snapshot.ts

@@ -0,0 +1,169 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiPolicyScope = {
+  level: 'tenant' | 'application_environment';
+  tenantId: AiPolicyIdentifier;
+  appId?: AiPolicyIdentifier;
+  environment?: AiPolicyIdentifier;
+};
+export type AiPolicyIdentifier = string;
+export type AiPolicyDigest = string;
+export type AiPolicyGuardrailRule = {
+  ruleId: AiPolicyIdentifier;
+  detectorId: AiPolicyIdentifier;
+  detectorVersion: string;
+  phase: 'input' | 'output';
+  action: 'ALLOW' | 'OBSERVE' | 'REDACT' | 'BLOCK';
+  parameters?: AiPolicyGuardrailParameters;
+};
+/**
+ * Bounded, closed JSON Schema subset carried by an output.json_schema guardrail. Every node is a closed object over an enumerated keyword set; object nodes must state additionalProperties: false, so the validated output shape is closed too. Size is bounded per node (maxProperties/maxLength/maxItems); the consuming validator additionally enforces an overall byte budget at policy load.
+ */
+export type AiPolicyEmbeddedJsonSchema = {
+  type: 'object' | 'array' | 'string' | 'number' | 'integer' | 'boolean' | 'null';
+  description?: string;
+  properties?: {
+    [k: string]: AiPolicyEmbeddedJsonSchema;
+  };
+  /**
+   * @maxItems 64
+   */
+  required?: string[];
+  additionalProperties?: false;
+  items?: AiPolicyEmbeddedJsonSchema;
+  /**
+   * @minItems 1
+   * @maxItems 64
+   */
+  enum?: (string | number | boolean | null)[];
+  minimum?: number;
+  maximum?: number;
+  minLength?: number;
+  maxLength?: number;
+  minItems?: number;
+  maxItems?: number;
+};
+
+/**
+ * Immutable, content-addressed AI policy snapshot consumed by the Harbour AI Gateway. Provider credentials are represented only by Secrets Manager references.
+ */
+export interface AiPolicySnapshot {
+  schema: 'harbour.ai-policy-snapshot/1.0';
+  scope: AiPolicyScope;
+  revision: number;
+  publishedAt: string;
+  contentDigest: AiPolicyDigest;
+  baselineDigest: AiPolicyDigest;
+  classificationMinimum?: AiPolicyClassificationMinimum;
+  /**
+   * @maxItems 64
+   */
+  providers: AiPolicyProvider[];
+  /**
+   * @maxItems 512
+   */
+  models: AiPolicyModel[];
+  /**
+   * @maxItems 256
+   */
+  routes: AiPolicyRoute[];
+  /**
+   * @maxItems 256
+   */
+  policies: AiPolicyRuleSet[];
+  /**
+   * @maxItems 128
+   */
+  limits: AiPolicyLimit[];
+  retention: AiPolicyRetention;
+}
+export interface AiPolicyClassificationMinimum {
+  classification: 'Green' | 'Yellow' | 'Orange' | 'Red';
+  mappingDigest: AiPolicyDigest;
+}
+export interface AiPolicyProvider {
+  id: AiPolicyIdentifier;
+  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter';
+  baseUrl?: string;
+  credentialSecretRef: string;
+  enabled: boolean;
+}
+export interface AiPolicyModel {
+  id: AiPolicyIdentifier;
+  providerId: AiPolicyIdentifier;
+  providerModel: string;
+  /**
+   * @minItems 1
+   * @maxItems 2
+   */
+  capabilities: ('generation' | 'embeddings')[];
+  approved: boolean;
+  pricing: AiPolicyPricing;
+}
+export interface AiPolicyPricing {
+  revision: AiPolicyIdentifier;
+  inputMicroUsdPerMillion: number;
+  outputMicroUsdPerMillion: number;
+}
+export interface AiPolicyRoute {
+  alias: AiPolicyIdentifier;
+  version: number;
+  capability: 'generation' | 'embeddings';
+  /**
+   * @minItems 1
+   * @maxItems 16
+   */
+  targets: AiPolicyRouteTarget[];
+  retryCount: number;
+  timeoutMs: number;
+}
+export interface AiPolicyRouteTarget {
+  modelId: AiPolicyIdentifier;
+  priority: number;
+  weight: number;
+}
+export interface AiPolicyRuleSet {
+  name: AiPolicyIdentifier;
+  version: number;
+  maxRequestBytes: number;
+  maxInputTokens: number;
+  maxOutputTokens: number;
+  bufferedDelivery: boolean;
+  permittedRequestFields: AiPolicyPermittedRequestFields;
+  /**
+   * @maxItems 128
+   */
+  guardrails: AiPolicyGuardrailRule[];
+}
+export interface AiPolicyPermittedRequestFields {
+  temperature: boolean;
+  maxOutputTokens: boolean;
+  responseFormat: boolean;
+  tools: boolean;
+}
+export interface AiPolicyGuardrailParameters {
+  /**
+   * @minItems 1
+   * @maxItems 64
+   */
+  allowedTools?: string[];
+  jsonSchema?: AiPolicyEmbeddedJsonSchema;
+  jsonSchemaRef?: AiPolicyDigest;
+}
+export interface AiPolicyLimit {
+  name: AiPolicyIdentifier;
+  enabled: boolean;
+  scope: 'tenant' | 'application';
+  requestsPerMinute: number;
+  tokensPerMinute: number;
+  monthlyBudgetMicroUsd: number;
+}
+export interface AiPolicyRetention {
+  captureMode: 'OFF' | 'BEST_EFFORT' | 'REQUIRED';
+  retentionDays: number;
+  /**
+   * @maxItems 16
+   */
+  revealRoles: AiPolicyIdentifier[];
+}

package/gen-ts/ai-pricing-revision.ts

@@ -0,0 +1,33 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiPricingIdentifier = string;
+export type AiPricingDigest = string;
+
+/**
+ * Immutable v2 line-item pricing revision. A correction is a new revision; published records are never edited.
+ */
+export interface AiPricingRevision {
+  schema: 'harbour.ai-pricing-revision/2.0';
+  revisionId: AiPricingIdentifier;
+  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter';
+  providerModel: string;
+  region?: AiPricingIdentifier;
+  currency: 'USD';
+  /**
+   * @minItems 1
+   * @maxItems 64
+   */
+  dimensions: PriceDimension[];
+  supersedesRevisionId?: AiPricingIdentifier;
+  revisionDigest: AiPricingDigest;
+  effectiveAt: string;
+  publishedAt: string;
+}
+export interface PriceDimension {
+  dimension: AiPricingIdentifier;
+  direction: 'input' | 'output';
+  unit: AiPricingIdentifier;
+  scale: number;
+  microUsdPerScale: number;
+}

package/gen-ts/ai-runtime-binding.ts

@@ -0,0 +1,18 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * A value-free hierarchical identifier. Schemes are an additive reviewed registry; userinfo, ports, percent encoding, query strings, fragments and empty path segments are unrepresentable.
+ */
+export type AiRuntimeSafeReference = string;
+
+/**
+ * Platform-neutral, value-free binding of one workload identity to one version-scoped Harbour Gateway secret. Platform adapters may add implementation details internally; they never enter this contract.
+ */
+export interface AiRuntimeBinding {
+  schema: 'harbour.ai-runtime-binding/1.0';
+  platform: string;
+  workloadIdentityRef: AiRuntimeSafeReference;
+  secretRef: AiRuntimeSafeReference;
+  runtimeBindingDigest: string;
+}

package/gen-ts/ai-runtime-contract.ts

@@ -0,0 +1,46 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiRuntimeIdentifier = string;
+export type AiRuntimeModelAlias = string;
+export type AiRuntimeDigest = string;
+/**
+ * Platform-neutral value-free hierarchical reference using the additive reviewed scheme registry; no userinfo, query, fragment, port or percent encoding.
+ */
+export type AiRuntimeContractSafeReference = string;
+
+/**
+ * Immutable deployment runtime contract derived by an AI Governance PLAN decision. Contains only scoped configuration and a Secrets Manager reference, never key plaintext.
+ */
+export interface AiRuntimeContract {
+  schema: 'harbour.ai-runtime-contract/1.0';
+  tenantId: AiRuntimeIdentifier;
+  appId: AiRuntimeIdentifier;
+  environment: AiRuntimeIdentifier;
+  versionId: string;
+  sourceRevision: string;
+  mode: 'observe' | 'enforce';
+  gatewayBaseUrl: string;
+  gatewayKeySecretRef: string;
+  modelAliases: {
+    generation?: AiRuntimeModelAlias;
+    embeddings?: AiRuntimeModelAlias;
+  };
+  policyDigest: AiRuntimeDigest;
+  runtimeBinding?: AiRuntimeContractBinding;
+  /**
+   * @minItems 1
+   * @maxItems 2
+   */
+  requiredStrategies: ('deployment_injection' | 'deterministic_adapter')[];
+}
+/**
+ * Optional additive platform-neutral binding. Existing 1.0 records without it remain valid.
+ */
+export interface AiRuntimeContractBinding {
+  schema: 'harbour.ai-runtime-binding/1.0';
+  platform: string;
+  workloadIdentityRef: AiRuntimeContractSafeReference;
+  secretRef: AiRuntimeContractSafeReference;
+  runtimeBindingDigest: AiRuntimeDigest;
+}