@fourier-labs/harbour-contracts 0.60.0 → 0.62.0

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.60.0.0",
-  "publishVersion": "0.60.0",
-  "publishTag": "v0.60.0",
-  "schemasDigest": "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409",
+  "repositoryVersion": "0.62.0.0",
+  "publishVersion": "0.62.0",
+  "publishTag": "v0.62.0",
+  "schemasDigest": "sha256:a5c3b50e5f79bdb216bccf43045f3170be29b7b0db6a97372372ed61c9663a93",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659",
-  "generatedTypeScriptDigest": "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985",
+  "generatedGoDigest": "sha256:0a3e973ce5db8c10dc0fc843604691afa216ecb3bead86a8d2fb65ce66a48c24",
+  "generatedTypeScriptDigest": "sha256:de3e733a443f8545c7ea4f34bbbbe547e1ff10c075f18909c6ff2108159bcc75",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -41,6 +41,7 @@
     "schema/data-source.schema.json": "sha256:899384f4f11b05d2737766918ab47987b11ed49f1160220a55a367fed96f6f2c",
     "schema/deploy-request.schema.json": "sha256:32531e21983cdfeec511f8b4cddd4dad6530cd90e4e9fe147225d78d138b6198",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
+    "schema/deployment-app-registration.schema.json": "sha256:50bc8e308fca14d014a50d96ef1cf403eeeca5c3caea4a204fe15f0080efed32",
     "schema/deployment-continuation.schema.json": "sha256:55b6945439f2c91cd851dfe4bc9484e67a64091b7763b2d8267354b4a8bfae8c",
     "schema/deployment-environment.schema.json": "sha256:35b26cae07da9ee375a842b5e87c4570c8eca06775e9fd6dd46eb9eb8aa0df6c",
     "schema/deployment-source.schema.json": "sha256:256988b1efbfc90bd0e1ae31a2c5d69b20ef1e4471dc24c9f9aa759278270fbe",
@@ -54,11 +55,13 @@
     "schema/integration-error-details.schema.json": "sha256:47ad7621c34b092c7e40f912a21e7ccbdc000b974cfb7fa0c9200463e029f8fb",
     "schema/integration-execute-request.schema.json": "sha256:7a3ebd7a9992a9390d05c9eea6b66762e437655afdca79b64ec992967172c325",
     "schema/integration-execute-result.schema.json": "sha256:de87c35fb4dfb16f7334cab111f247281fc2300dc27738871ed1f8397ece6753",
+    "schema/internal-configuration-request.schema.json": "sha256:79bf3b7fa0ffa76d751584bc6b2362ef75855efce210b157ea71b62f4cdd9dc5",
     "schema/kit-bundle-manifest.schema.json": "sha256:4a9fcdd52ba0d55718ef4dbdab112b145ef90471d9356d4d3fb41e50fe9e400d",
     "schema/kit-lock.schema.json": "sha256:a48154d9471e49a893d928f7b0e1e0bc77708a4a7edce4fdf14073203e0e8987",
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
+    "schema/resolved-app-serving.schema.json": "sha256:a1b278a209e7e37ef89826f09201592e19e7da50237c6ed1c3d4573ee79c78a0",
     "schema/saas-connection.schema.json": "sha256:82ed8018201800a95aa792bde1d22568e86b55b3be926aa094a260c8c78a58d7",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
@@ -108,7 +111,7 @@
     "gen-go/integration_execute_input_rules.go": "sha256:52a405aa7a97f7b4e2ed3c314a7bd28b7698cc7883ee72ad4c027637be602ab9",
     "gen-go/integration_execute_input_rules_test.go": "sha256:c437a8406a2f062a0173b9419e4cb176fc6eb54e569506225d5162323f55b40b",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:fdb9107727f78c7ce767456606dfca577d67d1f5534318e64d1c86cddffed4e0",
+    "gen-go/types.go": "sha256:6db2935d280302e4c8627144c4e35ca2d31e4aa572010cb2850051dfef4e131f",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -144,6 +147,7 @@
     "gen-ts/data-source.ts": "sha256:1a40c252e94ee717d287ba63647e4368668dad9ea731770f8b58deb17d18b311",
     "gen-ts/deploy-request.ts": "sha256:0214faa8be6680f0bfc117d5ce67c1a59fcc18bd0ea4bc840e03e7d051fa9ab6",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
+    "gen-ts/deployment-app-registration.ts": "sha256:07f840a82dddd770e54e1020a034cdbfc84e226a94131e3f5a4cdd5da8acc2f0",
     "gen-ts/deployment-continuation.ts": "sha256:cc9f63af4d0da5086a79103789e4f043783b75b4ed11c6512f044439a551a79c",
     "gen-ts/deployment-environment.ts": "sha256:fc08cabe2e52ebb93cfe84d2019994260f71734c33d0e50e7c63e40ef5b17cef",
     "gen-ts/deployment-source.ts": "sha256:8ccb55aaa7260eb6d19a00987d6a20a4b514e343564da13f27cd7fee8013500a",
@@ -154,17 +158,19 @@
     "gen-ts/error-category-registry.ts": "sha256:7466a502c0723a77db825cdeaa9556a244201b55d9b7acbf2c098e9e84351df1",
     "gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
-    "gen-ts/index.ts": "sha256:1fa78bbfd85f29f777f9018d110b70388af35ab2e428c07f75f6701ff3eaba22",
+    "gen-ts/index.ts": "sha256:c260e665bada040c8f1cb29dccc48fbdd33d11fd77ae5583450c1d3430ad1ed4",
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
     "gen-ts/integration-error-details.ts": "sha256:ad7ecec9dd4533a6e86b3508886a7d69937052f52105497285797f77106bcc6f",
     "gen-ts/integration-execute-input-rules.ts": "sha256:0da117ac9f3109462e5862d658edf0f50e4b71fdcbb675d3a9dcb08489bcadd0",
     "gen-ts/integration-execute-request.ts": "sha256:1008bc1c8b8fec41dd7241a9f6ccb31233473e34c5cf538c0125f4ee6f45d2db",
     "gen-ts/integration-execute-result.ts": "sha256:b7c9270abb0c12888e651aeb1a9927a658faa135ad6197be6dfbd46d942f2a0a",
+    "gen-ts/internal-configuration-request.ts": "sha256:945ca34f771664423a34c9bfa3b7bf8909373989356f05bfe7f34ce4f5d6e39d",
     "gen-ts/kit-bundle-manifest.ts": "sha256:2777a268aef8787b81e71d154a7d05f6f5ded09d66f378211ff5493ddb885171",
     "gen-ts/kit-lock.ts": "sha256:00ceeb97e9b7d0187bec00728f5099fd34e775e9cc44c85c4714f7a3a4118ef6",
     "gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
+    "gen-ts/resolved-app-serving.ts": "sha256:06f94dc007f0f2636f5387f0f1f82700274e966c13bbdd95bbe0dbdc2d1580e9",
     "gen-ts/saas-connection.ts": "sha256:a4b7a9b37db0cf747ca1c40db5b1459ade2a86cc067146154c3c42484b76e07a",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.60.0.0";
-export declare const ContractPublishVersion: "0.60.0";
-export declare const ContractPublishTag: "v0.60.0";
-export declare const ContractSchemasDigest: "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409";
+export declare const ContractRepositoryVersion: "0.62.0.0";
+export declare const ContractPublishVersion: "0.62.0";
+export declare const ContractPublishTag: "v0.62.0";
+export declare const ContractSchemasDigest: "sha256:a5c3b50e5f79bdb216bccf43045f3170be29b7b0db6a97372372ed61c9663a93";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985";
+export declare const ContractGeneratedGoDigest: "sha256:0a3e973ce5db8c10dc0fc843604691afa216ecb3bead86a8d2fb65ce66a48c24";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:de3e733a443f8545c7ea4f34bbbbe547e1ff10c075f18909c6ff2108159bcc75";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.60.0.0";
-export const ContractPublishVersion = "0.60.0";
-export const ContractPublishTag = "v0.60.0";
-export const ContractSchemasDigest = "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409";
+export const ContractRepositoryVersion = "0.62.0.0";
+export const ContractPublishVersion = "0.62.0";
+export const ContractPublishTag = "v0.62.0";
+export const ContractSchemasDigest = "sha256:a5c3b50e5f79bdb216bccf43045f3170be29b7b0db6a97372372ed61c9663a93";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659";
-export const ContractGeneratedTypeScriptDigest = "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985";
+export const ContractGeneratedGoDigest = "sha256:0a3e973ce5db8c10dc0fc843604691afa216ecb3bead86a8d2fb65ce66a48c24";
+export const ContractGeneratedTypeScriptDigest = "sha256:de3e733a443f8545c7ea4f34bbbbe547e1ff10c075f18909c6ff2108159bcc75";

package/dist/gen-ts/deployment-app-registration.d.ts

@@ -0,0 +1,18 @@
+/**
+ * IAM/SigV4 POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
+ */
+export interface DeploymentAppRegistration {
+    tenantId: string;
+    appId: string;
+    origin: string;
+    publicHostname?: string;
+    backendHostnames?: string[];
+    apiHostnames?: string[];
+    pathPrefix?: string;
+    environment?: 'preview' | 'production';
+    allowedDomains?: string[];
+    allowedUsers?: string[];
+    allowedGroups?: string[];
+    enabled?: boolean;
+    workloadPrincipalArn?: string;
+}

package/dist/gen-ts/deployment-app-registration.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/index.d.ts

@@ -31,6 +31,7 @@ export * from './data-grant.js';
 export * from './data-source.js';
 export * from './deploy-request.js';
 export * from './deploy-response.js';
+export * from './deployment-app-registration.js';
 export * from './deployment-continuation.js';
 export * from './deployment-environment.js';
 export * from './deployment-source.js';
@@ -46,11 +47,13 @@ export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';
 export * from './integration-execute-request.js';
 export * from './integration-execute-result.js';
+export * from './internal-configuration-request.js';
 export * from './kit-bundle-manifest.js';
 export * from './kit-lock.js';
 export * from './kvs-routing-entry.js';
 export * from './promotion-request.js';
 export * from './promotion-response.js';
+export * from './resolved-app-serving.js';
 export * from './saas-connection.js';
 export * from './sanitized-binding-digest-helper.js';
 export * from './sanitized-binding-evidence.js';

package/dist/gen-ts/index.js

@@ -33,6 +33,7 @@ export * from './data-grant.js';
 export * from './data-source.js';
 export * from './deploy-request.js';
 export * from './deploy-response.js';
+export * from './deployment-app-registration.js';
 export * from './deployment-continuation.js';
 export * from './deployment-environment.js';
 export * from './deployment-source.js';
@@ -48,11 +49,13 @@ export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';
 export * from './integration-execute-request.js';
 export * from './integration-execute-result.js';
+export * from './internal-configuration-request.js';
 export * from './kit-bundle-manifest.js';
 export * from './kit-lock.js';
 export * from './kvs-routing-entry.js';
 export * from './promotion-request.js';
 export * from './promotion-response.js';
+export * from './resolved-app-serving.js';
 export * from './saas-connection.js';
 export * from './sanitized-binding-digest-helper.js';
 export * from './sanitized-binding-evidence.js';

package/dist/gen-ts/internal-configuration-request.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Existing IAM-protected configuration resolver request. appId and preview environment request resolved serving alongside deployment-destination environments, using a ready tenant binding or the platform default.
+ */
+export interface InternalConfigurationRequest {
+    tenantId: string;
+    /**
+     * @minItems 1
+     */
+    scopes: ('source-control' | 'identity' | 'deployment' | 'custom-domains' | 'deployment-destination')[];
+    appId?: string;
+    environment?: 'preview';
+}

package/dist/gen-ts/internal-configuration-request.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/resolved-app-serving.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Governance-selected V2 preview serving facts. Admission resolves once and passes these unchanged to build/provision/publish. Pending tenant bindings cannot supply these facts.
+ */
+export interface ResolvedAppServing {
+    tenantId: string;
+    appId: string;
+    environment: 'preview';
+    frontendUrl: string;
+    apiUrl: string;
+    loginHost: string;
+    bindingVersion: number;
+    source: 'platform' | 'tenant';
+    edge: {
+        frontendOriginId: string;
+        /**
+         * Present only when the selected edge supports governed backend routing; absence leaves backend publication disabled during rollout.
+         */
+        backendOriginId?: string;
+        routingStoreArn: string;
+        distributionId: string;
+    };
+}

package/dist/gen-ts/resolved-app-serving.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.60.0.0" as const;
-export const ContractPublishVersion = "0.60.0" as const;
-export const ContractPublishTag = "v0.60.0" as const;
-export const ContractSchemasDigest = "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409" as const;
+export const ContractRepositoryVersion = "0.62.0.0" as const;
+export const ContractPublishVersion = "0.62.0" as const;
+export const ContractPublishTag = "v0.62.0" as const;
+export const ContractSchemasDigest = "sha256:a5c3b50e5f79bdb216bccf43045f3170be29b7b0db6a97372372ed61c9663a93" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985" as const;
+export const ContractGeneratedGoDigest = "sha256:0a3e973ce5db8c10dc0fc843604691afa216ecb3bead86a8d2fb65ce66a48c24" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:de3e733a443f8545c7ea4f34bbbbe547e1ff10c075f18909c6ff2108159bcc75" as const;

package/gen-ts/deployment-app-registration.ts

@@ -0,0 +1,21 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * IAM/SigV4 POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
+ */
+export interface DeploymentAppRegistration {
+  tenantId: string;
+  appId: string;
+  origin: string;
+  publicHostname?: string;
+  backendHostnames?: string[];
+  apiHostnames?: string[];
+  pathPrefix?: string;
+  environment?: 'preview' | 'production';
+  allowedDomains?: string[];
+  allowedUsers?: string[];
+  allowedGroups?: string[];
+  enabled?: boolean;
+  workloadPrincipalArn?: string;
+}

package/gen-ts/index.ts

@@ -34,6 +34,7 @@ export * from './data-grant.js';
 export * from './data-source.js';
 export * from './deploy-request.js';
 export * from './deploy-response.js';
+export * from './deployment-app-registration.js';
 export * from './deployment-continuation.js';
 export * from './deployment-environment.js';
 export * from './deployment-source.js';
@@ -49,11 +50,13 @@ export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';
 export * from './integration-execute-request.js';
 export * from './integration-execute-result.js';
+export * from './internal-configuration-request.js';
 export * from './kit-bundle-manifest.js';
 export * from './kit-lock.js';
 export * from './kvs-routing-entry.js';
 export * from './promotion-request.js';
 export * from './promotion-response.js';
+export * from './resolved-app-serving.js';
 export * from './saas-connection.js';
 export * from './sanitized-binding-digest-helper.js';
 export * from './sanitized-binding-evidence.js';

package/gen-ts/internal-configuration-request.ts

@@ -0,0 +1,15 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * Existing IAM-protected configuration resolver request. appId and preview environment request resolved serving alongside deployment-destination environments, using a ready tenant binding or the platform default.
+ */
+export interface InternalConfigurationRequest {
+  tenantId: string;
+  /**
+   * @minItems 1
+   */
+  scopes: ('source-control' | 'identity' | 'deployment' | 'custom-domains' | 'deployment-destination')[];
+  appId?: string;
+  environment?: 'preview';
+}

package/gen-ts/resolved-app-serving.ts

@@ -0,0 +1,25 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * Governance-selected V2 preview serving facts. Admission resolves once and passes these unchanged to build/provision/publish. Pending tenant bindings cannot supply these facts.
+ */
+export interface ResolvedAppServing {
+  tenantId: string;
+  appId: string;
+  environment: 'preview';
+  frontendUrl: string;
+  apiUrl: string;
+  loginHost: string;
+  bindingVersion: number;
+  source: 'platform' | 'tenant';
+  edge: {
+    frontendOriginId: string;
+    /**
+     * Present only when the selected edge supports governed backend routing; absence leaves backend publication disabled during rollout.
+     */
+    backendOriginId?: string;
+    routingStoreArn: string;
+    distributionId: string;
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.60.0",
+  "version": "0.62.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/deployment-app-registration.schema.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://contracts.harbour.dev/deployment-app-registration.schema.json",
+  "title": "DeploymentAppRegistration",
+  "description": "IAM/SigV4 POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["tenantId", "appId", "origin"],
+  "properties": {
+    "tenantId": {"type": "string", "minLength": 1},
+    "appId": {"type": "string", "minLength": 1},
+    "origin": {"type": "string", "format": "uri"},
+    "publicHostname": {"type": "string", "format": "hostname"},
+    "backendHostnames": {"type": "array", "uniqueItems": true, "items": {"type": "string", "format": "hostname"}},
+    "apiHostnames": {"type": "array", "uniqueItems": true, "items": {"type": "string", "format": "hostname"}},
+    "pathPrefix": {"type": "string", "pattern": "^/"},
+    "environment": {"type": "string", "enum": ["preview", "production"]},
+    "allowedDomains": {"type": "array", "items": {"type": "string"}},
+    "allowedUsers": {"type": "array", "items": {"type": "string"}},
+    "allowedGroups": {"type": "array", "items": {"type": "string"}},
+    "enabled": {"type": "boolean"},
+    "workloadPrincipalArn": {"type": "string", "pattern": "^arn:aws:(iam|sts)::[0-9]+:"}
+  }
+}

package/schema/internal-configuration-request.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://contracts.harbour.dev/internal-configuration-request.schema.json",
+  "title": "InternalConfigurationRequest",
+  "description": "Existing IAM-protected configuration resolver request. appId and preview environment request resolved serving alongside deployment-destination environments, using a ready tenant binding or the platform default.",
+  "type": "object", "additionalProperties": false,
+  "required": ["tenantId", "scopes"],
+  "properties": {
+    "tenantId": {"type": "string", "minLength": 1},
+    "scopes": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "string", "enum": ["source-control", "identity", "deployment", "custom-domains", "deployment-destination"]}},
+    "appId": {"type": "string", "minLength": 1},
+    "environment": {"const": "preview"}
+  },
+  "dependencies": {"appId": ["environment"], "environment": ["appId"]}
+}

package/schema/resolved-app-serving.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://contracts.harbour.dev/resolved-app-serving.schema.json",
+  "title": "ResolvedAppServing",
+  "description": "Governance-selected V2 preview serving facts. Admission resolves once and passes these unchanged to build/provision/publish. Pending tenant bindings cannot supply these facts.",
+  "type": "object", "additionalProperties": false,
+  "required": ["tenantId", "appId", "environment", "frontendUrl", "apiUrl", "loginHost", "bindingVersion", "source", "edge"],
+  "properties": {
+    "tenantId": {"type": "string", "minLength": 1},
+    "appId": {"type": "string", "minLength": 1},
+    "environment": {"const": "preview"},
+    "frontendUrl": {"type": "string", "format": "uri", "pattern": "^https://"},
+    "apiUrl": {"type": "string", "format": "uri", "pattern": "^https://"},
+    "loginHost": {"type": "string", "format": "hostname"},
+    "bindingVersion": {"type": "integer", "minimum": 0},
+    "source": {"type": "string", "enum": ["platform", "tenant"]},
+    "edge": {
+      "type": "object", "additionalProperties": false,
+      "required": ["frontendOriginId", "routingStoreArn", "distributionId"],
+      "properties": {
+        "frontendOriginId": {"type": "string", "minLength": 1},
+        "backendOriginId": {"type": "string", "minLength": 1, "description": "Present only when the selected edge supports governed backend routing; absence leaves backend publication disabled during rollout."},
+        "routingStoreArn": {"type": "string", "minLength": 1},
+        "distributionId": {"type": "string", "minLength": 1}
+      }
+    }
+  }
+}