@fourier-labs/harbour-contracts 0.33.0 → 0.41.0

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.33.0.0",
-  "publishVersion": "0.33.0",
-  "publishTag": "v0.33.0",
-  "schemasDigest": "sha256:dd106c711981c50f8ab49cf6c54bf201aa27f36a40d6c108aa0a1c2916d1d72c",
+  "repositoryVersion": "0.41.0.0",
+  "publishVersion": "0.41.0",
+  "publishTag": "v0.41.0",
+  "schemasDigest": "sha256:c4cb346100e76c8936457e0453a6219db10e1240cd71dde33cfef2b672e97e35",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:64d1d6efa060927f70394bd1d4758ca1008c1ccff30b34c1b50c518d27155a3b",
-  "generatedTypeScriptDigest": "sha256:dc9111b80945f2a233e382bc462140dca0de45dd29ffc824124d9b555fd769c7",
+  "generatedGoDigest": "sha256:b667bd3bb2eb76f268c60ad756de962c32cdb30f56fdedc2693150c6ff5c5feb",
+  "generatedTypeScriptDigest": "sha256:345aa69f8a745e004a50c9203d7abcf365edb6aedeb4e2886f89e3efd916afc9",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -31,20 +31,20 @@
     "schema/ai-transform-result.schema.json": "sha256:244e380a36957ab2dcb526ea22aaecb56b53664ce1fda6934d0021c084c99133",
     "schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
     "schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
-    "schema/artifact-contract.schema.json": "sha256:dddfeb765c7ee510bc3781689bef21e12689df50f6eabb41806083d6793cbfc5",
+    "schema/artifact-contract.schema.json": "sha256:bc9683cd5c62c231683906c70307412839458adb6f9273003c37dbab01a1cff3",
     "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/data-dependency.schema.json": "sha256:89ba8481ccabc935e7dab5d13871c985839a751ad1586710d8382a15e1f3340c",
     "schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
-    "schema/data-source.schema.json": "sha256:5a809171cc97f5778ca37db300d454098ce1c2d9071d2380550707b049899a75",
-    "schema/deploy-request.schema.json": "sha256:971575fa250eaed300337ecd262a5f2ace0fe4c32de5aa51cd6a995fc3f5cb41",
+    "schema/data-source.schema.json": "sha256:aec8d2497dae9a91886a3df9f6fbbdb3d3fcab44b14fbcacc3f5e99b827f1bba",
+    "schema/deploy-request.schema.json": "sha256:bfcef417bd76dc64ff97264fa42994d7f5856578ba1a0c4feac5349c280abf12",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
     "schema/deployment-environment.schema.json": "sha256:3f1325d5579b3fc47d02c83b6ac0657108909b1dfb901f68203c9c8b668c2ef4",
     "schema/deployment-source.schema.json": "sha256:256988b1efbfc90bd0e1ae31a2c5d69b20ef1e4471dc24c9f9aa759278270fbe",
-    "schema/deployment-status-failure.schema.json": "sha256:1a182e603d22467a4be507a37fd10698f6f3178d314d33eaf5de2c7f687c9412",
+    "schema/deployment-status-failure.schema.json": "sha256:7cc021d53a07c63b66eb48146d33e8875b64faf77ee927b235795469eb9a1559",
     "schema/deployment-status-request.schema.json": "sha256:1f9f87adc947a252b53b61f71ae17f8c1b8fbc1166f31301a043d11ac257dc66",
-    "schema/deployment-status-response.schema.json": "sha256:ce6b4e10a4302dff75c8958a3555f3a323e407e8cd2d2dce58550e7cb6cff1c8",
+    "schema/deployment-status-response.schema.json": "sha256:9a49f6a5db4e06e0965a536d6080a6155e539c1105e1625338d7f3a53583b2b8",
     "schema/env-bindings.schema.json": "sha256:ae09bc4ca5508afa698ef854a59153c4c6f99b07017b48cb9b07ce05abad12f2",
-    "schema/error-category.enum.json": "sha256:92b29448d5336797e73a854e134dd6a58c4c03c5f80a3c4e81024144e1f881b8",
+    "schema/error-category.enum.json": "sha256:2268b8a00dfa1f1ab6db7650c117028247fca980d4a23aa5969ce30b76692be9",
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
@@ -53,7 +53,7 @@
     "schema/secret-reference.schema.json": "sha256:966f7a6d2575b46a4b54804d06dc05c6229ebbcbd9200fe6a6c8d3b4ffb90f9f",
     "schema/security-scan-input.schema.json": "sha256:83502dffb3c07ac2e0698928e6dc123f454fc667d4aacd336bcad6944ef2ac3d",
     "schema/security-verdict.schema.json": "sha256:ec3c2d5c9df3601aeed0909b36c7f427469c7f0eeb3295c5809b96d09bf3fc26",
-    "schema/transform-report.schema.json": "sha256:815e764445fb41b912d0c0468f00621ad61f941fb4c7b9364e3f204ad47cdf7f",
+    "schema/transform-report.schema.json": "sha256:571bbf5112ce5b094caae44cb892ea0ab86392c33fc2d562dabddf28fd28c2a2",
     "schema/version-state.schema.json": "sha256:3b190007e2f8e3821c41ef11c6f5b226da7d5a18d34d4077f4618004846fd444",
     "schema/well-defined-app-manifest.schema.json": "sha256:d863433d7b68260a08aa0d33f897526c8f74f5f0ee8d242a6dd6c0bb23e60987"
   },
@@ -92,9 +92,9 @@
     "gen-go/binding_digest_helpers.go": "sha256:50462ba2beb16c7931dfc7e10302c12c90bf8111788991f74f08a718125dfbfb",
     "gen-go/contracts_test.go": "sha256:56376287cb1548be1b35ab4c65d6f0b558c5d34885f7a47cb3d9e8d786607bf5",
     "gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
-    "gen-go/error_category.go": "sha256:dbbc54e04b988a23b08cc5f6f368555e1b8e9c3633261f593fa9fda8b29a537e",
-    "gen-go/schema_documents.go": "sha256:4b9094aaf0acc4bae4b65784954853f0888572a53fa1a1dc354f97c88ded805f",
-    "gen-go/types.go": "sha256:3e61602b15af478141ec368bc2208b4f496d686004bbcbb4910bdc93a0901b08",
+    "gen-go/error_category.go": "sha256:b2ddea22dcfa030f1a45e721e635485b0bd816cf1f38e7654628a653f5ed4583",
+    "gen-go/schema_documents.go": "sha256:1269f5f97997661b27e3a6de0373f192be1a08a0c4424d034c9d0860922b1fed",
+    "gen-go/types.go": "sha256:b7fea49ec76820b97d5d1bc1b82800043b315ffa50a5f836a88f68e17a692d45",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -119,21 +119,21 @@
     "gen-ts/ai-transform-result.ts": "sha256:208c66b2aeb425c0cbcc18b7191f6e8989443f2b2c1690648e0e06cc1448ce25",
     "gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
     "gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
-    "gen-ts/artifact-contract.ts": "sha256:e14be765244303e311bf97004d70d8d40d37da5accfcc084765257f69b5ca15c",
+    "gen-ts/artifact-contract.ts": "sha256:ad39ac5a2bcc9462e206101c9792e92fd11ef721e26de9a40043a4ba00dd7350",
     "gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
     "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
     "gen-ts/data-dependency.ts": "sha256:0572c31d7ae9088eccc104eee1a205bf176d1d6dacfaf0f290d666024e284966",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
-    "gen-ts/data-source.ts": "sha256:71be83b050468c2ea8c5830d28f1837c2b5929d23b4fdf6661bc5bfe8999904c",
-    "gen-ts/deploy-request.ts": "sha256:6bc33531f8d18611dff10f4efd75da56cdd9a773655047db26af9d832a6ac48a",
+    "gen-ts/data-source.ts": "sha256:77d6bb3b0eaa355789c5d97dd1f548734add6950329dc69549350b8d17c8d582",
+    "gen-ts/deploy-request.ts": "sha256:f685210f3f4e48a04e64983d3e040d6601477df404b4f890d6ea49c91c475256",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
     "gen-ts/deployment-environment.ts": "sha256:bbd6eec3a1631b13a8de6e6b95081696f7be01d0bd2bf1b7a9e3a1db809a727c",
     "gen-ts/deployment-source.ts": "sha256:8ccb55aaa7260eb6d19a00987d6a20a4b514e343564da13f27cd7fee8013500a",
-    "gen-ts/deployment-status-failure.ts": "sha256:3ffe268e32240f9da3172b161b8e99e06aa2d21d8c37b30f340506a337c64047",
+    "gen-ts/deployment-status-failure.ts": "sha256:6da2e6eb2f708efa51d416a1ec50f71ea7967cf9be9f93e7ce2e4760dae2cfe3",
     "gen-ts/deployment-status-request.ts": "sha256:7ddccd07ab9f6d0821903a291ab35f903bb055727e03a058b99165ec048f6483",
-    "gen-ts/deployment-status-response.ts": "sha256:1a082b43663b9d7e6f2377c91713bf0792d52060beed5f2bad7879d0ac718bd3",
+    "gen-ts/deployment-status-response.ts": "sha256:70a75c801613a85ebf1946c31d3f5c051451cc99684b352e35b6fd1ccf444f24",
     "gen-ts/env-bindings.ts": "sha256:a167cfe9842352c9fec6412ff0d82bda9c5f5c3a1af541bd5c27a57f54fd0941",
-    "gen-ts/error-category-registry.ts": "sha256:c28e9a6c532ec326f9832edee1432436e01ff6a7c5a4c066a7a465318dddebe2",
+    "gen-ts/error-category-registry.ts": "sha256:7466a502c0723a77db825cdeaa9556a244201b55d9b7acbf2c098e9e84351df1",
     "gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
     "gen-ts/index.ts": "sha256:4aecbb1044a210bf5813deb645c623eefa7bb6af2a8e2557b76ed9ba1d95eba9",
@@ -145,7 +145,7 @@
     "gen-ts/secret-reference.ts": "sha256:a8b65de72705b6f51f57cd8ca58881483108005b1fa4d19106c3e9cf1fa877e7",
     "gen-ts/security-scan-input.ts": "sha256:b31f048be04c34b40f49d3b3ba53277e473cd435ae9216ba3a3b4dac69fb5685",
     "gen-ts/security-verdict.ts": "sha256:fea950cddbd12fe0218e2573c9a29c6748d56612a464559f1e6d688fa97f68c7",
-    "gen-ts/transform-report.ts": "sha256:6c54b579884d98135d73945d00980820b136f269622db27fa56a1c4c0e57d3b6",
+    "gen-ts/transform-report.ts": "sha256:efbe396f3f511420a7ee99f1a8fbe8764635b454f799bd3bb5b2ed747ba1e36f",
     "gen-ts/version-state-machine.ts": "sha256:c67af3e86ac306743345b850dfd3ae5201c19d10c40e2c149cf8c38258320d5f",
     "gen-ts/version-state.ts": "sha256:a835112930299e7b593a1b8810b7414f6c9e809da2092306c743128170a3b702",
     "gen-ts/well-defined-app-manifest.ts": "sha256:0c5c2fed747ad7f4c1034104c1acd9bb2e316f2c0b08a4ff3e2fab486f576a2f"

package/dist/gen-ts/artifact-contract.d.ts

@@ -22,6 +22,10 @@ export interface ArtifactContract {
          */
         runtime_features?: 'chromium'[];
     };
+    /**
+     * Optional immutable OCI image used only by auxiliary workloads of a statically served SPA.
+     */
+    workload_image_ref?: string;
     static: {
         /**
          * e.g. builds/<digest>/
@@ -93,6 +97,14 @@ export interface ArtifactContract {
         path: '.harbour/app-manifest.json';
         sha256: string;
     };
+    /**
+     * Optional digest-pinned browser capability declaration published only after LIVE cutover.
+     */
+    app_capabilities?: {
+        version: 1;
+        path: '.harbour/app-capabilities.json';
+        sha256: string;
+    };
     /**
      * Optional method/path authentication policy compiled by the transformation. The default is SSO; listed routes preserve the application's own token, signature, or callback authorization.
      */

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.33.0.0";
-export declare const ContractPublishVersion: "0.33.0";
-export declare const ContractPublishTag: "v0.33.0";
-export declare const ContractSchemasDigest: "sha256:dd106c711981c50f8ab49cf6c54bf201aa27f36a40d6c108aa0a1c2916d1d72c";
+export declare const ContractRepositoryVersion: "0.41.0.0";
+export declare const ContractPublishVersion: "0.41.0";
+export declare const ContractPublishTag: "v0.41.0";
+export declare const ContractSchemasDigest: "sha256:c4cb346100e76c8936457e0453a6219db10e1240cd71dde33cfef2b672e97e35";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:64d1d6efa060927f70394bd1d4758ca1008c1ccff30b34c1b50c518d27155a3b";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:dc9111b80945f2a233e382bc462140dca0de45dd29ffc824124d9b555fd769c7";
+export declare const ContractGeneratedGoDigest: "sha256:b667bd3bb2eb76f268c60ad756de962c32cdb30f56fdedc2693150c6ff5c5feb";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:345aa69f8a745e004a50c9203d7abcf365edb6aedeb4e2886f89e3efd916afc9";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.33.0.0";
-export const ContractPublishVersion = "0.33.0";
-export const ContractPublishTag = "v0.33.0";
-export const ContractSchemasDigest = "sha256:dd106c711981c50f8ab49cf6c54bf201aa27f36a40d6c108aa0a1c2916d1d72c";
+export const ContractRepositoryVersion = "0.41.0.0";
+export const ContractPublishVersion = "0.41.0";
+export const ContractPublishTag = "v0.41.0";
+export const ContractSchemasDigest = "sha256:c4cb346100e76c8936457e0453a6219db10e1240cd71dde33cfef2b672e97e35";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:64d1d6efa060927f70394bd1d4758ca1008c1ccff30b34c1b50c518d27155a3b";
-export const ContractGeneratedTypeScriptDigest = "sha256:dc9111b80945f2a233e382bc462140dca0de45dd29ffc824124d9b555fd769c7";
+export const ContractGeneratedGoDigest = "sha256:b667bd3bb2eb76f268c60ad756de962c32cdb30f56fdedc2693150c6ff5c5feb";
+export const ContractGeneratedTypeScriptDigest = "sha256:345aa69f8a745e004a50c9203d7abcf365edb6aedeb4e2886f89e3efd916afc9";

package/dist/gen-ts/data-source.d.ts

@@ -1,7 +1,7 @@
 /**
  * Closed connector set for the Data-Access MVP.
  */
-export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks';
+export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks' | 'mysql';
 /**
  * byo = admin brought existing infrastructure; harbour_managed = Harbour provisioned it.
  */
@@ -45,6 +45,10 @@ export interface DataSource {
      * Whether builders may request grants against this source.
      */
     requestableByBuilders: boolean;
+    /**
+     * Explicit tenant-admin permission to use this source during application validation. A source must also be active and granted to the app.
+     */
+    allowValidation?: boolean;
     status: DataSourceStatus;
 }
 /**

package/dist/gen-ts/deploy-request.d.ts

@@ -50,6 +50,12 @@ export interface DeployRequest {
      */
     idempotencyKey?: string;
     environmentBindings?: DeployRequestEnvironmentBindings;
+    /**
+     * Approved external sources available only during validation. Entries refer to names in environmentBindings and never contain credential values.
+     *
+     * @maxItems 32
+     */
+    validationSources?: DeployRequestValidationSource[];
     /**
      * Preview-only. When true, the transformed code is NOT committed back to the source branch (benchmark deploys). Ignored outside preview.
      */
@@ -76,6 +82,21 @@ export interface DeployRequestEnvironmentBindings {
      */
     bindings: DeployRequestEnvironmentBinding[];
 }
+export interface DeployRequestValidationSource {
+    sourceId: string;
+    connector: 'mysql';
+    /**
+     * Explicit role for each referenced environment binding. Names must be unique within and across validation sources; consumers enforce that semantic constraint.
+     *
+     * @minItems 1
+     * @maxItems 32
+     */
+    bindings: DeployRequestValidationSourceBinding[];
+}
+export interface DeployRequestValidationSourceBinding {
+    name: string;
+    role: 'host' | 'port' | 'database' | 'credential';
+}
 /**
  * Optional transformation-engine selection. New preview deployments default to branch_select; set sequential explicitly for the legacy engine.
  */

package/dist/gen-ts/deployment-status-failure.d.ts

@@ -1,9 +1,14 @@
 /**
- * Frontend-safe failure projection nested in a failed DeploymentStatusResponse. Internal evidence references, AWS identifiers and raw provider errors are excluded.
+ * Frontend-safe failure projection nested in a failed DeploymentStatusResponse. Raw provider errors are excluded; a digest-bound diagnosticRef locates the complete redacted terminal diagnostic.
  */
 export interface DeploymentStatusFailure {
     category: string;
     retryable: boolean;
     message: string;
     remediationHint: string;
+    diagnosticRef?: FailureDiagnosticRef;
+}
+export interface FailureDiagnosticRef {
+    key: string;
+    sha256: string;
 }

package/dist/gen-ts/deployment-status-response.d.ts

@@ -32,6 +32,11 @@ export interface StatusFailureProjection {
     retryable: boolean;
     message: string;
     remediationHint: string;
+    diagnosticRef?: StatusDiagnosticRef;
+}
+export interface StatusDiagnosticRef {
+    key: string;
+    sha256: string;
 }
 export interface StatusProgressEvent {
     /**

package/dist/gen-ts/error-category-registry.d.ts

@@ -3,6 +3,7 @@ export declare const ErrorCategories: {
     readonly IntakeUnsupportedRuntime: "intake.unsupported-runtime";
     readonly IntakeAttestationMissing: "intake.attestation-missing";
     readonly IntakeMultiAppRepo: "intake.multi-app-repo";
+    readonly IntakeSourceInvalid: "intake.source-invalid";
     readonly SecretsUnresolvable: "secrets.unresolvable";
     readonly SecretsReferenceUnresolvable: "secrets.reference-unresolvable";
     readonly SecretsPlaceholderUnresolved: "secrets.placeholder-unresolved";
@@ -10,8 +11,19 @@ export declare const ErrorCategories: {
     readonly StorageSqliteMisclassified: "storage.sqlite-misclassified";
     readonly StorageMappingDrift: "storage.mapping-drift";
     readonly StorageUnavailable: "storage.unavailable";
+    readonly AiPlanBlocked: "ai.plan-blocked";
     readonly TransformDeadlineExceeded: "transform.deadline-exceeded";
+    readonly TransformAttemptsExhausted: "transform.attempts-exhausted";
+    readonly TransformNonRetryable: "transform.non-retryable";
     readonly TransformValidationFailed: "transform.validation-failed";
+    readonly AuthValidationSeedUnsupported: "auth.validation-seed-unsupported";
+    readonly AuthIdentityEntityUnresolvable: "auth.identity-entity-unresolvable";
+    readonly DependencyPythonRuntimeUnsupported: "dependency.python-runtime-unsupported";
+    readonly DependencyResolverUnavailable: "dependency.resolver-unavailable";
+    readonly DependencyResolutionFailed: "dependency.resolution-failed";
+    readonly DependencyLockfileStale: "dependency.lockfile-stale";
+    readonly AuroraBundleInvalid: "aurora.bundle-invalid";
+    readonly CapabilityUnsupported: "capability.unsupported";
     readonly FrontendEnvInlinedUnfixable: "frontend.env-inlined-unfixable";
     readonly BuildRecipeFailed: "build.recipe-failed";
     readonly BuildImageTooLarge: "build.image-too-large";
@@ -42,5 +54,7 @@ export declare const ErrorCategories: {
     readonly PromotionQueuePublicationFailed: "promotion.queue-publication-failed";
     readonly CutoverFlipFailed: "cutover.flip-failed";
 };
+/** True for an exact registry entry or a concrete member of a documented family. */
+export declare function isKnownErrorCategory(category: string): boolean;
 /** Retryable lookup for a concrete or family-suffixed category. Unknown → false (fail closed). */
 export declare function isRetryable(category: string): boolean;

package/dist/gen-ts/error-category-registry.js

@@ -5,6 +5,7 @@ export const ErrorCategories = {
     IntakeUnsupportedRuntime: "intake.unsupported-runtime",
     IntakeAttestationMissing: "intake.attestation-missing",
     IntakeMultiAppRepo: "intake.multi-app-repo",
+    IntakeSourceInvalid: "intake.source-invalid",
     SecretsUnresolvable: "secrets.unresolvable",
     SecretsReferenceUnresolvable: "secrets.reference-unresolvable",
     SecretsPlaceholderUnresolved: "secrets.placeholder-unresolved",
@@ -12,8 +13,19 @@ export const ErrorCategories = {
     StorageSqliteMisclassified: "storage.sqlite-misclassified",
     StorageMappingDrift: "storage.mapping-drift",
     StorageUnavailable: "storage.unavailable",
+    AiPlanBlocked: "ai.plan-blocked",
     TransformDeadlineExceeded: "transform.deadline-exceeded",
+    TransformAttemptsExhausted: "transform.attempts-exhausted",
+    TransformNonRetryable: "transform.non-retryable",
     TransformValidationFailed: "transform.validation-failed",
+    AuthValidationSeedUnsupported: "auth.validation-seed-unsupported",
+    AuthIdentityEntityUnresolvable: "auth.identity-entity-unresolvable",
+    DependencyPythonRuntimeUnsupported: "dependency.python-runtime-unsupported",
+    DependencyResolverUnavailable: "dependency.resolver-unavailable",
+    DependencyResolutionFailed: "dependency.resolution-failed",
+    DependencyLockfileStale: "dependency.lockfile-stale",
+    AuroraBundleInvalid: "aurora.bundle-invalid",
+    CapabilityUnsupported: "capability.unsupported",
     FrontendEnvInlinedUnfixable: "frontend.env-inlined-unfixable",
     BuildRecipeFailed: "build.recipe-failed",
     BuildImageTooLarge: "build.image-too-large",
@@ -49,6 +61,7 @@ const retryableExact = {
     "intake.unsupported-runtime": false,
     "intake.attestation-missing": false,
     "intake.multi-app-repo": false,
+    "intake.source-invalid": false,
     "secrets.unresolvable": false,
     "secrets.reference-unresolvable": false,
     "secrets.placeholder-unresolved": false,
@@ -56,8 +69,19 @@ const retryableExact = {
     "storage.sqlite-misclassified": false,
     "storage.mapping-drift": false,
     "storage.unavailable": true,
+    "ai.plan-blocked": false,
     "transform.deadline-exceeded": true,
+    "transform.attempts-exhausted": false,
+    "transform.non-retryable": false,
     "transform.validation-failed": true,
+    "auth.validation-seed-unsupported": false,
+    "auth.identity-entity-unresolvable": false,
+    "dependency.python-runtime-unsupported": false,
+    "dependency.resolver-unavailable": true,
+    "dependency.resolution-failed": false,
+    "dependency.lockfile-stale": false,
+    "aurora.bundle-invalid": false,
+    "capability.unsupported": false,
     "frontend.env-inlined-unfixable": false,
     "build.recipe-failed": false,
     "build.image-too-large": false,
@@ -90,10 +114,15 @@ const retryableExact = {
 };
 const retryableFamilies = {
     "storage.unsupported-engine": false,
-    "transform.non-retryable": false,
     "quota.exceeded": false,
     "uncategorized": false,
 };
+/** True for an exact registry entry or a concrete member of a documented family. */
+export function isKnownErrorCategory(category) {
+    if (category in retryableExact)
+        return true;
+    return Object.keys(retryableFamilies).some(prefix => category === prefix || category.startsWith(prefix + '.'));
+}
 /** Retryable lookup for a concrete or family-suffixed category. Unknown → false (fail closed). */
 export function isRetryable(category) {
     if (category in retryableExact)

package/dist/gen-ts/transform-report.d.ts

@@ -1,5 +1,5 @@
 /**
- * Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields.
+ * Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It also carries validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run. An unsupported report carries only application.unsupported and no plan or fixtures.
  */
 export type TransformReport = {
     /**
@@ -29,11 +29,10 @@ export type TransformReport = {
         }[];
     };
     database?: {
-        mode: 'none' | 'sql' | 'unsupported';
+        mode: 'none' | 'sql';
         changeType: 'none' | 'code_only' | 'schema_only' | 'code_and_schema';
         requiresCodeChanges: boolean;
         requiresSchemaMigration: boolean;
-        desiredSchemaPath: string;
         /**
          * @maxItems 128
          */
@@ -55,11 +54,154 @@ export type TransformReport = {
          */
         unsupportedFeatures: string[];
     };
+    /**
+     * Agent-authored preservation (smoke) plan for this attempt. Required whenever the report is deployable; forbidden on an unsupported report. Every test must be grounded in files the agent actually read or changed (evidence) and expressed as tenant-relative browser or HTTP steps the validation cell can execute without secrets. Structural bounds live here; per-action required fields, at least one assert* step per test, one to three happy_path tests, unique ids, the {{runId}} substitution and path safety are enforced semantically by the deployment plane.
+     */
+    preservation_plan?: {
+        version: 1;
+        /**
+         * Ordered smoke tests. happy_path tests cover primary user journeys inferred from routes, APIs, forms and focused tests; boundary_check tests pin the smallest observable behaviour each applied playbook or changed file could regress.
+         *
+         * @minItems 1
+         * @maxItems 8
+         */
+        tests: {
+            id: string;
+            kind: 'happy_path' | 'boundary_check';
+            name: string;
+            /**
+             * Transformation boundaries this test claims to cover.
+             *
+             * @minItems 1
+             * @maxItems 8
+             */
+            boundaries: ('application' | 'routing' | 'database' | 'authentication' | 'runtime_dependency' | 'files' | 'provider' | 'background_work')[];
+            /**
+             * Files (and optionally lines) in the transformed workspace that ground this test. Paths must exist after transformation.
+             *
+             * @minItems 1
+             * @maxItems 8
+             */
+            evidence: {
+                path: string;
+                line?: number;
+                reason: string;
+            }[];
+            confidence: 'high' | 'medium' | 'low';
+            /**
+             * Executed in order inside the validation cell's authenticated browser context; the test stops at its first failed step. Which optional fields apply depends on action: navigate/request/assertURL use path; click/fill/assertVisible use target; fill uses value; assertVisible uses text; request uses method, body and name; assertResponse uses request, status, jsonKey and jsonValue.
+             *
+             * @minItems 1
+             * @maxItems 20
+             */
+            steps: {
+                action: 'navigate' | 'click' | 'fill' | 'reload' | 'request' | 'assertVisible' | 'assertURL' | 'assertResponse';
+                /**
+                 * Tenant-relative path starting with '/'; never a scheme or host.
+                 */
+                path?: string;
+                target?: {
+                    by: 'role' | 'label' | 'placeholder' | 'text' | 'testId' | 'css';
+                    role?: string;
+                    /**
+                     * Accessible name when by is role.
+                     */
+                    name?: string;
+                    /**
+                     * Locator value for every by other than role.
+                     */
+                    value?: string;
+                };
+                value?: string;
+                text?: string;
+                method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+                /**
+                 * JSON text sent as the request body.
+                 */
+                body?: string;
+                /**
+                 * Names a request's response for a later assertResponse in the same test.
+                 */
+                name?: string;
+                /**
+                 * The named preceding request an assertResponse inspects.
+                 */
+                request?: string;
+                status?: number;
+                /**
+                 * Top-level key or dotted path into the JSON response; no brackets.
+                 */
+                jsonKey?: string;
+                /**
+                 * Expected value, compared as a string.
+                 */
+                jsonValue?: string;
+                timeoutMs?: number;
+            }[];
+        }[];
+        /**
+         * Boundaries the agent deliberately left untested, each with a reviewed reason. An empty array claims full coverage.
+         *
+         * @maxItems 8
+         */
+        uncovered: {
+            boundary: 'application' | 'routing' | 'database' | 'authentication' | 'runtime_dependency' | 'files' | 'provider' | 'background_work';
+            reason: 'not-observable-in-validation-cell' | 'no-safe-fixture' | 'no-grounded-surface';
+            detail?: string;
+        }[];
+    };
+    /**
+     * A bounded, non-secret fixture program for this transformation's throwaway validation cell. Null means the application needs no external fixture. Bindings use application-owned logical names and explicitly inject only generated fixture URLs; fixtures describe deterministic HTTP or WebSocket exchanges without naming an application or provider and without executable code. The deployment plane semantically verifies unique fixture ids, template references, operation coverage, JSON text and safe config updates before forwarding the spec to the data plane.
+     */
+    validation_fixtures?: {
+        version: 1;
+        /**
+         * Bounded per-run fixture requirements. logical_name is an arbitrary application-owned binding name; deployment-plane semantic validation requires it to be unique within this array.
+         *
+         * @minItems 1
+         * @maxItems 32
+         */
+        bindings: ValidationFixtureBinding[];
+        /**
+         * @minItems 1
+         * @maxItems 32
+         */
+        fixtures: ({
+            id: string;
+            type: 'http';
+            http: ValidationHttpFixture;
+            websocket: null;
+        } | {
+            id: string;
+            type: 'websocket';
+            http: null;
+            websocket: ValidationWebSocketFixture;
+        })[];
+    } | null;
     application: {
         unsupported?: {
+            /**
+             * Closed machine category selected independently from the human explanation.
+             */
+            category: 'auth.validation-seed-unsupported' | 'auth.identity-entity-unresolvable' | 'capability.unsupported';
             capability: string;
+            /**
+             * The exact source operation that cannot be preserved, such as a cross-document transactional write. Name a concrete operation, not an engine or product.
+             */
+            operation: string;
             constraint: string;
             reason: string;
+            /**
+             * Exact source locations proving the required operation and the unsupported platform capability. Environment failures and unfinished conversion work are not evidence.
+             *
+             * @minItems 1
+             * @maxItems 32
+             */
+            evidence: {
+                path: string;
+                line: number;
+                reason: string;
+            }[];
         };
         runtime?: string;
         /**
@@ -74,18 +216,11 @@ export type TransformReport = {
             backgroundJobs: 'none' | 'sqs';
         } | null;
         /**
-         * Build-only bootstrap for authenticated browser validation. Use null when the application does not require a local database user. When local authorization resolves Harbour identity to an application-owned user or membership row, declare an idempotent command that creates the fixed validation identity in the throwaway database. Reuse an existing seed command when available; otherwise add the smallest validation-only script using the application's existing database layer. The command is never run during production deployment.
+         * Build-only PostgreSQL bootstrap for authenticated browser validation. Use null when the application does not require a pre-existing database identity. The SQL file runs only in Harbour's throwaway validation database after migrations and before candidate boot. Harbour supplies the fixed probe subject and lowercased email as transaction-local settings.
          */
         validationSeed?: {
-            /**
-             * @minItems 1
-             * @maxItems 64
-             */
-            command: string[];
-            /**
-             * Existing application-owned environment variable that receives the trusted browser probe email, for example ADMIN_EMAIL.
-             */
-            identityEmailEnvironmentVariable: string;
+            kind: 'sql';
+            path: string;
         } | null;
         buildKind?: 'container' | 'static';
         topology?: 'static' | 'backend' | 'frontend_and_backend';
@@ -138,3 +273,81 @@ export type TransformReport = {
         [k: string]: unknown;
     };
 });
+/**
+ * @maxItems 32
+ */
+export type ValidationFixtureNameValuePairs = {
+    name: string;
+    value: string;
+}[];
+export interface ValidationFixtureBinding {
+    logical_name: string;
+    /**
+     * Optional explicit fixture association for a binding that has no URL mapping, such as a credential-only binding.
+     */
+    fixture_id?: string;
+    /**
+     * @minItems 1
+     * @maxItems 5
+     */
+    operations: ('http' | 'websocket' | 'email' | 'webhook' | 'ai')[];
+    /**
+     * Environment variables that receive a generated fixture URL. Values cannot carry arbitrary configuration or secrets.
+     *
+     * @maxItems 32
+     */
+    environment: {
+        [k: string]: unknown;
+    }[];
+    /**
+     * Structured JSON or YAML keys that receive a generated fixture URL in a bounded relative application config file.
+     *
+     * @maxItems 32
+     */
+    config: {
+        path: string;
+        format: 'json' | 'yaml';
+        key: string;
+        value: string;
+    }[];
+}
+export interface ValidationHttpFixture {
+    base_path: string;
+    /**
+     * @minItems 1
+     * @maxItems 64
+     */
+    routes: {
+        operation: 'http' | 'email' | 'webhook' | 'ai';
+        request: {
+            method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+            path: string;
+            query: ValidationFixtureNameValuePairs;
+            headers: ValidationFixtureNameValuePairs;
+            body: string;
+        };
+        response: {
+            status: number;
+            headers: ValidationFixtureNameValuePairs;
+            body: string;
+        };
+    }[];
+}
+export interface ValidationWebSocketFixture {
+    path: string;
+    /**
+     * Exact JSON value the fixture expects as the first client message, or null when no client message is required. JSON parsing is a semantic check.
+     */
+    expected_json: string | null;
+    /**
+     * @minItems 1
+     * @maxItems 64
+     */
+    send_messages: string[];
+    close: {
+        code: number;
+        reason: string;
+    } | null;
+}
+/** True iff validation_fixtures.bindings contains no repeated logical_name values. */
+export declare function hasUniqueTransformReportValidationFixturesBindings(input: TransformReport): boolean;