@fourier-labs/harbour-contracts 0.44.0 → 0.46.0

package/README.md

@@ -38,6 +38,10 @@ exist here first.
 | `binding-classification-subject.schema.json` | Complete value-free binding-name classification before version allocation | AI governance §5.7 / SEC-UP-01 |
 | `sanitized-binding-evidence.schema.json` | Exact-version sanitized runtime-binding allocation receipt | AI governance §5.7 / SEC-UP-02 |
 | `ai-pricing-revision`, `ai-metering-policy`, `ai-budget-ledger-event`, `ai-trace-event-v2` | Additive metering v2 records, including media dimensions and P5 trace attribution; v1 records remain readable | AI governance §9 |
+| `app-integrations-declaration.schema.json` | Committed `.harbour/integrations.json` (`harbour.app-integrations/2.0`): closed three-operation set with fixed identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
+| `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds, the three result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
+| `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record and the additive `harbour.data-grant/2.0` grant record (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
+| `kit-bundle-manifest.schema.json`, `kit-lock.schema.json` | Published kit bundle identity (SDK tarball digest plus optional `sdk.version` and https `sdk.url` download location) and the committed `.harbour/kit.lock.json` the CodeBuild SDK-vendoring gate compares against | Dev kit §3 |
 
 Runtime resource profiles are a closed contract shared by transformation, artifacts, and
 well-defined application manifests. The supported profiles are `standard`, `memory-1g`, and

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.44.0.0",
-  "publishVersion": "0.44.0",
-  "publishTag": "v0.44.0",
-  "schemasDigest": "sha256:a83a5d65514b34668ba1aea770f626585b24d07c7bfcc5bb68cf6382a8b6ff6c",
+  "repositoryVersion": "0.46.0.0",
+  "publishVersion": "0.46.0",
+  "publishTag": "v0.46.0",
+  "schemasDigest": "sha256:2d5d65ab7cf2f575de0f93cc3b096b2ac6505e5f505653c65b6a472f219fbbe2",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:95f1e5ec97ac5883d529af6442fa58ae3a59bb3e00d4b5852d03049e23cb7f4d",
-  "generatedTypeScriptDigest": "sha256:49048cdb1c9ec15433f6cb7d4fa42d6f39a5fc5da48c9d2c3b4b2ef0c2b39b3d",
+  "generatedGoDigest": "sha256:529c21544ed916b2d50854f31acd933d0b5b2f9251465375bfe0338fb11351e5",
+  "generatedTypeScriptDigest": "sha256:7ebe33c88dcb7e20024201518b0da941b49e25f8ae4324cb15308cb450bf2422",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -31,10 +31,12 @@
     "schema/ai-transform-result.schema.json": "sha256:244e380a36957ab2dcb526ea22aaecb56b53664ce1fda6934d0021c084c99133",
     "schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
     "schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
+    "schema/app-integrations-declaration.schema.json": "sha256:ed289e461a44f24099ed19286e08f8703b7e71c2478a46969579ae1bf4face9d",
     "schema/artifact-contract.schema.json": "sha256:8047b461a1c6d07bbe867a259c57bdf5cc0fdf282cf842ec7b683a9e93713b10",
     "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/builder-input-proposal.schema.json": "sha256:fe85cffa6d76b1e1effe1f5d75525f8fe0e1eaa3be4a304e491aa23ad72c0e72",
     "schema/data-dependency.schema.json": "sha256:89ba8481ccabc935e7dab5d13871c985839a751ad1586710d8382a15e1f3340c",
+    "schema/data-grant-v2.schema.json": "sha256:167abdda40c62119d9f19d9a4b6485acbde15aea4754cfb3093f57a7a00219b7",
     "schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
     "schema/data-source.schema.json": "sha256:aec8d2497dae9a91886a3df9f6fbbdb3d3fcab44b14fbcacc3f5e99b827f1bba",
     "schema/deploy-request.schema.json": "sha256:32531e21983cdfeec511f8b4cddd4dad6530cd90e4e9fe147225d78d138b6198",
@@ -48,9 +50,16 @@
     "schema/env-bindings.schema.json": "sha256:ae09bc4ca5508afa698ef854a59153c4c6f99b07017b48cb9b07ce05abad12f2",
     "schema/error-category.enum.json": "sha256:2268b8a00dfa1f1ab6db7650c117028247fca980d4a23aa5969ce30b76692be9",
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
+    "schema/integration-connect-result.schema.json": "sha256:3f254b67ef739dc1fa395bdc8c4dc93359b16d481dba2a2d777aa5b6f34b7af8",
+    "schema/integration-error-details.schema.json": "sha256:d4cf0c175a109c985a46d1ee5b47fa98b72cab93c2bfebb4e7c29cedaefff7a4",
+    "schema/integration-execute-request.schema.json": "sha256:9b7a169432853e6bd640bf61b9eed6287a76f5b303820c77d037f48b7ec99411",
+    "schema/integration-execute-result.schema.json": "sha256:d28a22556c54f9ac6a9bd318e815acc8db487a1e51f6310bceadb41442016930",
+    "schema/kit-bundle-manifest.schema.json": "sha256:c15e28ae028dbd1c262427b9c797142e19b1f38fa36b4ecfe187e32c20a174ec",
+    "schema/kit-lock.schema.json": "sha256:5e24b76660f83990af7a6c037af350c3850ee439ef956f65a0360facbdcdd997",
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
+    "schema/saas-connection.schema.json": "sha256:2e35c907b3c470fdf7d451eba504c2875b830e97853d99078aaac61cc56e5ba0",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
     "schema/security-scan-input.schema.json": "sha256:83502dffb3c07ac2e0698928e6dc123f454fc667d4aacd336bcad6944ef2ac3d",
@@ -97,7 +106,7 @@
     "gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
     "gen-go/error_category.go": "sha256:b2ddea22dcfa030f1a45e721e635485b0bd816cf1f38e7654628a653f5ed4583",
     "gen-go/schema_documents.go": "sha256:bc8a5119241953827affa45588a1492fdf1e74bb9119564202baf424596d0d86",
-    "gen-go/types.go": "sha256:94c0936e557e6d43d9468793428fe5f2fc737668f51fe0fc058755c219be0c9f",
+    "gen-go/types.go": "sha256:5f72328441e849a45508b8e7ed1998388052ef61e079ff0de1c3076e052398cf",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -122,11 +131,13 @@
     "gen-ts/ai-transform-result.ts": "sha256:208c66b2aeb425c0cbcc18b7191f6e8989443f2b2c1690648e0e06cc1448ce25",
     "gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
     "gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
+    "gen-ts/app-integrations-declaration.ts": "sha256:5d7dac0705de33dbdc926c98caacd277b3a9698c132abeef01700077e961812e",
     "gen-ts/artifact-contract.ts": "sha256:4a6dc6d2caaeed4bb2066cc8a333e6e09e5a0d4745e0b1038293d54ab9403aeb",
     "gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
     "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
     "gen-ts/builder-input-proposal.ts": "sha256:b0108c3787873d3cf1a39f00967379418a6766275d3474cfa55f5a9d93ead174",
     "gen-ts/data-dependency.ts": "sha256:0572c31d7ae9088eccc104eee1a205bf176d1d6dacfaf0f290d666024e284966",
+    "gen-ts/data-grant-v2.ts": "sha256:e804821a3a4931e22387719ba3865a9a8c7f60d6e1b6ce37d6305cb867ccecb3",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
     "gen-ts/data-source.ts": "sha256:77d6bb3b0eaa355789c5d97dd1f548734add6950329dc69549350b8d17c8d582",
     "gen-ts/deploy-request.ts": "sha256:0214faa8be6680f0bfc117d5ce67c1a59fcc18bd0ea4bc840e03e7d051fa9ab6",
@@ -141,10 +152,17 @@
     "gen-ts/error-category-registry.ts": "sha256:7466a502c0723a77db825cdeaa9556a244201b55d9b7acbf2c098e9e84351df1",
     "gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
-    "gen-ts/index.ts": "sha256:2e8ea8a7b31e5db66cc733c286b18ac4589fdf712f5ca0f481dfbbce9f425b4e",
+    "gen-ts/index.ts": "sha256:982599819309370072af19f1c248a033c13b17a6ee9006272d3436ab87b0db21",
+    "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
+    "gen-ts/integration-error-details.ts": "sha256:ef0ede67e2fc9e7894604f63f807d43a54987f0e942753de94243bb5320ccf6c",
+    "gen-ts/integration-execute-request.ts": "sha256:da53eecf99da25c74b07d426adb8473795ebe2df4d8bd539894a6eda050f6c07",
+    "gen-ts/integration-execute-result.ts": "sha256:c0b8449b442f8286c3ade51667039c71410dd9d53ef8b6a28611af4ba45c1357",
+    "gen-ts/kit-bundle-manifest.ts": "sha256:9041b32af3df781ca6800bc14c3719e5e54c81dff370633454ac3ad27432eb58",
+    "gen-ts/kit-lock.ts": "sha256:de4ae82bac7bd234a3230ae671962e80eed6542d695a032a442673659dc6be5e",
     "gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
+    "gen-ts/saas-connection.ts": "sha256:6813e6cc0e4c0a3b4fb8181fe95b53a96bbf2953aa6ea0b6f3b6a5744cd0878b",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",

package/dist/gen-ts/app-integrations-declaration.d.ts

@@ -0,0 +1,48 @@
+export type IntegrationConnectionKind = 'saas' | 'database';
+/**
+ * Tenant-wide logical alias of a connection (governance sourceId) or of a resource under it.
+ */
+export type IntegrationAlias = string;
+/**
+ * @minItems 1
+ * @maxItems 64
+ */
+export type ResourceNames = IntegrationAlias[];
+/**
+ * Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (three operations) and each operation carries a fixed identity mode: slack.channel.history=user, slack.message.post=app, warehouse.view.read=app. A `saas` connection may declare only the Slack operations and a `database` connection only warehouse.view.read. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind enums referenced by the other integration schemas.
+ */
+export interface AppIntegrationsDeclaration {
+    schema: 'harbour.app-integrations/2.0';
+    connections: {
+        [k: string]: DeclaredConnection;
+    };
+}
+export interface DeclaredConnection {
+    kind: IntegrationConnectionKind;
+    operations: {
+        'slack.channel.history'?: UserModeChannelOperation;
+        'slack.message.post'?: AppModeChannelOperation;
+        'warehouse.view.read'?: AppModeViewOperation;
+    };
+}
+export interface UserModeChannelOperation {
+    identity: 'user';
+    resources: ResourceNames;
+}
+export interface AppModeChannelOperation {
+    identity: 'app';
+    resources: ResourceNames;
+}
+export interface AppModeViewOperation {
+    identity: 'app';
+    resources: {
+        [k: string]: ViewResource;
+    };
+}
+export interface ViewResource {
+    /**
+     * @minItems 1
+     * @maxItems 32
+     */
+    columns: string[];
+}

package/dist/gen-ts/app-integrations-declaration.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.44.0.0";
-export declare const ContractPublishVersion: "0.44.0";
-export declare const ContractPublishTag: "v0.44.0";
-export declare const ContractSchemasDigest: "sha256:a83a5d65514b34668ba1aea770f626585b24d07c7bfcc5bb68cf6382a8b6ff6c";
+export declare const ContractRepositoryVersion: "0.46.0.0";
+export declare const ContractPublishVersion: "0.46.0";
+export declare const ContractPublishTag: "v0.46.0";
+export declare const ContractSchemasDigest: "sha256:2d5d65ab7cf2f575de0f93cc3b096b2ac6505e5f505653c65b6a472f219fbbe2";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:95f1e5ec97ac5883d529af6442fa58ae3a59bb3e00d4b5852d03049e23cb7f4d";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:49048cdb1c9ec15433f6cb7d4fa42d6f39a5fc5da48c9d2c3b4b2ef0c2b39b3d";
+export declare const ContractGeneratedGoDigest: "sha256:529c21544ed916b2d50854f31acd933d0b5b2f9251465375bfe0338fb11351e5";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:7ebe33c88dcb7e20024201518b0da941b49e25f8ae4324cb15308cb450bf2422";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.44.0.0";
-export const ContractPublishVersion = "0.44.0";
-export const ContractPublishTag = "v0.44.0";
-export const ContractSchemasDigest = "sha256:a83a5d65514b34668ba1aea770f626585b24d07c7bfcc5bb68cf6382a8b6ff6c";
+export const ContractRepositoryVersion = "0.46.0.0";
+export const ContractPublishVersion = "0.46.0";
+export const ContractPublishTag = "v0.46.0";
+export const ContractSchemasDigest = "sha256:2d5d65ab7cf2f575de0f93cc3b096b2ac6505e5f505653c65b6a472f219fbbe2";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:95f1e5ec97ac5883d529af6442fa58ae3a59bb3e00d4b5852d03049e23cb7f4d";
-export const ContractGeneratedTypeScriptDigest = "sha256:49048cdb1c9ec15433f6cb7d4fa42d6f39a5fc5da48c9d2c3b4b2ef0c2b39b3d";
+export const ContractGeneratedGoDigest = "sha256:529c21544ed916b2d50854f31acd933d0b5b2f9251465375bfe0338fb11351e5";
+export const ContractGeneratedTypeScriptDigest = "sha256:7ebe33c88dcb7e20024201518b0da941b49e25f8ae4324cb15308cb450bf2422";

package/dist/gen-ts/data-grant-v2.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Grant lifecycle state. Legal edges live in x-transitions; DENIED and REVOKED are terminal.
+ */
+export type DataGrantV2Status = 'REQUESTED' | 'GRANTED' | 'DENIED' | 'REVOKED';
+/**
+ * Provider-side work for the current approved scope (credential mint, cleanup, installation check).
+ */
+export type DataGrantV2ProvisioningStatus = 'NONE' | 'PENDING' | 'FAILED' | 'DONE';
+/**
+ * An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON ["v2",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. Expiry is enforced from UTC time on every call and SDK calls never extend it. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal, SaaS grants add installation; both hold references only.
+ */
+export interface DataGrantV2 {
+    schema: 'harbour.data-grant/2.0';
+    appId: string;
+    /**
+     * Tenant-wide logical alias of a connection (governance sourceId) or of a resource under it.
+     */
+    sourceId: string;
+    kind: 'saas' | 'database';
+    /**
+     * development is the CLI/local kit; preview and production are hosted.
+     */
+    environment: 'development' | 'preview' | 'production';
+    /**
+     * Whose authority an operation runs under. Fixed per operation; callers never choose it.
+     */
+    identityMode: 'app' | 'user';
+    status: DataGrantV2Status;
+    /**
+     * Approved operations; each must match this grant's identityMode.
+     *
+     * @minItems 1
+     * @maxItems 3
+     */
+    operations: ('slack.channel.history' | 'slack.message.post' | 'warehouse.view.read')[];
+    /**
+     * Approved logical resource names (channel aliases or view names). Never inherited by wildcard.
+     *
+     * @minItems 1
+     * @maxItems 64
+     */
+    resources: string[];
+    /**
+     * Absent only for explicitly approved ongoing production access.
+     */
+    expiresAt?: string;
+    approvedBy?: string;
+    /**
+     * Optimistic-concurrency version; approvals compare it with the reviewed value.
+     */
+    version: number;
+    /**
+     * The one open access request attached to this grant, if any.
+     */
+    pendingRequestId?: string;
+    provisioning: DataGrantV2Provisioning;
+    /**
+     * Database grants: secretref://tenant/{t}/app/{a}/env/{env}/source/{s}.
+     */
+    credentialRef?: string;
+    /**
+     * Database grants: the deterministic per tenant/app/environment/source principal.
+     */
+    mintedPrincipal?: string;
+    /**
+     * SaaS grants: the connection installation this environment maps to.
+     */
+    installation?: string;
+}
+export interface DataGrantV2Provisioning {
+    status: DataGrantV2ProvisioningStatus;
+    /**
+     * Failed attempts; three requires an admin retry.
+     */
+    attempts: number;
+    /**
+     * Sanitized reason; never a provider error body.
+     */
+    lastError?: string;
+}
+/** True iff from→to is a legal DataGrantV2Status edge (schema x-transitions). */
+export declare function canTransitionDataGrantV2Status(from: string, to: string): boolean;
+/** True iff the DataGrantV2Status is terminal (DENIED, REVOKED). */
+export declare function isTerminalDataGrantV2Status(state: string): boolean;

package/dist/gen-ts/data-grant-v2.js

@@ -0,0 +1,13 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+const legalDataGrantV2StatusTransitions = {
+    "REQUESTED": { "GRANTED": true, "DENIED": true },
+    "GRANTED": { "REVOKED": true },
+};
+const terminalDataGrantV2StatusStates = new Set(["DENIED", "REVOKED"]);
+/** True iff from→to is a legal DataGrantV2Status edge (schema x-transitions). */
+export function canTransitionDataGrantV2Status(from, to) {
+    return Boolean(legalDataGrantV2StatusTransitions[from]?.[to]);
+}
+/** True iff the DataGrantV2Status is terminal (DENIED, REVOKED). */
+export function isTerminalDataGrantV2Status(state) { return terminalDataGrantV2StatusStates.has(state); }

package/dist/gen-ts/index.d.ts

@@ -19,12 +19,14 @@ export * from './ai-transform-event.js';
 export * from './ai-transform-result.js';
 export * from './ai-verification-evidence.js';
 export * from './api-error-response.js';
+export * from './app-integrations-declaration.js';
 export * from './artifact-contract.js';
 export * from './binding-classification-digest-helper.js';
 export * from './binding-classification-subject.js';
 export * from './builder-input-proposal.js';
 export * from './contract-release.js';
 export * from './data-dependency.js';
+export * from './data-grant-v2.js';
 export * from './data-grant.js';
 export * from './data-source.js';
 export * from './deploy-request.js';
@@ -39,9 +41,16 @@ export * from './env-bindings.js';
 export * from './error-category-registry.js';
 export * from './error-category.js';
 export * from './error-envelope.js';
+export * from './integration-connect-result.js';
+export * from './integration-error-details.js';
+export * from './integration-execute-request.js';
+export * from './integration-execute-result.js';
+export * from './kit-bundle-manifest.js';
+export * from './kit-lock.js';
 export * from './kvs-routing-entry.js';
 export * from './promotion-request.js';
 export * from './promotion-response.js';
+export * from './saas-connection.js';
 export * from './sanitized-binding-digest-helper.js';
 export * from './sanitized-binding-evidence.js';
 export * from './secret-reference.js';

package/dist/gen-ts/index.js

@@ -21,12 +21,14 @@ export * from './ai-transform-event.js';
 export * from './ai-transform-result.js';
 export * from './ai-verification-evidence.js';
 export * from './api-error-response.js';
+export * from './app-integrations-declaration.js';
 export * from './artifact-contract.js';
 export * from './binding-classification-digest-helper.js';
 export * from './binding-classification-subject.js';
 export * from './builder-input-proposal.js';
 export * from './contract-release.js';
 export * from './data-dependency.js';
+export * from './data-grant-v2.js';
 export * from './data-grant.js';
 export * from './data-source.js';
 export * from './deploy-request.js';
@@ -41,9 +43,16 @@ export * from './env-bindings.js';
 export * from './error-category-registry.js';
 export * from './error-category.js';
 export * from './error-envelope.js';
+export * from './integration-connect-result.js';
+export * from './integration-error-details.js';
+export * from './integration-execute-request.js';
+export * from './integration-execute-result.js';
+export * from './kit-bundle-manifest.js';
+export * from './kit-lock.js';
 export * from './kvs-routing-entry.js';
 export * from './promotion-request.js';
 export * from './promotion-response.js';
+export * from './saas-connection.js';
 export * from './sanitized-binding-digest-helper.js';
 export * from './sanitized-binding-evidence.js';
 export * from './secret-reference.js';

package/dist/gen-ts/integration-connect-result.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The `data` member of the connect (POST) and disconnect (DELETE) responses on /_harbour/integrations/connect. connected: this user's consent link for the app/environment/connection is ACTIVE (accountLabel is a display label, never an ID or token); consent_required: the user must follow authorizationUrl (governance OAuth start with an opaque ticket); disconnected: only this user's consent for this app/environment was revoked. Connect is a user action and never requests IT app approval.
+ */
+export type IntegrationConnectResult = {
+    status: 'connected' | 'consent_required' | 'disconnected';
+    accountLabel?: string;
+    authorizationUrl?: string;
+} & ({
+    status?: 'connected';
+} | {
+    status?: 'consent_required';
+} | {
+    status?: 'disconnected';
+});

package/dist/gen-ts/integration-connect-result.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/integration-error-details.d.ts

@@ -0,0 +1,22 @@
+/**
+ * App-SDK HarbourErrorCategory values an integration route may emit; INTERNAL is reserved for the transport.
+ */
+export type IntegrationErrorCategory = 'AUTH_REQUIRED' | 'FORBIDDEN' | 'NOT_FOUND' | 'CONFLICT' | 'VALIDATION_FAILED' | 'RATE_LIMITED' | 'UNAVAILABLE';
+/**
+ * Stable reason codes. SEND_OUTCOME_UNKNOWN: dispatch happened but the outcome is unknown; never re-post automatically. SEND_KEY_REUSED: the idempotency key was seen with a different payload or subject. GRANT_DENIED: IT denied the request. TOKEN_REFRESH_PENDING: another call holds the refresh lease; retry shortly. REQUEST_PENDING: a different request for this grant is still open.
+ */
+export type IntegrationErrorCode = 'USER_CONNECTION_REQUIRED' | 'USER_RECONNECT_REQUIRED' | 'GRANT_NOT_READY' | 'GRANT_EXPIRED' | 'GRANT_REVOKED' | 'CONNECTION_DISABLED' | 'OPERATION_NOT_DECLARED' | 'RESOURCE_NOT_APPROVED' | 'IDENTITY_MODE_MISMATCH' | 'SEND_OUTCOME_UNKNOWN' | 'SEND_KEY_REUSED' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'REQUEST_TOO_LARGE' | 'RESULT_TOO_LARGE' | 'DEADLINE_EXCEEDED' | 'APP_ACCESS_REQUIRED' | 'GRANT_DENIED' | 'TOKEN_REFRESH_PENDING' | 'REQUEST_PENDING';
+/**
+ * The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto HarbourError(category, message, details). `category` is the app-SDK HarbourErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.
+ */
+export interface IntegrationErrorDetails {
+    category: IntegrationErrorCategory;
+    message: string;
+    details: {
+        code: IntegrationErrorCode;
+        /**
+         * Mirrors the Retry-After header on RATE_LIMITED responses.
+         */
+        retryAfterSeconds?: number;
+    };
+}

package/dist/gen-ts/integration-error-details.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/integration-execute-request.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is NOT a caller field: it is fixed by the operation and enforced from the approved grant; any identity/userId/scope field is rejected by additionalProperties. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.
+ */
+export type IntegrationExecuteRequest = {
+    /**
+     * Tenant-wide logical alias of a connection (governance sourceId) or of a resource under it.
+     */
+    connection: string;
+    /**
+     * Closed operation set. Extending it is a contracts change.
+     */
+    operation: 'slack.channel.history' | 'slack.message.post' | 'warehouse.view.read';
+    /**
+     * Tenant-wide logical alias of a connection (governance sourceId) or of a resource under it.
+     */
+    resource: string;
+    input: {
+        limit?: number;
+        text?: string;
+        /**
+         * @minItems 1
+         * @maxItems 32
+         */
+        columns?: string[];
+    };
+    /**
+     * UUID of one explicit Send action; required for slack.message.post only. The same key with the same payload and subject returns the recorded outcome for seven days.
+     */
+    idempotencyKey?: string;
+};

package/dist/gen-ts/integration-execute-request.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/integration-execute-result.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the three operation results: slack.channel.history -> {messages, hasMore} (plain text/IDs/time only, never the provider payload); slack.message.post -> {messageId}; warehouse.view.read -> {rows} (decimal/64-bit values as strings, dates as ISO strings). An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. Results over 1 MiB are rejected, not truncated.
+ */
+export type IntegrationExecuteResult = {
+    /**
+     * @maxItems 15
+     */
+    messages?: ChannelMessage[];
+    hasMore?: boolean;
+    messageId?: string;
+    /**
+     * @maxItems 1000
+     */
+    rows?: {
+        [k: string]: unknown;
+    }[];
+};
+export interface ChannelMessage {
+    id: string;
+    text: string;
+    authorId: string;
+    createdAt: string;
+}

package/dist/gen-ts/integration-execute-result.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/kit-bundle-manifest.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Digest-pinned image reference <repository>@sha256:<hex>; tags are never accepted.
+ */
+export type ImageDigestReference = string;
+/**
+ * Identity of one published development-kit bundle (shipped with the CLI). It pins the app SDK tarball, the local runtime images and the agent-brief fingerprint that a kit-built app was developed against, so the hosted pipeline can prove compatibility before replacing the vendored SDK (see kit-lock.schema.json).
+ */
+export interface KitBundleManifest {
+    schema: 'harbour.kit-bundle/1.0';
+    /**
+     * The CLI package version that published this bundle.
+     */
+    kitVersion: string;
+    sdk: {
+        package: '@harbour/app-sdk';
+        /**
+         * The SDK package version the tarball was packed from (informational; compatibility is decided by tarballSha256).
+         */
+        version?: string;
+        /**
+         * SHA-256 of the SDK tarball baked into this bundle; the CodeBuild gate compares it with the pipeline's own tarball.
+         */
+        tarballSha256: string;
+        /**
+         * Where the CLI downloads the SDK tarball from when it is not shipped inline; the bytes are verified against tarballSha256 before install. The publisher may name the location by content address (for example an OCI blob whose path ends in sha256:<tarballSha256>).
+         */
+        url?: string;
+    };
+    images: {
+        appGateway: ImageDigestReference;
+        sessionFixture: ImageDigestReference;
+    };
+    brief: {
+        /**
+         * SHA-256 of the agent-brief tar, or the literal unknown when the bundle carried no brief.
+         */
+        fingerprint: string;
+    };
+    declarationSchema: 'harbour.app-integrations/2.0';
+}

package/dist/gen-ts/kit-bundle-manifest.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/kit-lock.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Committed `.harbour/kit.lock.json`: which app and tenant a kit-built app belongs to and the exact bundle it was developed against. The data-plane vendorAppSDK gate reads bundle.sdk.tarballSha256 and fails with kit_bundle_incompatible (naming both digests) when it differs from the baked tarball; apps without a kit.lock keep the existing path.
+ */
+export interface KitLock {
+    schema: 'harbour.kit-lock/1.0';
+    appId: string;
+    tenantId: string;
+    bundle: KitBundleManifest;
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * Identity of one published development-kit bundle (shipped with the CLI). It pins the app SDK tarball, the local runtime images and the agent-brief fingerprint that a kit-built app was developed against, so the hosted pipeline can prove compatibility before replacing the vendored SDK (see kit-lock.schema.json).
+ */
+interface KitBundleManifest {
+    schema: 'harbour.kit-bundle/1.0';
+    /**
+     * The CLI package version that published this bundle.
+     */
+    kitVersion: string;
+    sdk: {
+        package: '@harbour/app-sdk';
+        /**
+         * The SDK package version the tarball was packed from (informational; compatibility is decided by tarballSha256).
+         */
+        version?: string;
+        /**
+         * SHA-256 of the SDK tarball baked into this bundle; the CodeBuild gate compares it with the pipeline's own tarball.
+         */
+        tarballSha256: string;
+        /**
+         * Where the CLI downloads the SDK tarball from when it is not shipped inline; the bytes are verified against tarballSha256 before install. The publisher may name the location by content address (for example an OCI blob whose path ends in sha256:<tarballSha256>).
+         */
+        url?: string;
+    };
+    images: {
+        /**
+         * Digest-pinned image reference <repository>@sha256:<hex>; tags are never accepted.
+         */
+        appGateway: string;
+        /**
+         * Digest-pinned image reference <repository>@sha256:<hex>; tags are never accepted.
+         */
+        sessionFixture: string;
+    };
+    brief: {
+        /**
+         * SHA-256 of the agent-brief tar, or the literal unknown when the bundle carried no brief.
+         */
+        fingerprint: string;
+    };
+    declarationSchema: 'harbour.app-integrations/2.0';
+}
+export {};

package/dist/gen-ts/kit-lock.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};