@fourier-labs/harbour-contracts 0.5.0 → 0.9.0

package/gen-ts/ai-policy-snapshot.ts

@@ -0,0 +1,169 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiPolicyScope = {
+  level: 'tenant' | 'application_environment';
+  tenantId: AiPolicyIdentifier;
+  appId?: AiPolicyIdentifier;
+  environment?: AiPolicyIdentifier;
+};
+export type AiPolicyIdentifier = string;
+export type AiPolicyDigest = string;
+export type AiPolicyGuardrailRule = {
+  ruleId: AiPolicyIdentifier;
+  detectorId: AiPolicyIdentifier;
+  detectorVersion: string;
+  phase: 'input' | 'output';
+  action: 'ALLOW' | 'OBSERVE' | 'REDACT' | 'BLOCK';
+  parameters?: AiPolicyGuardrailParameters;
+};
+/**
+ * Bounded, closed JSON Schema subset carried by an output.json_schema guardrail. Every node is a closed object over an enumerated keyword set; object nodes must state additionalProperties: false, so the validated output shape is closed too. Size is bounded per node (maxProperties/maxLength/maxItems); the consuming validator additionally enforces an overall byte budget at policy load.
+ */
+export type AiPolicyEmbeddedJsonSchema = {
+  type: 'object' | 'array' | 'string' | 'number' | 'integer' | 'boolean' | 'null';
+  description?: string;
+  properties?: {
+    [k: string]: AiPolicyEmbeddedJsonSchema;
+  };
+  /**
+   * @maxItems 64
+   */
+  required?: string[];
+  additionalProperties?: false;
+  items?: AiPolicyEmbeddedJsonSchema;
+  /**
+   * @minItems 1
+   * @maxItems 64
+   */
+  enum?: (string | number | boolean | null)[];
+  minimum?: number;
+  maximum?: number;
+  minLength?: number;
+  maxLength?: number;
+  minItems?: number;
+  maxItems?: number;
+};
+
+/**
+ * Immutable, content-addressed AI policy snapshot consumed by the Harbour AI Gateway. Provider credentials are represented only by Secrets Manager references.
+ */
+export interface AiPolicySnapshot {
+  schema: 'harbour.ai-policy-snapshot/1.0';
+  scope: AiPolicyScope;
+  revision: number;
+  publishedAt: string;
+  contentDigest: AiPolicyDigest;
+  baselineDigest: AiPolicyDigest;
+  classificationMinimum?: AiPolicyClassificationMinimum;
+  /**
+   * @maxItems 64
+   */
+  providers: AiPolicyProvider[];
+  /**
+   * @maxItems 512
+   */
+  models: AiPolicyModel[];
+  /**
+   * @maxItems 256
+   */
+  routes: AiPolicyRoute[];
+  /**
+   * @maxItems 256
+   */
+  policies: AiPolicyRuleSet[];
+  /**
+   * @maxItems 128
+   */
+  limits: AiPolicyLimit[];
+  retention: AiPolicyRetention;
+}
+export interface AiPolicyClassificationMinimum {
+  classification: 'Green' | 'Yellow' | 'Orange' | 'Red';
+  mappingDigest: AiPolicyDigest;
+}
+export interface AiPolicyProvider {
+  id: AiPolicyIdentifier;
+  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter';
+  baseUrl?: string;
+  credentialSecretRef: string;
+  enabled: boolean;
+}
+export interface AiPolicyModel {
+  id: AiPolicyIdentifier;
+  providerId: AiPolicyIdentifier;
+  providerModel: string;
+  /**
+   * @minItems 1
+   * @maxItems 2
+   */
+  capabilities: ('generation' | 'embeddings')[];
+  approved: boolean;
+  pricing: AiPolicyPricing;
+}
+export interface AiPolicyPricing {
+  revision: AiPolicyIdentifier;
+  inputMicroUsdPerMillion: number;
+  outputMicroUsdPerMillion: number;
+}
+export interface AiPolicyRoute {
+  alias: AiPolicyIdentifier;
+  version: number;
+  capability: 'generation' | 'embeddings';
+  /**
+   * @minItems 1
+   * @maxItems 16
+   */
+  targets: AiPolicyRouteTarget[];
+  retryCount: number;
+  timeoutMs: number;
+}
+export interface AiPolicyRouteTarget {
+  modelId: AiPolicyIdentifier;
+  priority: number;
+  weight: number;
+}
+export interface AiPolicyRuleSet {
+  name: AiPolicyIdentifier;
+  version: number;
+  maxRequestBytes: number;
+  maxInputTokens: number;
+  maxOutputTokens: number;
+  bufferedDelivery: boolean;
+  permittedRequestFields: AiPolicyPermittedRequestFields;
+  /**
+   * @maxItems 128
+   */
+  guardrails: AiPolicyGuardrailRule[];
+}
+export interface AiPolicyPermittedRequestFields {
+  temperature: boolean;
+  maxOutputTokens: boolean;
+  responseFormat: boolean;
+  tools: boolean;
+}
+export interface AiPolicyGuardrailParameters {
+  /**
+   * @minItems 1
+   * @maxItems 64
+   */
+  allowedTools?: string[];
+  jsonSchema?: AiPolicyEmbeddedJsonSchema;
+  jsonSchemaRef?: AiPolicyDigest;
+}
+export interface AiPolicyLimit {
+  name: AiPolicyIdentifier;
+  enabled: boolean;
+  scope: 'tenant' | 'application';
+  requestsPerMinute: number;
+  tokensPerMinute: number;
+  monthlyBudgetMicroUsd: number;
+}
+export interface AiPolicyRetention {
+  captureMode: 'OFF' | 'BEST_EFFORT' | 'REQUIRED';
+  retentionDays: number;
+  /**
+   * @maxItems 16
+   */
+  revealRoles: AiPolicyIdentifier[];
+}

package/gen-ts/ai-pricing-revision.ts

@@ -0,0 +1,33 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiPricingIdentifier = string;
+export type AiPricingDigest = string;
+
+/**
+ * Immutable v2 line-item pricing revision. A correction is a new revision; published records are never edited.
+ */
+export interface AiPricingRevision {
+  schema: 'harbour.ai-pricing-revision/2.0';
+  revisionId: AiPricingIdentifier;
+  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter';
+  providerModel: string;
+  region?: AiPricingIdentifier;
+  currency: 'USD';
+  /**
+   * @minItems 1
+   * @maxItems 64
+   */
+  dimensions: PriceDimension[];
+  supersedesRevisionId?: AiPricingIdentifier;
+  revisionDigest: AiPricingDigest;
+  effectiveAt: string;
+  publishedAt: string;
+}
+export interface PriceDimension {
+  dimension: AiPricingIdentifier;
+  direction: 'input' | 'output';
+  unit: AiPricingIdentifier;
+  scale: number;
+  microUsdPerScale: number;
+}

package/gen-ts/ai-runtime-binding.ts

@@ -0,0 +1,18 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * A value-free hierarchical identifier. Schemes are an additive reviewed registry; userinfo, ports, percent encoding, query strings, fragments and empty path segments are unrepresentable.
+ */
+export type AiRuntimeSafeReference = string;
+
+/**
+ * Platform-neutral, value-free binding of one workload identity to one version-scoped Harbour Gateway secret. Platform adapters may add implementation details internally; they never enter this contract.
+ */
+export interface AiRuntimeBinding {
+  schema: 'harbour.ai-runtime-binding/1.0';
+  platform: string;
+  workloadIdentityRef: AiRuntimeSafeReference;
+  secretRef: AiRuntimeSafeReference;
+  runtimeBindingDigest: string;
+}

package/gen-ts/ai-runtime-contract.ts

@@ -0,0 +1,46 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiRuntimeIdentifier = string;
+export type AiRuntimeModelAlias = string;
+export type AiRuntimeDigest = string;
+/**
+ * Platform-neutral value-free hierarchical reference using the additive reviewed scheme registry; no userinfo, query, fragment, port or percent encoding.
+ */
+export type AiRuntimeContractSafeReference = string;
+
+/**
+ * Immutable deployment runtime contract derived by an AI Governance PLAN decision. Contains only scoped configuration and a Secrets Manager reference, never key plaintext.
+ */
+export interface AiRuntimeContract {
+  schema: 'harbour.ai-runtime-contract/1.0';
+  tenantId: AiRuntimeIdentifier;
+  appId: AiRuntimeIdentifier;
+  environment: AiRuntimeIdentifier;
+  versionId: string;
+  sourceRevision: string;
+  mode: 'observe' | 'enforce';
+  gatewayBaseUrl: string;
+  gatewayKeySecretRef: string;
+  modelAliases: {
+    generation?: AiRuntimeModelAlias;
+    embeddings?: AiRuntimeModelAlias;
+  };
+  policyDigest: AiRuntimeDigest;
+  runtimeBinding?: AiRuntimeContractBinding;
+  /**
+   * @minItems 1
+   * @maxItems 2
+   */
+  requiredStrategies: ('deployment_injection' | 'deterministic_adapter')[];
+}
+/**
+ * Optional additive platform-neutral binding. Existing 1.0 records without it remain valid.
+ */
+export interface AiRuntimeContractBinding {
+  schema: 'harbour.ai-runtime-binding/1.0';
+  platform: string;
+  workloadIdentityRef: AiRuntimeContractSafeReference;
+  secretRef: AiRuntimeContractSafeReference;
+  runtimeBindingDigest: AiRuntimeDigest;
+}

package/gen-ts/ai-trace-event-v2.ts

@@ -0,0 +1,35 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiTraceV2Digest = string;
+export type AiTraceV2Identifier = string;
+
+/**
+ * Additive metering projection linked to a readable v1 trace. It carries dimension-level reported or estimated usage without changing the v1 event.
+ */
+export interface AiTraceEventV2 {
+  schema: 'harbour.ai-trace-event/2.0';
+  traceId: string;
+  requestId: string;
+  policyDigest: AiTraceV2Digest;
+  outcome: 'succeeded' | 'blocked' | 'failed' | 'cancelled';
+  /**
+   * @maxItems 256
+   */
+  usageLineItems: UsageLineItem[];
+  totalCostMicroUsd: number;
+  reservationId?: string;
+  meteringStatus: 'settled' | 'reserved' | 'unknown' | 'repaired';
+  occurredAt: string;
+}
+export interface UsageLineItem {
+  attempt: number;
+  dimension: AiTraceV2Identifier;
+  direction: 'input' | 'output';
+  quantity: number;
+  unit: AiTraceV2Identifier;
+  priceRevisionDigest: AiTraceV2Digest;
+  scale: number;
+  costMicroUsd: number;
+  provenance: 'reported' | 'estimated';
+}

package/gen-ts/ai-trace-event.ts

@@ -0,0 +1,72 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * Value-free asynchronous AI Gateway trace metadata. Raw prompts and responses never enter the queue; captured content is referenced only after successful encrypted storage.
+ */
+export type AiTraceEvent = {
+  schema: 'harbour.ai-trace-event/1.0';
+  traceId: string;
+  requestId: string;
+  tenantId: AiTraceIdentifier;
+  appId: AiTraceIdentifier;
+  environment: AiTraceIdentifier;
+  versionId: string;
+  callsiteFingerprint?: AiTraceDigest;
+  policyDigest: AiTraceDigest;
+  routeRevision?: string;
+  requestedModel?: string;
+  governedModelAlias?: string;
+  provider?: 'openai' | 'anthropic' | 'gemini' | 'openrouter';
+  providerModel?: string;
+  outcome: 'succeeded' | 'blocked' | 'failed' | 'cancelled';
+  usage?: AiTraceUsage;
+  priceRevision?: AiTraceIdentifier;
+  costMicroUsd: number;
+  latencyMs: number;
+  retryCount: number;
+  fallbackUsed: boolean;
+  reservationId?: string;
+  /**
+   * @minItems 0
+   * @maxItems 32
+   */
+  attempts: AiTraceAttempt[];
+  /**
+   * @maxItems 128
+   */
+  guardrailResults: AiTraceGuardrailResult[];
+  contentCaptureStatus: 'off' | 'captured' | 'capture_failed';
+  contentRef?: string;
+  retentionExpiresAt?: string;
+  occurredAt: string;
+};
+export type AiTraceIdentifier = string;
+export type AiTraceDigest = string;
+export type AiTraceAttempt = {
+  attempt: number;
+  provider: 'openai' | 'anthropic' | 'gemini' | 'openrouter';
+  providerModel: string;
+  priceRevision: AiTraceIdentifier;
+  outcome: 'succeeded' | 'failed' | 'timed_out' | 'cancelled';
+  /**
+   * Provider-reported token usage, or null when the attempt did not succeed and the provider reported none. Null states that usage is UNKNOWN — estimates are never fabricated. A succeeded attempt always reports real usage.
+   */
+  usage: AiTraceUsage | null;
+  costMicroUsd: number;
+  latencyMs: number;
+  errorCode?: string;
+};
+
+export interface AiTraceUsage {
+  inputTokens: number;
+  outputTokens: number;
+}
+export interface AiTraceGuardrailResult {
+  ruleId: string;
+  detectorId: string;
+  detectorVersion: string;
+  phase: 'input' | 'output';
+  action: 'ALLOW' | 'OBSERVE' | 'REDACT' | 'BLOCK';
+  result: 'passed' | 'matched' | 'blocked' | 'redacted';
+}

package/gen-ts/ai-transform-event.ts

@@ -0,0 +1,51 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiTransformIdentifier = string;
+export type AiTransformDigest = string;
+export type AiTransformPlanEntry = {
+  callSiteFingerprint: AiTransformDigest;
+  sourcePath: string;
+  expectedSourceFileSha256: AiTransformDigest;
+  strategy: 'deployment_injection' | 'deterministic_adapter';
+  configurationMappingId?: AiTransformIdentifier;
+  configurationMappingVersion?: string;
+  transformId?: AiTransformIdentifier;
+  transformVersion?: string;
+  /**
+   * @minItems 1
+   * @maxItems 32
+   */
+  allowedSyntaxKinds: AiTransformIdentifier[];
+  runtimeShimName?: string;
+  runtimeShimVersion?: string;
+  runtimeShimDigest?: AiTransformDigest;
+};
+
+/**
+ * Checksum-bound deterministic AI interception task input. Entries are the complete ordered PLAN interception plan so the task can verify the governance plan digest before applying its deterministic subset; source and patches are referenced, never embedded.
+ */
+export interface AiTransformEvent {
+  schema: 'harbour.ai-transform-event/1.0';
+  tenantId: AiTransformIdentifier;
+  appId: AiTransformIdentifier;
+  environment: AiTransformIdentifier;
+  versionId: string;
+  sourceRevision: string;
+  workspace: AiTransformWorkspace;
+  inventoryDigest: AiTransformDigest;
+  policyDigest: AiTransformDigest;
+  runtimeContractDigest: AiTransformDigest;
+  interceptionPlanDigest: AiTransformDigest;
+  /**
+   * @minItems 1
+   * @maxItems 1000
+   */
+  entries: AiTransformPlanEntry[];
+}
+export interface AiTransformWorkspace {
+  bucket: string;
+  key: string;
+  sha256: AiTransformDigest;
+  size: number;
+}

package/gen-ts/ai-transform-result.ts

@@ -0,0 +1,36 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiTransformResultDigest = string;
+export type AiTransformResultIdentifier = string;
+
+/**
+ * Bounded deterministic interception result; contains descriptors and digest evidence only.
+ */
+export interface AiTransformResult {
+  schema: 'harbour.ai-transform-result/1.0';
+  workspace: AiTransformResultWorkspace;
+  interceptionPlanDigest: AiTransformResultDigest;
+  transformerVersion: string;
+  /**
+   * @minItems 1
+   * @maxItems 1000
+   */
+  applied: AiTransformApplied[];
+}
+export interface AiTransformResultWorkspace {
+  bucket: string;
+  key: string;
+  sha256: AiTransformResultDigest;
+  size: number;
+}
+export interface AiTransformApplied {
+  callSiteFingerprint: AiTransformResultDigest;
+  transformId: AiTransformResultIdentifier;
+  transformVersion: string;
+  sourcePath: string;
+  beforeSha256: AiTransformResultDigest;
+  afterSha256: AiTransformResultDigest;
+  governedBoundaryFingerprint: AiTransformResultDigest;
+  runtimeShimDigest: AiTransformResultDigest;
+}

package/gen-ts/ai-verification-evidence.ts

@@ -0,0 +1,54 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AiVerificationIdentifier = string;
+export type AiVerificationDigest = string;
+
+/**
+ * Bounded, value-free evidence submitted by deployment verification for one governed version.
+ */
+export interface AiVerificationEvidence {
+  schema: 'harbour.ai-verification-evidence/1.0';
+  tenantId: AiVerificationIdentifier;
+  appId: AiVerificationIdentifier;
+  environment: AiVerificationIdentifier;
+  versionId: string;
+  sourceRevision: string;
+  inventoryDigest: AiVerificationDigest;
+  interceptionPlanDigest: AiVerificationDigest;
+  runtimeContractDigest: AiVerificationDigest;
+  policyDigest: AiVerificationDigest;
+  runtimeBindingDigest?: AiVerificationDigest;
+  finalWorkspaceDigest: AiVerificationDigest;
+  /**
+   * @maxItems 1000
+   */
+  verifiedCallsiteFingerprints: AiVerificationDigest[];
+  /**
+   * @maxItems 1000
+   */
+  appliedTransforms: AiVerificationTransform[];
+  /**
+   * @minItems 1
+   * @maxItems 32
+   */
+  endpointChecks: AiVerificationEndpointCheck[];
+  providerCredentialsAbsent: true;
+  smokeTraceId: string;
+  evidenceDigest: AiVerificationDigest;
+  verifiedAt: string;
+}
+export interface AiVerificationTransform {
+  callSiteFingerprint: AiVerificationDigest;
+  governedBoundaryFingerprint: AiVerificationDigest;
+  transformId: AiVerificationIdentifier;
+  transformVersion: string;
+  beforeSha256: AiVerificationDigest;
+  afterSha256: AiVerificationDigest;
+  runtimeShimDigest: AiVerificationDigest;
+}
+export interface AiVerificationEndpointCheck {
+  name: AiVerificationIdentifier;
+  passed: true;
+  configurationMappingVersion: string;
+}

package/gen-ts/api-error-response.ts

@@ -0,0 +1,16 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * Safe JSON error body returned by the Deploy and Status Lambdas for API-level 4xx and 5xx responses. It is distinct from the internal pipeline ErrorEnvelope, which requires a version and evidence reference.
+ */
+export interface ApiErrorResponse {
+  code: string;
+  message: string;
+  correlationId: string;
+  requestId?: string;
+  /**
+   * Present when a version was minted before the API-level failure.
+   */
+  versionId?: string;
+}

package/gen-ts/artifact-contract.ts

@@ -0,0 +1,81 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * The build output contract (LLD §3) — the provider-portability seam. Emitted by the build (`artifact.json`) and consumed by every deploy stage below build. Deploy stages read ONLY this document plus the blobs it references. Secret REFERENCES only — never values.
+ */
+export interface ArtifactContract {
+  contract_version: 1;
+  app_id: string;
+  commit: string;
+  /**
+   * sha256 of the canonical bundle; the immutable identity that promotion pins to (invariant §1.3.2).
+   */
+  artifact_digest: string;
+  backend: {
+    type: 'oci-image' | 'zip';
+    /**
+     * ECR uri@digest (oci-image) or S3 key (zip).
+     */
+    ref: string;
+    entrypoint: string;
+    runtime: string;
+  };
+  static: {
+    /**
+     * e.g. builds/<digest>/
+     */
+    path: string;
+    /**
+     * true when static assets carry no env-specific values (no static rebuild needed on promotion).
+     */
+    env_agnostic: boolean;
+  };
+  routes: {
+    path: string;
+    target: 'backend' | 'static';
+  }[];
+  env: {
+    /**
+     * Non-secret env vars, e.g. {"PORT":"8080"}.
+     */
+    vars: {
+      [k: string]: string;
+    };
+    /**
+     * Secrets Manager references only, e.g. harbour/<org>/<app>/<env>/STRIPE_KEY. Never values.
+     */
+    secret_refs: string[];
+  };
+  storage_bindings: {
+    kind: 'sql' | 'kv' | 'files';
+    /**
+     * Logical name, e.g. "default".
+     */
+    logical?: string;
+    /**
+     * e.g. aurora-sv2.
+     */
+    provider: string;
+  }[];
+  /**
+   * Post-MVP (migration tooling is post-MVP, LLD §4.6); MVP emits an empty array.
+   */
+  migrations: {
+    seq: number;
+    sha: string;
+    destructive: boolean;
+    path: string;
+  }[];
+  /**
+   * MVP emits an empty array.
+   */
+  scheduled_tasks: {}[];
+  transform_report: {
+    /**
+     * Transformed surfaces, e.g. ["secrets","storage.sql"].
+     */
+    surfaces: string[];
+    static_rebuild_required: boolean;
+  };
+}

package/gen-ts/contract-release.ts

@@ -0,0 +1,10 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export const ContractRepositoryVersion = "0.9.0.0" as const;
+export const ContractPublishVersion = "0.9.0" as const;
+export const ContractPublishTag = "v0.9.0" as const;
+export const ContractSchemasDigest = "sha256:df73090b9fbbac8a39d0ec92e929f4d687bd7920de583fb2463bf8570dc68ebb" as const;
+export const ContractAiFixturesDigest = "sha256:180a5f30cf0b6d93fa4c812a217d2365ffe22ac54d11626e71f8072fcf8f67c6" as const;
+export const ContractGeneratedGoDigest = "sha256:be376911aec8ee6359a38fdafebf343ce157255e19c544617b7bcccd4329e5de" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:857288e60b476b42dce0304ec05aff6af1f2719278959ed03740ef88af5e736b" as const;

package/gen-ts/data-dependency.ts

@@ -0,0 +1,46 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Harbour.
+ */
+export type DataDependencyKind = 'database' | 'api' | 'app_owned_external';
+/**
+ * matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Harbour's remit.
+ */
+export type DataDependencyClassification = 'matched' | 'out_of_scope' | 'unknown' | 'inventory' | 'app_owned_external';
+/**
+ * declared = stated by the builder; detected = found by analysis.
+ */
+export type DataDependencyOrigin = 'declared' | 'detected';
+
+/**
+ * A single external data dependency of an app, either declared by the builder or detected during analysis. Classification records how the dependency resolved against the tenant's registered data-source inventory; matchedSourceId is present only when classification is matched.
+ */
+export interface DataDependency {
+  kind: DataDependencyKind;
+  identifiers: DataDependencyIdentifiers;
+  classification: DataDependencyClassification;
+  /**
+   * sourceId of the registered data source this dependency matched; present only when classification is matched.
+   */
+  matchedSourceId?: string;
+  origin: DataDependencyOrigin;
+}
+/**
+ * Evidence identifying the dependency; used to match it against the registered source inventory.
+ */
+export interface DataDependencyIdentifiers {
+  /**
+   * Hostnames the dependency was observed or declared against.
+   */
+  hosts: string[];
+  /**
+   * Client driver/library that surfaced the dependency (e.g. pg, snowflake-sdk).
+   */
+  driver?: string;
+  /**
+   * Environment-variable names the app reads to configure this dependency.
+   */
+  envNames: string[];
+}