@fourier-labs/harbour-contracts 0.57.0 → 0.59.0

package/README.md

@@ -1,6 +1,6 @@
 # harbour-contracts
 
-The single source of truth for every data shape that crosses a boundary between Harbour
+The single source of truth for every data shape that crosses a boundary between Isomorph
 components. **Schema-first:** hand-written JSON Schema in `schema/` is the source; the Go
 package (`gen-go/`) and TypeScript package (`gen-ts/` → `@fourier-labs/harbour-contracts`) are **generated**
 and committed. No handler, infra stack, or MCP op is built against a shape that does not
@@ -38,10 +38,10 @@ exist here first.
 | `binding-classification-subject.schema.json` | Complete value-free binding-name classification before version allocation | AI governance §5.7 / SEC-UP-01 |
 | `sanitized-binding-evidence.schema.json` | Exact-version sanitized runtime-binding allocation receipt | AI governance §5.7 / SEC-UP-02 |
 | `ai-pricing-revision`, `ai-metering-policy`, `ai-budget-ledger-event`, `ai-trace-event-v2` | Additive metering v2 records, including media dimensions and P5 trace attribution; v1 records remain readable | AI governance §9 |
-| `app-integrations-declaration.schema.json` | Committed `.harbour/integrations.json` (`harbour.app-integrations/2.0`): closed five-operation set (Slack read/post, Gmail read-only, warehouse view read) with fixed identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
+| `app-integrations-declaration.schema.json` | Committed `.isomorph/integrations.json` (`isomorph.app-integrations/2.0`): closed five-operation set (Slack read/post, Gmail read-only, warehouse view read) with fixed identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
 | `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds, the five result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
 | `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
-| `kit-bundle-manifest.schema.json`, `kit-lock.schema.json` | Published kit bundle identity (SDK tarball digest plus optional `sdk.version` and https `sdk.url` download location) and the committed `.harbour/kit.lock.json` the CodeBuild SDK-vendoring gate compares against | Dev kit §3 |
+| `kit-bundle-manifest.schema.json`, `kit-lock.schema.json` | Published kit bundle identity (SDK tarball digest plus optional `sdk.version` and https `sdk.url` download location) and the committed `.isomorph/kit.lock.json` the CodeBuild SDK-vendoring gate compares against | Dev kit §3 |
 | `deploy-response.schema.json` | 202 Accepted body for `POST /v1/tenants/{tenant}/apps/{app}/deployments`, returned only after the authoritative QUEUED version exists and its SQS message is accepted | — |
 | `deployment-source.schema.json` | Credential-free GitHub source in the `DeployRequest` body; credentials are resolved internally by MaterializeSource | — |
 | `deployment-environment.schema.json` | Public environment accepted by the preview APIs (`preview` only; production is reachable only through promotion) | — |
@@ -63,7 +63,7 @@ exist here first.
 | `ai-callsite-inventory.schema.json` | Immutable, sanitized AI call-site discovery for one exact deployment version (detection only) | AI governance |
 | `ai-runtime-contract.schema.json` | Immutable runtime contract derived by an AI Governance PLAN decision; scoped configuration plus a Secrets Manager reference | AI governance |
 | `ai-policy-snapshot.schema.json` | Immutable, content-addressed AI policy snapshot consumed by the AI Gateway | AI governance |
-| `ai-gateway-key-lookup.schema.json` | Value-free Gateway authentication metadata for one version-scoped Harbour key | AI governance |
+| `ai-gateway-key-lookup.schema.json` | Value-free Gateway authentication metadata for one version-scoped Isomorph key | AI governance |
 | `ai-trace-event.schema.json` | Value-free asynchronous AI Gateway trace metadata (v1); raw prompts and responses never enter the queue | AI governance |
 | `ai-transform-event.schema.json` | Checksum-bound deterministic AI interception task input carrying the ordered PLAN interception plan | AI governance |
 | `ai-transform-result.schema.json` | Bounded deterministic interception result: descriptors and digest evidence only | AI governance |
@@ -169,7 +169,7 @@ consumer cutover evidence.
 
   - It cannot be folder-scoped (`includeIf gitdir:…`). Go runs `git ls-remote` inside
     `~/go/pkg/mod/cache/vcs/…`, not inside your repo, so a per-directory helper never
-    applies. This fails identically from `/tmp` and from inside a Harbour repo, which
+    applies. This fails identically from `/tmp` and from inside an Isomorph repo, which
     makes it look like a bad tag rather than an auth problem.
   - Scoping by URL prefix keeps it off your other GitHub accounts: only
     `github.com/Fourier-Labs-AI/*` uses this credential.

package/contract-release.json

@@ -1,29 +1,29 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.57.0.0",
-  "publishVersion": "0.57.0",
-  "publishTag": "v0.57.0",
-  "schemasDigest": "sha256:68c005c88631759af9cbdec89e54afd6bcc87f153564e94fcf73aabf8ff76781",
+  "repositoryVersion": "0.59.0.0",
+  "publishVersion": "0.59.0",
+  "publishTag": "v0.59.0",
+  "schemasDigest": "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:b52b9d9f19dec87f989be6526a36d80b892f8fe800e82a5284b4a99664bb6eb0",
-  "generatedTypeScriptDigest": "sha256:1bb0b982246718edf2162d8185b98df4c3efad570bbf95cc49c997ed5f524b0d",
+  "generatedGoDigest": "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659",
+  "generatedTypeScriptDigest": "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
   },
   "schemas": {
     "schema/ai-budget-ledger-event.schema.json": "sha256:92770bc5358e03a3aae6cd261dad02dfcbbb06a6203566da2c6c7a5e63dd671c",
-    "schema/ai-callsite-inventory.schema.json": "sha256:dc607b008336add7ff41b414987a961f89440fb46e1c655bf116a937451c7cf7",
+    "schema/ai-callsite-inventory.schema.json": "sha256:1b13c24fba951e50620a77699bce46bc1a9ada031dcf7b14596f7e91e829b650",
     "schema/ai-classification-stamp.schema.json": "sha256:ad7f01dc8bb9a1cd619fce470227914aa3ef2ad57d34bfeaa0c6ef753aa6781d",
     "schema/ai-composite-policy-digest.schema.json": "sha256:3efccc249327e59f67a37fd954b524ee727a3e28a3c557a46d6ec1f15d69b34e",
     "schema/ai-deployment-gate-decision.schema.json": "sha256:bae1bdf91777b9a78f8da5a29f06b5de7f1e235789cf16b1bb507e85ad0243ff",
     "schema/ai-gateway-key-lifecycle-event.schema.json": "sha256:ba5cb862abe73227bee714b25247b4cacb34f11fdd1476bb5f920923fd75e2a9",
-    "schema/ai-gateway-key-lookup.schema.json": "sha256:e994d4782c9bc4f14d3a1c35c9ac1e7a5ec84284cde5b3af7e3e6022130ddbb3",
+    "schema/ai-gateway-key-lookup.schema.json": "sha256:7d362ded73c0da6b433f3c73afeabea4c38c5d6fc92c391c7ded727324deddf2",
     "schema/ai-governance-decision.schema.json": "sha256:d650762a428350748deafd6b251cbd4a03ba564650e74204f1a77bbe923e145f",
     "schema/ai-metering-policy.schema.json": "sha256:044115938d254d914feac162219d20ee48f741cd7ad32df4613b45f9c862fe8c",
-    "schema/ai-policy-snapshot.schema.json": "sha256:55cabb3cdd833d66d5d4d30d3e1b41dfc981f473725db2e64983930995424fc3",
+    "schema/ai-policy-snapshot.schema.json": "sha256:709e2d24ac0176295cee1c85b6892461c97c3c1c088cbdefbebd07be7f69e2cb",
     "schema/ai-pricing-revision.schema.json": "sha256:5ddb40c23712c0cec37b733678e4bb34811f5db44a233773c21a7dfaec188375",
-    "schema/ai-runtime-binding.schema.json": "sha256:e86cac2f70a474997bdef1577ca15f22982ec0ce866921df3f763c4d7f7fa191",
+    "schema/ai-runtime-binding.schema.json": "sha256:e99f983e78478b50114e0b2c940bb5bb30a4645cfd7fbddb7e0cf161d6d28502",
     "schema/ai-runtime-contract.schema.json": "sha256:bfa2f8968b1c0678b328c178c7b9c6563f7a363ae04bf74a1078a1cd9679fa14",
     "schema/ai-trace-event-v2.schema.json": "sha256:b479199bb6e44ea23a1da53f69943cb8f3886c433914fdb9bf9e9bdbc3dd767d",
     "schema/ai-trace-event.schema.json": "sha256:96d095805ce35ceac2a4cb76ebcca9188f5dd8689ed6c67e93f33c5412d2a78b",
@@ -31,43 +31,43 @@
     "schema/ai-transform-result.schema.json": "sha256:244e380a36957ab2dcb526ea22aaecb56b53664ce1fda6934d0021c084c99133",
     "schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
     "schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
-    "schema/app-integrations-declaration.schema.json": "sha256:93bfab77064f0ff912c8c51ae53da421f727fd3c8614d903f505da16f74a51ad",
+    "schema/app-integrations-declaration.schema.json": "sha256:feaf24ae933173708254ae0a37598db03deda808e0984f2f88963657bdb82428",
     "schema/artifact-contract.schema.json": "sha256:8047b461a1c6d07bbe867a259c57bdf5cc0fdf282cf842ec7b683a9e93713b10",
     "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/builder-input-proposal.schema.json": "sha256:fe85cffa6d76b1e1effe1f5d75525f8fe0e1eaa3be4a304e491aa23ad72c0e72",
-    "schema/data-dependency.schema.json": "sha256:89ba8481ccabc935e7dab5d13871c985839a751ad1586710d8382a15e1f3340c",
+    "schema/data-dependency.schema.json": "sha256:b4cc2b2484e982cfed64c0f56b8f1e9d1363c71854cd71f845b24fbe7d85c971",
     "schema/data-grant-v2.schema.json": "sha256:7fa6022aa2fcfd3c94bb969315155ea24e5a1aa25a25cb718df4465397076e07",
     "schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
-    "schema/data-source.schema.json": "sha256:aec8d2497dae9a91886a3df9f6fbbdb3d3fcab44b14fbcacc3f5e99b827f1bba",
+    "schema/data-source.schema.json": "sha256:899384f4f11b05d2737766918ab47987b11ed49f1160220a55a367fed96f6f2c",
     "schema/deploy-request.schema.json": "sha256:32531e21983cdfeec511f8b4cddd4dad6530cd90e4e9fe147225d78d138b6198",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
     "schema/deployment-continuation.schema.json": "sha256:55b6945439f2c91cd851dfe4bc9484e67a64091b7763b2d8267354b4a8bfae8c",
-    "schema/deployment-environment.schema.json": "sha256:3f1325d5579b3fc47d02c83b6ac0657108909b1dfb901f68203c9c8b668c2ef4",
+    "schema/deployment-environment.schema.json": "sha256:35b26cae07da9ee375a842b5e87c4570c8eca06775e9fd6dd46eb9eb8aa0df6c",
     "schema/deployment-source.schema.json": "sha256:256988b1efbfc90bd0e1ae31a2c5d69b20ef1e4471dc24c9f9aa759278270fbe",
     "schema/deployment-status-failure.schema.json": "sha256:7cc021d53a07c63b66eb48146d33e8875b64faf77ee927b235795469eb9a1559",
     "schema/deployment-status-request.schema.json": "sha256:1f9f87adc947a252b53b61f71ae17f8c1b8fbc1166f31301a043d11ac257dc66",
-    "schema/deployment-status-response.schema.json": "sha256:e591edf08d9dcfce7551b69b449be13927668309b2ebc3b064370f3cfef0385b",
+    "schema/deployment-status-response.schema.json": "sha256:d65a7d320c50dcc0985eaf59906a25ab05650efdaa76df0db6b21f9649969070",
     "schema/env-bindings.schema.json": "sha256:ae09bc4ca5508afa698ef854a59153c4c6f99b07017b48cb9b07ce05abad12f2",
-    "schema/error-category.enum.json": "sha256:2268b8a00dfa1f1ab6db7650c117028247fca980d4a23aa5969ce30b76692be9",
+    "schema/error-category.enum.json": "sha256:d6d83000c3357805b13138d717c411248c14f1c0fde1c02e82a25691de85d68d",
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
     "schema/integration-connect-result.schema.json": "sha256:3f254b67ef739dc1fa395bdc8c4dc93359b16d481dba2a2d777aa5b6f34b7af8",
-    "schema/integration-error-details.schema.json": "sha256:0e86425a9c9644ec88f4c55fb2d28454a779a705fb6446d9aa63ce2746a1a55c",
-    "schema/integration-execute-request.schema.json": "sha256:1549d7d25525e71696e38f5832aeeddba538c1b2e6f5c5497efc3aa5220a5124",
+    "schema/integration-error-details.schema.json": "sha256:47ad7621c34b092c7e40f912a21e7ccbdc000b974cfb7fa0c9200463e029f8fb",
+    "schema/integration-execute-request.schema.json": "sha256:7a3ebd7a9992a9390d05c9eea6b66762e437655afdca79b64ec992967172c325",
     "schema/integration-execute-result.schema.json": "sha256:de87c35fb4dfb16f7334cab111f247281fc2300dc27738871ed1f8397ece6753",
-    "schema/kit-bundle-manifest.schema.json": "sha256:bce5ab368194babf32d6553c7fe50d1d51b698b788beb0ad27a5ee132bd69784",
-    "schema/kit-lock.schema.json": "sha256:5e24b76660f83990af7a6c037af350c3850ee439ef956f65a0360facbdcdd997",
+    "schema/kit-bundle-manifest.schema.json": "sha256:4a9fcdd52ba0d55718ef4dbdab112b145ef90471d9356d4d3fb41e50fe9e400d",
+    "schema/kit-lock.schema.json": "sha256:a48154d9471e49a893d928f7b0e1e0bc77708a4a7edce4fdf14073203e0e8987",
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
     "schema/saas-connection.schema.json": "sha256:82ed8018201800a95aa792bde1d22568e86b55b3be926aa094a260c8c78a58d7",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
-    "schema/security-scan-input.schema.json": "sha256:83502dffb3c07ac2e0698928e6dc123f454fc667d4aacd336bcad6944ef2ac3d",
-    "schema/security-verdict.schema.json": "sha256:ec3c2d5c9df3601aeed0909b36c7f427469c7f0eeb3295c5809b96d09bf3fc26",
+    "schema/security-scan-input.schema.json": "sha256:9d221c27aba1937944d6e30eae92d6b7699b12e3ed088117ef8a628d32ffbbb5",
+    "schema/security-verdict.schema.json": "sha256:639cb83291b4c276b4cdc0ee8ba82a8a2a9792481ad2a1ab6d9ff3ba1f89dd7d",
     "schema/transform-parked-result.schema.json": "sha256:11729980d4c89d4a9e18f5f213232cd3359739c85626b36c20c2a37ba794c9af",
-    "schema/transform-report.schema.json": "sha256:62c8f3aa3ac748cb54d78cb729bdfbaaccf1c03574ea92841eb23b2557eff3cf",
+    "schema/transform-report.schema.json": "sha256:b9b4b09f88714b49d855f01ab9b611f34fb856447c0d063be409bb12a6c2700a",
     "schema/version-state.schema.json": "sha256:3b190007e2f8e3821c41ef11c6f5b226da7d5a18d34d4077f4618004846fd444",
-    "schema/well-defined-app-manifest.schema.json": "sha256:40f1bfea912dd85a05a0a3be2f6becadaf8ae3c5de9d5782ff1c8dd1bd83485f"
+    "schema/well-defined-app-manifest.schema.json": "sha256:2941d4a7e3a76ae500271f061eda7ea48a0d67729277bd9c7e26759d4bed696e"
   },
   "aiFixtures": {
     "fixtures/ai/adversarial-binding-classification-value.json": "sha256:ca009f3f6162a9d93b4ab416d52c1fba12a8a15aca5aed956c5fdcf2171b1e28",
@@ -103,29 +103,29 @@
     "gen-go/ai_gateway_key_token.go": "sha256:859c34383955f21c22589158214df074b74de6907a54bee7c781acfa9dad8679",
     "gen-go/binding_digest_helpers.go": "sha256:50462ba2beb16c7931dfc7e10302c12c90bf8111788991f74f08a718125dfbfb",
     "gen-go/contracts_test.go": "sha256:56376287cb1548be1b35ab4c65d6f0b558c5d34885f7a47cb3d9e8d786607bf5",
-    "gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
+    "gen-go/doc.go": "sha256:316d610ce568597a2ce6f38e9782e34fa5920f6f51ab0866e6d061b8a41cd822",
     "gen-go/error_category.go": "sha256:b2ddea22dcfa030f1a45e721e635485b0bd816cf1f38e7654628a653f5ed4583",
-    "gen-go/integration_execute_input_rules.go": "sha256:224fb490a5f936b30927e6637e698093e1e42a695cbc1bcf9a39bc70db9f2172",
+    "gen-go/integration_execute_input_rules.go": "sha256:52a405aa7a97f7b4e2ed3c314a7bd28b7698cc7883ee72ad4c027637be602ab9",
     "gen-go/integration_execute_input_rules_test.go": "sha256:c437a8406a2f062a0173b9419e4cb176fc6eb54e569506225d5162323f55b40b",
-    "gen-go/schema_documents.go": "sha256:a01b157658d23e2585e64ff101ed720942856626676b50c83efbd8b044a050d6",
-    "gen-go/types.go": "sha256:fb373233f316ece26444a8143b2dbf49d296e2fb2c4062d9f3a7f9f0e1e06642",
+    "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
+    "gen-go/types.go": "sha256:fdb9107727f78c7ce767456606dfca577d67d1f5534318e64d1c86cddffed4e0",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
     "gen-ts/ai-budget-ledger-event.ts": "sha256:64448d98a394e6eb103927cd35ce8a33e30176c0d5ee5afcdd8444f8aa051809",
-    "gen-ts/ai-callsite-inventory.ts": "sha256:f6ea0fd19a8cde08b92567255a8fa89bf599bab6dbcf007e484474c3ab28f637",
+    "gen-ts/ai-callsite-inventory.ts": "sha256:371ab7169c24befe1d044db7b1f66cee3bcf99b566181c98c0d39924faa99082",
     "gen-ts/ai-classification-stamp.ts": "sha256:dce78efba03df86a0986a16fd54c52066d322ff515d2463dbc45cafad82ecb44",
     "gen-ts/ai-composite-policy-digest-helper.ts": "sha256:d6c51d0c35599ee4f81d605b71773f4fff41a0bb46499ff0c6185072fedf53ce",
     "gen-ts/ai-composite-policy-digest.ts": "sha256:26b72227ca511d744c0f27fa0c85eb1ba6451ee380e38371e58a810898cfae96",
     "gen-ts/ai-deployment-gate-decision.ts": "sha256:e2b5aeccdf0c8785f9621e9d54fc072ebfce029804becb2c396a737cdde17350",
     "gen-ts/ai-gateway-key-lifecycle-event.ts": "sha256:8f1ab4774be1959e82c97da20ec8b293f3f10262f95393d2ae57e4c7817353cb",
-    "gen-ts/ai-gateway-key-lookup.ts": "sha256:e55fc9a2252d5e7e1a383a58c8b92f22d8147ee4862a893a6cfe815b4225fc00",
+    "gen-ts/ai-gateway-key-lookup.ts": "sha256:21e1d9020b015272119af8419485aca40f5e075701aec23525906017c7b5eb66",
     "gen-ts/ai-gateway-key-token.ts": "sha256:ff6551ad3332cc665878d7ec93f42ce185c375e637531b2fbc82c697b877e784",
     "gen-ts/ai-governance-decision.ts": "sha256:4a04e116f2ec281104e616a8ba414f23a9d34d398f850888d27510173e39c5c3",
     "gen-ts/ai-metering-policy.ts": "sha256:dd261d57646a509cd46efaefac4aad58d018c7f7da98326dd8859e4ce951c56a",
-    "gen-ts/ai-policy-snapshot.ts": "sha256:d79223055a03dfabfff3b09800dfb4c50ad6316ee2b97c840d141ef816f4544f",
+    "gen-ts/ai-policy-snapshot.ts": "sha256:f4768dba29713053f7d1dd34746fe2f8162ed755eb17d2b7e288db612fcb7b8a",
     "gen-ts/ai-pricing-revision.ts": "sha256:48afdea7fb09b9a392147a0a62bcee013157a9d536c07e0782ef28781a3000de",
-    "gen-ts/ai-runtime-binding.ts": "sha256:176c830d400ce44c508f8d249bb3c9724b2d595b78262615487cdafc4790263e",
+    "gen-ts/ai-runtime-binding.ts": "sha256:3930989c01e2b90041b5a8f9eaf9d8612854c9088090ca82e5687b85f26e106f",
     "gen-ts/ai-runtime-contract.ts": "sha256:6ed3bde6ab7a3f7e2e298c2904eb52d35e06699c5e284f98fb39abfc76858beb",
     "gen-ts/ai-trace-event-v2.ts": "sha256:8c994355f290864da1cf42850c3eceb0e4a1567b45ed989de865213430d3ce0e",
     "gen-ts/ai-trace-event.ts": "sha256:53a74d014c59c059256ea855a100a209d9d4e83c5f95ae8e639073e1182c62dd",
@@ -133,35 +133,35 @@
     "gen-ts/ai-transform-result.ts": "sha256:208c66b2aeb425c0cbcc18b7191f6e8989443f2b2c1690648e0e06cc1448ce25",
     "gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
     "gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
-    "gen-ts/app-integrations-declaration.ts": "sha256:3d0ec11ed1ca5c28edecc5dce3e305bc6cb5d2f64937ef9eee8a10bd5378938c",
+    "gen-ts/app-integrations-declaration.ts": "sha256:92ab07458747623fc8060247818bbf8e75b014efed55c4bb4332d39951a387fa",
     "gen-ts/artifact-contract.ts": "sha256:4a6dc6d2caaeed4bb2066cc8a333e6e09e5a0d4745e0b1038293d54ab9403aeb",
     "gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
     "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
     "gen-ts/builder-input-proposal.ts": "sha256:b0108c3787873d3cf1a39f00967379418a6766275d3474cfa55f5a9d93ead174",
-    "gen-ts/data-dependency.ts": "sha256:0572c31d7ae9088eccc104eee1a205bf176d1d6dacfaf0f290d666024e284966",
+    "gen-ts/data-dependency.ts": "sha256:259f19e2759395d72ead90b8ed74a6dcef0c2641124f4f182823138cfd19bedf",
     "gen-ts/data-grant-v2.ts": "sha256:b6660cd182b9c73e840bb962e66eafeda28cf003a3596ab8b3572174232da612",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
-    "gen-ts/data-source.ts": "sha256:77d6bb3b0eaa355789c5d97dd1f548734add6950329dc69549350b8d17c8d582",
+    "gen-ts/data-source.ts": "sha256:1a40c252e94ee717d287ba63647e4368668dad9ea731770f8b58deb17d18b311",
     "gen-ts/deploy-request.ts": "sha256:0214faa8be6680f0bfc117d5ce67c1a59fcc18bd0ea4bc840e03e7d051fa9ab6",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
     "gen-ts/deployment-continuation.ts": "sha256:cc9f63af4d0da5086a79103789e4f043783b75b4ed11c6512f044439a551a79c",
-    "gen-ts/deployment-environment.ts": "sha256:bbd6eec3a1631b13a8de6e6b95081696f7be01d0bd2bf1b7a9e3a1db809a727c",
+    "gen-ts/deployment-environment.ts": "sha256:fc08cabe2e52ebb93cfe84d2019994260f71734c33d0e50e7c63e40ef5b17cef",
     "gen-ts/deployment-source.ts": "sha256:8ccb55aaa7260eb6d19a00987d6a20a4b514e343564da13f27cd7fee8013500a",
     "gen-ts/deployment-status-failure.ts": "sha256:6da2e6eb2f708efa51d416a1ec50f71ea7967cf9be9f93e7ce2e4760dae2cfe3",
     "gen-ts/deployment-status-request.ts": "sha256:7ddccd07ab9f6d0821903a291ab35f903bb055727e03a058b99165ec048f6483",
-    "gen-ts/deployment-status-response.ts": "sha256:91f99eaa875968934bf9f920aa2bb3f7e8d4b0c24b18536a1e5c7bb739608a51",
+    "gen-ts/deployment-status-response.ts": "sha256:4f4ba74edf5f5ec743be91656c38cf5eeb85d7573fc357d6144733a32427ffa7",
     "gen-ts/env-bindings.ts": "sha256:a167cfe9842352c9fec6412ff0d82bda9c5f5c3a1af541bd5c27a57f54fd0941",
     "gen-ts/error-category-registry.ts": "sha256:7466a502c0723a77db825cdeaa9556a244201b55d9b7acbf2c098e9e84351df1",
     "gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
     "gen-ts/index.ts": "sha256:1fa78bbfd85f29f777f9018d110b70388af35ab2e428c07f75f6701ff3eaba22",
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
-    "gen-ts/integration-error-details.ts": "sha256:46b5ef79491117e125649afa3bd3a16bc72ece78f635fb0daf60816176c515ef",
-    "gen-ts/integration-execute-input-rules.ts": "sha256:a779c872c44bb892dec7b28173d961696d95e5b6e1fa14e2ba67dd78344cdc5b",
-    "gen-ts/integration-execute-request.ts": "sha256:353136b98c881efdb559c43617245c0a300cd683b7e876d70e9df96b1fe35cb6",
+    "gen-ts/integration-error-details.ts": "sha256:ad7ecec9dd4533a6e86b3508886a7d69937052f52105497285797f77106bcc6f",
+    "gen-ts/integration-execute-input-rules.ts": "sha256:0da117ac9f3109462e5862d658edf0f50e4b71fdcbb675d3a9dcb08489bcadd0",
+    "gen-ts/integration-execute-request.ts": "sha256:1008bc1c8b8fec41dd7241a9f6ccb31233473e34c5cf538c0125f4ee6f45d2db",
     "gen-ts/integration-execute-result.ts": "sha256:b7c9270abb0c12888e651aeb1a9927a658faa135ad6197be6dfbd46d942f2a0a",
-    "gen-ts/kit-bundle-manifest.ts": "sha256:0623879ce120f1464d90777518ddce5f1df580eabd6b53cfb831bb93f8132e63",
-    "gen-ts/kit-lock.ts": "sha256:f1bfd47f03061458c2d6387016c04b10d0e7624cdb761f205335d4ae68f525cb",
+    "gen-ts/kit-bundle-manifest.ts": "sha256:2777a268aef8787b81e71d154a7d05f6f5ded09d66f378211ff5493ddb885171",
+    "gen-ts/kit-lock.ts": "sha256:00ceeb97e9b7d0187bec00728f5099fd34e775e9cc44c85c4714f7a3a4118ef6",
     "gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
@@ -169,12 +169,12 @@
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",
-    "gen-ts/security-scan-input.ts": "sha256:b31f048be04c34b40f49d3b3ba53277e473cd435ae9216ba3a3b4dac69fb5685",
-    "gen-ts/security-verdict.ts": "sha256:fea950cddbd12fe0218e2573c9a29c6748d56612a464559f1e6d688fa97f68c7",
+    "gen-ts/security-scan-input.ts": "sha256:c9e2a95e488c1d19c543d87be5dac8408939e3ff955e373c2c57408a3430fa69",
+    "gen-ts/security-verdict.ts": "sha256:f87f43ba45ee2adbe2121c11ba462c7b83a4f027032f5a8daa7074e740e3754d",
     "gen-ts/transform-parked-result.ts": "sha256:6279e27cee8d75c29f3ede45580fef1daa0ca300867a78e43ead8a7689ec613f",
-    "gen-ts/transform-report.ts": "sha256:2f42c94644b0f4e2d03e339d0b9d333254555746f74d362d820522156e964ef9",
+    "gen-ts/transform-report.ts": "sha256:d83f1c34c4a082bd80bf9588b08e2fba3b7e25cd1855375ca3073ab9fafddfec",
     "gen-ts/version-state-machine.ts": "sha256:c67af3e86ac306743345b850dfd3ae5201c19d10c40e2c149cf8c38258320d5f",
     "gen-ts/version-state.ts": "sha256:a835112930299e7b593a1b8810b7414f6c9e809da2092306c743128170a3b702",
-    "gen-ts/well-defined-app-manifest.ts": "sha256:2b72a39c2fa8e76239634d0478dc0da05446e74e944950eacf999b78876455c6"
+    "gen-ts/well-defined-app-manifest.ts": "sha256:f6af2fe88d94ce36bc4345815dcd8912489ceb8b088da61de20c29f007ff0816"
   }
 }

package/dist/gen-ts/ai-callsite-inventory.d.ts

@@ -1,7 +1,7 @@
 export type AiInventoryIdentifier = string;
 export type AiInventoryDigest = string;
 /**
- * Immutable, sanitized AI call-site discovery for one exact Harbour deployment version. Inventory records detection only; planning, transformation, and verification outcomes are separate append-only records.
+ * Immutable, sanitized AI call-site discovery for one exact Isomorph deployment version. Inventory records detection only; planning, transformation, and verification outcomes are separate append-only records.
  */
 export interface AiCallsiteInventory {
     schema: 'harbour.ai-callsite-inventory/1.0';

package/dist/gen-ts/ai-gateway-key-lookup.d.ts

@@ -1,5 +1,5 @@
 /**
- * Value-free Gateway authentication metadata for one version-scoped Harbour key.
+ * Value-free Gateway authentication metadata for one version-scoped Isomorph key.
  */
 export type AiGatewayKeyLookup = {
     schema: 'harbour.ai-gateway-key-lookup/1.0';

package/dist/gen-ts/ai-policy-snapshot.d.ts

@@ -51,7 +51,7 @@ export type AiPolicyDimensionLimit1 = {
     [k: string]: unknown;
 };
 /**
- * Immutable, content-addressed AI policy snapshot consumed by the Harbour AI Gateway. Provider credentials are represented only by Secrets Manager references.
+ * Immutable, content-addressed AI policy snapshot consumed by the Isomorph AI Gateway. Provider credentials are represented only by Secrets Manager references.
  */
 export interface AiPolicySnapshot {
     schema: 'harbour.ai-policy-snapshot/1.0';

package/dist/gen-ts/ai-runtime-binding.d.ts

@@ -3,7 +3,7 @@
  */
 export type AiRuntimeSafeReference = string;
 /**
- * Platform-neutral, value-free binding of one workload identity to one version-scoped Harbour Gateway secret. Platform adapters may add implementation details internally; they never enter this contract.
+ * Platform-neutral, value-free binding of one workload identity to one version-scoped Isomorph Gateway secret. Platform adapters may add implementation details internally; they never enter this contract.
  */
 export interface AiRuntimeBinding {
     schema: 'harbour.ai-runtime-binding/1.0';

package/dist/gen-ts/app-integrations-declaration.d.ts

@@ -13,14 +13,14 @@ export type ResourceNames = IntegrationAlias[];
  */
 export type IntegrationIdentityMode = 'app' | 'user';
 /**
- * A plain column identifier of a warehouse view.
+ * A plain warehouse column identifier, or `*` as the sole selection when IT exposed all current and future columns.
  */
 export type ColumnName = string;
 /**
- * Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each slack.message.post call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
+ * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each slack.message.post call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
  */
 export interface AppIntegrationsDeclaration {
-    schema: 'harbour.app-integrations/2.0';
+    schema: 'isomorph.app-integrations/2.0';
     connections: {
         [k: string]: DeclaredConnection;
     };

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.57.0.0";
-export declare const ContractPublishVersion: "0.57.0";
-export declare const ContractPublishTag: "v0.57.0";
-export declare const ContractSchemasDigest: "sha256:68c005c88631759af9cbdec89e54afd6bcc87f153564e94fcf73aabf8ff76781";
+export declare const ContractRepositoryVersion: "0.59.0.0";
+export declare const ContractPublishVersion: "0.59.0";
+export declare const ContractPublishTag: "v0.59.0";
+export declare const ContractSchemasDigest: "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:b52b9d9f19dec87f989be6526a36d80b892f8fe800e82a5284b4a99664bb6eb0";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:1bb0b982246718edf2162d8185b98df4c3efad570bbf95cc49c997ed5f524b0d";
+export declare const ContractGeneratedGoDigest: "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.57.0.0";
-export const ContractPublishVersion = "0.57.0";
-export const ContractPublishTag = "v0.57.0";
-export const ContractSchemasDigest = "sha256:68c005c88631759af9cbdec89e54afd6bcc87f153564e94fcf73aabf8ff76781";
+export const ContractRepositoryVersion = "0.59.0.0";
+export const ContractPublishVersion = "0.59.0";
+export const ContractPublishTag = "v0.59.0";
+export const ContractSchemasDigest = "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:b52b9d9f19dec87f989be6526a36d80b892f8fe800e82a5284b4a99664bb6eb0";
-export const ContractGeneratedTypeScriptDigest = "sha256:1bb0b982246718edf2162d8185b98df4c3efad570bbf95cc49c997ed5f524b0d";
+export const ContractGeneratedGoDigest = "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659";
+export const ContractGeneratedTypeScriptDigest = "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985";

package/dist/gen-ts/data-dependency.d.ts

@@ -1,9 +1,9 @@
 /**
- * database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Harbour.
+ * database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Isomorph.
  */
 export type DataDependencyKind = 'database' | 'api' | 'app_owned_external';
 /**
- * matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Harbour's remit.
+ * matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Isomorph's remit.
  */
 export type DataDependencyClassification = 'matched' | 'out_of_scope' | 'unknown' | 'inventory' | 'app_owned_external';
 /**

package/dist/gen-ts/data-source.d.ts

@@ -3,7 +3,7 @@
  */
 export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks' | 'mysql';
 /**
- * byo = admin brought existing infrastructure; harbour_managed = Harbour provisioned it.
+ * byo = admin brought existing infrastructure; harbour_managed = Isomorph provisioned it.
  */
 export type DataSourceProvisioningMode = 'byo' | 'harbour_managed';
 /**

package/dist/gen-ts/deployment-environment.d.ts

@@ -1,4 +1,4 @@
 /**
- * Public environment accepted by the preview deployment-control-plane APIs. The MVP accepts only preview; production remains reachable only through Harbour's human-merge promotion flow.
+ * Public environment accepted by the preview deployment-control-plane APIs. The MVP accepts only preview; production remains reachable only through Isomorph's human-merge promotion flow.
  */
 export type DeploymentEnvironment = 'preview';

package/dist/gen-ts/deployment-status-response.d.ts

@@ -86,7 +86,7 @@ export interface StatusProgressEvent {
     origin?: 'initial' | 'widen';
 }
 /**
- * The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means harbour-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.
+ * The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means Isomorph-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.
  */
 export interface StatusDeployTarget {
     /**

package/dist/gen-ts/integration-error-details.d.ts

@@ -1,5 +1,5 @@
 /**
- * App-SDK HarbourErrorCategory values an integration route may emit; INTERNAL is reserved for the transport.
+ * App-SDK IsomorphErrorCategory values an integration route may emit; INTERNAL is reserved for the transport.
  */
 export type IntegrationErrorCategory = 'AUTH_REQUIRED' | 'FORBIDDEN' | 'NOT_FOUND' | 'CONFLICT' | 'VALIDATION_FAILED' | 'RATE_LIMITED' | 'UNAVAILABLE';
 /**
@@ -7,7 +7,7 @@ export type IntegrationErrorCategory = 'AUTH_REQUIRED' | 'FORBIDDEN' | 'NOT_FOUN
  */
 export type IntegrationErrorCode = 'USER_CONNECTION_REQUIRED' | 'USER_RECONNECT_REQUIRED' | 'GRANT_NOT_READY' | 'GRANT_EXPIRED' | 'GRANT_REVOKED' | 'CONNECTION_DISABLED' | 'OPERATION_NOT_DECLARED' | 'RESOURCE_NOT_APPROVED' | 'IDENTITY_MODE_MISMATCH' | 'SEND_OUTCOME_UNKNOWN' | 'SEND_KEY_REUSED' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'REQUEST_TOO_LARGE' | 'RESULT_TOO_LARGE' | 'DEADLINE_EXCEEDED' | 'APP_ACCESS_REQUIRED' | 'GRANT_DENIED' | 'TOKEN_REFRESH_PENDING' | 'REQUEST_PENDING' | 'INPUT_INVALID' | 'IDEMPOTENCY_KEY_REQUIRED' | 'SEND_IN_PROGRESS' | 'CONNECTION_NOT_FOUND' | 'APP_NOT_FOUND' | 'GRANT_NOT_FOUND' | 'AUTH_REQUIRED' | 'UNAVAILABLE' | 'MODE_NOT_GRANTED' | 'MODE_REQUIRED';
 /**
- * The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto HarbourError(category, message, details). `category` is the app-SDK HarbourErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.
+ * The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto IsomorphError(category, message, details). `category` is the app-SDK IsomorphErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.
  */
 export interface IntegrationErrorDetails {
     category: IntegrationErrorCategory;

package/dist/gen-ts/integration-execute-input-rules.d.ts

@@ -150,7 +150,7 @@ export declare const IntegrationExecuteInputRules: {
                 readonly uniqueItems: false;
                 readonly item: {
                     readonly minLength: 0;
-                    readonly pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$";
+                    readonly pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$";
                 };
             };
             readonly limit: {

package/dist/gen-ts/integration-execute-input-rules.js

@@ -39,7 +39,7 @@ export const IntegrationExecuteInputRules = {
     "warehouse.view.read": {
         idempotencyKey: false,
         fields: {
-            columns: { kind: "string[]", required: true, minItems: 1, maxItems: 32, uniqueItems: false, item: { minLength: 0, pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$" } },
+            columns: { kind: "string[]", required: true, minItems: 1, maxItems: 32, uniqueItems: false, item: { minLength: 0, pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$" } },
             limit: { kind: "integer", required: false, minimum: 1, maximum: 1000, default: 100 },
         },
     },

package/dist/gen-ts/integration-execute-request.d.ts

@@ -39,6 +39,8 @@ export type IntegrationExecuteRequest = {
          */
         replyToMessageId?: string;
         /**
+         * Explicit columns, or `*` alone when the app's approved resource grant allows all current and future columns.
+         *
          * @minItems 1
          * @maxItems 32
          */

package/dist/gen-ts/kit-bundle-manifest.d.ts

@@ -7,13 +7,13 @@ export type HexSha256 = string;
  * Identity of one published development-kit bundle (shipped with the CLI). It pins the app SDK tarball, the local runtime images and the agent-brief fingerprint that a kit-built app was developed against, so the hosted pipeline can prove compatibility before replacing the vendored SDK (see kit-lock.schema.json).
  */
 export interface KitBundleManifest {
-    schema: 'harbour.kit-bundle/1.0';
+    schema: 'isomorph.kit-bundle/1.0';
     /**
      * The CLI package version that published this bundle.
      */
     kitVersion: string;
     sdk: {
-        package: '@harbour/app-sdk';
+        package: '@isomorph.ai/app-sdk';
         /**
          * The SDK package version the tarball was packed from (informational; compatibility is decided by tarballSha256).
          */
@@ -45,7 +45,7 @@ export interface KitBundleManifest {
          */
         fingerprint: string;
     };
-    declarationSchema: 'harbour.app-integrations/2.0';
+    declarationSchema: 'isomorph.app-integrations/2.0';
 }
 export interface NativeExecutable {
     url: string;

package/dist/gen-ts/kit-lock.d.ts

@@ -1,8 +1,8 @@
 /**
- * Committed `.harbour/kit.lock.json`: which app and tenant a kit-built app belongs to and the exact bundle it was developed against. The data-plane vendorAppSDK gate reads bundle.sdk.tarballSha256 and fails with kit_bundle_incompatible (naming both digests) when it differs from the baked tarball; apps without a kit.lock keep the existing path.
+ * Committed `.isomorph/kit.lock.json`: which app and tenant a kit-built app belongs to and the exact bundle it was developed against. The data-plane vendorAppSDK gate reads bundle.sdk.tarballSha256 and fails with kit_bundle_incompatible (naming both digests) when it differs from the baked tarball; apps without a kit.lock keep the existing path.
  */
 export interface KitLock {
-    schema: 'harbour.kit-lock/1.0';
+    schema: 'isomorph.kit-lock/1.0';
     appId: string;
     tenantId: string;
     bundle: KitBundleManifest;
@@ -13,13 +13,13 @@ export interface KitLock {
  * Identity of one published development-kit bundle (shipped with the CLI). It pins the app SDK tarball, the local runtime images and the agent-brief fingerprint that a kit-built app was developed against, so the hosted pipeline can prove compatibility before replacing the vendored SDK (see kit-lock.schema.json).
  */
 interface KitBundleManifest {
-    schema: 'harbour.kit-bundle/1.0';
+    schema: 'isomorph.kit-bundle/1.0';
     /**
      * The CLI package version that published this bundle.
      */
     kitVersion: string;
     sdk: {
-        package: '@harbour/app-sdk';
+        package: '@isomorph.ai/app-sdk';
         /**
          * The SDK package version the tarball was packed from (informational; compatibility is decided by tarballSha256).
          */
@@ -57,7 +57,7 @@ interface KitBundleManifest {
          */
         fingerprint: string;
     };
-    declarationSchema: 'harbour.app-integrations/2.0';
+    declarationSchema: 'isomorph.app-integrations/2.0';
 }
 interface NativeExecutable {
     url: string;

package/dist/gen-ts/security-scan-input.d.ts

@@ -1,5 +1,5 @@
 /**
- * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
+ * Input to the Isomorph Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
  */
 export interface SecurityScanInput {
     /**
@@ -7,11 +7,11 @@ export interface SecurityScanInput {
      */
     phase: 'SOURCE' | 'ARTIFACT';
     /**
-     * Harbour organization id, e.g. fourier.
+     * Isomorph organization id, e.g. fourier.
      */
     org: string;
     /**
-     * Harbour app id within the org, e.g. focuslist.
+     * Isomorph app id within the org, e.g. focuslist.
      */
     app: string;
     /**

package/dist/gen-ts/security-verdict.d.ts

@@ -1,5 +1,5 @@
 /**
- * Decision produced by the Harbour Security Assurance machine (Security Assurance LLD §2). `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.
+ * Decision produced by the Isomorph Security Assurance machine (Security Assurance LLD §2). `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.
  */
 export interface SecurityVerdict {
     /**
@@ -11,7 +11,7 @@ export interface SecurityVerdict {
      */
     profile: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
     /**
-     * Human-readable cause, present when outcome is BLOCKED; becomes the Fail-state cause of HarbourSecurityBlocked.
+     * Human-readable cause, present when outcome is BLOCKED; becomes the cause carried by the Security Assurance state machine's `HarbourSecurityBlocked` fail state.
      */
     reason?: string;
     /**