@fourier-labs/harbour-contracts 0.58.0 → 0.60.0

package/dist/gen-ts/well-defined-app-manifest.d.ts

@@ -17,13 +17,13 @@ export type Command = string[];
 export type ResourceProfile = 'standard' | 'memory-1g' | 'memory-2g';
 export type Capability = 'data' | 'files' | 'actions' | 'realtime' | 'telemetry';
 /**
- * Versioned provisioning input emitted by Harbour Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.
+ * Versioned provisioning input emitted by Isomorph Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.
  */
 export interface WellDefinedAppManifest {
     version: 1;
     architecture: 'static-v1' | 'fullstack-v1' | 'spa-harbour-data-v1';
     /**
-     * Required only when transformed browser code uses @harbour/app-sdk.
+     * Required only when transformed browser code uses @isomorph.ai/app-sdk.
      */
     sdkMajor?: 1;
     /**
@@ -39,7 +39,7 @@ export interface WellDefinedAppManifest {
      */
     runtime?: string;
     /**
-     * Optional declaration of the Harbour browser capabilities the application uses. Same closed set as the app-capabilities document; this is the declaration, not a source scan.
+     * Optional declaration of the Isomorph browser capabilities the application uses. Same closed set as the app-capabilities document; this is the declaration, not a source scan.
      *
      * @maxItems 5
      */
@@ -77,7 +77,7 @@ export interface WorkloadBinding {
     reference?: string;
 }
 /**
- * Optional method/path authentication policy. Omitted means every route requires Harbour SSO, the same default the policy states explicitly.
+ * Optional method/path authentication policy. Omitted means every route requires Isomorph SSO, the same default the policy states explicitly.
  */
 export interface RouteAuth {
     default: 'sso_required';

package/dist/naming/index.d.ts

@@ -0,0 +1,2 @@
+/** Stable V2 identity label. Do not use it to recover tenant or app identity. */
+export declare function deploymentLabel(org: string, app: string): string;

package/dist/naming/index.js

@@ -0,0 +1,14 @@
+import { createHash } from 'node:crypto';
+const slug = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** Stable V2 identity label. Do not use it to recover tenant or app identity. */
+export function deploymentLabel(org, app) {
+    if (!slug.test(org) || !slug.test(app))
+        throw new Error('org and app must be DNS labels of 1–63 characters');
+    const plain = `${org}-${app}`;
+    // Reserve double hyphens for hashed labels and -api for custom-domain API hosts.
+    if (!org.includes('-') && !plain.includes('--') && !plain.endsWith('-api') && plain.length <= 55)
+        return plain;
+    const digest = createHash('sha256').update(JSON.stringify([org, app])).digest('hex').slice(0, 32);
+    const prefix = plain.slice(0, 19).replace(/-+$/, '');
+    return `h--${prefix}-${digest}`;
+}

package/dist/resolver/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * Harbour AI policy resolver — the ONE hardened five-layer merge, shipped with
+ * Isomorph AI policy resolver — the ONE hardened five-layer merge, shipped with
  * the contracts package so governance and the gateway resolve identically
  * (completion-spec D-6). Extracted from
  * `harbour-governance-control-plane/src/ai-governance.ts` (merge machinery)

package/dist/resolver/index.js

@@ -1,5 +1,5 @@
 /**
- * Harbour AI policy resolver — the ONE hardened five-layer merge, shipped with
+ * Isomorph AI policy resolver — the ONE hardened five-layer merge, shipped with
  * the contracts package so governance and the gateway resolve identically
  * (completion-spec D-6). Extracted from
  * `harbour-governance-control-plane/src/ai-governance.ts` (merge machinery)

package/gen-ts/ai-callsite-inventory.ts

@@ -5,7 +5,7 @@ export type AiInventoryIdentifier = string;
 export type AiInventoryDigest = string;
 
 /**
- * Immutable, sanitized AI call-site discovery for one exact Harbour deployment version. Inventory records detection only; planning, transformation, and verification outcomes are separate append-only records.
+ * Immutable, sanitized AI call-site discovery for one exact Isomorph deployment version. Inventory records detection only; planning, transformation, and verification outcomes are separate append-only records.
  */
 export interface AiCallsiteInventory {
   schema: 'harbour.ai-callsite-inventory/1.0';

package/gen-ts/ai-gateway-key-lookup.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Value-free Gateway authentication metadata for one version-scoped Harbour key.
+ * Value-free Gateway authentication metadata for one version-scoped Isomorph key.
  */
 export type AiGatewayKeyLookup = {
   schema: 'harbour.ai-gateway-key-lookup/1.0';

package/gen-ts/ai-policy-snapshot.ts

@@ -55,7 +55,7 @@ export type AiPolicyDimensionLimit1 = {
 };
 
 /**
- * Immutable, content-addressed AI policy snapshot consumed by the Harbour AI Gateway. Provider credentials are represented only by Secrets Manager references.
+ * Immutable, content-addressed AI policy snapshot consumed by the Isomorph AI Gateway. Provider credentials are represented only by Secrets Manager references.
  */
 export interface AiPolicySnapshot {
   schema: 'harbour.ai-policy-snapshot/1.0';

package/gen-ts/ai-runtime-binding.ts

@@ -7,7 +7,7 @@
 export type AiRuntimeSafeReference = string;
 
 /**
- * Platform-neutral, value-free binding of one workload identity to one version-scoped Harbour Gateway secret. Platform adapters may add implementation details internally; they never enter this contract.
+ * Platform-neutral, value-free binding of one workload identity to one version-scoped Isomorph Gateway secret. Platform adapters may add implementation details internally; they never enter this contract.
  */
 export interface AiRuntimeBinding {
   schema: 'harbour.ai-runtime-binding/1.0';

package/gen-ts/app-integrations-declaration.ts

@@ -21,10 +21,10 @@ export type IntegrationIdentityMode = 'app' | 'user';
 export type ColumnName = string;
 
 /**
- * Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each slack.message.post call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
+ * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each slack.message.post call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
  */
 export interface AppIntegrationsDeclaration {
-  schema: 'harbour.app-integrations/2.0';
+  schema: 'isomorph.app-integrations/2.0';
   connections: {
     [k: string]: DeclaredConnection;
   };

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.58.0.0" as const;
-export const ContractPublishVersion = "0.58.0" as const;
-export const ContractPublishTag = "v0.58.0" as const;
-export const ContractSchemasDigest = "sha256:cff24f4a933f29c84244bece6e9cccdd017e281cb646b339ffe1a2a34844728f" as const;
+export const ContractRepositoryVersion = "0.60.0.0" as const;
+export const ContractPublishVersion = "0.60.0" as const;
+export const ContractPublishTag = "v0.60.0" as const;
+export const ContractSchemasDigest = "sha256:cae27ba35b1cc0deb819df6fcfc1ebf5c2bd5de621bd505eb9bd5b540fec0409" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:c8bbf51aa8da7ab736e3d936b584913407f68deed68cf67dc009357beaf3aa88" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:9edaf3341de24431574f6d22e6effb551c675f963e27996290f2ebaa8497c3dc" as const;
+export const ContractGeneratedGoDigest = "sha256:dcbd1548dfeddcd7e499f88851c9fdc58b34e00c3b4f2b162c3c6cae073f6659" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:937e6425678739d44c4ca024db1e4fc44dc5a9be9950f261ffc320f2d458a985" as const;

package/gen-ts/data-dependency.ts

@@ -2,11 +2,11 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Harbour.
+ * database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Isomorph.
  */
 export type DataDependencyKind = 'database' | 'api' | 'app_owned_external';
 /**
- * matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Harbour's remit.
+ * matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Isomorph's remit.
  */
 export type DataDependencyClassification = 'matched' | 'out_of_scope' | 'unknown' | 'inventory' | 'app_owned_external';
 /**

package/gen-ts/data-source.ts

@@ -6,7 +6,7 @@
  */
 export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks' | 'mysql';
 /**
- * byo = admin brought existing infrastructure; harbour_managed = Harbour provisioned it.
+ * byo = admin brought existing infrastructure; harbour_managed = Isomorph provisioned it.
  */
 export type DataSourceProvisioningMode = 'byo' | 'harbour_managed';
 /**

package/gen-ts/deployment-environment.ts

@@ -2,6 +2,6 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Public environment accepted by the preview deployment-control-plane APIs. The MVP accepts only preview; production remains reachable only through Harbour's human-merge promotion flow.
+ * Public environment accepted by the preview deployment-control-plane APIs. The MVP accepts only preview; production remains reachable only through Isomorph's human-merge promotion flow.
  */
 export type DeploymentEnvironment = 'preview';

package/gen-ts/deployment-status-response.ts

@@ -103,7 +103,7 @@ export interface StatusProgressEvent {
   origin?: 'initial' | 'widen';
 }
 /**
- * The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means harbour-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.
+ * The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means Isomorph-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.
  */
 export interface StatusDeployTarget {
   /**

package/gen-ts/integration-error-details.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * App-SDK HarbourErrorCategory values an integration route may emit; INTERNAL is reserved for the transport.
+ * App-SDK IsomorphErrorCategory values an integration route may emit; INTERNAL is reserved for the transport.
  */
 export type IntegrationErrorCategory =
   'AUTH_REQUIRED' | 'FORBIDDEN' | 'NOT_FOUND' | 'CONFLICT' | 'VALIDATION_FAILED' | 'RATE_LIMITED' | 'UNAVAILABLE';
@@ -42,7 +42,7 @@ export type IntegrationErrorCode =
   | 'MODE_REQUIRED';
 
 /**
- * The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto HarbourError(category, message, details). `category` is the app-SDK HarbourErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.
+ * The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto IsomorphError(category, message, details). `category` is the app-SDK IsomorphErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.
  */
 export interface IntegrationErrorDetails {
   category: IntegrationErrorCategory;

package/gen-ts/kit-bundle-manifest.ts

@@ -11,13 +11,13 @@ export type HexSha256 = string;
  * Identity of one published development-kit bundle (shipped with the CLI). It pins the app SDK tarball, the local runtime images and the agent-brief fingerprint that a kit-built app was developed against, so the hosted pipeline can prove compatibility before replacing the vendored SDK (see kit-lock.schema.json).
  */
 export interface KitBundleManifest {
-  schema: 'harbour.kit-bundle/1.0';
+  schema: 'isomorph.kit-bundle/1.0';
   /**
    * The CLI package version that published this bundle.
    */
   kitVersion: string;
   sdk: {
-    package: '@harbour/app-sdk';
+    package: '@isomorph.ai/app-sdk';
     /**
      * The SDK package version the tarball was packed from (informational; compatibility is decided by tarballSha256).
      */
@@ -49,7 +49,7 @@ export interface KitBundleManifest {
      */
     fingerprint: string;
   };
-  declarationSchema: 'harbour.app-integrations/2.0';
+  declarationSchema: 'isomorph.app-integrations/2.0';
 }
 export interface NativeExecutable {
   url: string;

package/gen-ts/kit-lock.ts

@@ -2,10 +2,10 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Committed `.harbour/kit.lock.json`: which app and tenant a kit-built app belongs to and the exact bundle it was developed against. The data-plane vendorAppSDK gate reads bundle.sdk.tarballSha256 and fails with kit_bundle_incompatible (naming both digests) when it differs from the baked tarball; apps without a kit.lock keep the existing path.
+ * Committed `.isomorph/kit.lock.json`: which app and tenant a kit-built app belongs to and the exact bundle it was developed against. The data-plane vendorAppSDK gate reads bundle.sdk.tarballSha256 and fails with kit_bundle_incompatible (naming both digests) when it differs from the baked tarball; apps without a kit.lock keep the existing path.
  */
 export interface KitLock {
-  schema: 'harbour.kit-lock/1.0';
+  schema: 'isomorph.kit-lock/1.0';
   appId: string;
   tenantId: string;
   bundle: KitBundleManifest;
@@ -16,13 +16,13 @@ export interface KitLock {
  * Identity of one published development-kit bundle (shipped with the CLI). It pins the app SDK tarball, the local runtime images and the agent-brief fingerprint that a kit-built app was developed against, so the hosted pipeline can prove compatibility before replacing the vendored SDK (see kit-lock.schema.json).
  */
 interface KitBundleManifest {
-  schema: 'harbour.kit-bundle/1.0';
+  schema: 'isomorph.kit-bundle/1.0';
   /**
    * The CLI package version that published this bundle.
    */
   kitVersion: string;
   sdk: {
-    package: '@harbour/app-sdk';
+    package: '@isomorph.ai/app-sdk';
     /**
      * The SDK package version the tarball was packed from (informational; compatibility is decided by tarballSha256).
      */
@@ -60,7 +60,7 @@ interface KitBundleManifest {
      */
     fingerprint: string;
   };
-  declarationSchema: 'harbour.app-integrations/2.0';
+  declarationSchema: 'isomorph.app-integrations/2.0';
 }
 interface NativeExecutable {
   url: string;

package/gen-ts/security-scan-input.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
+ * Input to the Isomorph Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
  */
 export interface SecurityScanInput {
   /**
@@ -10,11 +10,11 @@ export interface SecurityScanInput {
    */
   phase: 'SOURCE' | 'ARTIFACT';
   /**
-   * Harbour organization id, e.g. fourier.
+   * Isomorph organization id, e.g. fourier.
    */
   org: string;
   /**
-   * Harbour app id within the org, e.g. focuslist.
+   * Isomorph app id within the org, e.g. focuslist.
    */
   app: string;
   /**

package/gen-ts/security-verdict.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Decision produced by the Harbour Security Assurance machine (Security Assurance LLD §2). `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.
+ * Decision produced by the Isomorph Security Assurance machine (Security Assurance LLD §2). `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.
  */
 export interface SecurityVerdict {
   /**
@@ -14,7 +14,7 @@ export interface SecurityVerdict {
    */
   profile: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
   /**
-   * Human-readable cause, present when outcome is BLOCKED; becomes the Fail-state cause of HarbourSecurityBlocked.
+   * Human-readable cause, present when outcome is BLOCKED; becomes the cause carried by the Security Assurance state machine's `HarbourSecurityBlocked` fail state.
    */
   reason?: string;
   /**

package/gen-ts/transform-report.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It may also carry validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run; the deployment plane reads the workspace fixture sidecar, so the report's copy is optional. An unsupported report carries only application.unsupported and no plan or fixtures.
+ * Structured output an agent must return from one Isomorph transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It may also carry validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run; the deployment plane reads the workspace fixture sidecar, so the report's copy is optional. An unsupported report carries only application.unsupported and no plan or fixtures.
  */
 export type TransformReport = {
   /**
@@ -18,7 +18,7 @@ export type TransformReport = {
   analysis?: {
     deployable: boolean;
     /**
-     * Whether the attempt changed the tree. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     * Whether the attempt changed the tree. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
      */
     needsTransformation?: boolean;
     /**
@@ -26,7 +26,7 @@ export type TransformReport = {
      */
     blockers: string[];
     /**
-     * Paths the attempt touched. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     * Paths the attempt touched. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
      *
      * @minItems 1
      * @maxItems 1024
@@ -46,25 +46,25 @@ export type TransformReport = {
   database?: {
     mode: 'none' | 'sql';
     /**
-     * Classification of the changed paths. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     * Classification of the changed paths. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
      */
     changeType?: 'none' | 'code_only' | 'schema_only' | 'code_and_schema';
     /**
-     * Whether any changed path sits outside the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     * Whether any changed path sits outside the database boundary. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
      */
     requiresCodeChanges?: boolean;
     /**
-     * Whether the Aurora bundle grew past its seeded prefix. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     * Whether the Aurora bundle grew past its seeded prefix. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
      */
     requiresSchemaMigration?: boolean;
     /**
-     * Migration files in the Aurora bundle. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     * Migration files in the Aurora bundle. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
      *
      * @maxItems 128
      */
     migrationPaths?: string[];
     /**
-     * Changed paths on the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     * Changed paths on the database boundary. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
      *
      * @maxItems 512
      */
@@ -102,7 +102,7 @@ export type TransformReport = {
       kind: 'happy_path' | 'boundary_check';
       name: string;
       /**
-       * Transformation boundaries this test claims to cover. Optional: Harbour derives them from the test's own evidence paths, so a deployable report may omit them and one that still carries them stays valid.
+       * Transformation boundaries this test claims to cover. Optional: Isomorph derives them from the test's own evidence paths, so a deployable report may omit them and one that still carries them stays valid.
        *
        * @minItems 1
        * @maxItems 8
@@ -187,7 +187,7 @@ export type TransformReport = {
      */
     uncovered: {
       /**
-       * Optional: Harbour derives the uncovered boundaries from the changed paths and the covered set, so a deployable report may omit this and one that still carries it stays valid.
+       * Optional: Isomorph derives the uncovered boundaries from the changed paths and the covered set, so a deployable report may omit this and one that still carries it stays valid.
        */
       boundary?:
         | 'application'
@@ -271,7 +271,7 @@ export type TransformReport = {
       backgroundJobs: 'none' | 'sqs';
     } | null;
     /**
-     * Build-only PostgreSQL bootstrap for authenticated browser validation. Use null when the application does not require a pre-existing database identity. The SQL file runs only in Harbour's throwaway validation database after migrations and before candidate boot. Harbour supplies the fixed probe subject and lowercased email as transaction-local settings.
+     * Build-only PostgreSQL bootstrap for authenticated browser validation. Use null when the application does not require a pre-existing database identity. The SQL file runs only in Isomorph's throwaway validation database after migrations and before candidate boot. Isomorph supplies the fixed probe subject and lowercased email as transaction-local settings.
      */
     validationSeed?: {
       kind: 'sql';

package/gen-ts/well-defined-app-manifest.ts

@@ -21,13 +21,13 @@ export type ResourceProfile = 'standard' | 'memory-1g' | 'memory-2g';
 export type Capability = 'data' | 'files' | 'actions' | 'realtime' | 'telemetry';
 
 /**
- * Versioned provisioning input emitted by Harbour Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.
+ * Versioned provisioning input emitted by Isomorph Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.
  */
 export interface WellDefinedAppManifest {
   version: 1;
   architecture: 'static-v1' | 'fullstack-v1' | 'spa-harbour-data-v1';
   /**
-   * Required only when transformed browser code uses @harbour/app-sdk.
+   * Required only when transformed browser code uses @isomorph.ai/app-sdk.
    */
   sdkMajor?: 1;
   /**
@@ -43,7 +43,7 @@ export interface WellDefinedAppManifest {
    */
   runtime?: string;
   /**
-   * Optional declaration of the Harbour browser capabilities the application uses. Same closed set as the app-capabilities document; this is the declaration, not a source scan.
+   * Optional declaration of the Isomorph browser capabilities the application uses. Same closed set as the app-capabilities document; this is the declaration, not a source scan.
    *
    * @maxItems 5
    */
@@ -81,7 +81,7 @@ export interface WorkloadBinding {
   reference?: string;
 }
 /**
- * Optional method/path authentication policy. Omitted means every route requires Harbour SSO, the same default the policy states explicitly.
+ * Optional method/path authentication policy. Omitted means every route requires Isomorph SSO, the same default the policy states explicitly.
  */
 export interface RouteAuth {
   default: 'sso_required';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.58.0",
-  "description": "Single source of truth for every data shape that crosses a boundary between Harbour components.",
+  "version": "0.60.0",
+  "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -23,6 +23,10 @@
       "types": "./dist/gen-ts/index.d.ts",
       "default": "./dist/gen-ts/index.js"
     },
+    "./naming": {
+      "types": "./dist/naming/index.d.ts",
+      "default": "./dist/naming/index.js"
+    },
     "./resolver": {
       "types": "./dist/resolver/index.d.ts",
       "default": "./dist/resolver/index.js"
@@ -31,7 +35,7 @@
   "scripts": {
     "gen": "node tools/gen/gen.mjs",
     "build": "tsc -p tsconfig.json",
-    "test": "node --experimental-strip-types --test tools/gen/*.test.mjs resolver/*.test.mjs",
+    "test": "node --experimental-strip-types --test tools/gen/*.test.mjs resolver/*.test.mjs naming/*.test.mjs",
     "verify": "node tools/release/verify-release.mjs && node tools/gen/gen.mjs && { [ -z \"$(git status --porcelain -- gen-ts gen-go contract-release.json)\" ] || { echo 'STALE: generated code or release manifest out of date or uncommitted — run make gen and commit'; exit 1; }; }"
   },
   "devDependencies": {

package/schema/ai-callsite-inventory.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/ai-callsite-inventory.schema.json",
   "title": "AiCallsiteInventory",
-  "description": "Immutable, sanitized AI call-site discovery for one exact Harbour deployment version. Inventory records detection only; planning, transformation, and verification outcomes are separate append-only records.",
+  "description": "Immutable, sanitized AI call-site discovery for one exact Isomorph deployment version. Inventory records detection only; planning, transformation, and verification outcomes are separate append-only records.",
   "type": "object",
   "additionalProperties": false,
   "required": [

package/schema/ai-gateway-key-lookup.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/ai-gateway-key-lookup.schema.json",
   "title": "AiGatewayKeyLookup",
-  "description": "Value-free Gateway authentication metadata for one version-scoped Harbour key.",
+  "description": "Value-free Gateway authentication metadata for one version-scoped Isomorph key.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "keyId", "tenantId", "appId", "environment", "versionId", "tokenPrefix", "status", "createdAt"],

package/schema/ai-policy-snapshot.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/ai-policy-snapshot.schema.json",
   "title": "AiPolicySnapshot",
-  "description": "Immutable, content-addressed AI policy snapshot consumed by the Harbour AI Gateway. Provider credentials are represented only by Secrets Manager references.",
+  "description": "Immutable, content-addressed AI policy snapshot consumed by the Isomorph AI Gateway. Provider credentials are represented only by Secrets Manager references.",
   "type": "object",
   "additionalProperties": false,
   "required": [

package/schema/ai-runtime-binding.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/ai-runtime-binding.schema.json",
   "title": "AiRuntimeBinding",
-  "description": "Platform-neutral, value-free binding of one workload identity to one version-scoped Harbour Gateway secret. Platform adapters may add implementation details internally; they never enter this contract.",
+  "description": "Platform-neutral, value-free binding of one workload identity to one version-scoped Isomorph Gateway secret. Platform adapters may add implementation details internally; they never enter this contract.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "platform", "workloadIdentityRef", "secretRef", "runtimeBindingDigest"],

package/schema/app-integrations-declaration.schema.json

@@ -2,12 +2,12 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/app-integrations-declaration.schema.json",
   "title": "AppIntegrationsDeclaration",
-  "description": "Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each slack.message.post call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.",
+  "description": "Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each slack.message.post call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "connections"],
   "properties": {
-    "schema": { "type": "string", "const": "harbour.app-integrations/2.0" },
+    "schema": { "type": "string", "const": "isomorph.app-integrations/2.0" },
     "connections": {
       "type": "object",
       "minProperties": 1,
@@ -148,7 +148,7 @@
   },
   "examples": [
     {
-      "schema": "harbour.app-integrations/2.0",
+      "schema": "isomorph.app-integrations/2.0",
       "connections": {
         "company-slack": {
           "kind": "saas",
@@ -178,7 +178,7 @@
       }
     },
     {
-      "schema": "harbour.app-integrations/2.0",
+      "schema": "isomorph.app-integrations/2.0",
       "connections": {
         "company-slack": {
           "kind": "saas",

package/schema/data-dependency.schema.json

@@ -30,7 +30,7 @@
     "DataDependencyKind": {
       "type": "string",
       "enum": ["database", "api", "app_owned_external"],
-      "description": "database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Harbour."
+      "description": "database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Isomorph."
     },
     "DataDependencyIdentifiers": {
       "type": "object",
@@ -65,7 +65,7 @@
     "DataDependencyClassification": {
       "type": "string",
       "enum": ["matched", "out_of_scope", "unknown", "inventory", "app_owned_external"],
-      "description": "matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Harbour's remit."
+      "description": "matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Isomorph's remit."
     },
     "DataDependencyOrigin": {
       "type": "string",

package/schema/data-source.schema.json

@@ -126,7 +126,7 @@
     "DataSourceProvisioningMode": {
       "type": "string",
       "enum": ["byo", "harbour_managed"],
-      "description": "byo = admin brought existing infrastructure; harbour_managed = Harbour provisioned it."
+      "description": "byo = admin brought existing infrastructure; harbour_managed = Isomorph provisioned it."
     },
     "DataSourceStatus": {
       "type": "string",

package/schema/deployment-environment.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/deployment-environment.schema.json",
   "title": "DeploymentEnvironment",
-  "description": "Public environment accepted by the preview deployment-control-plane APIs. The MVP accepts only preview; production remains reachable only through Harbour's human-merge promotion flow.",
+  "description": "Public environment accepted by the preview deployment-control-plane APIs. The MVP accepts only preview; production remains reachable only through Isomorph's human-merge promotion flow.",
   "type": "string",
   "enum": ["preview"],
   "examples": ["preview"]

package/schema/deployment-status-response.schema.json

@@ -122,7 +122,7 @@
       "type": "object",
       "additionalProperties": false,
       "required": ["account", "region"],
-      "description": "The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means harbour-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.",
+      "description": "The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means Isomorph-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.",
       "properties": {
         "account": {
           "type": "string",