@fourier-labs/harbour-contracts 0.68.0 → 0.70.0

package/README.md

@@ -38,8 +38,8 @@ exist here first.
 | `binding-classification-subject.schema.json` | Complete value-free binding-name classification before version allocation | AI governance §5.7 / SEC-UP-01 |
 | `sanitized-binding-evidence.schema.json` | Exact-version sanitized runtime-binding allocation receipt | AI governance §5.7 / SEC-UP-02 |
 | `ai-pricing-revision`, `ai-metering-policy`, `ai-budget-ledger-event`, `ai-trace-event-v2` | Additive metering v2 records, including media dimensions and P5 trace attribution; v1 records remain readable | AI governance §9 |
-| `app-integrations-declaration.schema.json` | Committed `.isomorph/integrations.json` (`isomorph.app-integrations/2.0`): closed five-operation set (Slack read/post, Gmail read-only, warehouse view read) with fixed identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
-| `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds, the five result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
+| `app-integrations-declaration.schema.json` | Committed `.isomorph/integrations.json` (`isomorph.app-integrations/2.0`): closed six-operation set (Slack read/post, Gmail read/send, warehouse view read) with fixed identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
+| `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds (a warehouse read filters, groups, aggregates and sorts in the warehouse and says when it was `truncated` — ADR 0017), the six result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
 | `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
 | `kit-bundle-manifest.schema.json`, `kit-lock.schema.json` | Published kit bundle identity (SDK tarball digest plus optional `sdk.version` and https `sdk.url` download location) and the committed `.isomorph/kit.lock.json` the CodeBuild SDK-vendoring gate compares against | Dev kit §3 |
 | `deploy-response.schema.json` | 202 Accepted body for `POST /v1/tenants/{tenant}/apps/{app}/deployments`, returned only after the authoritative QUEUED version exists and its SQS message is accepted | — |

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.68.0.0",
-  "publishVersion": "0.68.0",
-  "publishTag": "v0.68.0",
-  "schemasDigest": "sha256:3860585b4a4a55334e788faca34018dfaa21bf7ee5fa42bb50b0a454a77047b3",
+  "repositoryVersion": "0.70.0.0",
+  "publishVersion": "0.70.0",
+  "publishTag": "v0.70.0",
+  "schemasDigest": "sha256:b3c430914fee8a4f33dc15051ec59a6a8bad9a84c31fda119b6d683eb523b094",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:0c97fd145737bf8fba6de780187033f04e52fe524284cd95c084fcda38e31a28",
-  "generatedTypeScriptDigest": "sha256:bd9927f250e96a91958f078ea29d1420ca3d6545ce93b2b2901033ac09e52827",
+  "generatedGoDigest": "sha256:05b383b27a90f3b3495a327e3da9ab6e13c5c2b047fc9311616ff6e7a283ccab",
+  "generatedTypeScriptDigest": "sha256:184aacb9eb73cec089f8e891b1840873ca9497eb91cf4d3b12cfa9f0a9f305d1",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -54,8 +54,8 @@
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
     "schema/integration-connect-result.schema.json": "sha256:3f254b67ef739dc1fa395bdc8c4dc93359b16d481dba2a2d777aa5b6f34b7af8",
     "schema/integration-error-details.schema.json": "sha256:47ad7621c34b092c7e40f912a21e7ccbdc000b974cfb7fa0c9200463e029f8fb",
-    "schema/integration-execute-request.schema.json": "sha256:7a3ebd7a9992a9390d05c9eea6b66762e437655afdca79b64ec992967172c325",
-    "schema/integration-execute-result.schema.json": "sha256:de87c35fb4dfb16f7334cab111f247281fc2300dc27738871ed1f8397ece6753",
+    "schema/integration-execute-request.schema.json": "sha256:b0ad5a3f4836d1f724ee9c28c2e55748819004f37ece37e5711a46bbcc85f3a6",
+    "schema/integration-execute-result.schema.json": "sha256:ae0f17788d0933ee67e4f058d57484e192bc6d7d964ee01ec53b94b1777a0724",
     "schema/internal-configuration-request.schema.json": "sha256:229d44a3458f68dceddfba802e5c1adcd95523a45af29b93b972706b88461a7d",
     "schema/kit-bundle-manifest.schema.json": "sha256:4a9fcdd52ba0d55718ef4dbdab112b145ef90471d9356d4d3fb41e50fe9e400d",
     "schema/kit-lock.schema.json": "sha256:a48154d9471e49a893d928f7b0e1e0bc77708a4a7edce4fdf14073203e0e8987",
@@ -66,8 +66,8 @@
     "schema/saas-connection.schema.json": "sha256:82ed8018201800a95aa792bde1d22568e86b55b3be926aa094a260c8c78a58d7",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
-    "schema/security-scan-input-v2.schema.json": "sha256:adf90e7e158e2a29145fa9696219dad82d294cac14614bcd10910a251ebe6940",
-    "schema/security-verdict.schema.json": "sha256:6650c327b58431c6a567bbbf1e59bb9d4a8dc2f0ff2efc92ca4c2fd5b2cf28b6",
+    "schema/security-scan-input-v2.schema.json": "sha256:0d418342078c9b5046ea6f4bef3c2c57539285dfee99cc0850d4f0d03739ee13",
+    "schema/security-verdict.schema.json": "sha256:f4a1c109ed27779374c52daccb0a96589613db4f3cf030a8b0e4713bf1b3dbff",
     "schema/transform-parked-result.schema.json": "sha256:11729980d4c89d4a9e18f5f213232cd3359739c85626b36c20c2a37ba794c9af",
     "schema/transform-report.schema.json": "sha256:b9b4b09f88714b49d855f01ab9b611f34fb856447c0d063be409bb12a6c2700a",
     "schema/version-state.schema.json": "sha256:3b190007e2f8e3821c41ef11c6f5b226da7d5a18d34d4077f4618004846fd444",
@@ -109,10 +109,10 @@
     "gen-go/contracts_test.go": "sha256:56376287cb1548be1b35ab4c65d6f0b558c5d34885f7a47cb3d9e8d786607bf5",
     "gen-go/doc.go": "sha256:316d610ce568597a2ce6f38e9782e34fa5920f6f51ab0866e6d061b8a41cd822",
     "gen-go/error_category.go": "sha256:b2ddea22dcfa030f1a45e721e635485b0bd816cf1f38e7654628a653f5ed4583",
-    "gen-go/integration_execute_input_rules.go": "sha256:52a405aa7a97f7b4e2ed3c314a7bd28b7698cc7883ee72ad4c027637be602ab9",
-    "gen-go/integration_execute_input_rules_test.go": "sha256:c437a8406a2f062a0173b9419e4cb176fc6eb54e569506225d5162323f55b40b",
+    "gen-go/integration_execute_input_rules.go": "sha256:7465a20d79cfb82ed5be683eca901677066e9f28fc5355c643a1883a28c4793a",
+    "gen-go/integration_execute_input_rules_test.go": "sha256:0368dce6ee45d06cf8d8444afaa5d92449848187d8f391fffe69654ff1ca861b",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:e700fb22b4e2eb59f8531da4bdac154ac22991f9fd39e72b2f4483e1fa2e0264",
+    "gen-go/types.go": "sha256:096be357356c51cf346b3e4568014f501cad66c2a482bdb6fd349c9e23bbcea0",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -163,9 +163,9 @@
     "gen-ts/index.ts": "sha256:8459b1cf136a0c822795154e2df2a28c848cddfadced329604be893ae6eef069",
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
     "gen-ts/integration-error-details.ts": "sha256:ad7ecec9dd4533a6e86b3508886a7d69937052f52105497285797f77106bcc6f",
-    "gen-ts/integration-execute-input-rules.ts": "sha256:0da117ac9f3109462e5862d658edf0f50e4b71fdcbb675d3a9dcb08489bcadd0",
-    "gen-ts/integration-execute-request.ts": "sha256:1008bc1c8b8fec41dd7241a9f6ccb31233473e34c5cf538c0125f4ee6f45d2db",
-    "gen-ts/integration-execute-result.ts": "sha256:b7c9270abb0c12888e651aeb1a9927a658faa135ad6197be6dfbd46d942f2a0a",
+    "gen-ts/integration-execute-input-rules.ts": "sha256:6f97b347d822624cbb4d51dae5834c67696babdea04b4c3aec9361e2bb670886",
+    "gen-ts/integration-execute-request.ts": "sha256:fef0568ab5ffd9e021f3be4ee1178dec5ca1aa54d9799546699ae54b188d2c54",
+    "gen-ts/integration-execute-result.ts": "sha256:79d40eb1f6f75ea06ca69d62bef5a71b5ad0c46eb51ab312fedefd5d3f568cb2",
     "gen-ts/internal-configuration-request.ts": "sha256:7032437797473fa1c581d134adef2f3d4b4f4132f482cd17743e9d47097886bc",
     "gen-ts/kit-bundle-manifest.ts": "sha256:2777a268aef8787b81e71d154a7d05f6f5ded09d66f378211ff5493ddb885171",
     "gen-ts/kit-lock.ts": "sha256:00ceeb97e9b7d0187bec00728f5099fd34e775e9cc44c85c4714f7a3a4118ef6",
@@ -177,8 +177,8 @@
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",
-    "gen-ts/security-scan-input-v2.ts": "sha256:ec703b8fe1734a623ce138adc54dc7acbe3b0880e469c70e8bf8f94d7ddb85c2",
-    "gen-ts/security-verdict.ts": "sha256:c7c4c82183e7996941cee93a9cdb4dcaa8a4dab2d607ce29aab8683ee5ced8eb",
+    "gen-ts/security-scan-input-v2.ts": "sha256:cccbfc5dae0ea5a328e6b15525ac190a0aae522e3220dffe7e6c80c445d54610",
+    "gen-ts/security-verdict.ts": "sha256:beef7e4e23b385f3b18579f43bb4eb92b19aeef9e5089f3e9a149bf0067be4e8",
     "gen-ts/transform-parked-result.ts": "sha256:6279e27cee8d75c29f3ede45580fef1daa0ca300867a78e43ead8a7689ec613f",
     "gen-ts/transform-report.ts": "sha256:d83f1c34c4a082bd80bf9588b08e2fba3b7e25cd1855375ca3073ab9fafddfec",
     "gen-ts/version-state-machine.ts": "sha256:c67af3e86ac306743345b850dfd3ae5201c19d10c40e2c149cf8c38258320d5f",

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.68.0.0";
-export declare const ContractPublishVersion: "0.68.0";
-export declare const ContractPublishTag: "v0.68.0";
-export declare const ContractSchemasDigest: "sha256:3860585b4a4a55334e788faca34018dfaa21bf7ee5fa42bb50b0a454a77047b3";
+export declare const ContractRepositoryVersion: "0.70.0.0";
+export declare const ContractPublishVersion: "0.70.0";
+export declare const ContractPublishTag: "v0.70.0";
+export declare const ContractSchemasDigest: "sha256:b3c430914fee8a4f33dc15051ec59a6a8bad9a84c31fda119b6d683eb523b094";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:0c97fd145737bf8fba6de780187033f04e52fe524284cd95c084fcda38e31a28";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:bd9927f250e96a91958f078ea29d1420ca3d6545ce93b2b2901033ac09e52827";
+export declare const ContractGeneratedGoDigest: "sha256:05b383b27a90f3b3495a327e3da9ab6e13c5c2b047fc9311616ff6e7a283ccab";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:184aacb9eb73cec089f8e891b1840873ca9497eb91cf4d3b12cfa9f0a9f305d1";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.68.0.0";
-export const ContractPublishVersion = "0.68.0";
-export const ContractPublishTag = "v0.68.0";
-export const ContractSchemasDigest = "sha256:3860585b4a4a55334e788faca34018dfaa21bf7ee5fa42bb50b0a454a77047b3";
+export const ContractRepositoryVersion = "0.70.0.0";
+export const ContractPublishVersion = "0.70.0";
+export const ContractPublishTag = "v0.70.0";
+export const ContractSchemasDigest = "sha256:b3c430914fee8a4f33dc15051ec59a6a8bad9a84c31fda119b6d683eb523b094";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:0c97fd145737bf8fba6de780187033f04e52fe524284cd95c084fcda38e31a28";
-export const ContractGeneratedTypeScriptDigest = "sha256:bd9927f250e96a91958f078ea29d1420ca3d6545ce93b2b2901033ac09e52827";
+export const ContractGeneratedGoDigest = "sha256:05b383b27a90f3b3495a327e3da9ab6e13c5c2b047fc9311616ff6e7a283ccab";
+export const ContractGeneratedTypeScriptDigest = "sha256:184aacb9eb73cec089f8e891b1840873ca9497eb91cf4d3b12cfa9f0a9f305d1";

package/dist/gen-ts/integration-execute-input-rules.d.ts

@@ -28,7 +28,30 @@ export type IntegrationExecuteInputFieldRule = {
         maxLength?: number;
         pattern?: string;
     };
+} | {
+    kind: 'enum';
+    required: boolean;
+    values: readonly string[];
+    default?: string;
+} | {
+    kind: 'object[]';
+    required: boolean;
+    minItems: number;
+    maxItems: number;
+    fields: Readonly<Record<string, IntegrationExecuteInputFieldRule>>;
+} | {
+    kind: 'value';
+    required: boolean;
+    types: readonly IntegrationExecuteInputValueType[];
+    maxLength?: number;
+    list?: {
+        minItems: number;
+        maxItems: number;
+        types: readonly IntegrationExecuteInputValueType[];
+    };
 };
+/** The scalar types a `value` input accepts, alone or in its list form. */
+export type IntegrationExecuteInputValueType = 'string' | 'number' | 'boolean';
 export type IntegrationExecuteOperationRule = {
     idempotencyKey: boolean;
     fields: Record<string, IntegrationExecuteInputFieldRule>;
@@ -144,7 +167,7 @@ export declare const IntegrationExecuteInputRules: {
         readonly fields: {
             readonly columns: {
                 readonly kind: "string[]";
-                readonly required: true;
+                readonly required: false;
                 readonly minItems: 1;
                 readonly maxItems: 32;
                 readonly uniqueItems: false;
@@ -153,6 +176,92 @@ export declare const IntegrationExecuteInputRules: {
                     readonly pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$";
                 };
             };
+            readonly where: {
+                readonly kind: "object[]";
+                readonly required: false;
+                readonly minItems: 1;
+                readonly maxItems: 16;
+                readonly fields: {
+                    readonly column: {
+                        readonly kind: "string";
+                        readonly required: true;
+                        readonly minLength: 0;
+                        readonly pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$";
+                    };
+                    readonly op: {
+                        readonly kind: "enum";
+                        readonly required: true;
+                        readonly values: readonly ["eq", "ne", "gt", "gte", "lt", "lte", "in", "notIn", "isNull", "isNotNull"];
+                    };
+                    readonly value: {
+                        readonly kind: "value";
+                        readonly required: false;
+                        readonly types: readonly ["string", "number", "boolean"];
+                        readonly maxLength: 256;
+                        readonly list: {
+                            readonly minItems: 1;
+                            readonly maxItems: 100;
+                            readonly types: readonly ["string", "number"];
+                        };
+                    };
+                };
+            };
+            readonly groupBy: {
+                readonly kind: "string[]";
+                readonly required: false;
+                readonly minItems: 1;
+                readonly maxItems: 8;
+                readonly uniqueItems: false;
+                readonly item: {
+                    readonly minLength: 0;
+                    readonly pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$";
+                };
+            };
+            readonly aggregates: {
+                readonly kind: "object[]";
+                readonly required: false;
+                readonly minItems: 1;
+                readonly maxItems: 16;
+                readonly fields: {
+                    readonly fn: {
+                        readonly kind: "enum";
+                        readonly required: true;
+                        readonly values: readonly ["count", "sum", "avg", "min", "max"];
+                    };
+                    readonly column: {
+                        readonly kind: "string";
+                        readonly required: true;
+                        readonly minLength: 0;
+                        readonly pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$";
+                    };
+                    readonly as: {
+                        readonly kind: "string";
+                        readonly required: true;
+                        readonly minLength: 0;
+                        readonly pattern: "^[a-z_][a-z0-9_]{0,62}$";
+                    };
+                };
+            };
+            readonly orderBy: {
+                readonly kind: "object[]";
+                readonly required: false;
+                readonly minItems: 1;
+                readonly maxItems: 8;
+                readonly fields: {
+                    readonly column: {
+                        readonly kind: "string";
+                        readonly required: true;
+                        readonly minLength: 0;
+                        readonly pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$";
+                    };
+                    readonly direction: {
+                        readonly kind: "enum";
+                        readonly required: false;
+                        readonly values: readonly ["asc", "desc"];
+                        readonly default: "asc";
+                    };
+                };
+            };
             readonly limit: {
                 readonly kind: "integer";
                 readonly required: false;

package/dist/gen-ts/integration-execute-input-rules.js

@@ -39,7 +39,22 @@ export const IntegrationExecuteInputRules = {
     "warehouse.view.read": {
         idempotencyKey: false,
         fields: {
-            columns: { kind: "string[]", required: true, minItems: 1, maxItems: 32, uniqueItems: false, item: { minLength: 0, pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$" } },
+            columns: { kind: "string[]", required: false, minItems: 1, maxItems: 32, uniqueItems: false, item: { minLength: 0, pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$" } },
+            where: { kind: "object[]", required: false, minItems: 1, maxItems: 16, fields: {
+                    column: { kind: "string", required: true, minLength: 0, pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$" },
+                    op: { kind: "enum", required: true, values: ["eq", "ne", "gt", "gte", "lt", "lte", "in", "notIn", "isNull", "isNotNull"] },
+                    value: { kind: "value", required: false, types: ["string", "number", "boolean"], maxLength: 256, list: { minItems: 1, maxItems: 100, types: ["string", "number"] } },
+                } },
+            groupBy: { kind: "string[]", required: false, minItems: 1, maxItems: 8, uniqueItems: false, item: { minLength: 0, pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$" } },
+            aggregates: { kind: "object[]", required: false, minItems: 1, maxItems: 16, fields: {
+                    fn: { kind: "enum", required: true, values: ["count", "sum", "avg", "min", "max"] },
+                    column: { kind: "string", required: true, minLength: 0, pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$" },
+                    as: { kind: "string", required: true, minLength: 0, pattern: "^[a-z_][a-z0-9_]{0,62}$" },
+                } },
+            orderBy: { kind: "object[]", required: false, minItems: 1, maxItems: 8, fields: {
+                    column: { kind: "string", required: true, minLength: 0, pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$" },
+                    direction: { kind: "enum", required: false, values: ["asc", "desc"], default: "asc" },
+                } },
             limit: { kind: "integer", required: false, minimum: 1, maximum: 1000, default: 100 },
         },
     },
@@ -60,55 +75,111 @@ function matches(pattern, value) {
     }
     return compiled.test(value);
 }
+function refuse(field, message) { return { ok: false, problem: { field, message } }; }
+const valueNouns = { string: ['a string', 'strings'], number: ['a number', 'numbers'], boolean: ['a boolean', 'booleans'] };
+function either(parts) {
+    return parts.length > 1 ? `${parts.slice(0, -1).join(', ')} or ${parts[parts.length - 1]}` : parts.join('');
+}
+function isScalar(types, maxLength, value) {
+    if (typeof value === 'string')
+        return types.includes('string') && (maxLength === undefined || value.length <= maxLength);
+    if (typeof value === 'number')
+        return types.includes('number') && Number.isFinite(value);
+    return typeof value === 'boolean' && types.includes('boolean');
+}
 /**
- * Validates one operation's input against the contract and returns it with the
- * contract's defaults applied. The message names the field and its allowed
- * range; it is the sentence the platform answers with, so a caller may show it.
+ * Checks one object's fields in rule order and applies defaults: the input
+ * itself (where null counts as absent), or one entry of an object[] input
+ * (where only a missing key is absent, so null is refused like any wrong value).
  */
-export function validateIntegrationExecuteInput(operation, input) {
-    const rule = IntegrationExecuteInputRules[operation];
-    if (!rule)
-        return { ok: false, problem: { field: 'operation', message: `${operation} is not a declared integration operation` } };
-    const raw = input === undefined ? {} : input;
-    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
-        return { ok: false, problem: { field: 'input', message: 'input must be an object' } };
-    const given = raw;
+function checkFields(operation, prefix, fields, given, nullIsAbsent) {
     for (const name of Object.keys(given))
-        if (!Object.prototype.hasOwnProperty.call(rule.fields, name))
-            return { ok: false, problem: { field: name, message: `${name} is not an input of ${operation}` } };
+        if (!Object.prototype.hasOwnProperty.call(fields, name))
+            return refuse(prefix + name, `${prefix}${name} is not an input of ${operation}`);
     const out = {};
-    for (const [name, field] of Object.entries(rule.fields)) {
+    for (const [name, field] of Object.entries(fields)) {
+        const path = prefix + name;
         const value = given[name];
-        if (value === undefined || value === null) {
+        if (value === undefined || (nullIsAbsent && value === null)) {
             if (field.required)
-                return { ok: false, problem: { field: name, message: `${name} is required for ${operation}` } };
-            if (field.kind === 'integer' && field.default !== undefined)
+                return refuse(path, `${path} is required for ${operation}`);
+            if ((field.kind === 'integer' || field.kind === 'enum') && field.default !== undefined)
                 out[name] = field.default;
             continue;
         }
-        if (field.kind === 'integer') {
+        const checked = checkField(operation, path, name, field, value);
+        if (!checked.ok)
+            return checked;
+        out[name] = checked.value;
+    }
+    return { ok: true, value: out };
+}
+function checkField(operation, path, name, field, value) {
+    switch (field.kind) {
+        case 'integer':
             if (typeof value !== 'number' || !Number.isInteger(value) || value < field.minimum || value > field.maximum)
-                return { ok: false, problem: { field: name, message: `${name} must be an integer between ${field.minimum} and ${field.maximum}` } };
-        }
-        else if (field.kind === 'string') {
+                return refuse(path, `${path} must be an integer between ${field.minimum} and ${field.maximum}`);
+            return { ok: true, value };
+        case 'string':
             if (typeof value !== 'string' || value.length < field.minLength || (field.maxLength !== undefined && value.length > field.maxLength))
-                return { ok: false, problem: { field: name, message: field.maxLength !== undefined ? `${name} must be ${field.minLength} to ${field.maxLength} characters` : `${name} must be a string of at least ${field.minLength} characters` } };
+                return refuse(path, field.maxLength !== undefined ? `${path} must be ${field.minLength} to ${field.maxLength} characters` : `${path} must be a string of at least ${field.minLength} characters`);
             if (field.pattern && !matches(field.pattern, value))
-                return { ok: false, problem: { field: name, message: `${name} must match ${field.pattern}` } };
-        }
-        else {
+                return refuse(path, `${path} must match ${field.pattern}`);
+            return { ok: true, value };
+        case 'enum':
+            if (typeof value !== 'string' || !field.values.includes(value))
+                return refuse(path, `${path} must be one of ${field.values.join(', ')}`);
+            return { ok: true, value };
+        case 'string[]': {
             if (!Array.isArray(value) || value.length < field.minItems || value.length > field.maxItems)
-                return { ok: false, problem: { field: name, message: `${name} must list ${field.minItems} to ${field.maxItems} items` } };
+                return refuse(path, `${path} must list ${field.minItems} to ${field.maxItems} items`);
             const seen = new Set();
             for (const [index, item] of value.entries()) {
                 if (typeof item !== 'string' || item.length < field.item.minLength || (field.item.maxLength !== undefined && item.length > field.item.maxLength) || (field.item.pattern !== undefined && !matches(field.item.pattern, item)))
-                    return { ok: false, problem: { field: name, message: `${name}[${index}] is not a valid ${name} entry` } };
+                    return refuse(path, `${path}[${index}] is not a valid ${name} entry`);
                 if (field.uniqueItems && seen.has(item))
-                    return { ok: false, problem: { field: name, message: `${name} must not repeat an entry` } };
+                    return refuse(path, `${path} must not repeat an entry`);
                 seen.add(item);
             }
+            return { ok: true, value };
+        }
+        case 'object[]': {
+            if (!Array.isArray(value) || value.length < field.minItems || value.length > field.maxItems)
+                return refuse(path, `${path} must list ${field.minItems} to ${field.maxItems} items`);
+            const entries = [];
+            for (const [index, item] of value.entries()) {
+                if (item === null || typeof item !== 'object' || Array.isArray(item))
+                    return refuse(path, `${path}[${index}] is not a valid ${name} entry`);
+                const entry = checkFields(operation, `${path}[${index}].`, field.fields, item, false);
+                if (!entry.ok)
+                    return entry;
+                entries.push(entry.value);
+            }
+            return { ok: true, value: entries };
+        }
+        case 'value': {
+            const { types, maxLength, list } = field;
+            if (isScalar(types, maxLength, value) || (list !== undefined && Array.isArray(value) && value.length >= list.minItems && value.length <= list.maxItems && value.every(item => isScalar(list.types, maxLength, item))))
+                return { ok: true, value };
+            const shapes = types.map(type => (type === 'string' && maxLength !== undefined ? `a string of at most ${maxLength} characters` : valueNouns[type][0]));
+            if (list !== undefined)
+                shapes.push(`a list of ${list.minItems} to ${list.maxItems} ${either(list.types.map(type => valueNouns[type][1]))}`);
+            return refuse(path, `${path} must be ${either(shapes)}`);
         }
-        out[name] = value;
     }
-    return { ok: true, input: out };
+}
+/**
+ * Validates one operation's input against the contract and returns it with the
+ * contract's defaults applied. The message names the field and its allowed
+ * range; it is the sentence the platform answers with, so a caller may show it.
+ */
+export function validateIntegrationExecuteInput(operation, input) {
+    const rule = IntegrationExecuteInputRules[operation];
+    if (!rule)
+        return refuse('operation', `${operation} is not a declared integration operation`);
+    const raw = input === undefined ? {} : input;
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+        return refuse('input', 'input must be an object');
+    const checked = checkFields(operation, '', rule.fields, raw, true);
+    return checked.ok ? { ok: true, input: checked.value } : checked;
 }

package/dist/gen-ts/integration-execute-request.d.ts

@@ -1,5 +1,5 @@
 /**
- * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is fixed by the operation for every operation but slack.message.post, and always enforced from an approved grant; any identity/userId/scope field is rejected by additionalProperties. A slack.message.post runs as the app (the IT-approved per-app name from the grant, plus a "Posted by <app> on Isomorph" footer) or as the signed-in person (no name, no footer) — the same input either way — and since 0.55.0 the call names which of the app's approved modes it runs under (`mode`): required when IT approved both modes for the app (MODE_REQUIRED otherwise), optional when it approved one (that one is used), and a named mode without an approved grant is refused (MODE_NOT_GRANTED) rather than served under the other, so approval order never decides what a post does. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.
+ * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is fixed by the operation for every operation but slack.message.post, and always enforced from an approved grant; any identity/userId/scope field is rejected by additionalProperties. A slack.message.post runs as the app (the IT-approved per-app name from the grant, plus a "Posted by <app> on Isomorph" footer) or as the signed-in person (no name, no footer) — the same input either way — and since 0.55.0 the call names which of the app's approved modes it runs under (`mode`): required when IT approved both modes for the app (MODE_REQUIRED otherwise), optional when it approved one (that one is used), and a named mode without an approved grant is refused (MODE_NOT_GRANTED) rather than served under the other, so approval order never decides what a post does. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns? 1..32, where? 1..16 filters, groupBy? 1..8 columns, aggregates? 1..16, orderBy? 1..8, limit? 1..1000, default 100} (0.70.0: a plain read names columns, an aggregate read names aggregates and optionally groupBy; the cross-field rules — exactly one of columns or aggregates, groupBy needs aggregates, a filter value that fits its op, orderBy naming a returned column, every named column approved — are enforced by governance, not expressible here; ADR 0017). Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.
  */
 export type IntegrationExecuteRequest = {
     /**
@@ -39,12 +39,40 @@ export type IntegrationExecuteRequest = {
          */
         replyToMessageId?: string;
         /**
-         * Explicit columns, or `*` alone when the app's approved resource grant allows all current and future columns.
+         * warehouse.view.read, a plain read: explicit columns, or `*` alone when the app's approved resource grant allows all current and future columns. An aggregate read names aggregates instead.
          *
          * @minItems 1
          * @maxItems 32
          */
         columns?: string[];
+        /**
+         * warehouse.view.read (0.70.0): filters the warehouse applies before it returns, grouping or limits rows. All of them must hold (AND); there is no OR and no LIKE.
+         *
+         * @minItems 1
+         * @maxItems 16
+         */
+        where?: WarehouseFilter[];
+        /**
+         * warehouse.view.read (0.70.0): columns (never `*`) that group the rows; needs aggregates. Each returned row is one group: its groupBy columns, then its aggregate aliases.
+         *
+         * @minItems 1
+         * @maxItems 8
+         */
+        groupBy?: string[];
+        /**
+         * warehouse.view.read (0.70.0): what an aggregate read computes, over each group or over every matching row when there is no groupBy.
+         *
+         * @minItems 1
+         * @maxItems 16
+         */
+        aggregates?: WarehouseAggregate[];
+        /**
+         * warehouse.view.read (0.70.0): sort keys, first key first. Without orderBy an aggregate read is sorted by its groupBy columns and a plain read is not sorted at all.
+         *
+         * @minItems 1
+         * @maxItems 8
+         */
+        orderBy?: WarehouseOrder[];
     };
     /**
      * UUID of one explicit Send action; required for slack.message.post and gmail.message.send only. The same key with the same payload and subject returns the recorded outcome for seven days.
@@ -80,3 +108,53 @@ export type EmailAddressList1 = EmailAddress[];
  * @maxItems 50
  */
 export type EmailAddressList2 = EmailAddress[];
+/**
+ * A filter comparison: = <> > >= < <= IN, NOT IN, IS NULL, IS NOT NULL. Word-like so every value is a valid generated constant.
+ */
+export type WarehouseFilterOp = 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'notIn' | 'isNull' | 'isNotNull';
+/**
+ * An aggregate function.
+ */
+export type WarehouseAggregateFn = 'count' | 'sum' | 'avg' | 'min' | 'max';
+/**
+ * Sort direction; asc when absent.
+ */
+export type WarehouseOrderDirection = 'asc' | 'desc';
+/**
+ * One warehouse.view.read filter (0.70.0): <column> <op> <value>. The value is always bound as a query parameter, never written into the SQL. Which value an op takes is a governance rule: isNull/isNotNull take none; in/notIn take a non-empty list of one scalar type; every other op takes one scalar, and a boolean only with eq/ne.
+ */
+export interface WarehouseFilter {
+    /**
+     * The filtered column; never `*`.
+     */
+    column: string;
+    op: WarehouseFilterOp;
+    /**
+     * The value compared with: a string (a date or timestamp is its ISO string), a number, a boolean, or a list of strings or numbers for in/notIn. Never null; use isNull or isNotNull.
+     */
+    value?: string | number | boolean | (string | number)[];
+}
+/**
+ * One computed column of an aggregate warehouse.view.read (0.70.0): fn(column) AS as. `*` is a column only for count (a governance rule). The value follows the read's cell rules, so a 64-bit or decimal result may be a string.
+ */
+export interface WarehouseAggregate {
+    fn: WarehouseAggregateFn;
+    /**
+     * A plain warehouse column identifier, or `*` as the sole selection when IT exposed all current and future columns.
+     */
+    column: string;
+    /**
+     * The name the computed value is returned under; unique in the read and never a groupBy column (governance rules).
+     */
+    as: string;
+}
+/**
+ * One warehouse.view.read sort key (0.70.0). A plain read sorts by a selected column (any column when it selects `*`); an aggregate read sorts by a groupBy column or an aggregate alias (governance rules).
+ */
+export interface WarehouseOrder {
+    /**
+     * A column or an aggregate alias; never `*`.
+     */
+    column: string;
+    direction?: WarehouseOrderDirection;
+}

package/dist/gen-ts/integration-execute-result.d.ts

@@ -1,5 +1,5 @@
 /**
- * The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the six operation results: slack.channel.history -> {messages, hasMore} (plain text/IDs/time, plus the display name and emoji icon a per-app-named app post carries — authorName/authorIcon, 0.55.0 — never the provider payload); slack.message.post -> {messageId}; gmail.thread.list -> {threads, hasMore} (newest inbox threads; each `messageId` is the thread's newest message, what gmail.message.read takes); gmail.message.read -> {id, threadId, subject, from, to, date, text, truncated} (headers plus the plain text with html stripped, cut at 16 KiB with `truncated` set); gmail.message.send -> {messageId, threadId} (the Gmail ids of the sent message and its thread); warehouse.view.read -> {rows} (decimal/64-bit values as strings, dates as ISO strings). An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. Results over 1 MiB are rejected, not truncated.
+ * The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the six operation results: slack.channel.history -> {messages, hasMore} (plain text/IDs/time, plus the display name and emoji icon a per-app-named app post carries — authorName/authorIcon, 0.55.0 — never the provider payload); slack.message.post -> {messageId}; gmail.thread.list -> {threads, hasMore} (newest inbox threads; each `messageId` is the thread's newest message, what gmail.message.read takes); gmail.message.read -> {id, threadId, subject, from, to, date, text, truncated} (headers plus the plain text with html stripped, cut at 16 KiB with `truncated` set); gmail.message.send -> {messageId, threadId} (the Gmail ids of the sent message and its thread); warehouse.view.read -> {rows, truncated} (rows keyed by the selected columns, or for an aggregate read by the groupBy columns then the aggregate aliases; decimal/64-bit values as strings, dates as ISO strings; since 0.70.0 every server sends `truncated`, true when more rows matched than `limit` — the server reads limit+1 rows to know — so the rows are incomplete and must not be totalled or averaged; a server before 0.70.0 omitted it). An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. A whole result over 1 MiB is rejected, never cut down to fit.
  */
 export type IntegrationExecuteResult = {
     /**
@@ -19,6 +19,9 @@ export type IntegrationExecuteResult = {
     to?: string;
     date?: string;
     text?: string;
+    /**
+     * gmail.message.read: the text was cut at 16 KiB. warehouse.view.read (0.70.0): more rows matched than the read's limit, so `rows` is incomplete.
+     */
     truncated?: boolean;
     /**
      * @maxItems 1000

package/dist/gen-ts/security-scan-input-v2.d.ts

@@ -1,5 +1,5 @@
 /**
- * Input to the Security Assurance machine, second shape, replacing security-scan-input.schema.json. V1 scanned a deployed commit located through the deployment state; v2 scans exactly one thing: an uploaded package that governance validated at source intake, identified by the zip sha256 the stager verifies before extraction and by the tree digest governance computed from the unzipped bytes (`sourceDigestOf`, `sha256:`-prefixed), which keys the governance scan record and the check report on the laptop. Commit-mode and ARTIFACT-phase inputs are deliberately absent: the console's later on-demand scan uses this same package path against the deploy upload, and the Transform lane runs the scanner in-process; an image scan, if it returns, is an additive v3. The policy profile is named by the caller when it knows better than the data classification (the kit lane names BASELINE); `profile` and `classification` are mutually exclusive, and both absent still defaults to STANDARD with `classificationDefaulted: true`. Nothing here carries a scanner version: the scanner stamps its own into verdict provenance, and governance decides validity by comparing that against its MINIMUM_SCANNER_VERSION. `org`/`app` are the tenant and app ids for kit apps; `env` stays required because the evidence key carries it (governance passes `preview` for a package scan; promotion never re-scans). The `execution` block names the tenant's execution-account scanner, invoke role and artifacts bucket, resolved by governance the way admission resolves them for the deploy machine.
+ * Input to the Security Assurance machine, second shape, replacing security-scan-input.schema.json. V1 scanned a deployed commit located through the deployment state; v2 scans exactly one thing: an uploaded package that governance validated at source intake, identified by the zip sha256 the stager verifies before extraction and by the tree digest governance computed from the unzipped bytes (`sourceDigestOf`, `sha256:`-prefixed), which keys the governance scan record and the check report on the laptop. Commit-mode and ARTIFACT-phase inputs are deliberately absent: the console's later on-demand scan uses this same package path against the deploy upload, and the Transform lane runs the scanner in-process; an image scan, if it returns, is an additive v3. The caller always names the policy profile (governance names BASELINE for the kit lane); there is no classification input and no default profile. Nothing here carries a scanner version: the scanner stamps its own into verdict provenance, and governance decides validity by comparing that against its MINIMUM_SCANNER_VERSION. `org`/`app` are the tenant and app ids for kit apps; `env` stays required because the evidence key carries it (governance passes `preview` for a package scan; promotion never re-scans). The `execution` block names the tenant's execution-account scanner, invoke role and artifacts bucket, resolved by governance the way admission resolves them for the deploy machine.
  */
 export interface SecurityScanInputV2 {
     schema: 'harbour.security-scan-input/2.0';
@@ -18,13 +18,9 @@ export interface SecurityScanInputV2 {
     package: PackageSource;
     execution: Execution;
     /**
-     * Policy profile named by the caller. Takes the place of deriving one from `classification`; the verdict echoes the profile evaluated and stamps `classificationDefaulted: false`. Governance names BASELINE for kit-lane scans; the default when nothing is named is STANDARD.
+     * Policy profile the machine evaluates the evidence against; the verdict echoes it. Governance names BASELINE for kit-lane scans.
      */
-    profile?: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
-    /**
-     * Data classification, mapped to a profile as in v1 (GREEN → BASELINE, YELLOW → STANDARD, ORANGE → HIGH, RED → CRITICAL). Not allowed beside `profile`. Absent with no `profile` means STANDARD and `classificationDefaulted: true`; an invalid value fails closed.
-     */
-    classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
+    profile: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
 }
 /**
  * The bytes `isomorph secure` (or a later console re-run against a deploy upload) put through source intake.