@fourier-labs/harbour-contracts 0.68.0 → 0.70.0

package/dist/gen-ts/security-verdict.d.ts

@@ -7,7 +7,7 @@ export interface SecurityVerdict {
      */
     outcome: 'PASS' | 'BLOCKED';
     /**
-     * Policy profile the evidence was evaluated against: the input's `profile` when the caller named one, else derived from the input classification, else STANDARD.
+     * Policy profile the evidence was evaluated against, echoed from the input's `profile`.
      */
     profile: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
     /**
@@ -62,22 +62,28 @@ export interface Finding {
      * Suggested fix, when the tool provides one.
      */
     remediation?: string;
+    dependency?: Dependency;
     /**
-     * Dependency name, for a dependency-sca finding.
+     * Set by policy on every finding it evaluated: true when the finding on its own fires a block rule under the evaluated profile, false when it is reported only.
      */
-    package?: string;
+    blocking?: boolean;
+}
+/**
+ * The dependency a dependency-sca finding is about. Absent on findings that are not about one installed package (secrets, code, a missing lockfile).
+ */
+export interface Dependency {
     /**
-     * Installed version of `package` the vulnerability applies to.
+     * Package name as the lockfile names it.
      */
-    installedVersion?: string;
+    name: string;
     /**
-     * First version of `package` that fixes the vulnerability, when the tool knows one.
+     * Version of the package the app installs, which the vulnerability applies to.
      */
-    fixedVersion?: string;
+    installedVersion: string;
     /**
-     * Set by policy on every finding it evaluated: true when the finding on its own fires a block rule under the evaluated profile, false when it is reported only.
+     * The one version to upgrade to: the lowest fixed release on the installed version's major line, else the lowest fixed release above the installed version. Absent when no fix above the installed version exists.
      */
-    blocking?: boolean;
+    fixedVersion?: string;
 }
 export interface EvidenceRef {
     /**
@@ -113,8 +119,4 @@ export interface Provenance {
      * Orderable release version of the runner image that produced the evidence. Governance compares its numeric core with MINIMUM_SCANNER_VERSION to decide whether a PASS still counts.
      */
     scannerVersion: string;
-    /**
-     * True iff the input named neither a profile nor a classification and the machine assumed STANDARD (decision 2026-08-27). An invalid classification fails closed and never reaches a verdict.
-     */
-    classificationDefaulted: boolean;
 }

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.68.0.0" as const;
-export const ContractPublishVersion = "0.68.0" as const;
-export const ContractPublishTag = "v0.68.0" as const;
-export const ContractSchemasDigest = "sha256:3860585b4a4a55334e788faca34018dfaa21bf7ee5fa42bb50b0a454a77047b3" as const;
+export const ContractRepositoryVersion = "0.70.0.0" as const;
+export const ContractPublishVersion = "0.70.0" as const;
+export const ContractPublishTag = "v0.70.0" as const;
+export const ContractSchemasDigest = "sha256:b3c430914fee8a4f33dc15051ec59a6a8bad9a84c31fda119b6d683eb523b094" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:0c97fd145737bf8fba6de780187033f04e52fe524284cd95c084fcda38e31a28" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:bd9927f250e96a91958f078ea29d1420ca3d6545ce93b2b2901033ac09e52827" as const;
+export const ContractGeneratedGoDigest = "sha256:05b383b27a90f3b3495a327e3da9ab6e13c5c2b047fc9311616ff6e7a283ccab" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:184aacb9eb73cec089f8e891b1840873ca9497eb91cf4d3b12cfa9f0a9f305d1" as const;

package/gen-ts/integration-execute-input-rules.ts

@@ -11,7 +11,13 @@
 export type IntegrationExecuteInputFieldRule =
   | { kind: 'integer'; required: boolean; minimum: number; maximum: number; default?: number }
   | { kind: 'string'; required: boolean; minLength: number; maxLength?: number; pattern?: string }
-  | { kind: 'string[]'; required: boolean; minItems: number; maxItems: number; uniqueItems: boolean; item: { minLength: number; maxLength?: number; pattern?: string } };
+  | { kind: 'string[]'; required: boolean; minItems: number; maxItems: number; uniqueItems: boolean; item: { minLength: number; maxLength?: number; pattern?: string } }
+  | { kind: 'enum'; required: boolean; values: readonly string[]; default?: string }
+  | { kind: 'object[]'; required: boolean; minItems: number; maxItems: number; fields: Readonly<Record<string, IntegrationExecuteInputFieldRule>> }
+  | { kind: 'value'; required: boolean; types: readonly IntegrationExecuteInputValueType[]; maxLength?: number; list?: { minItems: number; maxItems: number; types: readonly IntegrationExecuteInputValueType[] } };
+
+/** The scalar types a `value` input accepts, alone or in its list form. */
+export type IntegrationExecuteInputValueType = 'string' | 'number' | 'boolean';
 
 export type IntegrationExecuteOperationRule = { idempotencyKey: boolean; fields: Record<string, IntegrationExecuteInputFieldRule> };
 
@@ -54,7 +60,22 @@ export const IntegrationExecuteInputRules = {
   "warehouse.view.read": {
     idempotencyKey: false,
     fields: {
-      columns: { kind: "string[]", required: true, minItems: 1, maxItems: 32, uniqueItems: false, item: { minLength: 0, pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$" } },
+      columns: { kind: "string[]", required: false, minItems: 1, maxItems: 32, uniqueItems: false, item: { minLength: 0, pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$" } },
+      where: { kind: "object[]", required: false, minItems: 1, maxItems: 16, fields: {
+        column: { kind: "string", required: true, minLength: 0, pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$" },
+        op: { kind: "enum", required: true, values: ["eq", "ne", "gt", "gte", "lt", "lte", "in", "notIn", "isNull", "isNotNull"] },
+        value: { kind: "value", required: false, types: ["string", "number", "boolean"], maxLength: 256, list: { minItems: 1, maxItems: 100, types: ["string", "number"] } },
+      } },
+      groupBy: { kind: "string[]", required: false, minItems: 1, maxItems: 8, uniqueItems: false, item: { minLength: 0, pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$" } },
+      aggregates: { kind: "object[]", required: false, minItems: 1, maxItems: 16, fields: {
+        fn: { kind: "enum", required: true, values: ["count", "sum", "avg", "min", "max"] },
+        column: { kind: "string", required: true, minLength: 0, pattern: "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$" },
+        as: { kind: "string", required: true, minLength: 0, pattern: "^[a-z_][a-z0-9_]{0,62}$" },
+      } },
+      orderBy: { kind: "object[]", required: false, minItems: 1, maxItems: 8, fields: {
+        column: { kind: "string", required: true, minLength: 0, pattern: "^[A-Za-z_][A-Za-z0-9_]{0,62}$" },
+        direction: { kind: "enum", required: false, values: ["asc", "desc"], default: "asc" },
+      } },
       limit: { kind: "integer", required: false, minimum: 1, maximum: 1000, default: 100 },
     },
   },
@@ -79,41 +100,95 @@ function matches(pattern: string, value: string): boolean {
   return compiled.test(value);
 }
 
+type Refusal = { ok: false; problem: IntegrationExecuteInputProblem };
+function refuse(field: string, message: string): Refusal { return { ok: false, problem: { field, message } }; }
+
+const valueNouns = { string: ['a string', 'strings'], number: ['a number', 'numbers'], boolean: ['a boolean', 'booleans'] } as const;
+function either(parts: readonly string[]): string {
+  return parts.length > 1 ? `${parts.slice(0, -1).join(', ')} or ${parts[parts.length - 1]}` : parts.join('');
+}
+function isScalar(types: readonly IntegrationExecuteInputValueType[], maxLength: number | undefined, value: unknown): boolean {
+  if (typeof value === 'string') return types.includes('string') && (maxLength === undefined || value.length <= maxLength);
+  if (typeof value === 'number') return types.includes('number') && Number.isFinite(value);
+  return typeof value === 'boolean' && types.includes('boolean');
+}
+
 /**
- * Validates one operation's input against the contract and returns it with the
- * contract's defaults applied. The message names the field and its allowed
- * range; it is the sentence the platform answers with, so a caller may show it.
+ * Checks one object's fields in rule order and applies defaults: the input
+ * itself (where null counts as absent), or one entry of an object[] input
+ * (where only a missing key is absent, so null is refused like any wrong value).
  */
-export function validateIntegrationExecuteInput(operation: string, input: unknown): IntegrationExecuteInputValidation {
-  const rule = (IntegrationExecuteInputRules as Record<string, IntegrationExecuteOperationRule>)[operation];
-  if (!rule) return { ok: false, problem: { field: 'operation', message: `${operation} is not a declared integration operation` } };
-  const raw = input === undefined ? {} : input;
-  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, problem: { field: 'input', message: 'input must be an object' } };
-  const given = raw as Record<string, unknown>;
-  for (const name of Object.keys(given)) if (!Object.prototype.hasOwnProperty.call(rule.fields, name)) return { ok: false, problem: { field: name, message: `${name} is not an input of ${operation}` } };
+function checkFields(operation: string, prefix: string, fields: Readonly<Record<string, IntegrationExecuteInputFieldRule>>, given: Record<string, unknown>, nullIsAbsent: boolean): { ok: true; value: Record<string, unknown> } | Refusal {
+  for (const name of Object.keys(given)) if (!Object.prototype.hasOwnProperty.call(fields, name)) return refuse(prefix + name, `${prefix}${name} is not an input of ${operation}`);
   const out: Record<string, unknown> = {};
-  for (const [name, field] of Object.entries(rule.fields)) {
+  for (const [name, field] of Object.entries(fields)) {
+    const path = prefix + name;
     const value = given[name];
-    if (value === undefined || value === null) {
-      if (field.required) return { ok: false, problem: { field: name, message: `${name} is required for ${operation}` } };
-      if (field.kind === 'integer' && field.default !== undefined) out[name] = field.default;
+    if (value === undefined || (nullIsAbsent && value === null)) {
+      if (field.required) return refuse(path, `${path} is required for ${operation}`);
+      if ((field.kind === 'integer' || field.kind === 'enum') && field.default !== undefined) out[name] = field.default;
       continue;
     }
-    if (field.kind === 'integer') {
-      if (typeof value !== 'number' || !Number.isInteger(value) || value < field.minimum || value > field.maximum) return { ok: false, problem: { field: name, message: `${name} must be an integer between ${field.minimum} and ${field.maximum}` } };
-    } else if (field.kind === 'string') {
-      if (typeof value !== 'string' || value.length < field.minLength || (field.maxLength !== undefined && value.length > field.maxLength)) return { ok: false, problem: { field: name, message: field.maxLength !== undefined ? `${name} must be ${field.minLength} to ${field.maxLength} characters` : `${name} must be a string of at least ${field.minLength} characters` } };
-      if (field.pattern && !matches(field.pattern, value)) return { ok: false, problem: { field: name, message: `${name} must match ${field.pattern}` } };
-    } else {
-      if (!Array.isArray(value) || value.length < field.minItems || value.length > field.maxItems) return { ok: false, problem: { field: name, message: `${name} must list ${field.minItems} to ${field.maxItems} items` } };
+    const checked = checkField(operation, path, name, field, value);
+    if (!checked.ok) return checked;
+    out[name] = checked.value;
+  }
+  return { ok: true, value: out };
+}
+
+function checkField(operation: string, path: string, name: string, field: IntegrationExecuteInputFieldRule, value: unknown): { ok: true; value: unknown } | Refusal {
+  switch (field.kind) {
+    case 'integer':
+      if (typeof value !== 'number' || !Number.isInteger(value) || value < field.minimum || value > field.maximum) return refuse(path, `${path} must be an integer between ${field.minimum} and ${field.maximum}`);
+      return { ok: true, value };
+    case 'string':
+      if (typeof value !== 'string' || value.length < field.minLength || (field.maxLength !== undefined && value.length > field.maxLength)) return refuse(path, field.maxLength !== undefined ? `${path} must be ${field.minLength} to ${field.maxLength} characters` : `${path} must be a string of at least ${field.minLength} characters`);
+      if (field.pattern && !matches(field.pattern, value)) return refuse(path, `${path} must match ${field.pattern}`);
+      return { ok: true, value };
+    case 'enum':
+      if (typeof value !== 'string' || !field.values.includes(value)) return refuse(path, `${path} must be one of ${field.values.join(', ')}`);
+      return { ok: true, value };
+    case 'string[]': {
+      if (!Array.isArray(value) || value.length < field.minItems || value.length > field.maxItems) return refuse(path, `${path} must list ${field.minItems} to ${field.maxItems} items`);
       const seen = new Set<string>();
       for (const [index, item] of value.entries()) {
-        if (typeof item !== 'string' || item.length < field.item.minLength || (field.item.maxLength !== undefined && item.length > field.item.maxLength) || (field.item.pattern !== undefined && !matches(field.item.pattern, item))) return { ok: false, problem: { field: name, message: `${name}[${index}] is not a valid ${name} entry` } };
-        if (field.uniqueItems && seen.has(item)) return { ok: false, problem: { field: name, message: `${name} must not repeat an entry` } };
+        if (typeof item !== 'string' || item.length < field.item.minLength || (field.item.maxLength !== undefined && item.length > field.item.maxLength) || (field.item.pattern !== undefined && !matches(field.item.pattern, item))) return refuse(path, `${path}[${index}] is not a valid ${name} entry`);
+        if (field.uniqueItems && seen.has(item)) return refuse(path, `${path} must not repeat an entry`);
         seen.add(item);
       }
+      return { ok: true, value };
+    }
+    case 'object[]': {
+      if (!Array.isArray(value) || value.length < field.minItems || value.length > field.maxItems) return refuse(path, `${path} must list ${field.minItems} to ${field.maxItems} items`);
+      const entries: Record<string, unknown>[] = [];
+      for (const [index, item] of value.entries()) {
+        if (item === null || typeof item !== 'object' || Array.isArray(item)) return refuse(path, `${path}[${index}] is not a valid ${name} entry`);
+        const entry = checkFields(operation, `${path}[${index}].`, field.fields, item as Record<string, unknown>, false);
+        if (!entry.ok) return entry;
+        entries.push(entry.value);
+      }
+      return { ok: true, value: entries };
+    }
+    case 'value': {
+      const { types, maxLength, list } = field;
+      if (isScalar(types, maxLength, value) || (list !== undefined && Array.isArray(value) && value.length >= list.minItems && value.length <= list.maxItems && value.every(item => isScalar(list.types, maxLength, item)))) return { ok: true, value };
+      const shapes = types.map(type => (type === 'string' && maxLength !== undefined ? `a string of at most ${maxLength} characters` : valueNouns[type][0]));
+      if (list !== undefined) shapes.push(`a list of ${list.minItems} to ${list.maxItems} ${either(list.types.map(type => valueNouns[type][1]))}`);
+      return refuse(path, `${path} must be ${either(shapes)}`);
     }
-    out[name] = value;
   }
-  return { ok: true, input: out };
+}
+
+/**
+ * Validates one operation's input against the contract and returns it with the
+ * contract's defaults applied. The message names the field and its allowed
+ * range; it is the sentence the platform answers with, so a caller may show it.
+ */
+export function validateIntegrationExecuteInput(operation: string, input: unknown): IntegrationExecuteInputValidation {
+  const rule = (IntegrationExecuteInputRules as Record<string, IntegrationExecuteOperationRule>)[operation];
+  if (!rule) return refuse('operation', `${operation} is not a declared integration operation`);
+  const raw = input === undefined ? {} : input;
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return refuse('input', 'input must be an object');
+  const checked = checkFields(operation, '', rule.fields, raw as Record<string, unknown>, true);
+  return checked.ok ? { ok: true, input: checked.value } : checked;
 }

package/gen-ts/integration-execute-request.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is fixed by the operation for every operation but slack.message.post, and always enforced from an approved grant; any identity/userId/scope field is rejected by additionalProperties. A slack.message.post runs as the app (the IT-approved per-app name from the grant, plus a "Posted by <app> on Isomorph" footer) or as the signed-in person (no name, no footer) — the same input either way — and since 0.55.0 the call names which of the app's approved modes it runs under (`mode`): required when IT approved both modes for the app (MODE_REQUIRED otherwise), optional when it approved one (that one is used), and a named mode without an approved grant is refused (MODE_NOT_GRANTED) rather than served under the other, so approval order never decides what a post does. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.
+ * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is fixed by the operation for every operation but slack.message.post, and always enforced from an approved grant; any identity/userId/scope field is rejected by additionalProperties. A slack.message.post runs as the app (the IT-approved per-app name from the grant, plus a "Posted by <app> on Isomorph" footer) or as the signed-in person (no name, no footer) — the same input either way — and since 0.55.0 the call names which of the app's approved modes it runs under (`mode`): required when IT approved both modes for the app (MODE_REQUIRED otherwise), optional when it approved one (that one is used), and a named mode without an approved grant is refused (MODE_NOT_GRANTED) rather than served under the other, so approval order never decides what a post does. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns? 1..32, where? 1..16 filters, groupBy? 1..8 columns, aggregates? 1..16, orderBy? 1..8, limit? 1..1000, default 100} (0.70.0: a plain read names columns, an aggregate read names aggregates and optionally groupBy; the cross-field rules — exactly one of columns or aggregates, groupBy needs aggregates, a filter value that fits its op, orderBy naming a returned column, every named column approved — are enforced by governance, not expressible here; ADR 0017). Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.
  */
 export type IntegrationExecuteRequest = {
   /**
@@ -48,12 +48,40 @@ export type IntegrationExecuteRequest = {
      */
     replyToMessageId?: string;
     /**
-     * Explicit columns, or `*` alone when the app's approved resource grant allows all current and future columns.
+     * warehouse.view.read, a plain read: explicit columns, or `*` alone when the app's approved resource grant allows all current and future columns. An aggregate read names aggregates instead.
      *
      * @minItems 1
      * @maxItems 32
      */
     columns?: string[];
+    /**
+     * warehouse.view.read (0.70.0): filters the warehouse applies before it returns, grouping or limits rows. All of them must hold (AND); there is no OR and no LIKE.
+     *
+     * @minItems 1
+     * @maxItems 16
+     */
+    where?: WarehouseFilter[];
+    /**
+     * warehouse.view.read (0.70.0): columns (never `*`) that group the rows; needs aggregates. Each returned row is one group: its groupBy columns, then its aggregate aliases.
+     *
+     * @minItems 1
+     * @maxItems 8
+     */
+    groupBy?: string[];
+    /**
+     * warehouse.view.read (0.70.0): what an aggregate read computes, over each group or over every matching row when there is no groupBy.
+     *
+     * @minItems 1
+     * @maxItems 16
+     */
+    aggregates?: WarehouseAggregate[];
+    /**
+     * warehouse.view.read (0.70.0): sort keys, first key first. Without orderBy an aggregate read is sorted by its groupBy columns and a plain read is not sorted at all.
+     *
+     * @minItems 1
+     * @maxItems 8
+     */
+    orderBy?: WarehouseOrder[];
   };
   /**
    * UUID of one explicit Send action; required for slack.message.post and gmail.message.send only. The same key with the same payload and subject returns the recorded outcome for seven days.
@@ -89,3 +117,54 @@ export type EmailAddressList1 = EmailAddress[];
  * @maxItems 50
  */
 export type EmailAddressList2 = EmailAddress[];
+/**
+ * A filter comparison: = <> > >= < <= IN, NOT IN, IS NULL, IS NOT NULL. Word-like so every value is a valid generated constant.
+ */
+export type WarehouseFilterOp = 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'notIn' | 'isNull' | 'isNotNull';
+/**
+ * An aggregate function.
+ */
+export type WarehouseAggregateFn = 'count' | 'sum' | 'avg' | 'min' | 'max';
+/**
+ * Sort direction; asc when absent.
+ */
+export type WarehouseOrderDirection = 'asc' | 'desc';
+
+/**
+ * One warehouse.view.read filter (0.70.0): <column> <op> <value>. The value is always bound as a query parameter, never written into the SQL. Which value an op takes is a governance rule: isNull/isNotNull take none; in/notIn take a non-empty list of one scalar type; every other op takes one scalar, and a boolean only with eq/ne.
+ */
+export interface WarehouseFilter {
+  /**
+   * The filtered column; never `*`.
+   */
+  column: string;
+  op: WarehouseFilterOp;
+  /**
+   * The value compared with: a string (a date or timestamp is its ISO string), a number, a boolean, or a list of strings or numbers for in/notIn. Never null; use isNull or isNotNull.
+   */
+  value?: string | number | boolean | (string | number)[];
+}
+/**
+ * One computed column of an aggregate warehouse.view.read (0.70.0): fn(column) AS as. `*` is a column only for count (a governance rule). The value follows the read's cell rules, so a 64-bit or decimal result may be a string.
+ */
+export interface WarehouseAggregate {
+  fn: WarehouseAggregateFn;
+  /**
+   * A plain warehouse column identifier, or `*` as the sole selection when IT exposed all current and future columns.
+   */
+  column: string;
+  /**
+   * The name the computed value is returned under; unique in the read and never a groupBy column (governance rules).
+   */
+  as: string;
+}
+/**
+ * One warehouse.view.read sort key (0.70.0). A plain read sorts by a selected column (any column when it selects `*`); an aggregate read sorts by a groupBy column or an aggregate alias (governance rules).
+ */
+export interface WarehouseOrder {
+  /**
+   * A column or an aggregate alias; never `*`.
+   */
+  column: string;
+  direction?: WarehouseOrderDirection;
+}

package/gen-ts/integration-execute-result.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the six operation results: slack.channel.history -> {messages, hasMore} (plain text/IDs/time, plus the display name and emoji icon a per-app-named app post carries — authorName/authorIcon, 0.55.0 — never the provider payload); slack.message.post -> {messageId}; gmail.thread.list -> {threads, hasMore} (newest inbox threads; each `messageId` is the thread's newest message, what gmail.message.read takes); gmail.message.read -> {id, threadId, subject, from, to, date, text, truncated} (headers plus the plain text with html stripped, cut at 16 KiB with `truncated` set); gmail.message.send -> {messageId, threadId} (the Gmail ids of the sent message and its thread); warehouse.view.read -> {rows} (decimal/64-bit values as strings, dates as ISO strings). An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. Results over 1 MiB are rejected, not truncated.
+ * The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the six operation results: slack.channel.history -> {messages, hasMore} (plain text/IDs/time, plus the display name and emoji icon a per-app-named app post carries — authorName/authorIcon, 0.55.0 — never the provider payload); slack.message.post -> {messageId}; gmail.thread.list -> {threads, hasMore} (newest inbox threads; each `messageId` is the thread's newest message, what gmail.message.read takes); gmail.message.read -> {id, threadId, subject, from, to, date, text, truncated} (headers plus the plain text with html stripped, cut at 16 KiB with `truncated` set); gmail.message.send -> {messageId, threadId} (the Gmail ids of the sent message and its thread); warehouse.view.read -> {rows, truncated} (rows keyed by the selected columns, or for an aggregate read by the groupBy columns then the aggregate aliases; decimal/64-bit values as strings, dates as ISO strings; since 0.70.0 every server sends `truncated`, true when more rows matched than `limit` — the server reads limit+1 rows to know — so the rows are incomplete and must not be totalled or averaged; a server before 0.70.0 omitted it). An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. A whole result over 1 MiB is rejected, never cut down to fit.
  */
 export type IntegrationExecuteResult = {
   /**
@@ -22,6 +22,9 @@ export type IntegrationExecuteResult = {
   to?: string;
   date?: string;
   text?: string;
+  /**
+   * gmail.message.read: the text was cut at 16 KiB. warehouse.view.read (0.70.0): more rows matched than the read's limit, so `rows` is incomplete.
+   */
   truncated?: boolean;
   /**
    * @maxItems 1000

package/gen-ts/security-scan-input-v2.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Input to the Security Assurance machine, second shape, replacing security-scan-input.schema.json. V1 scanned a deployed commit located through the deployment state; v2 scans exactly one thing: an uploaded package that governance validated at source intake, identified by the zip sha256 the stager verifies before extraction and by the tree digest governance computed from the unzipped bytes (`sourceDigestOf`, `sha256:`-prefixed), which keys the governance scan record and the check report on the laptop. Commit-mode and ARTIFACT-phase inputs are deliberately absent: the console's later on-demand scan uses this same package path against the deploy upload, and the Transform lane runs the scanner in-process; an image scan, if it returns, is an additive v3. The policy profile is named by the caller when it knows better than the data classification (the kit lane names BASELINE); `profile` and `classification` are mutually exclusive, and both absent still defaults to STANDARD with `classificationDefaulted: true`. Nothing here carries a scanner version: the scanner stamps its own into verdict provenance, and governance decides validity by comparing that against its MINIMUM_SCANNER_VERSION. `org`/`app` are the tenant and app ids for kit apps; `env` stays required because the evidence key carries it (governance passes `preview` for a package scan; promotion never re-scans). The `execution` block names the tenant's execution-account scanner, invoke role and artifacts bucket, resolved by governance the way admission resolves them for the deploy machine.
+ * Input to the Security Assurance machine, second shape, replacing security-scan-input.schema.json. V1 scanned a deployed commit located through the deployment state; v2 scans exactly one thing: an uploaded package that governance validated at source intake, identified by the zip sha256 the stager verifies before extraction and by the tree digest governance computed from the unzipped bytes (`sourceDigestOf`, `sha256:`-prefixed), which keys the governance scan record and the check report on the laptop. Commit-mode and ARTIFACT-phase inputs are deliberately absent: the console's later on-demand scan uses this same package path against the deploy upload, and the Transform lane runs the scanner in-process; an image scan, if it returns, is an additive v3. The caller always names the policy profile (governance names BASELINE for the kit lane); there is no classification input and no default profile. Nothing here carries a scanner version: the scanner stamps its own into verdict provenance, and governance decides validity by comparing that against its MINIMUM_SCANNER_VERSION. `org`/`app` are the tenant and app ids for kit apps; `env` stays required because the evidence key carries it (governance passes `preview` for a package scan; promotion never re-scans). The `execution` block names the tenant's execution-account scanner, invoke role and artifacts bucket, resolved by governance the way admission resolves them for the deploy machine.
  */
 export interface SecurityScanInputV2 {
   schema: 'harbour.security-scan-input/2.0';
@@ -21,13 +21,9 @@ export interface SecurityScanInputV2 {
   package: PackageSource;
   execution: Execution;
   /**
-   * Policy profile named by the caller. Takes the place of deriving one from `classification`; the verdict echoes the profile evaluated and stamps `classificationDefaulted: false`. Governance names BASELINE for kit-lane scans; the default when nothing is named is STANDARD.
+   * Policy profile the machine evaluates the evidence against; the verdict echoes it. Governance names BASELINE for kit-lane scans.
    */
-  profile?: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
-  /**
-   * Data classification, mapped to a profile as in v1 (GREEN → BASELINE, YELLOW → STANDARD, ORANGE → HIGH, RED → CRITICAL). Not allowed beside `profile`. Absent with no `profile` means STANDARD and `classificationDefaulted: true`; an invalid value fails closed.
-   */
-  classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
+  profile: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
 }
 /**
  * The bytes `isomorph secure` (or a later console re-run against a deploy upload) put through source intake.

package/gen-ts/security-verdict.ts

@@ -10,7 +10,7 @@ export interface SecurityVerdict {
    */
   outcome: 'PASS' | 'BLOCKED';
   /**
-   * Policy profile the evidence was evaluated against: the input's `profile` when the caller named one, else derived from the input classification, else STANDARD.
+   * Policy profile the evidence was evaluated against, echoed from the input's `profile`.
    */
   profile: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
   /**
@@ -65,22 +65,28 @@ export interface Finding {
    * Suggested fix, when the tool provides one.
    */
   remediation?: string;
+  dependency?: Dependency;
   /**
-   * Dependency name, for a dependency-sca finding.
+   * Set by policy on every finding it evaluated: true when the finding on its own fires a block rule under the evaluated profile, false when it is reported only.
    */
-  package?: string;
+  blocking?: boolean;
+}
+/**
+ * The dependency a dependency-sca finding is about. Absent on findings that are not about one installed package (secrets, code, a missing lockfile).
+ */
+export interface Dependency {
   /**
-   * Installed version of `package` the vulnerability applies to.
+   * Package name as the lockfile names it.
    */
-  installedVersion?: string;
+  name: string;
   /**
-   * First version of `package` that fixes the vulnerability, when the tool knows one.
+   * Version of the package the app installs, which the vulnerability applies to.
    */
-  fixedVersion?: string;
+  installedVersion: string;
   /**
-   * Set by policy on every finding it evaluated: true when the finding on its own fires a block rule under the evaluated profile, false when it is reported only.
+   * The one version to upgrade to: the lowest fixed release on the installed version's major line, else the lowest fixed release above the installed version. Absent when no fix above the installed version exists.
    */
-  blocking?: boolean;
+  fixedVersion?: string;
 }
 export interface EvidenceRef {
   /**
@@ -116,8 +122,4 @@ export interface Provenance {
    * Orderable release version of the runner image that produced the evidence. Governance compares its numeric core with MINIMUM_SCANNER_VERSION to decide whether a PASS still counts.
    */
   scannerVersion: string;
-  /**
-   * True iff the input named neither a profile nor a classification and the machine assumed STANDARD (decision 2026-08-27). An invalid classification fails closed and never reaches a verdict.
-   */
-  classificationDefaulted: boolean;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.68.0",
+  "version": "0.70.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,