@fourier-labs/harbour-contracts 0.71.0 → 0.73.0

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.71.0.0",
-  "publishVersion": "0.71.0",
-  "publishTag": "v0.71.0",
-  "schemasDigest": "sha256:25c5de2ee9586c6280dca7c733a7063f46bd5d400112fe60f928cf6db1a627c3",
+  "repositoryVersion": "0.73.0.0",
+  "publishVersion": "0.73.0",
+  "publishTag": "v0.73.0",
+  "schemasDigest": "sha256:c0f37c59c7c2decb4fb62d96596b787628483bdcdb09756c3ea286385d31a5f5",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:09bd95f079e733af9bf594a157d7396a645cc6c9866d48b7aee6b00a9762ac62",
-  "generatedTypeScriptDigest": "sha256:7fa5c1e4d8fdb68855b5e10208ee6c0a210f3595f7e74174efbf6bfa4c3673ce",
+  "generatedGoDigest": "sha256:eb98ee80133c91e8562b95d92388c5bb637a06ae8d97a0827f528cd6decde8c9",
+  "generatedTypeScriptDigest": "sha256:ad539efcc9e4a7521f9526dd6304215f6b764be64bd40cd598ec023f6bbb4583",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -31,7 +31,7 @@
     "schema/ai-transform-result.schema.json": "sha256:244e380a36957ab2dcb526ea22aaecb56b53664ce1fda6934d0021c084c99133",
     "schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
     "schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
-    "schema/app-integrations-declaration.schema.json": "sha256:9a8f6e192158c731afed92aeb76b0b6d0734800870a9e6f61181a95d43e6d7f8",
+    "schema/app-integrations-declaration.schema.json": "sha256:2647af515f9291ea02bed363d535f36ac3d0b1cf012466a25937cf4e41c4dedd",
     "schema/artifact-contract.schema.json": "sha256:8047b461a1c6d07bbe867a259c57bdf5cc0fdf282cf842ec7b683a9e93713b10",
     "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/builder-input-proposal.schema.json": "sha256:fe85cffa6d76b1e1effe1f5d75525f8fe0e1eaa3be4a304e491aa23ad72c0e72",
@@ -41,10 +41,10 @@
     "schema/data-source.schema.json": "sha256:899384f4f11b05d2737766918ab47987b11ed49f1160220a55a367fed96f6f2c",
     "schema/deploy-request.schema.json": "sha256:32531e21983cdfeec511f8b4cddd4dad6530cd90e4e9fe147225d78d138b6198",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
-    "schema/deployment-app-registration.schema.json": "sha256:50bc8e308fca14d014a50d96ef1cf403eeeca5c3caea4a204fe15f0080efed32",
+    "schema/deployment-app-registration.schema.json": "sha256:eb705c38466ebd97cb76c1ce7a6177d75c2f10381df75976b40d47eeb8dd5712",
     "schema/deployment-continuation.schema.json": "sha256:55b6945439f2c91cd851dfe4bc9484e67a64091b7763b2d8267354b4a8bfae8c",
     "schema/deployment-environment.schema.json": "sha256:35b26cae07da9ee375a842b5e87c4570c8eca06775e9fd6dd46eb9eb8aa0df6c",
-    "schema/deployment-preview-retirement.schema.json": "sha256:4f945253c3af015f31d6857ec13661f2239e87f2b9dc76cc0a5109d6d40f2a1a",
+    "schema/deployment-preview-retirement.schema.json": "sha256:ccf6b971b7853ca98530272f280fe62cd3aab5425b10b81ae6b717cc949e014f",
     "schema/deployment-source.schema.json": "sha256:256988b1efbfc90bd0e1ae31a2c5d69b20ef1e4471dc24c9f9aa759278270fbe",
     "schema/deployment-status-failure.schema.json": "sha256:7cc021d53a07c63b66eb48146d33e8875b64faf77ee927b235795469eb9a1559",
     "schema/deployment-status-request.schema.json": "sha256:1f9f87adc947a252b53b61f71ae17f8c1b8fbc1166f31301a043d11ac257dc66",
@@ -54,8 +54,8 @@
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
     "schema/integration-connect-result.schema.json": "sha256:3f254b67ef739dc1fa395bdc8c4dc93359b16d481dba2a2d777aa5b6f34b7af8",
     "schema/integration-error-details.schema.json": "sha256:47ad7621c34b092c7e40f912a21e7ccbdc000b974cfb7fa0c9200463e029f8fb",
-    "schema/integration-execute-request.schema.json": "sha256:2865c54564aa21eaf22f017312f42ef0cf77fc26c223ddd3e9de86062ed37156",
-    "schema/integration-execute-result.schema.json": "sha256:97f345cfc094a7af1d269486f3b3b90c07d13b70954c2b01dc0313225c9e5bd1",
+    "schema/integration-execute-request.schema.json": "sha256:03b462a721dbd41f0591922d84e66b6074d36947338240d4f548eb0179d11ac7",
+    "schema/integration-execute-result.schema.json": "sha256:3097b25f93234bc19872fa2081be0e3df1600c375106bd8b013533aea8deb95e",
     "schema/internal-configuration-request.schema.json": "sha256:229d44a3458f68dceddfba802e5c1adcd95523a45af29b93b972706b88461a7d",
     "schema/kit-bundle-manifest.schema.json": "sha256:4a9fcdd52ba0d55718ef4dbdab112b145ef90471d9356d4d3fb41e50fe9e400d",
     "schema/kit-lock.schema.json": "sha256:a48154d9471e49a893d928f7b0e1e0bc77708a4a7edce4fdf14073203e0e8987",
@@ -63,7 +63,7 @@
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
     "schema/resolved-app-serving.schema.json": "sha256:260e30ca16831ddd96b15f44eadc7daa2a5f87a0025588bd6318b236f349ec6b",
-    "schema/saas-connection.schema.json": "sha256:91ea0e7b1bf503962fba7aea4672bcaba5be70c2a91f4f5fbafe9e93460d5002",
+    "schema/saas-connection.schema.json": "sha256:6720b906b89293eebd8c5a6cb8ac6bc14dfca9b13d822e3026641f935b637892",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
     "schema/security-scan-input-v2.schema.json": "sha256:0d418342078c9b5046ea6f4bef3c2c57539285dfee99cc0850d4f0d03739ee13",
@@ -109,10 +109,11 @@
     "gen-go/contracts_test.go": "sha256:56376287cb1548be1b35ab4c65d6f0b558c5d34885f7a47cb3d9e8d786607bf5",
     "gen-go/doc.go": "sha256:316d610ce568597a2ce6f38e9782e34fa5920f6f51ab0866e6d061b8a41cd822",
     "gen-go/error_category.go": "sha256:b2ddea22dcfa030f1a45e721e635485b0bd816cf1f38e7654628a653f5ed4583",
-    "gen-go/integration_execute_input_rules.go": "sha256:0293686700684419c8aae3d78c85b27825b9fc3429b013c5a84a6378c4e3f778",
-    "gen-go/integration_execute_input_rules_test.go": "sha256:9d81e4aac0c3d7f35ea98a40c6d8851570f715ddc95d1ae7324cdc095de4a72e",
+    "gen-go/integration_execute_input_rules.go": "sha256:f319996ec5ec3df38f357a84901680df15f80e982a3cbaec4956b3ef1f13548b",
+    "gen-go/integration_execute_input_rules_test.go": "sha256:17830fe9bc76d55d95e4e1959363c35ac595064972ac5c6eea3c2fae1efcaff9",
+    "gen-go/integration_operations.go": "sha256:e2871c9df4c07068753256f0549aebe1ca6009495cdef8dab1168efd2894b77c",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:4a301cf02eb10f4f666e4358b0c7054aed742ec924a1e4f9420c58ff7b8f0c88",
+    "gen-go/types.go": "sha256:5c18e15a00dc7e7e0296cf7a6afefb24a93d828aca3b019f95b8256dea5754f6",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -137,21 +138,21 @@
     "gen-ts/ai-transform-result.ts": "sha256:208c66b2aeb425c0cbcc18b7191f6e8989443f2b2c1690648e0e06cc1448ce25",
     "gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
     "gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
-    "gen-ts/app-integrations-declaration.ts": "sha256:c522e5139d8ee454b7cfa2399802e2101de3b3932273106f51f7cf4e26bbb7fb",
+    "gen-ts/app-integrations-declaration.ts": "sha256:18c495f22f4501e8f425688f5294cc7e2bba48bc6c7faba7e35d169da540f77b",
     "gen-ts/artifact-contract.ts": "sha256:4a6dc6d2caaeed4bb2066cc8a333e6e09e5a0d4745e0b1038293d54ab9403aeb",
     "gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
     "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
     "gen-ts/builder-input-proposal.ts": "sha256:b0108c3787873d3cf1a39f00967379418a6766275d3474cfa55f5a9d93ead174",
     "gen-ts/data-dependency.ts": "sha256:259f19e2759395d72ead90b8ed74a6dcef0c2641124f4f182823138cfd19bedf",
-    "gen-ts/data-grant-v2.ts": "sha256:7ae2df78f14a76712bcab42d35ce5cf8509b317feb4d67f9a1da6bd13cc5dc2b",
+    "gen-ts/data-grant-v2.ts": "sha256:cce15e51813fd693850391f12602a4436d869c75fc286b24cca539cfc5e27789",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
     "gen-ts/data-source.ts": "sha256:1a40c252e94ee717d287ba63647e4368668dad9ea731770f8b58deb17d18b311",
     "gen-ts/deploy-request.ts": "sha256:0214faa8be6680f0bfc117d5ce67c1a59fcc18bd0ea4bc840e03e7d051fa9ab6",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
-    "gen-ts/deployment-app-registration.ts": "sha256:07f840a82dddd770e54e1020a034cdbfc84e226a94131e3f5a4cdd5da8acc2f0",
+    "gen-ts/deployment-app-registration.ts": "sha256:642db3a3f796e5d7089cdb834991277ab1aac5bff37cd5cab42aa2f1c116f0be",
     "gen-ts/deployment-continuation.ts": "sha256:cc9f63af4d0da5086a79103789e4f043783b75b4ed11c6512f044439a551a79c",
     "gen-ts/deployment-environment.ts": "sha256:fc08cabe2e52ebb93cfe84d2019994260f71734c33d0e50e7c63e40ef5b17cef",
-    "gen-ts/deployment-preview-retirement.ts": "sha256:0b30339d6f1d14a9d4a14fa4b59c4c476a5d8aa534be71f7d750c677bb9a2d44",
+    "gen-ts/deployment-preview-retirement.ts": "sha256:309421d08daf0ade163b6457ed0e5410ec6573c40a59423a6cce14780d9c38db",
     "gen-ts/deployment-source.ts": "sha256:8ccb55aaa7260eb6d19a00987d6a20a4b514e343564da13f27cd7fee8013500a",
     "gen-ts/deployment-status-failure.ts": "sha256:6da2e6eb2f708efa51d416a1ec50f71ea7967cf9be9f93e7ce2e4760dae2cfe3",
     "gen-ts/deployment-status-request.ts": "sha256:7ddccd07ab9f6d0821903a291ab35f903bb055727e03a058b99165ec048f6483",
@@ -160,12 +161,13 @@
     "gen-ts/error-category-registry.ts": "sha256:7466a502c0723a77db825cdeaa9556a244201b55d9b7acbf2c098e9e84351df1",
     "gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
-    "gen-ts/index.ts": "sha256:8459b1cf136a0c822795154e2df2a28c848cddfadced329604be893ae6eef069",
+    "gen-ts/index.ts": "sha256:57927b9fcddf506785671bbd44cced9f729373e4dd3e3480bc6c37fd05fb59e8",
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
     "gen-ts/integration-error-details.ts": "sha256:ad7ecec9dd4533a6e86b3508886a7d69937052f52105497285797f77106bcc6f",
-    "gen-ts/integration-execute-input-rules.ts": "sha256:3304b0fd14df331a164a035410de9b10885be6585077add4720da39b5d16d527",
-    "gen-ts/integration-execute-request.ts": "sha256:92ee799c42e5434229cb72198382352dabc469a2be551ef5c1926ed5ada45619",
-    "gen-ts/integration-execute-result.ts": "sha256:d72ca736d06741552e6a7be6c98fe1ae506ddaa1e58938b785303fdc3e1784ac",
+    "gen-ts/integration-execute-input-rules.ts": "sha256:1127c321720cb9bde63a6d20dadd177c923fef1c8c8f37e0b106a2488fe079de",
+    "gen-ts/integration-execute-request.ts": "sha256:c9904987f61b006ebcc7d8500ec255e7bd7fc1ae0f98f23cf3a096a4273e3d42",
+    "gen-ts/integration-execute-result.ts": "sha256:f82de8f2e36bac732e015cecd7454a7cecd6ea5cf09b6efd119e252990a47c92",
+    "gen-ts/integration-operations.ts": "sha256:f4ddc2dc5776557d20dbf92a1e20cec63198c7d008426773c2e0fc3f509cd460",
     "gen-ts/internal-configuration-request.ts": "sha256:7032437797473fa1c581d134adef2f3d4b4f4132f482cd17743e9d47097886bc",
     "gen-ts/kit-bundle-manifest.ts": "sha256:2777a268aef8787b81e71d154a7d05f6f5ded09d66f378211ff5493ddb885171",
     "gen-ts/kit-lock.ts": "sha256:00ceeb97e9b7d0187bec00728f5099fd34e775e9cc44c85c4714f7a3a4118ef6",
@@ -173,7 +175,7 @@
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
     "gen-ts/resolved-app-serving.ts": "sha256:6131a6cc5f784f0d101081d2ce1b96b76b2f904b2c5e7b2809f9ede5878ada1f",
-    "gen-ts/saas-connection.ts": "sha256:b1ad7d3694806b429f10daf7440d0dbdfbb78d4022044da2324189ca59b1f737",
+    "gen-ts/saas-connection.ts": "sha256:807554f7e4bd3629fff4d05778e56b71096ba70a6dda9e1645ebdc8c40a5d3a8",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",

package/dist/gen-ts/app-integrations-declaration.d.ts

@@ -1,4 +1,23 @@
-export type IntegrationConnectionKind = 'saas' | 'database';
+export type DeclaredConnection = {
+    kind: IntegrationConnectionKind;
+    presentation?: IntegrationPresentation;
+    operations: {
+        'slack.channel.history'?: DeclaredModeChannelOperation;
+        'slack.message.post'?: DeclaredModeChannelOperation;
+        'slack.message.update'?: DeclaredModeChannelOperation;
+        'slack.message.delete'?: DeclaredModeChannelOperation;
+        'slack.dm.send'?: AppModeChannelOperation;
+        'slack.user.lookup'?: AppModeChannelOperation;
+        'gmail.thread.list'?: UserModeChannelOperation;
+        'gmail.thread.read'?: UserModeChannelOperation;
+        'gmail.message.read'?: UserModeChannelOperation;
+        'gmail.message.send'?: UserModeChannelOperation;
+        'gmail.attachment.read'?: UserModeChannelOperation;
+        'warehouse.view.read'?: AppModeViewOperation;
+        'service.request'?: ServiceOperation;
+    };
+};
+export type IntegrationConnectionKind = 'saas' | 'database' | 'service';
 /**
  * Whose authority an operation runs under. Fixed per operation, except the declared-mode Slack operations (slack.message.post; since 0.71.0 also slack.channel.history, slack.message.update, slack.message.delete): declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
  */
@@ -17,7 +36,7 @@ export type ResourceNames = IntegrationAlias[];
  */
 export type ColumnName = string;
 /**
- * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (twelve operations since 0.71.0, ADR 0018). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, warehouse.view.read=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
+ * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (thirteen operations since 0.73.0, ADR 0018). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, warehouse.view.read=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
  */
 export interface AppIntegrationsDeclaration {
     schema: 'isomorph.app-integrations/2.0';
@@ -25,24 +44,6 @@ export interface AppIntegrationsDeclaration {
         [k: string]: DeclaredConnection;
     };
 }
-export interface DeclaredConnection {
-    kind: IntegrationConnectionKind;
-    presentation?: IntegrationPresentation;
-    operations: {
-        'slack.channel.history'?: DeclaredModeChannelOperation;
-        'slack.message.post'?: DeclaredModeChannelOperation;
-        'slack.message.update'?: DeclaredModeChannelOperation;
-        'slack.message.delete'?: DeclaredModeChannelOperation;
-        'slack.dm.send'?: AppModeChannelOperation;
-        'slack.user.lookup'?: AppModeChannelOperation;
-        'gmail.thread.list'?: UserModeChannelOperation;
-        'gmail.thread.read'?: UserModeChannelOperation;
-        'gmail.message.read'?: UserModeChannelOperation;
-        'gmail.message.send'?: UserModeChannelOperation;
-        'gmail.attachment.read'?: UserModeChannelOperation;
-        'warehouse.view.read'?: AppModeViewOperation;
-    };
-}
 /**
  * saas connections only (Slack): how this app's app-mode posts are presented; meaningless for every other operation.
  */
@@ -87,3 +88,11 @@ export interface ViewResource {
      */
     columns: ColumnName[];
 }
+export interface ServiceOperation {
+    identity: 'app';
+    /**
+     * @minItems 1
+     * @maxItems 1
+     */
+    resources: 'api'[];
+}

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.71.0.0";
-export declare const ContractPublishVersion: "0.71.0";
-export declare const ContractPublishTag: "v0.71.0";
-export declare const ContractSchemasDigest: "sha256:25c5de2ee9586c6280dca7c733a7063f46bd5d400112fe60f928cf6db1a627c3";
+export declare const ContractRepositoryVersion: "0.73.0.0";
+export declare const ContractPublishVersion: "0.73.0";
+export declare const ContractPublishTag: "v0.73.0";
+export declare const ContractSchemasDigest: "sha256:c0f37c59c7c2decb4fb62d96596b787628483bdcdb09756c3ea286385d31a5f5";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:09bd95f079e733af9bf594a157d7396a645cc6c9866d48b7aee6b00a9762ac62";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:7fa5c1e4d8fdb68855b5e10208ee6c0a210f3595f7e74174efbf6bfa4c3673ce";
+export declare const ContractGeneratedGoDigest: "sha256:eb98ee80133c91e8562b95d92388c5bb637a06ae8d97a0827f528cd6decde8c9";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:ad539efcc9e4a7521f9526dd6304215f6b764be64bd40cd598ec023f6bbb4583";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.71.0.0";
-export const ContractPublishVersion = "0.71.0";
-export const ContractPublishTag = "v0.71.0";
-export const ContractSchemasDigest = "sha256:25c5de2ee9586c6280dca7c733a7063f46bd5d400112fe60f928cf6db1a627c3";
+export const ContractRepositoryVersion = "0.73.0.0";
+export const ContractPublishVersion = "0.73.0";
+export const ContractPublishTag = "v0.73.0";
+export const ContractSchemasDigest = "sha256:c0f37c59c7c2decb4fb62d96596b787628483bdcdb09756c3ea286385d31a5f5";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:09bd95f079e733af9bf594a157d7396a645cc6c9866d48b7aee6b00a9762ac62";
-export const ContractGeneratedTypeScriptDigest = "sha256:7fa5c1e4d8fdb68855b5e10208ee6c0a210f3595f7e74174efbf6bfa4c3673ce";
+export const ContractGeneratedGoDigest = "sha256:eb98ee80133c91e8562b95d92388c5bb637a06ae8d97a0827f528cd6decde8c9";
+export const ContractGeneratedTypeScriptDigest = "sha256:ad539efcc9e4a7521f9526dd6304215f6b764be64bd40cd598ec023f6bbb4583";

package/dist/gen-ts/data-grant-v2.d.ts

@@ -26,14 +26,14 @@ export interface DataGrantV2 {
      * Whose authority an operation runs under. Fixed per operation, except the declared-mode Slack operations (slack.message.post; since 0.71.0 also slack.channel.history, slack.message.update, slack.message.delete): declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
      */
     mode: 'app' | 'user';
-    kind: 'saas' | 'database';
+    kind: 'saas' | 'database' | 'service';
     status: DataGrantV2Status;
     /**
      * Approved operations; each must match this grant's mode. Empty until the first approval. At most the eleven SaaS operations (0.71.0); a database grant holds one.
      *
      * @maxItems 11
      */
-    operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'warehouse.view.read')[];
+    operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'warehouse.view.read' | 'service.request')[];
     /**
      * Approved logical resources. Never inherited by wildcard. Empty until the first approval.
      *

package/dist/gen-ts/deployment-app-registration.d.ts

@@ -1,5 +1,5 @@
 /**
- * IAM/SigV4 POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
+ * IAM/SigV4 POST /v1/internal/deployment/apps/{appId}/register (Internal API) or POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
  */
 export interface DeploymentAppRegistration {
     tenantId: string;

package/dist/gen-ts/deployment-preview-retirement.d.ts

@@ -1,5 +1,5 @@
 /**
- * IAM-protected POST /v1/deployment/apps/retire-preview request after production is LIVE and the deployment plane holds the preview retirement reservation. Disables only the registered preview version's serving routes and workload authority.
+ * IAM-protected POST /v1/internal/deployment/apps/{appId}/retire-preview (Internal API) or POST /v1/deployment/apps/retire-preview request after production is LIVE and the deployment plane holds the preview retirement reservation. Disables only the registered preview version's serving routes and workload authority.
  */
 export interface DeploymentPreviewRetirement {
     tenantId: string;

package/dist/gen-ts/index.d.ts

@@ -48,6 +48,7 @@ export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';
 export * from './integration-execute-request.js';
 export * from './integration-execute-result.js';
+export * from './integration-operations.js';
 export * from './internal-configuration-request.js';
 export * from './kit-bundle-manifest.js';
 export * from './kit-lock.js';

package/dist/gen-ts/index.js

@@ -50,6 +50,7 @@ export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';
 export * from './integration-execute-request.js';
 export * from './integration-execute-result.js';
+export * from './integration-operations.js';
 export * from './internal-configuration-request.js';
 export * from './kit-bundle-manifest.js';
 export * from './kit-lock.js';

package/dist/gen-ts/integration-execute-input-rules.d.ts

@@ -6,6 +6,9 @@
  * same message wherever it is made.
  */
 export type IntegrationExecuteInputFieldRule = {
+    kind: 'object';
+    required: boolean;
+} | {
     kind: 'integer';
     required: boolean;
     minimum: number;
@@ -461,6 +464,38 @@ export declare const IntegrationExecuteInputRules: {
             };
         };
     };
+    readonly "service.request": {
+        readonly idempotencyKey: false;
+        readonly fields: {
+            readonly method: {
+                readonly kind: "enum";
+                readonly required: true;
+                readonly values: readonly ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
+            };
+            readonly path: {
+                readonly kind: "string";
+                readonly required: true;
+                readonly minLength: 0;
+                readonly maxLength: 16384;
+            };
+            readonly pathParams: {
+                readonly kind: "object";
+                readonly required: false;
+            };
+            readonly query: {
+                readonly kind: "object";
+                readonly required: false;
+            };
+            readonly headers: {
+                readonly kind: "object";
+                readonly required: false;
+            };
+            readonly body: {
+                readonly kind: "object";
+                readonly required: false;
+            };
+        };
+    };
 };
 export type IntegrationExecuteOperation = keyof typeof IntegrationExecuteInputRules;
 /** The upper bound of one integer input as a literal type: integrationExecuteInputMaximum('slack.channel.history', 'limit') is 15. */

package/dist/gen-ts/integration-execute-input-rules.js

@@ -113,6 +113,17 @@ export const IntegrationExecuteInputRules = {
             limit: { kind: "integer", required: false, minimum: 1, maximum: 1000, default: 100 },
         },
     },
+    "service.request": {
+        idempotencyKey: false,
+        fields: {
+            method: { kind: "enum", required: true, values: ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"] },
+            path: { kind: "string", required: true, minLength: 0, maxLength: 16384 },
+            pathParams: { kind: "object", required: false },
+            query: { kind: "object", required: false },
+            headers: { kind: "object", required: false },
+            body: { kind: "object", required: false },
+        },
+    },
 };
 /** The upper bound of one integer input as a literal type: integrationExecuteInputMaximum('slack.channel.history', 'limit') is 15. */
 export function integrationExecuteInputMaximum(operation, field) {
@@ -173,6 +184,10 @@ function checkFields(operation, prefix, fields, given, nullIsAbsent) {
 }
 function checkField(operation, path, name, field, value) {
     switch (field.kind) {
+        case 'object':
+            if (value === null || typeof value !== 'object' || Array.isArray(value))
+                return refuse(path, `${path} must be a JSON object`);
+            return { ok: true, value };
         case 'integer':
             if (typeof value !== 'number' || !Number.isInteger(value) || value < field.minimum || value > field.maximum)
                 return refuse(path, `${path} must be an integer between ${field.minimum} and ${field.maximum}`);

package/dist/gen-ts/integration-execute-request.d.ts

@@ -9,11 +9,11 @@ export type IntegrationExecuteRequest = {
     /**
      * Closed operation set. Extending it is a contracts change. gmail.message.send (0.50.0) sends one email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity; since 0.71.0 it may carry an HTML body and attachments. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent); since 0.55.0 each call names which of the approved modes it runs under. 0.71.0 (ADR 0018) adds slack.message.update and slack.message.delete (declared mode, like post), slack.dm.send (app mode: a direct message to 1..8 workspace members named by email), slack.user.lookup (app mode: email to Slack user id), gmail.thread.read (every message of one thread) and gmail.attachment.read (one attachment's bytes), and lets slack.channel.history run in app mode as well as user mode.
      */
-    operation: 'slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'warehouse.view.read';
+    operation: 'slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'warehouse.view.read' | 'service.request';
     /**
      * Tenant-wide logical alias of a connection (governance sourceId) or of a resource under it.
      */
-    resource: string;
+    resource?: string;
     input: {
         /**
          * Read operations: how many items to return; the per-operation then-block sets the real ceiling (100 for slack.channel.history, 50 for gmail.thread.list, 1000 for warehouse.view.read) and the default.
@@ -127,6 +127,20 @@ export type IntegrationExecuteRequest = {
          * @maxItems 8
          */
         orderBy?: WarehouseOrder[];
+        method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
+        path?: string;
+        pathParams?: {
+            [k: string]: unknown;
+        };
+        query?: {
+            [k: string]: unknown;
+        };
+        headers?: {
+            [k: string]: unknown;
+        };
+        body?: {
+            [k: string]: unknown;
+        };
     };
     /**
      * UUID of one explicit Send action; required for slack.message.post and gmail.message.send only. The same key with the same payload and subject returns the recorded outcome for seven days.

package/dist/gen-ts/integration-execute-result.d.ts

@@ -71,6 +71,11 @@ export type IntegrationExecuteResult = {
     rows?: {
         [k: string]: unknown;
     }[];
+    status?: number;
+    headers?: {
+        [k: string]: string;
+    };
+    body?: unknown;
 };
 export interface ChannelMessage {
     id: string;

package/dist/gen-ts/integration-operations.d.ts

@@ -0,0 +1,94 @@
+/** Declaration and execute metadata from the contract schemas. */
+export declare const IntegrationOperations: {
+    readonly "slack.channel.history": {
+        readonly kind: "saas";
+        readonly identities: readonly ["user", "app"];
+        readonly readOnly: true;
+        readonly declaredMode: true;
+        readonly idempotencyKey: false;
+    };
+    readonly "slack.message.post": {
+        readonly kind: "saas";
+        readonly identities: readonly ["app", "user"];
+        readonly readOnly: false;
+        readonly declaredMode: true;
+        readonly idempotencyKey: true;
+    };
+    readonly "slack.message.update": {
+        readonly kind: "saas";
+        readonly identities: readonly ["app", "user"];
+        readonly readOnly: false;
+        readonly declaredMode: true;
+        readonly idempotencyKey: false;
+    };
+    readonly "slack.message.delete": {
+        readonly kind: "saas";
+        readonly identities: readonly ["app", "user"];
+        readonly readOnly: false;
+        readonly declaredMode: true;
+        readonly idempotencyKey: false;
+    };
+    readonly "slack.dm.send": {
+        readonly kind: "saas";
+        readonly identities: readonly ["app"];
+        readonly readOnly: false;
+        readonly declaredMode: false;
+        readonly idempotencyKey: true;
+    };
+    readonly "slack.user.lookup": {
+        readonly kind: "saas";
+        readonly identities: readonly ["app"];
+        readonly readOnly: true;
+        readonly declaredMode: false;
+        readonly idempotencyKey: false;
+    };
+    readonly "gmail.thread.list": {
+        readonly kind: "saas";
+        readonly identities: readonly ["user"];
+        readonly readOnly: true;
+        readonly declaredMode: false;
+        readonly idempotencyKey: false;
+    };
+    readonly "gmail.thread.read": {
+        readonly kind: "saas";
+        readonly identities: readonly ["user"];
+        readonly readOnly: true;
+        readonly declaredMode: false;
+        readonly idempotencyKey: false;
+    };
+    readonly "gmail.message.read": {
+        readonly kind: "saas";
+        readonly identities: readonly ["user"];
+        readonly readOnly: true;
+        readonly declaredMode: false;
+        readonly idempotencyKey: false;
+    };
+    readonly "gmail.message.send": {
+        readonly kind: "saas";
+        readonly identities: readonly ["user"];
+        readonly readOnly: false;
+        readonly declaredMode: false;
+        readonly idempotencyKey: true;
+    };
+    readonly "gmail.attachment.read": {
+        readonly kind: "saas";
+        readonly identities: readonly ["user"];
+        readonly readOnly: true;
+        readonly declaredMode: false;
+        readonly idempotencyKey: false;
+    };
+    readonly "warehouse.view.read": {
+        readonly kind: "database";
+        readonly identities: readonly ["app"];
+        readonly readOnly: true;
+        readonly declaredMode: false;
+        readonly idempotencyKey: false;
+    };
+    readonly "service.request": {
+        readonly kind: "service";
+        readonly identities: readonly ["app"];
+        readonly readOnly: false;
+        readonly declaredMode: false;
+        readonly idempotencyKey: false;
+    };
+};