@fourier-labs/harbour-contracts 0.73.0 → 0.74.0

package/README.md

@@ -39,7 +39,7 @@ exist here first.
 | `sanitized-binding-evidence.schema.json` | Exact-version sanitized runtime-binding allocation receipt | AI governance §5.7 / SEC-UP-02 |
 | `ai-pricing-revision`, `ai-metering-policy`, `ai-budget-ledger-event`, `ai-trace-event-v2` | Additive metering v2 records, including media dimensions and P5 trace attribution; v1 records remain readable | AI governance §9 |
 | `app-integrations-declaration.schema.json` | Committed `.isomorph/integrations.json` (`isomorph.app-integrations/2.0`): closed twelve-operation set (Slack read/post/update/delete/DM/lookup, Gmail list/thread/read/send/attachment, warehouse view read — ADR 0018) with fixed or declared identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
-| `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds (a warehouse read filters, groups, aggregates and sorts in the warehouse and says when it was `truncated` — ADR 0017; Slack and Gmail reads page, posts thread, mail carries HTML and attachments — ADR 0018), the per-operation result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
+| `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds (a warehouse read filters, groups, aggregates and sorts in the warehouse and says when it was `truncated` — ADR 0017; Slack and Gmail reads page, posts thread, mail carries HTML and attachments — ADR 0018; a development warehouse read may carry the app's `sampleRows` and the result says `sample` — ADR 0021), the per-operation result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
 | `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider; IT's optional `oauthClient`, `userModeApproval`, `directMessages`, `externalRecipients` — ADR 0018) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
 | `kit-bundle-manifest.schema.json`, `kit-lock.schema.json` | Published kit bundle identity (SDK tarball digest plus optional `sdk.version` and https `sdk.url` download location) and the committed `.isomorph/kit.lock.json` the CodeBuild SDK-vendoring gate compares against | Dev kit §3 |
 | `deploy-response.schema.json` | 202 Accepted body for `POST /v1/tenants/{tenant}/apps/{app}/deployments`, returned only after the authoritative QUEUED version exists and its SQS message is accepted | — |
@@ -57,7 +57,7 @@ exist here first.
 | `deployment-continuation.schema.json` | Immutable reference admitting one child deployment from a parked input request; never credential values | — |
 | `security-scan-input-v2.schema.json` | Input to the Security Assurance machine (`harbour.security-scan-input/2.0`, replaces v1): one package validated at source intake, scanned in the tenant's execution account | ADR 0014 |
 | `security-verdict.schema.json` | Security Assurance decision; `BLOCKED` surfaces as the non-retryable `gate.security-scan` category | ADR 0014 |
-| `data-source.schema.json` | Admin-registered external data source; `credentialRef` is a secretref URI and the credential never crosses this boundary | Data-Access MVP |
+| `data-source.schema.json` | Admin-registered external data source; `credentialRef` is a secretref URI and the credential never crosses this boundary; optional `development`/`preview` copies under `environments`, production is the top-level endpoint; connectors include `trino` (ADR 0021) | Data-Access MVP |
 | `data-dependency.schema.json` | One external data dependency of an app, declared or detected, classified against the tenant's data-source inventory | Data-Access MVP |
 | `secret-reference.schema.json` | Named secret slot an app depends on; only the reference and its lifecycle cross, never the value | Secret-Manager MVP |
 | `ai-callsite-inventory.schema.json` | Immutable, sanitized AI call-site discovery for one exact deployment version (detection only) | AI governance |

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.73.0.0",
-  "publishVersion": "0.73.0",
-  "publishTag": "v0.73.0",
-  "schemasDigest": "sha256:c0f37c59c7c2decb4fb62d96596b787628483bdcdb09756c3ea286385d31a5f5",
+  "repositoryVersion": "0.74.0.0",
+  "publishVersion": "0.74.0",
+  "publishTag": "v0.74.0",
+  "schemasDigest": "sha256:340d7f930a6cea6292f6ec20a02ca37ed5b78b42f4f4ec6e4c15057b44c6c3ff",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:eb98ee80133c91e8562b95d92388c5bb637a06ae8d97a0827f528cd6decde8c9",
-  "generatedTypeScriptDigest": "sha256:ad539efcc9e4a7521f9526dd6304215f6b764be64bd40cd598ec023f6bbb4583",
+  "generatedGoDigest": "sha256:639a4832d8301e197caefe8d9b0fb2bd21cf20f9b580861a04bdce8d5411624a",
+  "generatedTypeScriptDigest": "sha256:ab6a5dd30f09a9604d34f5a994fb8a3491a092d1fb77232b1165e02a5e217939",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -38,7 +38,7 @@
     "schema/data-dependency.schema.json": "sha256:b4cc2b2484e982cfed64c0f56b8f1e9d1363c71854cd71f845b24fbe7d85c971",
     "schema/data-grant-v2.schema.json": "sha256:576db6f17bbd3c6d700628bb5b93dcb4ade536ab868085634d05ff06476b6272",
     "schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
-    "schema/data-source.schema.json": "sha256:899384f4f11b05d2737766918ab47987b11ed49f1160220a55a367fed96f6f2c",
+    "schema/data-source.schema.json": "sha256:46ef4ace5fce612fce055813bf4f99956423b46c929993fbbc5dfec497087bad",
     "schema/deploy-request.schema.json": "sha256:32531e21983cdfeec511f8b4cddd4dad6530cd90e4e9fe147225d78d138b6198",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
     "schema/deployment-app-registration.schema.json": "sha256:eb705c38466ebd97cb76c1ce7a6177d75c2f10381df75976b40d47eeb8dd5712",
@@ -53,9 +53,9 @@
     "schema/error-category.enum.json": "sha256:d6d83000c3357805b13138d717c411248c14f1c0fde1c02e82a25691de85d68d",
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
     "schema/integration-connect-result.schema.json": "sha256:3f254b67ef739dc1fa395bdc8c4dc93359b16d481dba2a2d777aa5b6f34b7af8",
-    "schema/integration-error-details.schema.json": "sha256:47ad7621c34b092c7e40f912a21e7ccbdc000b974cfb7fa0c9200463e029f8fb",
-    "schema/integration-execute-request.schema.json": "sha256:03b462a721dbd41f0591922d84e66b6074d36947338240d4f548eb0179d11ac7",
-    "schema/integration-execute-result.schema.json": "sha256:3097b25f93234bc19872fa2081be0e3df1600c375106bd8b013533aea8deb95e",
+    "schema/integration-error-details.schema.json": "sha256:5a290584b1542b2b8cdd4966869126180ce29c1f0dd250dca7fb68c05e76b8e9",
+    "schema/integration-execute-request.schema.json": "sha256:601b5a72a99bdfb8e7b1ee0948bdda4bd1d3d694c66bb013431e927cddebfa58",
+    "schema/integration-execute-result.schema.json": "sha256:1b625e69a805b5b9e2a99ed9c60699372ab09793874bb98149f43b6d3ba11947",
     "schema/internal-configuration-request.schema.json": "sha256:229d44a3458f68dceddfba802e5c1adcd95523a45af29b93b972706b88461a7d",
     "schema/kit-bundle-manifest.schema.json": "sha256:4a9fcdd52ba0d55718ef4dbdab112b145ef90471d9356d4d3fb41e50fe9e400d",
     "schema/kit-lock.schema.json": "sha256:a48154d9471e49a893d928f7b0e1e0bc77708a4a7edce4fdf14073203e0e8987",
@@ -113,7 +113,7 @@
     "gen-go/integration_execute_input_rules_test.go": "sha256:17830fe9bc76d55d95e4e1959363c35ac595064972ac5c6eea3c2fae1efcaff9",
     "gen-go/integration_operations.go": "sha256:e2871c9df4c07068753256f0549aebe1ca6009495cdef8dab1168efd2894b77c",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:5c18e15a00dc7e7e0296cf7a6afefb24a93d828aca3b019f95b8256dea5754f6",
+    "gen-go/types.go": "sha256:01f7a573b1e0ca4366ec3dc1bf74ff6fc7d66274dec5ffb36c0332251188d4cc",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -146,7 +146,7 @@
     "gen-ts/data-dependency.ts": "sha256:259f19e2759395d72ead90b8ed74a6dcef0c2641124f4f182823138cfd19bedf",
     "gen-ts/data-grant-v2.ts": "sha256:cce15e51813fd693850391f12602a4436d869c75fc286b24cca539cfc5e27789",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
-    "gen-ts/data-source.ts": "sha256:1a40c252e94ee717d287ba63647e4368668dad9ea731770f8b58deb17d18b311",
+    "gen-ts/data-source.ts": "sha256:f30d4c14c15afbb9530d30af9235844198765984ce1579fa25961d7f07bcfb1f",
     "gen-ts/deploy-request.ts": "sha256:0214faa8be6680f0bfc117d5ce67c1a59fcc18bd0ea4bc840e03e7d051fa9ab6",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
     "gen-ts/deployment-app-registration.ts": "sha256:642db3a3f796e5d7089cdb834991277ab1aac5bff37cd5cab42aa2f1c116f0be",
@@ -163,10 +163,10 @@
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
     "gen-ts/index.ts": "sha256:57927b9fcddf506785671bbd44cced9f729373e4dd3e3480bc6c37fd05fb59e8",
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
-    "gen-ts/integration-error-details.ts": "sha256:ad7ecec9dd4533a6e86b3508886a7d69937052f52105497285797f77106bcc6f",
+    "gen-ts/integration-error-details.ts": "sha256:e73cb5942373ef88b2d8e03a1de56d5a69e71069ecd14e68396f7edba1f60780",
     "gen-ts/integration-execute-input-rules.ts": "sha256:1127c321720cb9bde63a6d20dadd177c923fef1c8c8f37e0b106a2488fe079de",
-    "gen-ts/integration-execute-request.ts": "sha256:c9904987f61b006ebcc7d8500ec255e7bd7fc1ae0f98f23cf3a096a4273e3d42",
-    "gen-ts/integration-execute-result.ts": "sha256:f82de8f2e36bac732e015cecd7454a7cecd6ea5cf09b6efd119e252990a47c92",
+    "gen-ts/integration-execute-request.ts": "sha256:f95ec137982a9d774828998fcde76b2ac08a9261dc4f6988fe222f77ecdd00ba",
+    "gen-ts/integration-execute-result.ts": "sha256:1ac69edc6db8641c4fefe6e4ef86bc8855c95006089af279b15e8d6daf978252",
     "gen-ts/integration-operations.ts": "sha256:f4ddc2dc5776557d20dbf92a1e20cec63198c7d008426773c2e0fc3f509cd460",
     "gen-ts/internal-configuration-request.ts": "sha256:7032437797473fa1c581d134adef2f3d4b4f4132f482cd17743e9d47097886bc",
     "gen-ts/kit-bundle-manifest.ts": "sha256:2777a268aef8787b81e71d154a7d05f6f5ded09d66f378211ff5493ddb885171",

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.73.0.0";
-export declare const ContractPublishVersion: "0.73.0";
-export declare const ContractPublishTag: "v0.73.0";
-export declare const ContractSchemasDigest: "sha256:c0f37c59c7c2decb4fb62d96596b787628483bdcdb09756c3ea286385d31a5f5";
+export declare const ContractRepositoryVersion: "0.74.0.0";
+export declare const ContractPublishVersion: "0.74.0";
+export declare const ContractPublishTag: "v0.74.0";
+export declare const ContractSchemasDigest: "sha256:340d7f930a6cea6292f6ec20a02ca37ed5b78b42f4f4ec6e4c15057b44c6c3ff";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:eb98ee80133c91e8562b95d92388c5bb637a06ae8d97a0827f528cd6decde8c9";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:ad539efcc9e4a7521f9526dd6304215f6b764be64bd40cd598ec023f6bbb4583";
+export declare const ContractGeneratedGoDigest: "sha256:639a4832d8301e197caefe8d9b0fb2bd21cf20f9b580861a04bdce8d5411624a";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:ab6a5dd30f09a9604d34f5a994fb8a3491a092d1fb77232b1165e02a5e217939";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.73.0.0";
-export const ContractPublishVersion = "0.73.0";
-export const ContractPublishTag = "v0.73.0";
-export const ContractSchemasDigest = "sha256:c0f37c59c7c2decb4fb62d96596b787628483bdcdb09756c3ea286385d31a5f5";
+export const ContractRepositoryVersion = "0.74.0.0";
+export const ContractPublishVersion = "0.74.0";
+export const ContractPublishTag = "v0.74.0";
+export const ContractSchemasDigest = "sha256:340d7f930a6cea6292f6ec20a02ca37ed5b78b42f4f4ec6e4c15057b44c6c3ff";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:eb98ee80133c91e8562b95d92388c5bb637a06ae8d97a0827f528cd6decde8c9";
-export const ContractGeneratedTypeScriptDigest = "sha256:ad539efcc9e4a7521f9526dd6304215f6b764be64bd40cd598ec023f6bbb4583";
+export const ContractGeneratedGoDigest = "sha256:639a4832d8301e197caefe8d9b0fb2bd21cf20f9b580861a04bdce8d5411624a";
+export const ContractGeneratedTypeScriptDigest = "sha256:ab6a5dd30f09a9604d34f5a994fb8a3491a092d1fb77232b1165e02a5e217939";

package/dist/gen-ts/data-source.d.ts

@@ -1,7 +1,7 @@
 /**
- * Closed connector set for the Data-Access MVP.
+ * Closed connector set for the Data-Access MVP. trino (0.74.0): Trino/Presto-compatible engines (Trino, Presto, Starburst, Galaxy) over the Trino HTTP statement protocol; the endpoint reuses host, port and database (as the Trino catalog) with no connector-specific fields.
  */
-export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks' | 'mysql';
+export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks' | 'mysql' | 'trino';
 /**
  * byo = admin brought existing infrastructure; harbour_managed = Isomorph provisioned it.
  */
@@ -50,6 +50,13 @@ export interface DataSource {
      */
     allowValidation?: boolean;
     status: DataSourceStatus;
+    /**
+     * 0.74.0: per-environment copies of the source. A read for an environment that has a copy here uses that copy's endpoint and credentialRef; production always uses the top-level endpoint and credentialRef. A development read with no development copy is answered from the app's sample rows (integration-execute-request.sampleRows), never from the source; a preview read with no preview copy uses the production endpoint. A laptop never reads the production endpoint.
+     */
+    environments?: {
+        development?: DataSourceEnvironmentCopy;
+        preview?: DataSourceEnvironmentCopy;
+    };
 }
 /**
  * Connector endpoint coordinates. host is always present; database vs project/workspace depends on the connector family.
@@ -76,3 +83,13 @@ export interface DataSourceEndpoint {
      */
     workspace?: string;
 }
+/**
+ * One environment's copy of a source: the same endpoint and credentialRef shapes as the top-level fields, for the same connector.
+ */
+export interface DataSourceEnvironmentCopy {
+    endpoint: DataSourceEndpoint;
+    /**
+     * secretref URI naming the platform-held credential for this copy. The referenced value never crosses this boundary.
+     */
+    credentialRef: string;
+}

package/dist/gen-ts/integration-error-details.d.ts

@@ -3,9 +3,9 @@
  */
 export type IntegrationErrorCategory = 'AUTH_REQUIRED' | 'FORBIDDEN' | 'NOT_FOUND' | 'CONFLICT' | 'VALIDATION_FAILED' | 'RATE_LIMITED' | 'UNAVAILABLE';
 /**
- * Stable reason codes. SEND_OUTCOME_UNKNOWN: dispatch happened but the outcome is unknown; never re-post automatically. SEND_KEY_REUSED: the idempotency key was seen with a different payload or subject. GRANT_DENIED: IT denied the request. TOKEN_REFRESH_PENDING: another call holds the refresh lease; retry shortly. REQUEST_PENDING: a different request for this grant is still open. INPUT_INVALID: the operation input failed its bounds. IDEMPOTENCY_KEY_REQUIRED: a send without a UUID idempotencyKey. SEND_IN_PROGRESS: a retry arrived while the first send of that key is still running. CONNECTION_NOT_FOUND / APP_NOT_FOUND / GRANT_NOT_FOUND: the named record does not exist. AUTH_REQUIRED: no verified caller. UNAVAILABLE: the governance dependency (store, provider seam) is unreachable. MODE_NOT_GRANTED (403 FORBIDDEN, 0.55.0): a slack.message.post named a mode (app or user) IT has not approved for this app; the post is never served under the other mode. MODE_REQUIRED (400 VALIDATION_FAILED, 0.55.0): the app holds approved grants for both modes and the post named neither.
+ * Stable reason codes. SEND_OUTCOME_UNKNOWN: dispatch happened but the outcome is unknown; never re-post automatically. SEND_KEY_REUSED: the idempotency key was seen with a different payload or subject. GRANT_DENIED: IT denied the request. TOKEN_REFRESH_PENDING: another call holds the refresh lease; retry shortly. REQUEST_PENDING: a different request for this grant is still open. INPUT_INVALID: the operation input failed its bounds. IDEMPOTENCY_KEY_REQUIRED: a send without a UUID idempotencyKey. SEND_IN_PROGRESS: a retry arrived while the first send of that key is still running. CONNECTION_NOT_FOUND / APP_NOT_FOUND / GRANT_NOT_FOUND: the named record does not exist. AUTH_REQUIRED: no verified caller. UNAVAILABLE: the governance dependency (store, provider seam) is unreachable. MODE_NOT_GRANTED (403 FORBIDDEN, 0.55.0): a slack.message.post named a mode (app or user) IT has not approved for this app; the post is never served under the other mode. MODE_REQUIRED (400 VALIDATION_FAILED, 0.55.0): the app holds approved grants for both modes and the post named neither. SAMPLE_ROWS_NOT_ALLOWED (400 VALIDATION_FAILED, 0.74.0): an execute request carried sampleRows on any route but the development one. A sample value that does not parse as the column's recorded type is INPUT_INVALID, naming the column and the row.
  */
-export type IntegrationErrorCode = 'USER_CONNECTION_REQUIRED' | 'USER_RECONNECT_REQUIRED' | 'GRANT_NOT_READY' | 'GRANT_EXPIRED' | 'GRANT_REVOKED' | 'CONNECTION_DISABLED' | 'OPERATION_NOT_DECLARED' | 'RESOURCE_NOT_APPROVED' | 'IDENTITY_MODE_MISMATCH' | 'SEND_OUTCOME_UNKNOWN' | 'SEND_KEY_REUSED' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'REQUEST_TOO_LARGE' | 'RESULT_TOO_LARGE' | 'DEADLINE_EXCEEDED' | 'APP_ACCESS_REQUIRED' | 'GRANT_DENIED' | 'TOKEN_REFRESH_PENDING' | 'REQUEST_PENDING' | 'INPUT_INVALID' | 'IDEMPOTENCY_KEY_REQUIRED' | 'SEND_IN_PROGRESS' | 'CONNECTION_NOT_FOUND' | 'APP_NOT_FOUND' | 'GRANT_NOT_FOUND' | 'AUTH_REQUIRED' | 'UNAVAILABLE' | 'MODE_NOT_GRANTED' | 'MODE_REQUIRED';
+export type IntegrationErrorCode = 'USER_CONNECTION_REQUIRED' | 'USER_RECONNECT_REQUIRED' | 'GRANT_NOT_READY' | 'GRANT_EXPIRED' | 'GRANT_REVOKED' | 'CONNECTION_DISABLED' | 'OPERATION_NOT_DECLARED' | 'RESOURCE_NOT_APPROVED' | 'IDENTITY_MODE_MISMATCH' | 'SEND_OUTCOME_UNKNOWN' | 'SEND_KEY_REUSED' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'REQUEST_TOO_LARGE' | 'RESULT_TOO_LARGE' | 'DEADLINE_EXCEEDED' | 'APP_ACCESS_REQUIRED' | 'GRANT_DENIED' | 'TOKEN_REFRESH_PENDING' | 'REQUEST_PENDING' | 'INPUT_INVALID' | 'IDEMPOTENCY_KEY_REQUIRED' | 'SEND_IN_PROGRESS' | 'CONNECTION_NOT_FOUND' | 'APP_NOT_FOUND' | 'GRANT_NOT_FOUND' | 'AUTH_REQUIRED' | 'UNAVAILABLE' | 'MODE_NOT_GRANTED' | 'MODE_REQUIRED' | 'SAMPLE_ROWS_NOT_ALLOWED';
 /**
  * The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto IsomorphError(category, message, details). `category` is the app-SDK IsomorphErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.
  */

package/dist/gen-ts/integration-execute-request.d.ts

@@ -150,6 +150,14 @@ export type IntegrationExecuteRequest = {
      * The declared-mode Slack operations only (slack.message.post since 0.55.0; slack.channel.history, slack.message.update and slack.message.delete since 0.71.0): which of the app's IT-approved modes this call runs under — app (the company's Slack app; a post goes out under the grant's per-app name and the footer) or user (the signed-in person, after their consent; no name, no footer). Required when the app holds approved grants for both modes (else MODE_REQUIRED); may be omitted when it holds one, which is then used. A named mode without an approved grant is refused with MODE_NOT_GRANTED; governance never falls back to the other mode. Every other operation's mode is fixed, so the field is refused there.
      */
     mode?: 'app' | 'user';
+    /**
+     * Development only (0.74.0). Rows the kit dev runtime attaches for the resource being read, from the sample-row file the agent wrote into the app's .isomorph/ folder. Governance serves them for a development warehouse.view.read when the source has no development copy (data-source.environments.development): it parses each value by the resource's recorded column type and refuses a value that does not parse, naming the column and the row. The field is refused with SAMPLE_ROWS_NOT_ALLOWED on any route but the development one, so a preview or production read never carries made-up data. Not part of the per-operation input rules; the dev runtime adds it beside the app's request.
+     *
+     * @maxItems 50
+     */
+    sampleRows?: {
+        [k: string]: string | number | boolean | null;
+    }[];
 };
 /**
  * One bare email address (no display name).

package/dist/gen-ts/integration-execute-result.d.ts

@@ -43,6 +43,10 @@ export type IntegrationExecuteResult = {
      * gmail.message.read: the text was cut at 16 KiB. warehouse.view.read (0.70.0): more rows matched than the read's limit, so `rows` is incomplete.
      */
     truncated?: boolean;
+    /**
+     * warehouse.view.read (0.74.0): true when `rows` came from the app's sample rows (integration-execute-request.sampleRows) because the development read had no development copy of the source; the rows were never read from the source. Absent or false: the rows came from the source.
+     */
+    sample?: boolean;
     /**
      * gmail.message.read (0.71.0): the message's attachments, without their bytes.
      *

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.73.0.0" as const;
-export const ContractPublishVersion = "0.73.0" as const;
-export const ContractPublishTag = "v0.73.0" as const;
-export const ContractSchemasDigest = "sha256:c0f37c59c7c2decb4fb62d96596b787628483bdcdb09756c3ea286385d31a5f5" as const;
+export const ContractRepositoryVersion = "0.74.0.0" as const;
+export const ContractPublishVersion = "0.74.0" as const;
+export const ContractPublishTag = "v0.74.0" as const;
+export const ContractSchemasDigest = "sha256:340d7f930a6cea6292f6ec20a02ca37ed5b78b42f4f4ec6e4c15057b44c6c3ff" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:eb98ee80133c91e8562b95d92388c5bb637a06ae8d97a0827f528cd6decde8c9" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:ad539efcc9e4a7521f9526dd6304215f6b764be64bd40cd598ec023f6bbb4583" as const;
+export const ContractGeneratedGoDigest = "sha256:639a4832d8301e197caefe8d9b0fb2bd21cf20f9b580861a04bdce8d5411624a" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:ab6a5dd30f09a9604d34f5a994fb8a3491a092d1fb77232b1165e02a5e217939" as const;

package/gen-ts/data-source.ts

@@ -2,9 +2,9 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Closed connector set for the Data-Access MVP.
+ * Closed connector set for the Data-Access MVP. trino (0.74.0): Trino/Presto-compatible engines (Trino, Presto, Starburst, Galaxy) over the Trino HTTP statement protocol; the endpoint reuses host, port and database (as the Trino catalog) with no connector-specific fields.
  */
-export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks' | 'mysql';
+export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks' | 'mysql' | 'trino';
 /**
  * byo = admin brought existing infrastructure; harbour_managed = Isomorph provisioned it.
  */
@@ -54,6 +54,13 @@ export interface DataSource {
    */
   allowValidation?: boolean;
   status: DataSourceStatus;
+  /**
+   * 0.74.0: per-environment copies of the source. A read for an environment that has a copy here uses that copy's endpoint and credentialRef; production always uses the top-level endpoint and credentialRef. A development read with no development copy is answered from the app's sample rows (integration-execute-request.sampleRows), never from the source; a preview read with no preview copy uses the production endpoint. A laptop never reads the production endpoint.
+   */
+  environments?: {
+    development?: DataSourceEnvironmentCopy;
+    preview?: DataSourceEnvironmentCopy;
+  };
 }
 /**
  * Connector endpoint coordinates. host is always present; database vs project/workspace depends on the connector family.
@@ -80,3 +87,13 @@ export interface DataSourceEndpoint {
    */
   workspace?: string;
 }
+/**
+ * One environment's copy of a source: the same endpoint and credentialRef shapes as the top-level fields, for the same connector.
+ */
+export interface DataSourceEnvironmentCopy {
+  endpoint: DataSourceEndpoint;
+  /**
+   * secretref URI naming the platform-held credential for this copy. The referenced value never crosses this boundary.
+   */
+  credentialRef: string;
+}

package/gen-ts/integration-error-details.ts

@@ -7,7 +7,7 @@
 export type IntegrationErrorCategory =
   'AUTH_REQUIRED' | 'FORBIDDEN' | 'NOT_FOUND' | 'CONFLICT' | 'VALIDATION_FAILED' | 'RATE_LIMITED' | 'UNAVAILABLE';
 /**
- * Stable reason codes. SEND_OUTCOME_UNKNOWN: dispatch happened but the outcome is unknown; never re-post automatically. SEND_KEY_REUSED: the idempotency key was seen with a different payload or subject. GRANT_DENIED: IT denied the request. TOKEN_REFRESH_PENDING: another call holds the refresh lease; retry shortly. REQUEST_PENDING: a different request for this grant is still open. INPUT_INVALID: the operation input failed its bounds. IDEMPOTENCY_KEY_REQUIRED: a send without a UUID idempotencyKey. SEND_IN_PROGRESS: a retry arrived while the first send of that key is still running. CONNECTION_NOT_FOUND / APP_NOT_FOUND / GRANT_NOT_FOUND: the named record does not exist. AUTH_REQUIRED: no verified caller. UNAVAILABLE: the governance dependency (store, provider seam) is unreachable. MODE_NOT_GRANTED (403 FORBIDDEN, 0.55.0): a slack.message.post named a mode (app or user) IT has not approved for this app; the post is never served under the other mode. MODE_REQUIRED (400 VALIDATION_FAILED, 0.55.0): the app holds approved grants for both modes and the post named neither.
+ * Stable reason codes. SEND_OUTCOME_UNKNOWN: dispatch happened but the outcome is unknown; never re-post automatically. SEND_KEY_REUSED: the idempotency key was seen with a different payload or subject. GRANT_DENIED: IT denied the request. TOKEN_REFRESH_PENDING: another call holds the refresh lease; retry shortly. REQUEST_PENDING: a different request for this grant is still open. INPUT_INVALID: the operation input failed its bounds. IDEMPOTENCY_KEY_REQUIRED: a send without a UUID idempotencyKey. SEND_IN_PROGRESS: a retry arrived while the first send of that key is still running. CONNECTION_NOT_FOUND / APP_NOT_FOUND / GRANT_NOT_FOUND: the named record does not exist. AUTH_REQUIRED: no verified caller. UNAVAILABLE: the governance dependency (store, provider seam) is unreachable. MODE_NOT_GRANTED (403 FORBIDDEN, 0.55.0): a slack.message.post named a mode (app or user) IT has not approved for this app; the post is never served under the other mode. MODE_REQUIRED (400 VALIDATION_FAILED, 0.55.0): the app holds approved grants for both modes and the post named neither. SAMPLE_ROWS_NOT_ALLOWED (400 VALIDATION_FAILED, 0.74.0): an execute request carried sampleRows on any route but the development one. A sample value that does not parse as the column's recorded type is INPUT_INVALID, naming the column and the row.
  */
 export type IntegrationErrorCode =
   | 'USER_CONNECTION_REQUIRED'
@@ -39,7 +39,8 @@ export type IntegrationErrorCode =
   | 'AUTH_REQUIRED'
   | 'UNAVAILABLE'
   | 'MODE_NOT_GRANTED'
-  | 'MODE_REQUIRED';
+  | 'MODE_REQUIRED'
+  | 'SAMPLE_ROWS_NOT_ALLOWED';
 
 /**
  * The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto IsomorphError(category, message, details). `category` is the app-SDK IsomorphErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.

package/gen-ts/integration-execute-request.ts

@@ -166,6 +166,14 @@ export type IntegrationExecuteRequest = {
    * The declared-mode Slack operations only (slack.message.post since 0.55.0; slack.channel.history, slack.message.update and slack.message.delete since 0.71.0): which of the app's IT-approved modes this call runs under — app (the company's Slack app; a post goes out under the grant's per-app name and the footer) or user (the signed-in person, after their consent; no name, no footer). Required when the app holds approved grants for both modes (else MODE_REQUIRED); may be omitted when it holds one, which is then used. A named mode without an approved grant is refused with MODE_NOT_GRANTED; governance never falls back to the other mode. Every other operation's mode is fixed, so the field is refused there.
    */
   mode?: 'app' | 'user';
+  /**
+   * Development only (0.74.0). Rows the kit dev runtime attaches for the resource being read, from the sample-row file the agent wrote into the app's .isomorph/ folder. Governance serves them for a development warehouse.view.read when the source has no development copy (data-source.environments.development): it parses each value by the resource's recorded column type and refuses a value that does not parse, naming the column and the row. The field is refused with SAMPLE_ROWS_NOT_ALLOWED on any route but the development one, so a preview or production read never carries made-up data. Not part of the per-operation input rules; the dev runtime adds it beside the app's request.
+   *
+   * @maxItems 50
+   */
+  sampleRows?: {
+    [k: string]: string | number | boolean | null;
+  }[];
 };
 /**
  * One bare email address (no display name).

package/gen-ts/integration-execute-result.ts

@@ -46,6 +46,10 @@ export type IntegrationExecuteResult = {
    * gmail.message.read: the text was cut at 16 KiB. warehouse.view.read (0.70.0): more rows matched than the read's limit, so `rows` is incomplete.
    */
   truncated?: boolean;
+  /**
+   * warehouse.view.read (0.74.0): true when `rows` came from the app's sample rows (integration-execute-request.sampleRows) because the development read had no development copy of the source; the rows were never read from the source. Absent or false: the rows came from the source.
+   */
+  sample?: boolean;
   /**
    * gmail.message.read (0.71.0): the message's attachments, without their bytes.
    *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.73.0",
+  "version": "0.74.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/data-source.schema.json

@@ -77,13 +77,42 @@
     },
     "status": {
       "$ref": "#/definitions/DataSourceStatus"
+    },
+    "environments": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "development": {
+          "$ref": "#/definitions/DataSourceEnvironmentCopy"
+        },
+        "preview": {
+          "$ref": "#/definitions/DataSourceEnvironmentCopy"
+        }
+      },
+      "description": "0.74.0: per-environment copies of the source. A read for an environment that has a copy here uses that copy's endpoint and credentialRef; production always uses the top-level endpoint and credentialRef. A development read with no development copy is answered from the app's sample rows (integration-execute-request.sampleRows), never from the source; a preview read with no preview copy uses the production endpoint. A laptop never reads the production endpoint."
     }
   },
   "definitions": {
     "DataSourceConnector": {
       "type": "string",
-      "enum": ["postgres", "redshift", "bigquery", "databricks", "mysql"],
-      "description": "Closed connector set for the Data-Access MVP."
+      "enum": ["postgres", "redshift", "bigquery", "databricks", "mysql", "trino"],
+      "description": "Closed connector set for the Data-Access MVP. trino (0.74.0): Trino/Presto-compatible engines (Trino, Presto, Starburst, Galaxy) over the Trino HTTP statement protocol; the endpoint reuses host, port and database (as the Trino catalog) with no connector-specific fields."
+    },
+    "DataSourceEnvironmentCopy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["endpoint", "credentialRef"],
+      "properties": {
+        "endpoint": {
+          "$ref": "#/definitions/DataSourceEndpoint"
+        },
+        "credentialRef": {
+          "type": "string",
+          "pattern": "^secretref://[A-Za-z0-9][A-Za-z0-9/_.:-]*$",
+          "description": "secretref URI naming the platform-held credential for this copy. The referenced value never crosses this boundary."
+        }
+      },
+      "description": "One environment's copy of a source: the same endpoint and credentialRef shapes as the top-level fields, for the same connector."
     },
     "DataSourceEndpoint": {
       "type": "object",
@@ -152,6 +181,32 @@
       "requestableByBuilders": true,
       "allowValidation": false,
       "status": "ACTIVE"
+    },
+    {
+      "tenantId": "pocketfm",
+      "sourceId": "lakehouse",
+      "connector": "trino",
+      "displayName": "Lakehouse (Trino)",
+      "endpoint": {
+        "host": "trino.internal.example.com",
+        "port": 8443,
+        "database": "hive"
+      },
+      "credentialRef": "secretref://tenants/pocketfm/sources/lakehouse/reader",
+      "environments": {
+        "development": {
+          "endpoint": {
+            "host": "trino-dev.internal.example.com",
+            "port": 8443,
+            "database": "hive_dev"
+          },
+          "credentialRef": "secretref://tenants/pocketfm/sources/lakehouse/reader-dev"
+        }
+      },
+      "provisioningMode": "byo",
+      "allowedScope": ["analytics.episode_plays"],
+      "requestableByBuilders": true,
+      "status": "ACTIVE"
     }
   ]
 }

package/schema/integration-error-details.schema.json

@@ -62,9 +62,10 @@
         "AUTH_REQUIRED",
         "UNAVAILABLE",
         "MODE_NOT_GRANTED",
-        "MODE_REQUIRED"
+        "MODE_REQUIRED",
+        "SAMPLE_ROWS_NOT_ALLOWED"
       ],
-      "description": "Stable reason codes. SEND_OUTCOME_UNKNOWN: dispatch happened but the outcome is unknown; never re-post automatically. SEND_KEY_REUSED: the idempotency key was seen with a different payload or subject. GRANT_DENIED: IT denied the request. TOKEN_REFRESH_PENDING: another call holds the refresh lease; retry shortly. REQUEST_PENDING: a different request for this grant is still open. INPUT_INVALID: the operation input failed its bounds. IDEMPOTENCY_KEY_REQUIRED: a send without a UUID idempotencyKey. SEND_IN_PROGRESS: a retry arrived while the first send of that key is still running. CONNECTION_NOT_FOUND / APP_NOT_FOUND / GRANT_NOT_FOUND: the named record does not exist. AUTH_REQUIRED: no verified caller. UNAVAILABLE: the governance dependency (store, provider seam) is unreachable. MODE_NOT_GRANTED (403 FORBIDDEN, 0.55.0): a slack.message.post named a mode (app or user) IT has not approved for this app; the post is never served under the other mode. MODE_REQUIRED (400 VALIDATION_FAILED, 0.55.0): the app holds approved grants for both modes and the post named neither."
+      "description": "Stable reason codes. SEND_OUTCOME_UNKNOWN: dispatch happened but the outcome is unknown; never re-post automatically. SEND_KEY_REUSED: the idempotency key was seen with a different payload or subject. GRANT_DENIED: IT denied the request. TOKEN_REFRESH_PENDING: another call holds the refresh lease; retry shortly. REQUEST_PENDING: a different request for this grant is still open. INPUT_INVALID: the operation input failed its bounds. IDEMPOTENCY_KEY_REQUIRED: a send without a UUID idempotencyKey. SEND_IN_PROGRESS: a retry arrived while the first send of that key is still running. CONNECTION_NOT_FOUND / APP_NOT_FOUND / GRANT_NOT_FOUND: the named record does not exist. AUTH_REQUIRED: no verified caller. UNAVAILABLE: the governance dependency (store, provider seam) is unreachable. MODE_NOT_GRANTED (403 FORBIDDEN, 0.55.0): a slack.message.post named a mode (app or user) IT has not approved for this app; the post is never served under the other mode. MODE_REQUIRED (400 VALIDATION_FAILED, 0.55.0): the app holds approved grants for both modes and the post named neither. SAMPLE_ROWS_NOT_ALLOWED (400 VALIDATION_FAILED, 0.74.0): an execute request carried sampleRows on any route but the development one. A sample value that does not parse as the column's recorded type is INPUT_INVALID, naming the column and the row."
     }
   },
   "examples": [

package/schema/integration-execute-request.schema.json

@@ -244,6 +244,18 @@
     "mode": {
       "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationIdentityMode",
       "description": "The declared-mode Slack operations only (slack.message.post since 0.55.0; slack.channel.history, slack.message.update and slack.message.delete since 0.71.0): which of the app's IT-approved modes this call runs under \u2014 app (the company's Slack app; a post goes out under the grant's per-app name and the footer) or user (the signed-in person, after their consent; no name, no footer). Required when the app holds approved grants for both modes (else MODE_REQUIRED); may be omitted when it holds one, which is then used. A named mode without an approved grant is refused with MODE_NOT_GRANTED; governance never falls back to the other mode. Every other operation's mode is fixed, so the field is refused there."
+    },
+    "sampleRows": {
+      "type": "array",
+      "maxItems": 50,
+      "items": {
+        "type": "object",
+        "additionalProperties": {
+          "type": ["string", "number", "boolean", "null"]
+        },
+        "description": "One sample row keyed by column name; each value is a scalar that governance parses by the column's recorded type."
+      },
+      "description": "Development only (0.74.0). Rows the kit dev runtime attaches for the resource being read, from the sample-row file the agent wrote into the app's .isomorph/ folder. Governance serves them for a development warehouse.view.read when the source has no development copy (data-source.environments.development): it parses each value by the resource's recorded column type and refuses a value that does not parse, naming the column and the row. The field is refused with SAMPLE_ROWS_NOT_ALLOWED on any route but the development one, so a preview or production read never carries made-up data. Not part of the per-operation input rules; the dev runtime adds it beside the app's request."
     }
   },
   "allOf": [
@@ -1144,6 +1156,28 @@
           "text": "approved"
         }
       }
+    },
+    {
+      "connection": "sales-warehouse",
+      "operation": "warehouse.view.read",
+      "resource": "weekly_sales",
+      "input": {
+        "columns": [
+          "week",
+          "total"
+        ],
+        "limit": 100
+      },
+      "sampleRows": [
+        {
+          "week": "2026-W36",
+          "total": "1234.50"
+        },
+        {
+          "week": "2026-W37",
+          "total": null
+        }
+      ]
     }
   ]
 }

package/schema/integration-execute-result.schema.json

@@ -90,6 +90,10 @@
       "type": "boolean",
       "description": "gmail.message.read: the text was cut at 16 KiB. warehouse.view.read (0.70.0): more rows matched than the read's limit, so `rows` is incomplete."
     },
+    "sample": {
+      "type": "boolean",
+      "description": "warehouse.view.read (0.74.0): true when `rows` came from the app's sample rows (integration-execute-request.sampleRows) because the development read had no development copy of the source; the rows were never read from the source. Absent or false: the rows came from the source."
+    },
     "attachments": {
       "type": "array",
       "maxItems": 100,
@@ -248,7 +252,8 @@
       "propertyNames": {
         "enum": [
           "rows",
-          "truncated"
+          "truncated",
+          "sample"
         ]
       }
     }
@@ -579,6 +584,16 @@
       "mimeType": "application/pdf",
       "size": 20,
       "dataBase64": "JVBERi0xLjQKJcOkw7zDtsOfCg=="
+    },
+    {
+      "rows": [
+        {
+          "week": "2026-W36",
+          "total": "1234.50"
+        }
+      ],
+      "truncated": false,
+      "sample": true
     }
   ]
 }