@fourier-labs/harbour-contracts 0.78.0 → 0.80.0

package/README.md

@@ -40,7 +40,7 @@ exist here first.
 | `ai-pricing-revision`, `ai-metering-policy`, `ai-budget-ledger-event`, `ai-trace-event-v2` | Additive metering v2 records, including media dimensions and P5 trace attribution; v1 records remain readable | AI governance §9 |
 | `app-integrations-declaration.schema.json` | Committed `.isomorph/integrations.json` (`isomorph.app-integrations/2.0`): closed thirty-three-operation set (Slack read/post/update/delete/DM/lookup, Gmail list/thread/read/send/attachment — ADR 0018; Basecamp project/to-do list/to-do/message/comment/people lists, to-do create and complete, message, comment and Campfire posts — ADR 0022; SharePoint list/item/drive/file lists, file search and read, item create and update, file upload — ADR 0024; warehouse view read; service request) with fixed or declared identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
 | `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds (a warehouse read filters, groups, aggregates and sorts in the warehouse and says when it was `truncated` — ADR 0017; Slack and Gmail reads page, posts thread, mail carries HTML and attachments — ADR 0018; a development warehouse read may carry the app's `sampleRows` and the result says `sample` — ADR 0021; Basecamp lists page by `pageToken`, ids are digit strings, writes answer `{id, appUrl}` — ADR 0022; SharePoint lists page by a Graph `$skiptoken`, ids are Graph ids, `fields` is a bounded record, writes answer `{id, webUrl}` — ADR 0024), the per-operation result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
-| `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider; IT's optional `oauthClient`, `userModeApproval`, `directMessages`, `externalRecipients` — ADR 0018; a Basecamp connection's pinned `account` and project ids in `channels` — ADR 0022; a SharePoint connection's pinned Microsoft 365 tenant in `account` and site ids in `channels` — ADR 0024) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
+| `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider; IT's optional `oauthClient`, `userModeApproval`, `directMessages`, `externalRecipients` — ADR 0018; a Basecamp connection's pinned `account` and project ids in `channels` — ADR 0022; a SharePoint connection's pinned Microsoft 365 tenant in `account` and site ids in `channels` — ADR 0024; up to 20 `approvers` who may approve access requests beside the tenant admins — ADR 0026) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
 | `kit-bundle-manifest.schema.json`, `kit-lock.schema.json` | Published kit bundle identity (SDK tarball digest plus optional `sdk.version` and https `sdk.url` download location) and the committed `.isomorph/kit.lock.json` the CodeBuild SDK-vendoring gate compares against | Dev kit §3 |
 | `deploy-response.schema.json` | 202 Accepted body for `POST /v1/tenants/{tenant}/apps/{app}/deployments`, returned only after the authoritative QUEUED version exists and its SQS message is accepted | — |
 | `deployment-source.schema.json` | Credential-free source in the `DeployRequest` body: `provider` is `github` or `gitlab`, `repositoryUrl` is shape-only and the deployment control plane checks the host against the tenant's source connection (ADR 0023); credentials are resolved internally by MaterializeSource | — |

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.78.0.0",
-  "publishVersion": "0.78.0",
-  "publishTag": "v0.78.0",
-  "schemasDigest": "sha256:f1be566763706a00ed462099e750f17828f9fdc5a5cc6cdc2c5e39431e574360",
+  "repositoryVersion": "0.80.0.0",
+  "publishVersion": "0.80.0",
+  "publishTag": "v0.80.0",
+  "schemasDigest": "sha256:194d7a45ce74a147405e7cd0f4ef9c252c9a953f165b2834a5fa65d8a45e80fa",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:93ef23399ab41345982298e0a52e6d81be3496605771d7e347219ed11fa28bf1",
-  "generatedTypeScriptDigest": "sha256:0975b1595804430ca85ce07f4d624c215a8c5f537f259cc9df8497dea97a927c",
+  "generatedGoDigest": "sha256:8e22b9a650b562812579b20fa5b8b28ac63b97007da74e9ac47a5d581e1a6d2d",
+  "generatedTypeScriptDigest": "sha256:85b684d40d0c461fad52ec530250245a25f7db1d7e69a5ce81edc00e9486ef66",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -32,6 +32,7 @@
     "schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
     "schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
     "schema/app-integrations-declaration.schema.json": "sha256:af9b36a880b9f277da7691724a5fce59c7d77f2c2c10edc3b23eee48d31a4730",
+    "schema/app-sign-in.schema.json": "sha256:2093740131b84a69757c2e474d16e32ff5d0bf0edd6f6f8de62ede7f82988f29",
     "schema/artifact-contract.schema.json": "sha256:8047b461a1c6d07bbe867a259c57bdf5cc0fdf282cf842ec7b683a9e93713b10",
     "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/builder-input-proposal.schema.json": "sha256:fe85cffa6d76b1e1effe1f5d75525f8fe0e1eaa3be4a304e491aa23ad72c0e72",
@@ -41,7 +42,7 @@
     "schema/data-source.schema.json": "sha256:46ef4ace5fce612fce055813bf4f99956423b46c929993fbbc5dfec497087bad",
     "schema/deploy-request.schema.json": "sha256:c978406c273fa430db262888f0a8646b14e3057f64b0633780fcd6cfa646bc67",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
-    "schema/deployment-app-registration.schema.json": "sha256:eb705c38466ebd97cb76c1ce7a6177d75c2f10381df75976b40d47eeb8dd5712",
+    "schema/deployment-app-registration.schema.json": "sha256:f1deb15a467065a20f540649aac3713e6c8afe68f03b43969ef103356b7baa13",
     "schema/deployment-continuation.schema.json": "sha256:55b6945439f2c91cd851dfe4bc9484e67a64091b7763b2d8267354b4a8bfae8c",
     "schema/deployment-environment.schema.json": "sha256:35b26cae07da9ee375a842b5e87c4570c8eca06775e9fd6dd46eb9eb8aa0df6c",
     "schema/deployment-preview-retirement.schema.json": "sha256:ccf6b971b7853ca98530272f280fe62cd3aab5425b10b81ae6b717cc949e014f",
@@ -52,6 +53,8 @@
     "schema/env-bindings.schema.json": "sha256:ae09bc4ca5508afa698ef854a59153c4c6f99b07017b48cb9b07ce05abad12f2",
     "schema/error-category.enum.json": "sha256:d6d83000c3357805b13138d717c411248c14f1c0fde1c02e82a25691de85d68d",
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
+    "schema/external-sign-in.schema.json": "sha256:82d2cc5130a12a19554c85d4a78368939f417a80e795b2be060156294296ac70",
+    "schema/identity-context.schema.json": "sha256:a0be3d3499b70f1641887ec66ab5b21ca5ab71063e9209290905738943a36e59",
     "schema/integration-connect-result.schema.json": "sha256:3f254b67ef739dc1fa395bdc8c4dc93359b16d481dba2a2d777aa5b6f34b7af8",
     "schema/integration-error-details.schema.json": "sha256:5a290584b1542b2b8cdd4966869126180ce29c1f0dd250dca7fb68c05e76b8e9",
     "schema/integration-execute-request.schema.json": "sha256:9538c59ed750530493293cc4f33538b02b4df4247769f9fc4e96c2d8393f72d0",
@@ -63,7 +66,7 @@
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
     "schema/resolved-app-serving.schema.json": "sha256:260e30ca16831ddd96b15f44eadc7daa2a5f87a0025588bd6318b236f349ec6b",
-    "schema/saas-connection.schema.json": "sha256:48ffbf6f56361d4a62357e6c28c083517b26479b85de7ddc878353a19e05cc68",
+    "schema/saas-connection.schema.json": "sha256:88de2039c9acd726f9e79860c71ec7e74a92c323f44e1c55b8a29c5bf69b29df",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
     "schema/security-scan-input-v2.schema.json": "sha256:0d418342078c9b5046ea6f4bef3c2c57539285dfee99cc0850d4f0d03739ee13",
@@ -113,7 +116,7 @@
     "gen-go/integration_execute_input_rules_test.go": "sha256:4961b4b87012e8cb6e2c64653769f5fd4dd58e1d7d18af459f4f5b69a3e6760d",
     "gen-go/integration_operations.go": "sha256:fab89489825680fee6dfd7d5874e955839691af4cc5245d96caaf36505668db1",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:746204705f882de2da44469fdc7be3f256715d2683741671be50dd3740d77a69",
+    "gen-go/types.go": "sha256:0c147e97773521638fec09868c6299d2746ed8af24082720d883a448b2cb813c",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -139,6 +142,7 @@
     "gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
     "gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
     "gen-ts/app-integrations-declaration.ts": "sha256:860f51367547f05c97f9b048d019ef542788d0c4ae8cbb47e21daaccfb03c6af",
+    "gen-ts/app-sign-in.ts": "sha256:bf88671c00e9d9badb5ffc961a7e803cf92cee5a98c2f6c9e3172bbf5aaf0424",
     "gen-ts/artifact-contract.ts": "sha256:4a6dc6d2caaeed4bb2066cc8a333e6e09e5a0d4745e0b1038293d54ab9403aeb",
     "gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
     "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
@@ -149,7 +153,7 @@
     "gen-ts/data-source.ts": "sha256:f30d4c14c15afbb9530d30af9235844198765984ce1579fa25961d7f07bcfb1f",
     "gen-ts/deploy-request.ts": "sha256:913245577a95354849d3a8cb43fbaedbf895efe7b653c8502d25edfa22b7a864",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
-    "gen-ts/deployment-app-registration.ts": "sha256:642db3a3f796e5d7089cdb834991277ab1aac5bff37cd5cab42aa2f1c116f0be",
+    "gen-ts/deployment-app-registration.ts": "sha256:8c2d55983e33449ecfbaceaa41aac3e2905f1970f5514f0dbc3b611fad7beefb",
     "gen-ts/deployment-continuation.ts": "sha256:cc9f63af4d0da5086a79103789e4f043783b75b4ed11c6512f044439a551a79c",
     "gen-ts/deployment-environment.ts": "sha256:fc08cabe2e52ebb93cfe84d2019994260f71734c33d0e50e7c63e40ef5b17cef",
     "gen-ts/deployment-preview-retirement.ts": "sha256:309421d08daf0ade163b6457ed0e5410ec6573c40a59423a6cce14780d9c38db",
@@ -161,7 +165,9 @@
     "gen-ts/error-category-registry.ts": "sha256:7466a502c0723a77db825cdeaa9556a244201b55d9b7acbf2c098e9e84351df1",
     "gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
-    "gen-ts/index.ts": "sha256:57927b9fcddf506785671bbd44cced9f729373e4dd3e3480bc6c37fd05fb59e8",
+    "gen-ts/external-sign-in.ts": "sha256:393ef74d72e37d33e374e3226f34ab3e854fdb0c1129a367997cbb690bf253a6",
+    "gen-ts/identity-context.ts": "sha256:4b8151a321e224229250d214ef3e17f2ac986bb54ff0aadbb4509481724f6883",
+    "gen-ts/index.ts": "sha256:8f0b03bc46f0f24489e6a3f7a3ddee23c86dacc8ab2058b3b131c3d9dd75ab29",
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
     "gen-ts/integration-error-details.ts": "sha256:e73cb5942373ef88b2d8e03a1de56d5a69e71069ecd14e68396f7edba1f60780",
     "gen-ts/integration-execute-input-rules.ts": "sha256:ba2b4c624db36761b78cbd50ec3878b268c536ad1209174620e33833fd22197f",
@@ -175,7 +181,7 @@
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
     "gen-ts/resolved-app-serving.ts": "sha256:6131a6cc5f784f0d101081d2ce1b96b76b2f904b2c5e7b2809f9ede5878ada1f",
-    "gen-ts/saas-connection.ts": "sha256:de741fa539a3e6f30097c9d20413928af8d5ad07462d8b1fd9e0fe910c3d987d",
+    "gen-ts/saas-connection.ts": "sha256:5ab9875d20a50a99aec63d204425655816d7d27ea874497c6e483e6a363f4dcc",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",

package/dist/gen-ts/app-sign-in.d.ts

@@ -0,0 +1,9 @@
+export type AppSignIn = {
+    signIn?: 'company' | 'external';
+    /**
+     * @minItems 1
+     * @maxItems 1
+     */
+    signInMethods?: ('phone' | 'email')[];
+    clientId?: string;
+};

package/dist/gen-ts/app-sign-in.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.78.0.0";
-export declare const ContractPublishVersion: "0.78.0";
-export declare const ContractPublishTag: "v0.78.0";
-export declare const ContractSchemasDigest: "sha256:f1be566763706a00ed462099e750f17828f9fdc5a5cc6cdc2c5e39431e574360";
+export declare const ContractRepositoryVersion: "0.80.0.0";
+export declare const ContractPublishVersion: "0.80.0";
+export declare const ContractPublishTag: "v0.80.0";
+export declare const ContractSchemasDigest: "sha256:194d7a45ce74a147405e7cd0f4ef9c252c9a953f165b2834a5fa65d8a45e80fa";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:93ef23399ab41345982298e0a52e6d81be3496605771d7e347219ed11fa28bf1";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:0975b1595804430ca85ce07f4d624c215a8c5f537f259cc9df8497dea97a927c";
+export declare const ContractGeneratedGoDigest: "sha256:8e22b9a650b562812579b20fa5b8b28ac63b97007da74e9ac47a5d581e1a6d2d";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:85b684d40d0c461fad52ec530250245a25f7db1d7e69a5ce81edc00e9486ef66";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.78.0.0";
-export const ContractPublishVersion = "0.78.0";
-export const ContractPublishTag = "v0.78.0";
-export const ContractSchemasDigest = "sha256:f1be566763706a00ed462099e750f17828f9fdc5a5cc6cdc2c5e39431e574360";
+export const ContractRepositoryVersion = "0.80.0.0";
+export const ContractPublishVersion = "0.80.0";
+export const ContractPublishTag = "v0.80.0";
+export const ContractSchemasDigest = "sha256:194d7a45ce74a147405e7cd0f4ef9c252c9a953f165b2834a5fa65d8a45e80fa";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:93ef23399ab41345982298e0a52e6d81be3496605771d7e347219ed11fa28bf1";
-export const ContractGeneratedTypeScriptDigest = "sha256:0975b1595804430ca85ce07f4d624c215a8c5f537f259cc9df8497dea97a927c";
+export const ContractGeneratedGoDigest = "sha256:8e22b9a650b562812579b20fa5b8b28ac63b97007da74e9ac47a5d581e1a6d2d";
+export const ContractGeneratedTypeScriptDigest = "sha256:85b684d40d0c461fad52ec530250245a25f7db1d7e69a5ce81edc00e9486ef66";

package/dist/gen-ts/deployment-app-registration.d.ts

@@ -1,7 +1,7 @@
 /**
  * IAM/SigV4 POST /v1/internal/deployment/apps/{appId}/register (Internal API) or POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
  */
-export interface DeploymentAppRegistration {
+export type DeploymentAppRegistration = {
     tenantId: string;
     appId: string;
     origin: string;
@@ -15,4 +15,10 @@ export interface DeploymentAppRegistration {
     allowedGroups?: string[];
     enabled?: boolean;
     workloadPrincipalArn?: string;
-}
+    signIn?: 'company' | 'external';
+    /**
+     * @minItems 1
+     * @maxItems 1
+     */
+    signInMethods?: ('phone' | 'email')[];
+};

package/dist/gen-ts/external-sign-in.d.ts

@@ -0,0 +1,29 @@
+export interface ExternalSignIn {
+    enabledMethods: ('phone' | 'email')[];
+    email?: {
+        senderEmail: string;
+        senderDomain?: string;
+        sesRegion: string;
+        configurationSet?: string;
+    };
+    sms?: {
+        originationIdentity?: string;
+        region: string;
+        inEntityId?: string;
+        inTemplateId?: string;
+    };
+    directory?: {
+        accountId: string;
+        region: string;
+        userPoolId: string;
+    };
+    readiness?: {
+        email?: {
+            senderVerified: boolean;
+            productionAccess: boolean;
+        };
+        sms?: {
+            sandbox: boolean;
+        };
+    };
+}

package/dist/gen-ts/external-sign-in.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/identity-context.d.ts

@@ -0,0 +1,18 @@
+export type IdentityContext = {
+    iss: string;
+    aud: string;
+    sub: string;
+    tenant: string;
+    app: string;
+    iat: number;
+    exp: number;
+    session_id?: string;
+    email?: string;
+    name?: string;
+    phone_number?: string;
+    email_verified?: boolean;
+    phone_number_verified?: boolean;
+    directory?: 'company' | 'external';
+    groups?: string[];
+    role?: 'builder' | 'member';
+};

package/dist/gen-ts/identity-context.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/index.d.ts

@@ -20,6 +20,7 @@ export * from './ai-transform-result.js';
 export * from './ai-verification-evidence.js';
 export * from './api-error-response.js';
 export * from './app-integrations-declaration.js';
+export * from './app-sign-in.js';
 export * from './artifact-contract.js';
 export * from './binding-classification-digest-helper.js';
 export * from './binding-classification-subject.js';
@@ -43,6 +44,8 @@ export * from './env-bindings.js';
 export * from './error-category-registry.js';
 export * from './error-category.js';
 export * from './error-envelope.js';
+export * from './external-sign-in.js';
+export * from './identity-context.js';
 export * from './integration-connect-result.js';
 export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';

package/dist/gen-ts/index.js

@@ -22,6 +22,7 @@ export * from './ai-transform-result.js';
 export * from './ai-verification-evidence.js';
 export * from './api-error-response.js';
 export * from './app-integrations-declaration.js';
+export * from './app-sign-in.js';
 export * from './artifact-contract.js';
 export * from './binding-classification-digest-helper.js';
 export * from './binding-classification-subject.js';
@@ -45,6 +46,8 @@ export * from './env-bindings.js';
 export * from './error-category-registry.js';
 export * from './error-category.js';
 export * from './error-envelope.js';
+export * from './external-sign-in.js';
+export * from './identity-context.js';
 export * from './integration-connect-result.js';
 export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';

package/dist/gen-ts/saas-connection.d.ts

@@ -69,6 +69,12 @@ export interface SaasConnection {
      * @maxItems 256
      */
     blockedDevelopmentBuilders?: string[];
+    /**
+     * Lower-cased emails who may approve an app's access requests for this connection, besides tenant admins. Empty or absent means tenant admins only.
+     *
+     * @maxItems 20
+     */
+    approvers?: string[];
     createdAt: string;
     updatedAt: string;
     /**

package/gen-ts/app-sign-in.ts

@@ -0,0 +1,12 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AppSignIn = {
+  signIn?: 'company' | 'external';
+  /**
+   * @minItems 1
+   * @maxItems 1
+   */
+  signInMethods?: ('phone' | 'email')[];
+  clientId?: string;
+};

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.78.0.0" as const;
-export const ContractPublishVersion = "0.78.0" as const;
-export const ContractPublishTag = "v0.78.0" as const;
-export const ContractSchemasDigest = "sha256:f1be566763706a00ed462099e750f17828f9fdc5a5cc6cdc2c5e39431e574360" as const;
+export const ContractRepositoryVersion = "0.80.0.0" as const;
+export const ContractPublishVersion = "0.80.0" as const;
+export const ContractPublishTag = "v0.80.0" as const;
+export const ContractSchemasDigest = "sha256:194d7a45ce74a147405e7cd0f4ef9c252c9a953f165b2834a5fa65d8a45e80fa" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:93ef23399ab41345982298e0a52e6d81be3496605771d7e347219ed11fa28bf1" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:0975b1595804430ca85ce07f4d624c215a8c5f537f259cc9df8497dea97a927c" as const;
+export const ContractGeneratedGoDigest = "sha256:8e22b9a650b562812579b20fa5b8b28ac63b97007da74e9ac47a5d581e1a6d2d" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:85b684d40d0c461fad52ec530250245a25f7db1d7e69a5ce81edc00e9486ef66" as const;

package/gen-ts/deployment-app-registration.ts

@@ -4,7 +4,7 @@
 /**
  * IAM/SigV4 POST /v1/internal/deployment/apps/{appId}/register (Internal API) or POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
  */
-export interface DeploymentAppRegistration {
+export type DeploymentAppRegistration = {
   tenantId: string;
   appId: string;
   origin: string;
@@ -18,4 +18,10 @@ export interface DeploymentAppRegistration {
   allowedGroups?: string[];
   enabled?: boolean;
   workloadPrincipalArn?: string;
-}
+  signIn?: 'company' | 'external';
+  /**
+   * @minItems 1
+   * @maxItems 1
+   */
+  signInMethods?: ('phone' | 'email')[];
+};

package/gen-ts/external-sign-in.ts

@@ -0,0 +1,32 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export interface ExternalSignIn {
+  enabledMethods: ('phone' | 'email')[];
+  email?: {
+    senderEmail: string;
+    senderDomain?: string;
+    sesRegion: string;
+    configurationSet?: string;
+  };
+  sms?: {
+    originationIdentity?: string;
+    region: string;
+    inEntityId?: string;
+    inTemplateId?: string;
+  };
+  directory?: {
+    accountId: string;
+    region: string;
+    userPoolId: string;
+  };
+  readiness?: {
+    email?: {
+      senderVerified: boolean;
+      productionAccess: boolean;
+    };
+    sms?: {
+      sandbox: boolean;
+    };
+  };
+}

package/gen-ts/identity-context.ts

@@ -0,0 +1,21 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type IdentityContext = {
+  iss: string;
+  aud: string;
+  sub: string;
+  tenant: string;
+  app: string;
+  iat: number;
+  exp: number;
+  session_id?: string;
+  email?: string;
+  name?: string;
+  phone_number?: string;
+  email_verified?: boolean;
+  phone_number_verified?: boolean;
+  directory?: 'company' | 'external';
+  groups?: string[];
+  role?: 'builder' | 'member';
+};

package/gen-ts/index.ts

@@ -23,6 +23,7 @@ export * from './ai-transform-result.js';
 export * from './ai-verification-evidence.js';
 export * from './api-error-response.js';
 export * from './app-integrations-declaration.js';
+export * from './app-sign-in.js';
 export * from './artifact-contract.js';
 export * from './binding-classification-digest-helper.js';
 export * from './binding-classification-subject.js';
@@ -46,6 +47,8 @@ export * from './env-bindings.js';
 export * from './error-category-registry.js';
 export * from './error-category.js';
 export * from './error-envelope.js';
+export * from './external-sign-in.js';
+export * from './identity-context.js';
 export * from './integration-connect-result.js';
 export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';

package/gen-ts/saas-connection.ts

@@ -107,6 +107,12 @@ export interface SaasConnection {
    * @maxItems 256
    */
   blockedDevelopmentBuilders?: string[];
+  /**
+   * Lower-cased emails who may approve an app's access requests for this connection, besides tenant admins. Empty or absent means tenant admins only.
+   *
+   * @maxItems 20
+   */
+  approvers?: string[];
   createdAt: string;
   updatedAt: string;
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.78.0",
+  "version": "0.80.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/app-sign-in.schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://schemas.harbour.dev/app-sign-in.schema.json",
+  "title": "AppSignIn",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "signIn": {
+      "type": "string",
+      "enum": [
+        "company",
+        "external"
+      ]
+    },
+    "signInMethods": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "phone",
+          "email"
+        ]
+      },
+      "minItems": 1,
+      "maxItems": 1
+    },
+    "clientId": {
+      "type": "string"
+    }
+  },
+  "required": [],
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "signIn": {
+            "const": "external"
+          }
+        },
+        "required": [
+          "signIn"
+        ]
+      },
+      "then": {
+        "required": [
+          "signInMethods"
+        ]
+      }
+    }
+  ]
+}

package/schema/deployment-app-registration.schema.json

@@ -19,6 +19,9 @@
     "allowedUsers": {"type": "array", "items": {"type": "string"}},
     "allowedGroups": {"type": "array", "items": {"type": "string"}},
     "enabled": {"type": "boolean"},
-    "workloadPrincipalArn": {"type": "string", "pattern": "^arn:aws:(iam|sts)::[0-9]+:"}
-  }
+    "workloadPrincipalArn": {"type": "string", "pattern": "^arn:aws:(iam|sts)::[0-9]+:"},
+    "signIn": {"type": "string", "enum": ["company", "external"]},
+    "signInMethods": {"type": "array", "items": {"type": "string", "enum": ["phone", "email"]}, "minItems": 1, "maxItems": 1}
+  },
+  "allOf": [{"if": {"properties": {"signIn": {"const": "external"}}, "required": ["signIn"]}, "then": {"required": ["signInMethods"]}}]
 }

package/schema/external-sign-in.schema.json

@@ -0,0 +1,120 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://schemas.harbour.dev/external-sign-in.schema.json",
+  "title": "ExternalSignIn",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "enabledMethods": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "phone",
+          "email"
+        ]
+      },
+      "uniqueItems": true
+    },
+    "email": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "senderEmail": {
+          "type": "string"
+        },
+        "senderDomain": {
+          "type": "string"
+        },
+        "sesRegion": {
+          "type": "string"
+        },
+        "configurationSet": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "senderEmail",
+        "sesRegion"
+      ]
+    },
+    "sms": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "originationIdentity": {
+          "type": "string"
+        },
+        "region": {
+          "type": "string"
+        },
+        "inEntityId": {
+          "type": "string"
+        },
+        "inTemplateId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "region"
+      ]
+    },
+    "directory": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "accountId": {
+          "type": "string"
+        },
+        "region": {
+          "type": "string"
+        },
+        "userPoolId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "accountId",
+        "region",
+        "userPoolId"
+      ]
+    },
+    "readiness": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "email": {
+          "type": "object",
+          "properties": {
+            "senderVerified": {
+              "type": "boolean"
+            },
+            "productionAccess": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "senderVerified",
+            "productionAccess"
+          ],
+          "additionalProperties": false
+        },
+        "sms": {
+          "type": "object",
+          "properties": {
+            "sandbox": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "sandbox"
+          ],
+          "additionalProperties": false
+        }
+      }
+    }
+  },
+  "required": [
+    "enabledMethods"
+  ]
+}

package/schema/identity-context.schema.json

@@ -0,0 +1,141 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://schemas.harbour.dev/identity-context.schema.json",
+  "title": "IdentityContext",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "iss": {
+      "type": "string"
+    },
+    "aud": {
+      "type": "string"
+    },
+    "sub": {
+      "type": "string"
+    },
+    "tenant": {
+      "type": "string"
+    },
+    "app": {
+      "type": "string"
+    },
+    "iat": {
+      "type": "integer"
+    },
+    "exp": {
+      "type": "integer"
+    },
+    "session_id": {
+      "type": "string"
+    },
+    "email": {
+      "type": "string"
+    },
+    "name": {
+      "type": "string"
+    },
+    "phone_number": {
+      "type": "string"
+    },
+    "email_verified": {
+      "type": "boolean"
+    },
+    "phone_number_verified": {
+      "type": "boolean"
+    },
+    "directory": {
+      "type": "string",
+      "enum": [
+        "company",
+        "external"
+      ]
+    },
+    "groups": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "role": {
+      "type": "string",
+      "enum": [
+        "builder",
+        "member"
+      ]
+    }
+  },
+  "required": [
+    "iss",
+    "aud",
+    "sub",
+    "tenant",
+    "app",
+    "iat",
+    "exp"
+  ],
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "directory": {
+            "const": "external"
+          }
+        },
+        "required": [
+          "directory"
+        ]
+      },
+      "then": {
+        "properties": {
+          "role": {
+            "const": "member"
+          }
+        },
+        "anyOf": [
+          {
+            "required": [
+              "email",
+              "email_verified"
+            ],
+            "properties": {
+              "email": {
+                "minLength": 1
+              },
+              "email_verified": {
+                "const": true
+              }
+            }
+          },
+          {
+            "required": [
+              "phone_number",
+              "phone_number_verified"
+            ],
+            "properties": {
+              "phone_number": {
+                "minLength": 1
+              },
+              "phone_number_verified": {
+                "const": true
+              }
+            }
+          }
+        ],
+        "required": [
+          "role"
+        ]
+      },
+      "else": {
+        "required": [
+          "email"
+        ],
+        "properties": {
+          "email": {
+            "minLength": 1
+          }
+        }
+      }
+    }
+  ]
+}

package/schema/saas-connection.schema.json

@@ -45,6 +45,13 @@
       "items": { "type": "string", "minLength": 1, "maxLength": 255 },
       "description": "Lower-cased builder emails excluded from development preapproval."
     },
+    "approvers": {
+      "type": "array",
+      "maxItems": 20,
+      "uniqueItems": true,
+      "items": { "$ref": "integration-execute-request.schema.json#/definitions/EmailAddress" },
+      "description": "Lower-cased emails who may approve an app's access requests for this connection, besides tenant admins. Empty or absent means tenant admins only."
+    },
     "createdAt": { "type": "string", "format": "date-time" },
     "updatedAt": { "type": "string", "format": "date-time" },
     "clientId": { "type": "string", "minLength": 1, "maxLength": 255, "deprecated": true, "description": "Deprecated (pre-T25 tenant-owned provider client). Dropped on read; never written." },
@@ -229,6 +236,7 @@
       "oauthClient": { "clientId": "1234567890.1234567890", "secretRef": "secretref://tenant/fourier/saas/company-slack/oauth-client", "setAt": "2026-10-01T08:00:00Z", "setBy": "it-admin@example.com" },
       "userModeApproval": "automatic",
       "directMessages": { "allowed": "channel_members", "channel": "team-updates", "dailyRecipientCap": 50 },
+      "approvers": ["slack-owner@example.com", "it-lead@example.com"],
       "createdAt": "2026-09-09T08:00:00Z",
       "updatedAt": "2026-09-09T08:00:00Z"
     },