@fourier-labs/harbour-contracts 0.70.0 → 0.72.0

package/README.md

@@ -38,9 +38,9 @@ exist here first.
 | `binding-classification-subject.schema.json` | Complete value-free binding-name classification before version allocation | AI governance §5.7 / SEC-UP-01 |
 | `sanitized-binding-evidence.schema.json` | Exact-version sanitized runtime-binding allocation receipt | AI governance §5.7 / SEC-UP-02 |
 | `ai-pricing-revision`, `ai-metering-policy`, `ai-budget-ledger-event`, `ai-trace-event-v2` | Additive metering v2 records, including media dimensions and P5 trace attribution; v1 records remain readable | AI governance §9 |
-| `app-integrations-declaration.schema.json` | Committed `.isomorph/integrations.json` (`isomorph.app-integrations/2.0`): closed six-operation set (Slack read/post, Gmail read/send, warehouse view read) with fixed identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
-| `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds (a warehouse read filters, groups, aggregates and sorts in the warehouse and says when it was `truncated` — ADR 0017), the six result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
-| `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
+| `app-integrations-declaration.schema.json` | Committed `.isomorph/integrations.json` (`isomorph.app-integrations/2.0`): closed twelve-operation set (Slack read/post/update/delete/DM/lookup, Gmail list/thread/read/send/attachment, warehouse view read — ADR 0018) with fixed or declared identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
+| `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds (a warehouse read filters, groups, aggregates and sorts in the warehouse and says when it was `truncated` — ADR 0017; Slack and Gmail reads page, posts thread, mail carries HTML and attachments — ADR 0018), the per-operation result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
+| `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider; IT's optional `oauthClient`, `userModeApproval`, `directMessages`, `externalRecipients` — ADR 0018) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
 | `kit-bundle-manifest.schema.json`, `kit-lock.schema.json` | Published kit bundle identity (SDK tarball digest plus optional `sdk.version` and https `sdk.url` download location) and the committed `.isomorph/kit.lock.json` the CodeBuild SDK-vendoring gate compares against | Dev kit §3 |
 | `deploy-response.schema.json` | 202 Accepted body for `POST /v1/tenants/{tenant}/apps/{app}/deployments`, returned only after the authoritative QUEUED version exists and its SQS message is accepted | — |
 | `deployment-source.schema.json` | Credential-free GitHub source in the `DeployRequest` body; credentials are resolved internally by MaterializeSource | — |

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.70.0.0",
-  "publishVersion": "0.70.0",
-  "publishTag": "v0.70.0",
-  "schemasDigest": "sha256:b3c430914fee8a4f33dc15051ec59a6a8bad9a84c31fda119b6d683eb523b094",
+  "repositoryVersion": "0.72.0.0",
+  "publishVersion": "0.72.0",
+  "publishTag": "v0.72.0",
+  "schemasDigest": "sha256:e06999bb8befb0b4bb6eda19d70f2fc12dab3c3416ecdd6539e770a40828ffff",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:05b383b27a90f3b3495a327e3da9ab6e13c5c2b047fc9311616ff6e7a283ccab",
-  "generatedTypeScriptDigest": "sha256:184aacb9eb73cec089f8e891b1840873ca9497eb91cf4d3b12cfa9f0a9f305d1",
+  "generatedGoDigest": "sha256:1f39b6a41438726079b882256a402a17047dc1ee0f9209283723cc0125e88932",
+  "generatedTypeScriptDigest": "sha256:67ea1a0023a017eb99a47cd5e7ae2ccdd03d42e1c3ed1b8e9eed69672a7afbda",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -31,20 +31,20 @@
     "schema/ai-transform-result.schema.json": "sha256:244e380a36957ab2dcb526ea22aaecb56b53664ce1fda6934d0021c084c99133",
     "schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
     "schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
-    "schema/app-integrations-declaration.schema.json": "sha256:feaf24ae933173708254ae0a37598db03deda808e0984f2f88963657bdb82428",
+    "schema/app-integrations-declaration.schema.json": "sha256:9a8f6e192158c731afed92aeb76b0b6d0734800870a9e6f61181a95d43e6d7f8",
     "schema/artifact-contract.schema.json": "sha256:8047b461a1c6d07bbe867a259c57bdf5cc0fdf282cf842ec7b683a9e93713b10",
     "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/builder-input-proposal.schema.json": "sha256:fe85cffa6d76b1e1effe1f5d75525f8fe0e1eaa3be4a304e491aa23ad72c0e72",
     "schema/data-dependency.schema.json": "sha256:b4cc2b2484e982cfed64c0f56b8f1e9d1363c71854cd71f845b24fbe7d85c971",
-    "schema/data-grant-v2.schema.json": "sha256:7fa6022aa2fcfd3c94bb969315155ea24e5a1aa25a25cb718df4465397076e07",
+    "schema/data-grant-v2.schema.json": "sha256:576db6f17bbd3c6d700628bb5b93dcb4ade536ab868085634d05ff06476b6272",
     "schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
     "schema/data-source.schema.json": "sha256:899384f4f11b05d2737766918ab47987b11ed49f1160220a55a367fed96f6f2c",
     "schema/deploy-request.schema.json": "sha256:32531e21983cdfeec511f8b4cddd4dad6530cd90e4e9fe147225d78d138b6198",
     "schema/deploy-response.schema.json": "sha256:09064948abdbba7022738285d802ed44648a16ddc2a5b8c2eeb170ae19a66aeb",
-    "schema/deployment-app-registration.schema.json": "sha256:50bc8e308fca14d014a50d96ef1cf403eeeca5c3caea4a204fe15f0080efed32",
+    "schema/deployment-app-registration.schema.json": "sha256:eb705c38466ebd97cb76c1ce7a6177d75c2f10381df75976b40d47eeb8dd5712",
     "schema/deployment-continuation.schema.json": "sha256:55b6945439f2c91cd851dfe4bc9484e67a64091b7763b2d8267354b4a8bfae8c",
     "schema/deployment-environment.schema.json": "sha256:35b26cae07da9ee375a842b5e87c4570c8eca06775e9fd6dd46eb9eb8aa0df6c",
-    "schema/deployment-preview-retirement.schema.json": "sha256:4f945253c3af015f31d6857ec13661f2239e87f2b9dc76cc0a5109d6d40f2a1a",
+    "schema/deployment-preview-retirement.schema.json": "sha256:ccf6b971b7853ca98530272f280fe62cd3aab5425b10b81ae6b717cc949e014f",
     "schema/deployment-source.schema.json": "sha256:256988b1efbfc90bd0e1ae31a2c5d69b20ef1e4471dc24c9f9aa759278270fbe",
     "schema/deployment-status-failure.schema.json": "sha256:7cc021d53a07c63b66eb48146d33e8875b64faf77ee927b235795469eb9a1559",
     "schema/deployment-status-request.schema.json": "sha256:1f9f87adc947a252b53b61f71ae17f8c1b8fbc1166f31301a043d11ac257dc66",
@@ -54,8 +54,8 @@
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
     "schema/integration-connect-result.schema.json": "sha256:3f254b67ef739dc1fa395bdc8c4dc93359b16d481dba2a2d777aa5b6f34b7af8",
     "schema/integration-error-details.schema.json": "sha256:47ad7621c34b092c7e40f912a21e7ccbdc000b974cfb7fa0c9200463e029f8fb",
-    "schema/integration-execute-request.schema.json": "sha256:b0ad5a3f4836d1f724ee9c28c2e55748819004f37ece37e5711a46bbcc85f3a6",
-    "schema/integration-execute-result.schema.json": "sha256:ae0f17788d0933ee67e4f058d57484e192bc6d7d964ee01ec53b94b1777a0724",
+    "schema/integration-execute-request.schema.json": "sha256:2ca56a49ba709c78ca5b84d047c1430a90cf0d7287c4e889d40f34d7a26f3e43",
+    "schema/integration-execute-result.schema.json": "sha256:97f345cfc094a7af1d269486f3b3b90c07d13b70954c2b01dc0313225c9e5bd1",
     "schema/internal-configuration-request.schema.json": "sha256:229d44a3458f68dceddfba802e5c1adcd95523a45af29b93b972706b88461a7d",
     "schema/kit-bundle-manifest.schema.json": "sha256:4a9fcdd52ba0d55718ef4dbdab112b145ef90471d9356d4d3fb41e50fe9e400d",
     "schema/kit-lock.schema.json": "sha256:a48154d9471e49a893d928f7b0e1e0bc77708a4a7edce4fdf14073203e0e8987",
@@ -63,7 +63,7 @@
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
     "schema/resolved-app-serving.schema.json": "sha256:260e30ca16831ddd96b15f44eadc7daa2a5f87a0025588bd6318b236f349ec6b",
-    "schema/saas-connection.schema.json": "sha256:82ed8018201800a95aa792bde1d22568e86b55b3be926aa094a260c8c78a58d7",
+    "schema/saas-connection.schema.json": "sha256:6720b906b89293eebd8c5a6cb8ac6bc14dfca9b13d822e3026641f935b637892",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
     "schema/security-scan-input-v2.schema.json": "sha256:0d418342078c9b5046ea6f4bef3c2c57539285dfee99cc0850d4f0d03739ee13",
@@ -109,10 +109,11 @@
     "gen-go/contracts_test.go": "sha256:56376287cb1548be1b35ab4c65d6f0b558c5d34885f7a47cb3d9e8d786607bf5",
     "gen-go/doc.go": "sha256:316d610ce568597a2ce6f38e9782e34fa5920f6f51ab0866e6d061b8a41cd822",
     "gen-go/error_category.go": "sha256:b2ddea22dcfa030f1a45e721e635485b0bd816cf1f38e7654628a653f5ed4583",
-    "gen-go/integration_execute_input_rules.go": "sha256:7465a20d79cfb82ed5be683eca901677066e9f28fc5355c643a1883a28c4793a",
-    "gen-go/integration_execute_input_rules_test.go": "sha256:0368dce6ee45d06cf8d8444afaa5d92449848187d8f391fffe69654ff1ca861b",
+    "gen-go/integration_execute_input_rules.go": "sha256:0293686700684419c8aae3d78c85b27825b9fc3429b013c5a84a6378c4e3f778",
+    "gen-go/integration_execute_input_rules_test.go": "sha256:9d81e4aac0c3d7f35ea98a40c6d8851570f715ddc95d1ae7324cdc095de4a72e",
+    "gen-go/integration_operations.go": "sha256:ae055414ff7c2c41cd7aaa173ff37376bf3fbd748babac95fee3fcf20d18b353",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:096be357356c51cf346b3e4568014f501cad66c2a482bdb6fd349c9e23bbcea0",
+    "gen-go/types.go": "sha256:115f327d0e6551a8c514aefbecac126948a4846520dcffb6bfb08cb9cbec200f",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -137,21 +138,21 @@
     "gen-ts/ai-transform-result.ts": "sha256:208c66b2aeb425c0cbcc18b7191f6e8989443f2b2c1690648e0e06cc1448ce25",
     "gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
     "gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
-    "gen-ts/app-integrations-declaration.ts": "sha256:92ab07458747623fc8060247818bbf8e75b014efed55c4bb4332d39951a387fa",
+    "gen-ts/app-integrations-declaration.ts": "sha256:c522e5139d8ee454b7cfa2399802e2101de3b3932273106f51f7cf4e26bbb7fb",
     "gen-ts/artifact-contract.ts": "sha256:4a6dc6d2caaeed4bb2066cc8a333e6e09e5a0d4745e0b1038293d54ab9403aeb",
     "gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
     "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
     "gen-ts/builder-input-proposal.ts": "sha256:b0108c3787873d3cf1a39f00967379418a6766275d3474cfa55f5a9d93ead174",
     "gen-ts/data-dependency.ts": "sha256:259f19e2759395d72ead90b8ed74a6dcef0c2641124f4f182823138cfd19bedf",
-    "gen-ts/data-grant-v2.ts": "sha256:b6660cd182b9c73e840bb962e66eafeda28cf003a3596ab8b3572174232da612",
+    "gen-ts/data-grant-v2.ts": "sha256:7ae2df78f14a76712bcab42d35ce5cf8509b317feb4d67f9a1da6bd13cc5dc2b",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
     "gen-ts/data-source.ts": "sha256:1a40c252e94ee717d287ba63647e4368668dad9ea731770f8b58deb17d18b311",
     "gen-ts/deploy-request.ts": "sha256:0214faa8be6680f0bfc117d5ce67c1a59fcc18bd0ea4bc840e03e7d051fa9ab6",
     "gen-ts/deploy-response.ts": "sha256:364d9f1acf32e491498237cdd3f402d5f8e102f208db7748034f4ec68c6a6137",
-    "gen-ts/deployment-app-registration.ts": "sha256:07f840a82dddd770e54e1020a034cdbfc84e226a94131e3f5a4cdd5da8acc2f0",
+    "gen-ts/deployment-app-registration.ts": "sha256:642db3a3f796e5d7089cdb834991277ab1aac5bff37cd5cab42aa2f1c116f0be",
     "gen-ts/deployment-continuation.ts": "sha256:cc9f63af4d0da5086a79103789e4f043783b75b4ed11c6512f044439a551a79c",
     "gen-ts/deployment-environment.ts": "sha256:fc08cabe2e52ebb93cfe84d2019994260f71734c33d0e50e7c63e40ef5b17cef",
-    "gen-ts/deployment-preview-retirement.ts": "sha256:0b30339d6f1d14a9d4a14fa4b59c4c476a5d8aa534be71f7d750c677bb9a2d44",
+    "gen-ts/deployment-preview-retirement.ts": "sha256:309421d08daf0ade163b6457ed0e5410ec6573c40a59423a6cce14780d9c38db",
     "gen-ts/deployment-source.ts": "sha256:8ccb55aaa7260eb6d19a00987d6a20a4b514e343564da13f27cd7fee8013500a",
     "gen-ts/deployment-status-failure.ts": "sha256:6da2e6eb2f708efa51d416a1ec50f71ea7967cf9be9f93e7ce2e4760dae2cfe3",
     "gen-ts/deployment-status-request.ts": "sha256:7ddccd07ab9f6d0821903a291ab35f903bb055727e03a058b99165ec048f6483",
@@ -160,12 +161,13 @@
     "gen-ts/error-category-registry.ts": "sha256:7466a502c0723a77db825cdeaa9556a244201b55d9b7acbf2c098e9e84351df1",
     "gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
-    "gen-ts/index.ts": "sha256:8459b1cf136a0c822795154e2df2a28c848cddfadced329604be893ae6eef069",
+    "gen-ts/index.ts": "sha256:57927b9fcddf506785671bbd44cced9f729373e4dd3e3480bc6c37fd05fb59e8",
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
     "gen-ts/integration-error-details.ts": "sha256:ad7ecec9dd4533a6e86b3508886a7d69937052f52105497285797f77106bcc6f",
-    "gen-ts/integration-execute-input-rules.ts": "sha256:6f97b347d822624cbb4d51dae5834c67696babdea04b4c3aec9361e2bb670886",
-    "gen-ts/integration-execute-request.ts": "sha256:fef0568ab5ffd9e021f3be4ee1178dec5ca1aa54d9799546699ae54b188d2c54",
-    "gen-ts/integration-execute-result.ts": "sha256:79d40eb1f6f75ea06ca69d62bef5a71b5ad0c46eb51ab312fedefd5d3f568cb2",
+    "gen-ts/integration-execute-input-rules.ts": "sha256:3304b0fd14df331a164a035410de9b10885be6585077add4720da39b5d16d527",
+    "gen-ts/integration-execute-request.ts": "sha256:92ee799c42e5434229cb72198382352dabc469a2be551ef5c1926ed5ada45619",
+    "gen-ts/integration-execute-result.ts": "sha256:d72ca736d06741552e6a7be6c98fe1ae506ddaa1e58938b785303fdc3e1784ac",
+    "gen-ts/integration-operations.ts": "sha256:dcb61abfe380637f7537b4d3b8a399fd869e93485b7b3091be2434191a2c82a0",
     "gen-ts/internal-configuration-request.ts": "sha256:7032437797473fa1c581d134adef2f3d4b4f4132f482cd17743e9d47097886bc",
     "gen-ts/kit-bundle-manifest.ts": "sha256:2777a268aef8787b81e71d154a7d05f6f5ded09d66f378211ff5493ddb885171",
     "gen-ts/kit-lock.ts": "sha256:00ceeb97e9b7d0187bec00728f5099fd34e775e9cc44c85c4714f7a3a4118ef6",
@@ -173,7 +175,7 @@
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
     "gen-ts/resolved-app-serving.ts": "sha256:6131a6cc5f784f0d101081d2ce1b96b76b2f904b2c5e7b2809f9ede5878ada1f",
-    "gen-ts/saas-connection.ts": "sha256:a4b7a9b37db0cf747ca1c40db5b1459ade2a86cc067146154c3c42484b76e07a",
+    "gen-ts/saas-connection.ts": "sha256:f169d1bf454ad926bb15dfbc3f6b8dd7e8a3ed6bce77ce244a2069e5667de935",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",

package/dist/gen-ts/app-integrations-declaration.d.ts

@@ -1,4 +1,8 @@
 export type IntegrationConnectionKind = 'saas' | 'database';
+/**
+ * Whose authority an operation runs under. Fixed per operation, except the declared-mode Slack operations (slack.message.post; since 0.71.0 also slack.channel.history, slack.message.update, slack.message.delete): declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
+ */
+export type IntegrationIdentityMode = 'app' | 'user';
 /**
  * Tenant-wide logical alias of a connection (governance sourceId) or of a resource under it.
  */
@@ -8,16 +12,12 @@ export type IntegrationAlias = string;
  * @maxItems 64
  */
 export type ResourceNames = IntegrationAlias[];
-/**
- * Whose authority an operation runs under. Fixed per operation, except slack.message.post: declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
- */
-export type IntegrationIdentityMode = 'app' | 'user';
 /**
  * A plain warehouse column identifier, or `*` as the sole selection when IT exposed all current and future columns.
  */
 export type ColumnName = string;
 /**
- * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each slack.message.post call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
+ * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (twelve operations since 0.71.0, ADR 0018). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, warehouse.view.read=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
  */
 export interface AppIntegrationsDeclaration {
     schema: 'isomorph.app-integrations/2.0';
@@ -29,11 +29,17 @@ export interface DeclaredConnection {
     kind: IntegrationConnectionKind;
     presentation?: IntegrationPresentation;
     operations: {
-        'slack.channel.history'?: UserModeChannelOperation;
+        'slack.channel.history'?: DeclaredModeChannelOperation;
         'slack.message.post'?: DeclaredModeChannelOperation;
+        'slack.message.update'?: DeclaredModeChannelOperation;
+        'slack.message.delete'?: DeclaredModeChannelOperation;
+        'slack.dm.send'?: AppModeChannelOperation;
+        'slack.user.lookup'?: AppModeChannelOperation;
         'gmail.thread.list'?: UserModeChannelOperation;
+        'gmail.thread.read'?: UserModeChannelOperation;
         'gmail.message.read'?: UserModeChannelOperation;
         'gmail.message.send'?: UserModeChannelOperation;
+        'gmail.attachment.read'?: UserModeChannelOperation;
         'warehouse.view.read'?: AppModeViewOperation;
     };
 }
@@ -50,17 +56,24 @@ export interface IntegrationPresentation {
      */
     iconEmoji?: string;
 }
-export interface UserModeChannelOperation {
-    identity: 'user';
-    resources: ResourceNames;
-}
 /**
- * slack.message.post: the app declares the mode — app (posts as the company's Slack app) or user (posts as the signed-in person).
+ * slack.message.post, slack.channel.history, slack.message.update, slack.message.delete: the app declares the mode — app (acts as the company's Slack app) or user (acts as the signed-in person).
  */
 export interface DeclaredModeChannelOperation {
     identity: IntegrationIdentityMode;
     resources: ResourceNames;
 }
+/**
+ * slack.dm.send, slack.user.lookup (0.71.0): app mode only — the company's Slack app messages people or resolves them by email; the resource is the fixed `workspace` alias.
+ */
+export interface AppModeChannelOperation {
+    identity: 'app';
+    resources: ResourceNames;
+}
+export interface UserModeChannelOperation {
+    identity: 'user';
+    resources: ResourceNames;
+}
 export interface AppModeViewOperation {
     identity: 'app';
     resources: {

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.70.0.0";
-export declare const ContractPublishVersion: "0.70.0";
-export declare const ContractPublishTag: "v0.70.0";
-export declare const ContractSchemasDigest: "sha256:b3c430914fee8a4f33dc15051ec59a6a8bad9a84c31fda119b6d683eb523b094";
+export declare const ContractRepositoryVersion: "0.72.0.0";
+export declare const ContractPublishVersion: "0.72.0";
+export declare const ContractPublishTag: "v0.72.0";
+export declare const ContractSchemasDigest: "sha256:e06999bb8befb0b4bb6eda19d70f2fc12dab3c3416ecdd6539e770a40828ffff";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:05b383b27a90f3b3495a327e3da9ab6e13c5c2b047fc9311616ff6e7a283ccab";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:184aacb9eb73cec089f8e891b1840873ca9497eb91cf4d3b12cfa9f0a9f305d1";
+export declare const ContractGeneratedGoDigest: "sha256:1f39b6a41438726079b882256a402a17047dc1ee0f9209283723cc0125e88932";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:67ea1a0023a017eb99a47cd5e7ae2ccdd03d42e1c3ed1b8e9eed69672a7afbda";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.70.0.0";
-export const ContractPublishVersion = "0.70.0";
-export const ContractPublishTag = "v0.70.0";
-export const ContractSchemasDigest = "sha256:b3c430914fee8a4f33dc15051ec59a6a8bad9a84c31fda119b6d683eb523b094";
+export const ContractRepositoryVersion = "0.72.0.0";
+export const ContractPublishVersion = "0.72.0";
+export const ContractPublishTag = "v0.72.0";
+export const ContractSchemasDigest = "sha256:e06999bb8befb0b4bb6eda19d70f2fc12dab3c3416ecdd6539e770a40828ffff";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:05b383b27a90f3b3495a327e3da9ab6e13c5c2b047fc9311616ff6e7a283ccab";
-export const ContractGeneratedTypeScriptDigest = "sha256:184aacb9eb73cec089f8e891b1840873ca9497eb91cf4d3b12cfa9f0a9f305d1";
+export const ContractGeneratedGoDigest = "sha256:1f39b6a41438726079b882256a402a17047dc1ee0f9209283723cc0125e88932";
+export const ContractGeneratedTypeScriptDigest = "sha256:67ea1a0023a017eb99a47cd5e7ae2ccdd03d42e1c3ed1b8e9eed69672a7afbda";

package/dist/gen-ts/data-grant-v2.d.ts

@@ -23,17 +23,17 @@ export interface DataGrantV2 {
      */
     sourceId: string;
     /**
-     * Whose authority an operation runs under. Fixed per operation, except slack.message.post: declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
+     * Whose authority an operation runs under. Fixed per operation, except the declared-mode Slack operations (slack.message.post; since 0.71.0 also slack.channel.history, slack.message.update, slack.message.delete): declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
      */
     mode: 'app' | 'user';
     kind: 'saas' | 'database';
     status: DataGrantV2Status;
     /**
-     * Approved operations; each must match this grant's mode. Empty until the first approval.
+     * Approved operations; each must match this grant's mode. Empty until the first approval. At most the eleven SaaS operations (0.71.0); a database grant holds one.
      *
-     * @maxItems 5
+     * @maxItems 11
      */
-    operations: ('slack.channel.history' | 'slack.message.post' | 'gmail.thread.list' | 'gmail.message.read' | 'gmail.message.send' | 'warehouse.view.read')[];
+    operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'warehouse.view.read')[];
     /**
      * Approved logical resources. Never inherited by wildcard. Empty until the first approval.
      *
@@ -72,7 +72,7 @@ export interface DataGrantV2 {
     updatedAt: string;
     /**
      * @deprecated
-     * Whose authority an operation runs under. Fixed per operation, except slack.message.post: declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
+     * Whose authority an operation runs under. Fixed per operation, except the declared-mode Slack operations (slack.message.post; since 0.71.0 also slack.channel.history, slack.message.update, slack.message.delete): declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
      */
     identityMode?: 'app' | 'user';
     /**

package/dist/gen-ts/deployment-app-registration.d.ts

@@ -1,5 +1,5 @@
 /**
- * IAM/SigV4 POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
+ * IAM/SigV4 POST /v1/internal/deployment/apps/{appId}/register (Internal API) or POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
  */
 export interface DeploymentAppRegistration {
     tenantId: string;

package/dist/gen-ts/deployment-preview-retirement.d.ts

@@ -1,5 +1,5 @@
 /**
- * IAM-protected POST /v1/deployment/apps/retire-preview request after production is LIVE and the deployment plane holds the preview retirement reservation. Disables only the registered preview version's serving routes and workload authority.
+ * IAM-protected POST /v1/internal/deployment/apps/{appId}/retire-preview (Internal API) or POST /v1/deployment/apps/retire-preview request after production is LIVE and the deployment plane holds the preview retirement reservation. Disables only the registered preview version's serving routes and workload authority.
  */
 export interface DeploymentPreviewRetirement {
     tenantId: string;

package/dist/gen-ts/index.d.ts

@@ -48,6 +48,7 @@ export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';
 export * from './integration-execute-request.js';
 export * from './integration-execute-result.js';
+export * from './integration-operations.js';
 export * from './internal-configuration-request.js';
 export * from './kit-bundle-manifest.js';
 export * from './kit-lock.js';

package/dist/gen-ts/index.js

@@ -50,6 +50,7 @@ export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';
 export * from './integration-execute-request.js';
 export * from './integration-execute-result.js';
+export * from './integration-operations.js';
 export * from './internal-configuration-request.js';
 export * from './kit-bundle-manifest.js';
 export * from './kit-lock.js';

package/dist/gen-ts/integration-execute-input-rules.d.ts

@@ -28,6 +28,7 @@ export type IntegrationExecuteInputFieldRule = {
         maxLength?: number;
         pattern?: string;
     };
+    default?: readonly string[];
 } | {
     kind: 'enum';
     required: boolean;
@@ -64,9 +65,27 @@ export declare const IntegrationExecuteInputRules: {
                 readonly kind: "integer";
                 readonly required: false;
                 readonly minimum: 1;
-                readonly maximum: 15;
+                readonly maximum: 100;
                 readonly default: 15;
             };
+            readonly cursor: {
+                readonly kind: "string";
+                readonly required: false;
+                readonly minLength: 1;
+                readonly maxLength: 256;
+            };
+            readonly oldest: {
+                readonly kind: "string";
+                readonly required: false;
+                readonly minLength: 1;
+                readonly maxLength: 64;
+            };
+            readonly latest: {
+                readonly kind: "string";
+                readonly required: false;
+                readonly minLength: 1;
+                readonly maxLength: 64;
+            };
         };
     };
     readonly "slack.message.post": {
@@ -78,6 +97,93 @@ export declare const IntegrationExecuteInputRules: {
                 readonly minLength: 1;
                 readonly maxLength: 4000;
             };
+            readonly threadId: {
+                readonly kind: "string";
+                readonly required: false;
+                readonly minLength: 0;
+                readonly pattern: "^[A-Za-z0-9._-]{1,64}$";
+            };
+            readonly format: {
+                readonly kind: "enum";
+                readonly required: false;
+                readonly values: readonly ["plain", "mrkdwn"];
+                readonly default: "plain";
+            };
+        };
+    };
+    readonly "slack.message.update": {
+        readonly idempotencyKey: false;
+        readonly fields: {
+            readonly messageId: {
+                readonly kind: "string";
+                readonly required: true;
+                readonly minLength: 0;
+                readonly pattern: "^[A-Za-z0-9._-]{1,64}$";
+            };
+            readonly text: {
+                readonly kind: "string";
+                readonly required: true;
+                readonly minLength: 1;
+                readonly maxLength: 4000;
+            };
+            readonly format: {
+                readonly kind: "enum";
+                readonly required: false;
+                readonly values: readonly ["plain", "mrkdwn"];
+                readonly default: "plain";
+            };
+        };
+    };
+    readonly "slack.message.delete": {
+        readonly idempotencyKey: false;
+        readonly fields: {
+            readonly messageId: {
+                readonly kind: "string";
+                readonly required: true;
+                readonly minLength: 0;
+                readonly pattern: "^[A-Za-z0-9._-]{1,64}$";
+            };
+        };
+    };
+    readonly "slack.dm.send": {
+        readonly idempotencyKey: true;
+        readonly fields: {
+            readonly to: {
+                readonly kind: "string[]";
+                readonly required: true;
+                readonly minItems: 1;
+                readonly maxItems: 8;
+                readonly uniqueItems: true;
+                readonly item: {
+                    readonly minLength: 3;
+                    readonly maxLength: 254;
+                    readonly pattern: "^[^\\s@<>,;\"]+@[^\\s@<>,;\"]+\\.[^\\s@<>,;\"]+$";
+                };
+            };
+            readonly text: {
+                readonly kind: "string";
+                readonly required: true;
+                readonly minLength: 1;
+                readonly maxLength: 4000;
+            };
+            readonly format: {
+                readonly kind: "enum";
+                readonly required: false;
+                readonly values: readonly ["plain", "mrkdwn"];
+                readonly default: "plain";
+            };
+        };
+    };
+    readonly "slack.user.lookup": {
+        readonly idempotencyKey: false;
+        readonly fields: {
+            readonly email: {
+                readonly kind: "string";
+                readonly required: true;
+                readonly minLength: 3;
+                readonly maxLength: 254;
+                readonly pattern: "^[^\\s@<>,;\"]+@[^\\s@<>,;\"]+\\.[^\\s@<>,;\"]+$";
+            };
         };
     };
     readonly "gmail.thread.list": {
@@ -87,9 +193,44 @@ export declare const IntegrationExecuteInputRules: {
                 readonly kind: "integer";
                 readonly required: false;
                 readonly minimum: 1;
-                readonly maximum: 15;
+                readonly maximum: 50;
                 readonly default: 15;
             };
+            readonly q: {
+                readonly kind: "string";
+                readonly required: false;
+                readonly minLength: 1;
+                readonly maxLength: 256;
+            };
+            readonly labelIds: {
+                readonly kind: "string[]";
+                readonly required: false;
+                readonly minItems: 1;
+                readonly maxItems: 5;
+                readonly uniqueItems: true;
+                readonly item: {
+                    readonly minLength: 1;
+                    readonly maxLength: 64;
+                };
+                readonly default: readonly ["INBOX"];
+            };
+            readonly pageToken: {
+                readonly kind: "string";
+                readonly required: false;
+                readonly minLength: 1;
+                readonly maxLength: 256;
+            };
+        };
+    };
+    readonly "gmail.thread.read": {
+        readonly idempotencyKey: false;
+        readonly fields: {
+            readonly threadId: {
+                readonly kind: "string";
+                readonly required: true;
+                readonly minLength: 0;
+                readonly pattern: "^[A-Za-z0-9._-]{1,64}$";
+            };
         };
     };
     readonly "gmail.message.read": {
@@ -99,7 +240,7 @@ export declare const IntegrationExecuteInputRules: {
                 readonly kind: "string";
                 readonly required: true;
                 readonly minLength: 0;
-                readonly pattern: "^[A-Za-z0-9_-]{1,64}$";
+                readonly pattern: "^[A-Za-z0-9._-]{1,64}$";
             };
         };
     };
@@ -154,6 +295,38 @@ export declare const IntegrationExecuteInputRules: {
                 readonly minLength: 1;
                 readonly maxLength: 4000;
             };
+            readonly html: {
+                readonly kind: "string";
+                readonly required: false;
+                readonly minLength: 1;
+                readonly maxLength: 65536;
+            };
+            readonly attachments: {
+                readonly kind: "object[]";
+                readonly required: false;
+                readonly minItems: 1;
+                readonly maxItems: 5;
+                readonly fields: {
+                    readonly filename: {
+                        readonly kind: "string";
+                        readonly required: true;
+                        readonly minLength: 1;
+                        readonly maxLength: 255;
+                    };
+                    readonly contentType: {
+                        readonly kind: "string";
+                        readonly required: true;
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                    };
+                    readonly dataBase64: {
+                        readonly kind: "string";
+                        readonly required: true;
+                        readonly minLength: 1;
+                        readonly maxLength: 2796203;
+                    };
+                };
+            };
             readonly replyToMessageId: {
                 readonly kind: "string";
                 readonly required: false;
@@ -162,6 +335,23 @@ export declare const IntegrationExecuteInputRules: {
             };
         };
     };
+    readonly "gmail.attachment.read": {
+        readonly idempotencyKey: false;
+        readonly fields: {
+            readonly messageId: {
+                readonly kind: "string";
+                readonly required: true;
+                readonly minLength: 0;
+                readonly pattern: "^[A-Za-z0-9._-]{1,64}$";
+            };
+            readonly attachmentId: {
+                readonly kind: "string";
+                readonly required: true;
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+        };
+    };
     readonly "warehouse.view.read": {
         readonly idempotencyKey: false;
         readonly fields: {