@fourier-labs/harbour-contracts 0.73.0 → 0.76.0

package/dist/gen-ts/saas-connection.d.ts

@@ -1,7 +1,7 @@
 /**
- * Slack carries an installation and a channel map; Gmail is user-consent only.
+ * Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`.
  */
-export type SaasProvider = 'slack' | 'gmail';
+export type SaasProvider = 'slack' | 'gmail' | 'basecamp';
 /**
  * DISABLED stops every app call immediately (details.code CONNECTION_DISABLED).
  */
@@ -23,7 +23,7 @@ export type ExternalRecipientMode = 'block' | 'allowlist' | 'allow';
  */
 export type InstallationName = string;
 /**
- * Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.
+ * Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.
  */
 export interface SaasConnection {
     schema: 'harbour.saas-connection/1.0';
@@ -41,22 +41,23 @@ export interface SaasConnection {
      */
     version: number;
     installation?: SaasInstallation;
+    account?: BasecampAccount;
     /**
-     * Logical channel alias -> provider channel ID, shared by every environment. Always empty for Gmail.
+     * Logical alias → provider resource id: a Slack channel id or a Basecamp project id. Always empty for Gmail.
      */
     channels: {
         /**
-         * Provider channel ID; only public, non-archived channels are valid.
+         * A Slack channel id (public, non-archived) or a Basecamp project id (digits).
          */
         [k: string]: string;
     };
     /**
-     * Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read). Never warehouse.view.read.
+     * Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list). Never warehouse.view.read.
      *
      * @minItems 1
-     * @maxItems 11
+     * @maxItems 22
      */
-    operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'warehouse.view.read' | 'service.request')[];
+    operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'basecamp.project.list' | 'basecamp.todolist.list' | 'basecamp.todo.list' | 'basecamp.todo.create' | 'basecamp.todo.complete' | 'basecamp.message.list' | 'basecamp.message.post' | 'basecamp.comment.list' | 'basecamp.comment.post' | 'basecamp.campfire.post' | 'basecamp.people.list' | 'warehouse.view.read' | 'service.request')[];
     developmentPreapproval: DevelopmentPreapproval;
     oauthClient?: SaasOauthClient;
     userModeApproval?: UserModeApproval;
@@ -120,6 +121,19 @@ export interface SaasInstallation {
      */
     botName?: string;
 }
+/**
+ * The pinned Basecamp account (0.76.0, Basecamp only): the one account, among those IT's own Basecamp sign-in belongs to, that every user token on this connection must also belong to and that every project id in `channels` lives in. Absent until IT chooses it; governance refuses every basecamp.* call until then.
+ */
+export interface BasecampAccount {
+    /**
+     * The Basecamp account id, the first path segment of the API base URL.
+     */
+    id: string;
+    /**
+     * The account's name as Basecamp shows it, for IT to recognise.
+     */
+    name: string;
+}
 export interface DevelopmentPreapproval {
     /**
      * Auto-approve development requests within the allowlist.

package/gen-ts/app-integrations-declaration.ts

@@ -16,6 +16,17 @@ export type DeclaredConnection = {
     'gmail.message.read'?: UserModeChannelOperation;
     'gmail.message.send'?: UserModeChannelOperation;
     'gmail.attachment.read'?: UserModeChannelOperation;
+    'basecamp.project.list'?: UserModeChannelOperation;
+    'basecamp.todolist.list'?: UserModeChannelOperation;
+    'basecamp.todo.list'?: UserModeChannelOperation;
+    'basecamp.todo.create'?: UserModeChannelOperation;
+    'basecamp.todo.complete'?: UserModeChannelOperation;
+    'basecamp.message.list'?: UserModeChannelOperation;
+    'basecamp.message.post'?: UserModeChannelOperation;
+    'basecamp.comment.list'?: UserModeChannelOperation;
+    'basecamp.comment.post'?: UserModeChannelOperation;
+    'basecamp.campfire.post'?: UserModeChannelOperation;
+    'basecamp.people.list'?: UserModeChannelOperation;
     'warehouse.view.read'?: AppModeViewOperation;
     'service.request'?: ServiceOperation;
   };
@@ -40,7 +51,7 @@ export type ResourceNames = IntegrationAlias[];
 export type ColumnName = string;
 
 /**
- * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (thirteen operations since 0.73.0, ADR 0018). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, warehouse.view.read=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
+ * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (twenty-four operations since 0.76.0, ADR 0018 and ADR 0022). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, every basecamp.* operation=user, warehouse.view.read=app, service.request=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack, Gmail and Basecamp operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. Basecamp (0.76.0, ADR 0022) is user-mode only too: basecamp.project.list runs on the fixed `account` alias (the company's pinned Basecamp account) and every other basecamp.* operation on a project alias IT mapped in the connection's `channels` map, so Basecamp itself refuses an id outside that project. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
  */
 export interface AppIntegrationsDeclaration {
   schema: 'isomorph.app-integrations/2.0';
@@ -75,6 +86,9 @@ export interface AppModeChannelOperation {
   identity: 'app';
   resources: ResourceNames;
 }
+/**
+ * Every gmail.* operation (resource: the fixed `inbox` alias) and, since 0.76.0, every basecamp.* operation (resource: a project alias from the connection's `channels` map, or the fixed `account` alias for basecamp.project.list): user mode only — the app acts as the signed-in person after their own consent.
+ */
 export interface UserModeChannelOperation {
   identity: 'user';
   resources: ResourceNames;

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.73.0.0" as const;
-export const ContractPublishVersion = "0.73.0" as const;
-export const ContractPublishTag = "v0.73.0" as const;
-export const ContractSchemasDigest = "sha256:c0f37c59c7c2decb4fb62d96596b787628483bdcdb09756c3ea286385d31a5f5" as const;
+export const ContractRepositoryVersion = "0.76.0.0" as const;
+export const ContractPublishVersion = "0.76.0" as const;
+export const ContractPublishTag = "v0.76.0" as const;
+export const ContractSchemasDigest = "sha256:20ed0df1c63b7aec22d74c3582b1e6c5d36a974005bfe656f03f8f746b371fa7" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:eb98ee80133c91e8562b95d92388c5bb637a06ae8d97a0827f528cd6decde8c9" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:ad539efcc9e4a7521f9526dd6304215f6b764be64bd40cd598ec023f6bbb4583" as const;
+export const ContractGeneratedGoDigest = "sha256:db5f27b48a5e6b3706ac0173ebe37ec26deed375be46646b592da35a3aebcce4" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:9467bd533c557df0b263789b8585f0201abd9f536506ec28400e245be18dae42" as const;

package/gen-ts/data-grant-v2.ts

@@ -12,7 +12,7 @@ export type DataGrantV2ProvisioningStatus = 'NONE' | 'PENDING' | 'FAILED' | 'DON
 export type DataGrantV2CleanupStatus = 'PENDING' | 'FAILED' | 'DONE';
 
 /**
- * An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON ["v2",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. An app-mode Slack grant may carry `presentation` (0.53.0): the IT-approved display name and icon the app's posts go out under, copied from the approved request and read by every post — never from the call. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.
+ * An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON ["v2",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. An app-mode Slack grant may carry `presentation` (0.53.0): the IT-approved display name and icon the app's posts go out under, copied from the approved request and read by every post — never from the call. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.
  */
 export interface DataGrantV2 {
   schema: 'harbour.data-grant/2.0';
@@ -33,9 +33,9 @@ export interface DataGrantV2 {
   kind: 'saas' | 'database' | 'service';
   status: DataGrantV2Status;
   /**
-   * Approved operations; each must match this grant's mode. Empty until the first approval. At most the eleven SaaS operations (0.71.0); a database grant holds one.
+   * Approved operations; each must match this grant's mode. Empty until the first approval. At most the twenty-two SaaS operations (0.76.0: eleven Slack and Gmail, eleven Basecamp); a database grant holds one.
    *
-   * @maxItems 11
+   * @maxItems 22
    */
   operations: (
     | 'slack.channel.history'
@@ -49,6 +49,17 @@ export interface DataGrantV2 {
     | 'gmail.message.read'
     | 'gmail.message.send'
     | 'gmail.attachment.read'
+    | 'basecamp.project.list'
+    | 'basecamp.todolist.list'
+    | 'basecamp.todo.list'
+    | 'basecamp.todo.create'
+    | 'basecamp.todo.complete'
+    | 'basecamp.message.list'
+    | 'basecamp.message.post'
+    | 'basecamp.comment.list'
+    | 'basecamp.comment.post'
+    | 'basecamp.campfire.post'
+    | 'basecamp.people.list'
     | 'warehouse.view.read'
     | 'service.request'
   )[];
@@ -100,7 +111,7 @@ export interface DataGrantV2 {
   installation?: string;
 }
 /**
- * One approved logical resource: a channel alias, the fixed Gmail `inbox` alias, or a warehouse view alias with the approved columns.
+ * One approved logical resource: a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias (0.76.0), or a warehouse view alias with the approved columns.
  */
 export interface IntegrationResource {
   /**

package/gen-ts/data-source.ts

@@ -2,9 +2,9 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Closed connector set for the Data-Access MVP.
+ * Closed connector set for the Data-Access MVP. trino (0.74.0): Trino/Presto-compatible engines (Trino, Presto, Starburst, Galaxy) over the Trino HTTP statement protocol; the endpoint reuses host, port and database (as the Trino catalog) with no connector-specific fields.
  */
-export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks' | 'mysql';
+export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks' | 'mysql' | 'trino';
 /**
  * byo = admin brought existing infrastructure; harbour_managed = Isomorph provisioned it.
  */
@@ -54,6 +54,13 @@ export interface DataSource {
    */
   allowValidation?: boolean;
   status: DataSourceStatus;
+  /**
+   * 0.74.0: per-environment copies of the source. A read for an environment that has a copy here uses that copy's endpoint and credentialRef; production always uses the top-level endpoint and credentialRef. A development read with no development copy is answered from the app's sample rows (integration-execute-request.sampleRows), never from the source; a preview read with no preview copy uses the production endpoint. A laptop never reads the production endpoint.
+   */
+  environments?: {
+    development?: DataSourceEnvironmentCopy;
+    preview?: DataSourceEnvironmentCopy;
+  };
 }
 /**
  * Connector endpoint coordinates. host is always present; database vs project/workspace depends on the connector family.
@@ -80,3 +87,13 @@ export interface DataSourceEndpoint {
    */
   workspace?: string;
 }
+/**
+ * One environment's copy of a source: the same endpoint and credentialRef shapes as the top-level fields, for the same connector.
+ */
+export interface DataSourceEnvironmentCopy {
+  endpoint: DataSourceEndpoint;
+  /**
+   * secretref URI naming the platform-held credential for this copy. The referenced value never crosses this boundary.
+   */
+  credentialRef: string;
+}

package/gen-ts/integration-error-details.ts

@@ -7,7 +7,7 @@
 export type IntegrationErrorCategory =
   'AUTH_REQUIRED' | 'FORBIDDEN' | 'NOT_FOUND' | 'CONFLICT' | 'VALIDATION_FAILED' | 'RATE_LIMITED' | 'UNAVAILABLE';
 /**
- * Stable reason codes. SEND_OUTCOME_UNKNOWN: dispatch happened but the outcome is unknown; never re-post automatically. SEND_KEY_REUSED: the idempotency key was seen with a different payload or subject. GRANT_DENIED: IT denied the request. TOKEN_REFRESH_PENDING: another call holds the refresh lease; retry shortly. REQUEST_PENDING: a different request for this grant is still open. INPUT_INVALID: the operation input failed its bounds. IDEMPOTENCY_KEY_REQUIRED: a send without a UUID idempotencyKey. SEND_IN_PROGRESS: a retry arrived while the first send of that key is still running. CONNECTION_NOT_FOUND / APP_NOT_FOUND / GRANT_NOT_FOUND: the named record does not exist. AUTH_REQUIRED: no verified caller. UNAVAILABLE: the governance dependency (store, provider seam) is unreachable. MODE_NOT_GRANTED (403 FORBIDDEN, 0.55.0): a slack.message.post named a mode (app or user) IT has not approved for this app; the post is never served under the other mode. MODE_REQUIRED (400 VALIDATION_FAILED, 0.55.0): the app holds approved grants for both modes and the post named neither.
+ * Stable reason codes. SEND_OUTCOME_UNKNOWN: dispatch happened but the outcome is unknown; never re-post automatically. SEND_KEY_REUSED: the idempotency key was seen with a different payload or subject. GRANT_DENIED: IT denied the request. TOKEN_REFRESH_PENDING: another call holds the refresh lease; retry shortly. REQUEST_PENDING: a different request for this grant is still open. INPUT_INVALID: the operation input failed its bounds. IDEMPOTENCY_KEY_REQUIRED: a send without a UUID idempotencyKey. SEND_IN_PROGRESS: a retry arrived while the first send of that key is still running. CONNECTION_NOT_FOUND / APP_NOT_FOUND / GRANT_NOT_FOUND: the named record does not exist. AUTH_REQUIRED: no verified caller. UNAVAILABLE: the governance dependency (store, provider seam) is unreachable. MODE_NOT_GRANTED (403 FORBIDDEN, 0.55.0): a slack.message.post named a mode (app or user) IT has not approved for this app; the post is never served under the other mode. MODE_REQUIRED (400 VALIDATION_FAILED, 0.55.0): the app holds approved grants for both modes and the post named neither. SAMPLE_ROWS_NOT_ALLOWED (400 VALIDATION_FAILED, 0.74.0): an execute request carried sampleRows on any route but the development one. A sample value that does not parse as the column's recorded type is INPUT_INVALID, naming the column and the row.
  */
 export type IntegrationErrorCode =
   | 'USER_CONNECTION_REQUIRED'
@@ -39,7 +39,8 @@ export type IntegrationErrorCode =
   | 'AUTH_REQUIRED'
   | 'UNAVAILABLE'
   | 'MODE_NOT_GRANTED'
-  | 'MODE_REQUIRED';
+  | 'MODE_REQUIRED'
+  | 'SAMPLE_ROWS_NOT_ALLOWED';
 
 /**
  * The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto IsomorphError(category, message, details). `category` is the app-SDK IsomorphErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.

package/gen-ts/integration-execute-input-rules.ts

@@ -15,7 +15,8 @@ export type IntegrationExecuteInputFieldRule =
   | { kind: 'string[]'; required: boolean; minItems: number; maxItems: number; uniqueItems: boolean; item: { minLength: number; maxLength?: number; pattern?: string }; default?: readonly string[] }
   | { kind: 'enum'; required: boolean; values: readonly string[]; default?: string }
   | { kind: 'object[]'; required: boolean; minItems: number; maxItems: number; fields: Readonly<Record<string, IntegrationExecuteInputFieldRule>> }
-  | { kind: 'value'; required: boolean; types: readonly IntegrationExecuteInputValueType[]; maxLength?: number; list?: { minItems: number; maxItems: number; types: readonly IntegrationExecuteInputValueType[] } };
+  | { kind: 'value'; required: boolean; types: readonly IntegrationExecuteInputValueType[]; maxLength?: number; list?: { minItems: number; maxItems: number; types: readonly IntegrationExecuteInputValueType[] } }
+  | { kind: 'boolean'; required: boolean };
 
 /** The scalar types a `value` input accepts, alone or in its list form. */
 export type IntegrationExecuteInputValueType = 'string' | 'number' | 'boolean';
@@ -113,6 +114,87 @@ export const IntegrationExecuteInputRules = {
       attachmentId: { kind: "string", required: true, minLength: 1, maxLength: 512 },
     },
   },
+  "basecamp.project.list": {
+    idempotencyKey: false,
+    fields: {
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 256 },
+      projectStatus: { kind: "enum", required: false, values: ["active", "archived"] },
+    },
+  },
+  "basecamp.todolist.list": {
+    idempotencyKey: false,
+    fields: {
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 256 },
+    },
+  },
+  "basecamp.todo.list": {
+    idempotencyKey: false,
+    fields: {
+      todolistId: { kind: "string", required: true, minLength: 0, pattern: "^[0-9]{1,20}$" },
+      completed: { kind: "boolean", required: false },
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 256 },
+    },
+  },
+  "basecamp.todo.create": {
+    idempotencyKey: true,
+    fields: {
+      todolistId: { kind: "string", required: true, minLength: 0, pattern: "^[0-9]{1,20}$" },
+      content: { kind: "string", required: true, minLength: 1, maxLength: 1000 },
+      description: { kind: "string", required: false, minLength: 1, maxLength: 16384 },
+      contentFormat: { kind: "enum", required: false, values: ["plain", "html"], default: "plain" },
+      dueOn: { kind: "string", required: false, minLength: 0, pattern: "^\\d{4}-\\d{2}-\\d{2}$" },
+      assigneeIds: { kind: "string[]", required: false, minItems: 1, maxItems: 20, uniqueItems: true, item: { minLength: 0, pattern: "^[0-9]{1,20}$" } },
+      notify: { kind: "boolean", required: false },
+    },
+  },
+  "basecamp.todo.complete": {
+    idempotencyKey: false,
+    fields: {
+      todoId: { kind: "string", required: true, minLength: 0, pattern: "^[0-9]{1,20}$" },
+    },
+  },
+  "basecamp.message.list": {
+    idempotencyKey: false,
+    fields: {
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 256 },
+    },
+  },
+  "basecamp.message.post": {
+    idempotencyKey: true,
+    fields: {
+      subject: { kind: "string", required: true, minLength: 1, maxLength: 256 },
+      content: { kind: "string", required: true, minLength: 1, maxLength: 65536 },
+      contentFormat: { kind: "enum", required: false, values: ["plain", "html"], default: "plain" },
+    },
+  },
+  "basecamp.comment.list": {
+    idempotencyKey: false,
+    fields: {
+      recordingId: { kind: "string", required: true, minLength: 0, pattern: "^[0-9]{1,20}$" },
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 256 },
+    },
+  },
+  "basecamp.comment.post": {
+    idempotencyKey: true,
+    fields: {
+      recordingId: { kind: "string", required: true, minLength: 0, pattern: "^[0-9]{1,20}$" },
+      content: { kind: "string", required: true, minLength: 1, maxLength: 16384 },
+      contentFormat: { kind: "enum", required: false, values: ["plain", "html"], default: "plain" },
+    },
+  },
+  "basecamp.campfire.post": {
+    idempotencyKey: true,
+    fields: {
+      content: { kind: "string", required: true, minLength: 1, maxLength: 4000 },
+      contentFormat: { kind: "enum", required: false, values: ["plain", "html"], default: "plain" },
+    },
+  },
+  "basecamp.people.list": {
+    idempotencyKey: false,
+    fields: {
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 256 },
+    },
+  },
   "warehouse.view.read": {
     idempotencyKey: false,
     fields: {
@@ -209,6 +291,9 @@ function checkField(operation: string, path: string, name: string, field: Integr
     case 'object':
       if (value === null || typeof value !== 'object' || Array.isArray(value)) return refuse(path, `${path} must be a JSON object`);
       return { ok: true, value };
+    case 'boolean':
+      if (typeof value !== 'boolean') return refuse(path, `${path} must be a boolean`);
+      return { ok: true, value };
     case 'integer':
       if (typeof value !== 'number' || !Number.isInteger(value) || value < field.minimum || value > field.maximum) return refuse(path, `${path} must be an integer between ${field.minimum} and ${field.maximum}`);
       return { ok: true, value };

package/gen-ts/integration-execute-request.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is fixed by the operation for every operation but the declared-mode Slack operations (slack.channel.history, slack.message.post, slack.message.update, slack.message.delete; 0.71.0 widened history), and always enforced from an approved grant; any identity/userId/scope field is rejected by additionalProperties. A declared-mode operation runs as the app (for a post: the IT-approved per-app name from the grant, plus a "Posted by <app> on Isomorph" footer) or as the signed-in person (no name, no footer) — the same input either way — and since 0.55.0 the call names which of the app's approved modes it runs under (`mode`): required when IT approved both modes for the app (MODE_REQUIRED otherwise), optional when it approved one (that one is used), and a named mode without an approved grant is refused (MODE_NOT_GRANTED) rather than served under the other, so approval order never decides what a call does. Per-operation input bounds (0.71.0, ADR 0018): slack.channel.history {limit? 1..100, default 15, cursor?, oldest?, latest?}; slack.message.post {text 1..4000 chars, threadId?, format? plain|mrkdwn} and a required idempotencyKey retained across retries of one explicit Send; slack.message.update {messageId, text, format?}; slack.message.delete {messageId}; slack.dm.send {to 1..8 addresses, text, format?} (app mode only) with a required idempotencyKey; slack.user.lookup {email}; gmail.thread.list {limit? 1..50, default 15, q?, labelIds? default [INBOX], pageToken?}; gmail.thread.read {threadId}; gmail.message.read {messageId}; gmail.attachment.read {messageId, attachmentId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, html? <= 64 KiB, attachments? 1..5 of <= 2 MiB each as base64, replyToMessageId?} and a required idempotencyKey like slack.message.post; warehouse.view.read {columns? 1..32, where? 1..16 filters, groupBy? 1..8 columns, aggregates? 1..16, orderBy? 1..8, limit? 1..1000, default 100} (0.70.0: a plain read names columns, an aggregate read names aggregates and optionally groupBy; the cross-field rules — exactly one of columns or aggregates, groupBy needs aggregates, a filter value that fits its op, orderBy naming a returned column, every named column approved — are enforced by governance, not expressible here; ADR 0017). Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB except a gmail.message.send carrying attachments (governance sizes that route for the attachment bound), total deadline 10 s.
+ * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is fixed by the operation for every operation but the declared-mode Slack operations (slack.channel.history, slack.message.post, slack.message.update, slack.message.delete; 0.71.0 widened history), and always enforced from an approved grant; any identity/userId/scope field is rejected by additionalProperties. A declared-mode operation runs as the app (for a post: the IT-approved per-app name from the grant, plus a "Posted by <app> on Isomorph" footer) or as the signed-in person (no name, no footer) — the same input either way — and since 0.55.0 the call names which of the app's approved modes it runs under (`mode`): required when IT approved both modes for the app (MODE_REQUIRED otherwise), optional when it approved one (that one is used), and a named mode without an approved grant is refused (MODE_NOT_GRANTED) rather than served under the other, so approval order never decides what a call does. Per-operation input bounds (0.71.0, ADR 0018): slack.channel.history {limit? 1..100, default 15, cursor?, oldest?, latest?}; slack.message.post {text 1..4000 chars, threadId?, format? plain|mrkdwn} and a required idempotencyKey retained across retries of one explicit Send; slack.message.update {messageId, text, format?}; slack.message.delete {messageId}; slack.dm.send {to 1..8 addresses, text, format?} (app mode only) with a required idempotencyKey; slack.user.lookup {email}; gmail.thread.list {limit? 1..50, default 15, q?, labelIds? default [INBOX], pageToken?}; gmail.thread.read {threadId}; gmail.message.read {messageId}; gmail.attachment.read {messageId, attachmentId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, html? <= 64 KiB, attachments? 1..5 of <= 2 MiB each as base64, replyToMessageId?} and a required idempotencyKey like slack.message.post; warehouse.view.read {columns? 1..32, where? 1..16 filters, groupBy? 1..8 columns, aggregates? 1..16, orderBy? 1..8, limit? 1..1000, default 100} (0.70.0: a plain read names columns, an aggregate read names aggregates and optionally groupBy; the cross-field rules — exactly one of columns or aggregates, groupBy needs aggregates, a filter value that fits its op, orderBy naming a returned column, every named column approved — are enforced by governance, not expressible here; ADR 0017). Basecamp (0.76.0, ADR 0022; every id a string of 1..20 digits, every operation user mode): basecamp.project.list {pageToken?, projectStatus? active|archived} on the fixed `account` alias; on a project alias basecamp.todolist.list {pageToken?}; basecamp.todo.list {todolistId, completed?, pageToken?}; basecamp.todo.create {todolistId, content 1..1000 (the to-do title), description? <= 16384, contentFormat? plain|html, dueOn? YYYY-MM-DD, assigneeIds? 1..20, notify?} with a required idempotencyKey; basecamp.todo.complete {todoId} (idempotent at Basecamp, so no key); basecamp.message.list {pageToken?}; basecamp.message.post {subject 1..256, content 1..65536, contentFormat?} with a required idempotencyKey; basecamp.comment.list {recordingId, pageToken?}; basecamp.comment.post {recordingId, content 1..16384, contentFormat?} with a required idempotencyKey; basecamp.campfire.post {content 1..4000, contentFormat?} with a required idempotencyKey; basecamp.people.list {pageToken?}. `pageToken` is the previous page's `nextPageToken` (a Basecamp page number as digits). Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB except a gmail.message.send carrying attachments (governance sizes that route for the attachment bound) and a basecamp.message.post (its 64 KiB body; governance allows 80 KiB there), total deadline 10 s.
  */
 export type IntegrationExecuteRequest = {
   /**
@@ -10,7 +10,7 @@ export type IntegrationExecuteRequest = {
    */
   connection: string;
   /**
-   * Closed operation set. Extending it is a contracts change. gmail.message.send (0.50.0) sends one email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity; since 0.71.0 it may carry an HTML body and attachments. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent); since 0.55.0 each call names which of the approved modes it runs under. 0.71.0 (ADR 0018) adds slack.message.update and slack.message.delete (declared mode, like post), slack.dm.send (app mode: a direct message to 1..8 workspace members named by email), slack.user.lookup (app mode: email to Slack user id), gmail.thread.read (every message of one thread) and gmail.attachment.read (one attachment's bytes), and lets slack.channel.history run in app mode as well as user mode.
+   * Closed operation set. Extending it is a contracts change. 0.76.0 (ADR 0022) adds the eleven Basecamp operations, every one user mode only like gmail.*: basecamp.project.list (the projects of the company's pinned Basecamp account; its resource is the fixed `account` alias), and on one mapped project (the resource is a project alias, a key of the connection's `channels` map) basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create (a receipted write: explicit action, idempotencyKey), basecamp.todo.complete (idempotent at Basecamp, no key), basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post (the three posts are receipted writes) and basecamp.people.list. gmail.message.send (0.50.0) sends one email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity; since 0.71.0 it may carry an HTML body and attachments. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent); since 0.55.0 each call names which of the approved modes it runs under. 0.71.0 (ADR 0018) adds slack.message.update and slack.message.delete (declared mode, like post), slack.dm.send (app mode: a direct message to 1..8 workspace members named by email), slack.user.lookup (app mode: email to Slack user id), gmail.thread.read (every message of one thread) and gmail.attachment.read (one attachment's bytes), and lets slack.channel.history run in app mode as well as user mode.
    */
   operation:
     | 'slack.channel.history'
@@ -24,6 +24,17 @@ export type IntegrationExecuteRequest = {
     | 'gmail.message.read'
     | 'gmail.message.send'
     | 'gmail.attachment.read'
+    | 'basecamp.project.list'
+    | 'basecamp.todolist.list'
+    | 'basecamp.todo.list'
+    | 'basecamp.todo.create'
+    | 'basecamp.todo.complete'
+    | 'basecamp.message.list'
+    | 'basecamp.message.post'
+    | 'basecamp.comment.list'
+    | 'basecamp.comment.post'
+    | 'basecamp.campfire.post'
+    | 'basecamp.people.list'
     | 'warehouse.view.read'
     | 'service.request';
   /**
@@ -79,7 +90,7 @@ export type IntegrationExecuteRequest = {
      */
     labelIds?: string[];
     /**
-     * gmail.thread.list (0.71.0): the `nextPageToken` of the previous page; absent reads the first page.
+     * gmail.thread.list (0.71.0) and every basecamp.*.list operation (0.76.0): the `nextPageToken` of the previous page; absent reads the first page.
      */
     pageToken?: string;
     /**
@@ -90,7 +101,7 @@ export type IntegrationExecuteRequest = {
     cc?: EmailAddressList1;
     bcc?: EmailAddressList2;
     /**
-     * gmail.message.send: one-line subject (no line breaks).
+     * gmail.message.send: one-line subject (no line breaks). basecamp.message.post (0.76.0): the message's title.
      */
     subject?: string;
     /**
@@ -108,6 +119,53 @@ export type IntegrationExecuteRequest = {
      * @maxItems 5
      */
     attachments?: EmailAttachment[];
+    /**
+     * basecamp.todo.list / basecamp.todo.create (0.76.0): the to-do list, as a basecamp.todolist.list result named it.
+     */
+    todolistId?: string;
+    /**
+     * basecamp.todo.complete (0.76.0): the to-do, as a basecamp.todo.list or basecamp.todo.create result named it.
+     */
+    todoId?: string;
+    /**
+     * basecamp.comment.list / basecamp.comment.post (0.76.0): the Basecamp recording commented on — a message, a to-do or any other id a basecamp.* result named.
+     */
+    recordingId?: string;
+    /**
+     * basecamp.todo.create (0.76.0): the to-do's title, 1..1000 characters. basecamp.message.post: the body, at most 64 KiB; basecamp.comment.post: at most 16 KiB; basecamp.campfire.post: at most 4000 characters. Plain text unless `contentFormat` is html.
+     */
+    content?: string;
+    /**
+     * basecamp.todo.create / basecamp.message.post / basecamp.comment.post / basecamp.campfire.post (0.76.0): how `content` (and a to-do's `description`) is read; plain when absent.
+     */
+    contentFormat?: 'plain' | 'html';
+    /**
+     * basecamp.todo.create (0.76.0): the to-do's notes, at most 16 KiB, read the way `contentFormat` says.
+     */
+    description?: string;
+    /**
+     * basecamp.todo.create (0.76.0): the due date as YYYY-MM-DD; absent leaves the to-do undated.
+     */
+    dueOn?: string;
+    /**
+     * basecamp.todo.create (0.76.0): the people assigned, 1..20, by the ids a basecamp.people.list result named.
+     *
+     * @minItems 1
+     * @maxItems 20
+     */
+    assigneeIds?: string[];
+    /**
+     * basecamp.todo.create (0.76.0): whether Basecamp notifies the assignees; false when absent.
+     */
+    notify?: boolean;
+    /**
+     * basecamp.todo.list (0.76.0): true lists the completed to-dos instead of the open ones; absent lists the open ones.
+     */
+    completed?: boolean;
+    /**
+     * basecamp.project.list (0.76.0): which projects to list; active when absent.
+     */
+    projectStatus?: 'active' | 'archived';
     /**
      * warehouse.view.read, a plain read: explicit columns, or `*` alone when the app's approved resource grant allows all current and future columns. An aggregate read names aggregates instead.
      *
@@ -159,13 +217,21 @@ export type IntegrationExecuteRequest = {
     };
   };
   /**
-   * UUID of one explicit Send action; required for slack.message.post and gmail.message.send only. The same key with the same payload and subject returns the recorded outcome for seven days.
+   * UUID of one explicit Send action; required for the sends (slack.message.post, slack.dm.send, gmail.message.send) and the receipted Basecamp writes (basecamp.todo.create, basecamp.message.post, basecamp.comment.post, basecamp.campfire.post; 0.76.0), refused everywhere else. The same key with the same payload and subject returns the recorded outcome for seven days.
    */
   idempotencyKey?: string;
   /**
    * The declared-mode Slack operations only (slack.message.post since 0.55.0; slack.channel.history, slack.message.update and slack.message.delete since 0.71.0): which of the app's IT-approved modes this call runs under — app (the company's Slack app; a post goes out under the grant's per-app name and the footer) or user (the signed-in person, after their consent; no name, no footer). Required when the app holds approved grants for both modes (else MODE_REQUIRED); may be omitted when it holds one, which is then used. A named mode without an approved grant is refused with MODE_NOT_GRANTED; governance never falls back to the other mode. Every other operation's mode is fixed, so the field is refused there.
    */
   mode?: 'app' | 'user';
+  /**
+   * Development only (0.74.0). Rows the kit dev runtime attaches for the resource being read, from the sample-row file the agent wrote into the app's .isomorph/ folder. Governance serves them for a development warehouse.view.read when the source has no development copy (data-source.environments.development): it parses each value by the resource's recorded column type and refuses a value that does not parse, naming the column and the row. The field is refused with SAMPLE_ROWS_NOT_ALLOWED on any route but the development one, so a preview or production read never carries made-up data. Not part of the per-operation input rules; the dev runtime adds it beside the app's request.
+   *
+   * @maxItems 50
+   */
+  sampleRows?: {
+    [k: string]: string | number | boolean | null;
+  }[];
 };
 /**
  * One bare email address (no display name).