@fourier-labs/harbour-contracts 0.77.0 → 0.78.0

package/schema/integration-execute-result.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/integration-execute-result.schema.json",
   "title": "IntegrationExecuteResult",
-  "description": "The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the operation results (twenty-four operations since 0.76.0, ADR 0018 and ADR 0022): slack.channel.history -> {messages, hasMore, nextCursor?} (plain text/IDs/time, plus the display name and emoji icon a per-app-named app post carries \u2014 authorName/authorIcon, 0.55.0 \u2014 never the provider payload; `nextCursor` when hasMore, to pass as the next read's `cursor`); slack.message.post, slack.message.update, slack.message.delete -> {messageId} (the Slack ts); slack.dm.send -> {messageId, channelId} (the ts and the DM channel it went to); slack.user.lookup -> {userId, displayName}; gmail.thread.list -> {threads, hasMore, nextPageToken?} (newest matching threads; each `messageId` is the thread's newest message, what gmail.message.read takes; `nextPageToken` when hasMore); gmail.thread.read -> {id, emails} (every message of the thread, oldest first, each shaped like a gmail.message.read result); gmail.message.read -> {id, threadId, subject, from, to, date, text, truncated, attachments?} (headers plus the plain text with html stripped, cut at 16 KiB with `truncated` set; `attachments` lists the files without their bytes, which gmail.attachment.read fetches by id); gmail.attachment.read -> {filename, mimeType, size, dataBase64}; gmail.message.send -> {messageId, threadId} (the Gmail ids of the sent message and its thread); warehouse.view.read -> {rows, truncated} (rows keyed by the selected columns, or for an aggregate read by the groupBy columns then the aggregate aliases; decimal/64-bit values as strings, dates as ISO strings; since 0.70.0 every server sends `truncated`, true when more rows matched than `limit` \u2014 the server reads limit+1 rows to know \u2014 so the rows are incomplete and must not be totalled or averaged; a server before 0.70.0 omitted it). Basecamp (0.76.0, ADR 0022; every id a string of digits, every page at most 100 items, `nextPageToken` only when hasMore, text cut at 16 KiB like Gmail): basecamp.project.list -> {projects, hasMore, nextPageToken?}; basecamp.todolist.list -> {todolists, hasMore, nextPageToken?}; basecamp.todo.list -> {todos, hasMore, nextPageToken?}; basecamp.message.list -> {boardMessages, hasMore, nextPageToken?} (`boardMessages`, not `messages`, which is the Slack history shape); basecamp.comment.list -> {comments, hasMore, nextPageToken?}; basecamp.people.list -> {people, hasMore, nextPageToken?}; basecamp.todo.create, basecamp.message.post, basecamp.comment.post, basecamp.campfire.post -> {id, appUrl} (the new recording and its Basecamp page); basecamp.todo.complete -> {id, completed} with completed always true. An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. A whole result over 1 MiB is rejected, never cut down to fit \u2014 except a gmail.attachment.read, whose single attachment is bounded by its own 2 MiB.",
+  "description": "The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the operation results (thirty-three operations since 0.78.0, ADR 0018, ADR 0022 and ADR 0024): slack.channel.history -> {messages, hasMore, nextCursor?} (plain text/IDs/time, plus the display name and emoji icon a per-app-named app post carries \u2014 authorName/authorIcon, 0.55.0 \u2014 never the provider payload; `nextCursor` when hasMore, to pass as the next read's `cursor`); slack.message.post, slack.message.update, slack.message.delete -> {messageId} (the Slack ts); slack.dm.send -> {messageId, channelId} (the ts and the DM channel it went to); slack.user.lookup -> {userId, displayName}; gmail.thread.list -> {threads, hasMore, nextPageToken?} (newest matching threads; each `messageId` is the thread's newest message, what gmail.message.read takes; `nextPageToken` when hasMore); gmail.thread.read -> {id, emails} (every message of the thread, oldest first, each shaped like a gmail.message.read result); gmail.message.read -> {id, threadId, subject, from, to, date, text, truncated, attachments?} (headers plus the plain text with html stripped, cut at 16 KiB with `truncated` set; `attachments` lists the files without their bytes, which gmail.attachment.read fetches by id); gmail.attachment.read -> {filename, mimeType, size, dataBase64}; gmail.message.send -> {messageId, threadId} (the Gmail ids of the sent message and its thread); warehouse.view.read -> {rows, truncated} (rows keyed by the selected columns, or for an aggregate read by the groupBy columns then the aggregate aliases; decimal/64-bit values as strings, dates as ISO strings; since 0.70.0 every server sends `truncated`, true when more rows matched than `limit` \u2014 the server reads limit+1 rows to know \u2014 so the rows are incomplete and must not be totalled or averaged; a server before 0.70.0 omitted it). Basecamp (0.76.0, ADR 0022; every id a string of digits, every page at most 100 items, `nextPageToken` only when hasMore, text cut at 16 KiB like Gmail): basecamp.project.list -> {projects, hasMore, nextPageToken?}; basecamp.todolist.list -> {todolists, hasMore, nextPageToken?}; basecamp.todo.list -> {todos, hasMore, nextPageToken?}; basecamp.message.list -> {boardMessages, hasMore, nextPageToken?} (`boardMessages`, not `messages`, which is the Slack history shape); basecamp.comment.list -> {comments, hasMore, nextPageToken?}; basecamp.people.list -> {people, hasMore, nextPageToken?}; basecamp.todo.create, basecamp.message.post, basecamp.comment.post, basecamp.campfire.post -> {id, appUrl} (the new recording and its Basecamp page); basecamp.todo.complete -> {id, completed} with completed always true. SharePoint (0.78.0, ADR 0024; every id a Microsoft Graph id, `nextPageToken` only when hasMore and up to 2048 characters for a Graph `$skiptoken`): sharepoint.list.list -> {lists, hasMore, nextPageToken?} (at most 100, hidden lists dropped); sharepoint.item.list -> {items, hasMore, nextPageToken?} (at most 50; each item's `fields` are the column values as Graph returns them with the system columns dropped, the whole object cut at 16 KiB); sharepoint.drive.list -> {drives, hasMore, nextPageToken?}; sharepoint.file.list and sharepoint.file.search -> {files, hasMore, nextPageToken?} (at most 100 entries, folders included with isFolder); sharepoint.file.read -> {id, filename, mimeType, size, dataBase64} (the Gmail attachment shape plus the file's id; at most 2 MiB of bytes); sharepoint.item.create -> {id, webUrl} (the new item and its SharePoint page); sharepoint.item.update -> {id}; sharepoint.file.upload -> {id, filename, webUrl} (the stored file, under the name `conflict` rename may have given it). An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. A whole result over 1 MiB is rejected, never cut down to fit \u2014 except a gmail.attachment.read or a sharepoint.file.read, whose single file is bounded by its own 2 MiB.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -53,13 +53,14 @@
     "nextPageToken": {
       "type": "string",
       "minLength": 1,
-      "maxLength": 256,
-      "description": "gmail.thread.list (0.71.0): the token of the next page, present only when hasMore."
+      "maxLength": 2048,
+      "description": "gmail.thread.list (0.71.0), the basecamp.* lists (0.76.0) and the paged sharepoint.* reads (0.78.0): the token of the next page, present only when hasMore; up to 2048 characters since 0.78.0 for a Graph $skiptoken."
     },
     "id": {
       "type": "string",
       "minLength": 1,
-      "maxLength": 128
+      "maxLength": 256,
+      "description": "gmail.thread.read / gmail.message.read: the Gmail id; the Basecamp writes and complete (0.76.0): the recording's id; the SharePoint writes and sharepoint.file.read (0.78.0): the Graph id of the item or file (up to 256 characters since 0.78.0, the GraphId bound)."
     },
     "threadId": {
       "type": "string",
@@ -198,6 +199,45 @@
       "type": "boolean",
       "description": "basecamp.todo.complete (0.76.0): always true; the to-do is complete whether this call or an earlier one completed it."
     },
+    "lists": {
+      "type": "array",
+      "maxItems": 100,
+      "items": {
+        "$ref": "#/definitions/SharePointList"
+      },
+      "description": "sharepoint.list.list (0.78.0): one page of the site's lists the signed-in person can see, hidden lists dropped."
+    },
+    "items": {
+      "type": "array",
+      "maxItems": 50,
+      "items": {
+        "$ref": "#/definitions/SharePointListItem"
+      },
+      "description": "sharepoint.item.list (0.78.0): one page of the list's items (Graph pages of 50), filtered when the read said `filter`."
+    },
+    "drives": {
+      "type": "array",
+      "maxItems": 100,
+      "items": {
+        "$ref": "#/definitions/SharePointDrive"
+      },
+      "description": "sharepoint.drive.list (0.78.0): one page of the site's document libraries."
+    },
+    "files": {
+      "type": "array",
+      "maxItems": 100,
+      "items": {
+        "$ref": "#/definitions/SharePointFile"
+      },
+      "description": "sharepoint.file.list / sharepoint.file.search (0.78.0): one page of a folder's entries (files and folders) or of the files matching the search."
+    },
+    "webUrl": {
+      "type": "string",
+      "format": "uri",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "sharepoint.item.create / sharepoint.file.upload (0.78.0): the SharePoint page of the new item or file, for a person to open."
+    },
     "status": {
       "type": "integer"
     },
@@ -407,6 +447,87 @@
         "completed"
       ],
       "maxProperties": 2
+    },
+    {
+      "required": [
+        "lists",
+        "hasMore"
+      ],
+      "propertyNames": {
+        "enum": [
+          "lists",
+          "hasMore",
+          "nextPageToken"
+        ]
+      }
+    },
+    {
+      "required": [
+        "items",
+        "hasMore"
+      ],
+      "propertyNames": {
+        "enum": [
+          "items",
+          "hasMore",
+          "nextPageToken"
+        ]
+      }
+    },
+    {
+      "required": [
+        "drives",
+        "hasMore"
+      ],
+      "propertyNames": {
+        "enum": [
+          "drives",
+          "hasMore",
+          "nextPageToken"
+        ]
+      }
+    },
+    {
+      "required": [
+        "files",
+        "hasMore"
+      ],
+      "propertyNames": {
+        "enum": [
+          "files",
+          "hasMore",
+          "nextPageToken"
+        ]
+      }
+    },
+    {
+      "required": [
+        "id"
+      ],
+      "propertyNames": {
+        "enum": [
+          "id",
+          "webUrl"
+        ]
+      }
+    },
+    {
+      "required": [
+        "id",
+        "filename",
+        "webUrl"
+      ],
+      "maxProperties": 3
+    },
+    {
+      "required": [
+        "id",
+        "filename",
+        "mimeType",
+        "size",
+        "dataBase64"
+      ],
+      "maxProperties": 5
     }
   ],
   "definitions": {
@@ -852,6 +973,144 @@
           "description": "Whether the person is an administrator of the Basecamp account."
         }
       }
+    },
+    "SharePointList": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "name",
+        "webUrl"
+      ],
+      "description": "One list of a sharepoint.list.list result (0.78.0); `id` is what sharepoint.item.list, sharepoint.item.create and sharepoint.item.update take as `listId`. `template` is the list template Graph reports (genericList, documentLibrary, tasks, events...) when it does.",
+      "properties": {
+        "id": {
+          "$ref": "app-integrations-declaration.schema.json#/definitions/GraphId"
+        },
+        "name": {
+          "type": "string",
+          "maxLength": 256
+        },
+        "description": {
+          "type": "string",
+          "maxLength": 16384
+        },
+        "webUrl": {
+          "type": "string",
+          "format": "uri",
+          "minLength": 1,
+          "maxLength": 2048
+        },
+        "template": {
+          "type": "string",
+          "maxLength": 64
+        }
+      }
+    },
+    "SharePointListItem": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "fields",
+        "webUrl",
+        "createdAt",
+        "modifiedAt"
+      ],
+      "description": "One item of a sharepoint.item.list result (0.78.0): `fields` are its column values keyed by internal column name, as Graph returns them with the system columns (@odata.etag, ContentType, Attachments, Edit, LinkTitle*, ItemChildCount, FolderChildCount, _UIVersionString, _ComplianceFlags...) dropped and the whole object cut at 16 KiB; `id` is what sharepoint.item.update takes as `itemId`.",
+      "properties": {
+        "id": {
+          "$ref": "app-integrations-declaration.schema.json#/definitions/GraphId"
+        },
+        "fields": {
+          "type": "object",
+          "additionalProperties": {},
+          "description": "Column values as Graph returns them (strings, numbers, booleans, and lookup or person values as Graph shapes them)."
+        },
+        "webUrl": {
+          "type": "string",
+          "format": "uri",
+          "minLength": 1,
+          "maxLength": 2048
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "modifiedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "SharePointDrive": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "name",
+        "webUrl"
+      ],
+      "description": "One document library of a sharepoint.drive.list result (0.78.0); `id` is what the sharepoint.file.* operations take as `driveId`.",
+      "properties": {
+        "id": {
+          "$ref": "app-integrations-declaration.schema.json#/definitions/GraphId"
+        },
+        "name": {
+          "type": "string",
+          "maxLength": 256
+        },
+        "webUrl": {
+          "type": "string",
+          "format": "uri",
+          "minLength": 1,
+          "maxLength": 2048
+        }
+      }
+    },
+    "SharePointFile": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "name",
+        "isFolder",
+        "size",
+        "webUrl",
+        "modifiedAt"
+      ],
+      "description": "One entry of a sharepoint.file.list or sharepoint.file.search result (0.78.0): a file (`mimeType` set, `id` is what sharepoint.file.read takes as `fileId`) or a folder (`isFolder`, `id` is what sharepoint.file.list and sharepoint.file.upload take as `folderId`). `size` is in bytes; a folder's is the total of its contents.",
+      "properties": {
+        "id": {
+          "$ref": "app-integrations-declaration.schema.json#/definitions/GraphId"
+        },
+        "name": {
+          "type": "string",
+          "maxLength": 256
+        },
+        "isFolder": {
+          "type": "boolean"
+        },
+        "size": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "mimeType": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "webUrl": {
+          "type": "string",
+          "format": "uri",
+          "minLength": 1,
+          "maxLength": 2048
+        },
+        "modifiedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
     }
   },
   "examples": [
@@ -1135,6 +1394,88 @@
     {
       "id": "1069479526",
       "completed": true
+    },
+    {
+      "lists": [
+        {
+          "id": "c8f7a4d1-2b3e-4f5a-9c6d-7e8f9a0b1c2d",
+          "name": "Facilities requests",
+          "description": "Office and lease work.",
+          "webUrl": "https://fourier.sharepoint.com/sites/intranet/Lists/Facilities%20requests",
+          "template": "genericList"
+        }
+      ],
+      "hasMore": false
+    },
+    {
+      "items": [
+        {
+          "id": "42",
+          "fields": {
+            "Title": "Renew the office lease",
+            "Status": "Open",
+            "DueDate": "2026-10-31T00:00:00Z",
+            "Priority": 2,
+            "Urgent": false
+          },
+          "webUrl": "https://fourier.sharepoint.com/sites/intranet/Lists/Facilities%20requests/DispForm.aspx?ID=42",
+          "createdAt": "2026-10-11T08:00:00Z",
+          "modifiedAt": "2026-10-11T09:00:00Z"
+        }
+      ],
+      "hasMore": true,
+      "nextPageToken": "UGFnZWQ9VFJVRSZwX1NvcnRCZWhhdmlvcj0xJnBfSUQ9NDI"
+    },
+    {
+      "drives": [
+        {
+          "id": "b!X1Y2Z3a4B5c6D7e8F9g0H1i2J3k4L5m6N7o8P9q0R1s2T3u4V5w6X7y8Z9a0B1c2",
+          "name": "Documents",
+          "webUrl": "https://fourier.sharepoint.com/sites/intranet/Shared%20Documents"
+        }
+      ],
+      "hasMore": false
+    },
+    {
+      "files": [
+        {
+          "id": "01BYE5RZ6QN3ZWBTUFOFD3GSPGOHDJD36K",
+          "name": "Reports",
+          "isFolder": true,
+          "size": 1048576,
+          "webUrl": "https://fourier.sharepoint.com/sites/intranet/Shared%20Documents/Reports",
+          "modifiedAt": "2026-10-10T17:00:00Z"
+        },
+        {
+          "id": "01BYE5RZ5MYLM2SMX75ZBIPQZIHT6OAYPB",
+          "name": "weekly-report.pdf",
+          "isFolder": false,
+          "size": 48213,
+          "mimeType": "application/pdf",
+          "webUrl": "https://fourier.sharepoint.com/sites/intranet/Shared%20Documents/Reports/weekly-report.pdf",
+          "modifiedAt": "2026-10-11T08:00:00Z"
+        }
+      ],
+      "hasMore": false
+    },
+    {
+      "id": "01BYE5RZ5MYLM2SMX75ZBIPQZIHT6OAYPB",
+      "filename": "weekly-report.pdf",
+      "mimeType": "application/pdf",
+      "size": 20,
+      "dataBase64": "JVBERi0xLjQKJcOkw7zDtsOfCg=="
+    },
+    {
+      "id": "43",
+      "webUrl": "https://fourier.sharepoint.com/sites/intranet/Lists/Facilities%20requests/DispForm.aspx?ID=43"
+    },
+    {
+      "id": "43"
+    },
+    {
+      "id": "01BYE5RZ7KQJ2A3BUFOFD3GSPGOHDJD37L",
+      "filename": "weekly-report 1.pdf",
+      "webUrl": "https://fourier.sharepoint.com/sites/intranet/Shared%20Documents/Reports/weekly-report%201.pdf"
     }
   ]
 }

package/schema/saas-connection.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/saas-connection.schema.json",
   "title": "SaasConnection",
-  "description": "Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.",
+  "description": "Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. A SharePoint connection (0.78.0, ADR 0024) is shaped the same way: IT pins the company's Microsoft 365 tenant in `account` (the Entra tenant id and the organisation's display name, from IT's own Microsoft sign-in) and maps site aliases to Microsoft Graph site ids (`hostname,siteCollectionGuid,webGuid`) in `channels`; every sharepoint.* operation runs on a site alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "tenantId", "sourceId", "kind", "provider", "displayName", "status", "version", "channels", "operations", "developmentPreapproval", "createdAt", "updatedAt"],
@@ -21,17 +21,17 @@
       "type": "object",
       "maxProperties": 64,
       "propertyNames": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationAlias" },
-      "additionalProperties": { "type": "string", "pattern": "^[A-Za-z0-9]{1,32}$", "description": "A Slack channel id (public, non-archived) or a Basecamp project id (digits)." },
-      "description": "Logical alias → provider resource id: a Slack channel id or a Basecamp project id. Always empty for Gmail."
+      "additionalProperties": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9.,_:-]{0,255}$", "description": "A Slack channel id (public, non-archived), a Basecamp project id (digits) or a SharePoint site id (0.78.0: the Microsoft Graph composite `hostname,siteCollectionGuid,webGuid`)." },
+      "description": "Logical alias → provider resource id: a Slack channel id, a Basecamp project id or a SharePoint site id. Always empty for Gmail."
     },
     "operations": {
       "type": "array",
       "minItems": 1,
-      "maxItems": 22,
+      "maxItems": 31,
       "uniqueItems": true,
       "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" },
       "not": { "contains": { "const": "warehouse.view.read" } },
-      "description": "Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list). Never warehouse.view.read."
+      "description": "Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload). Never warehouse.view.read."
     },
     "developmentPreapproval": { "$ref": "#/definitions/DevelopmentPreapproval" },
     "oauthClient": { "$ref": "#/definitions/SaasOauthClient" },
@@ -77,17 +77,17 @@
   "definitions": {
     "SaasProvider": {
       "type": "string",
-      "enum": ["slack", "gmail", "basecamp"],
-      "description": "Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`."
+      "enum": ["slack", "gmail", "basecamp", "sharepoint"],
+      "description": "Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`."
     },
     "BasecampAccount": {
       "type": "object",
       "additionalProperties": false,
       "required": ["id", "name"],
-      "description": "The pinned Basecamp account (0.76.0, Basecamp only): the one account, among those IT's own Basecamp sign-in belongs to, that every user token on this connection must also belong to and that every project id in `channels` lives in. Absent until IT chooses it; governance refuses every basecamp.* call until then.",
+      "description": "The pinned provider account (0.76.0, Basecamp; 0.78.0, SharePoint — the name keeps its 0.76.0 spelling so consumers need not move): the one account, among those IT's own provider sign-in belongs to, that every user token on this connection must also belong to and that every resource id in `channels` lives in. For Basecamp the account (digits); for SharePoint the Microsoft 365 tenant (the Entra tenant GUID). Absent until IT chooses it; governance refuses every basecamp.* and sharepoint.* call until then.",
       "properties": {
-        "id": { "type": "string", "pattern": "^[0-9]{1,20}$", "description": "The Basecamp account id, the first path segment of the API base URL." },
-        "name": { "type": "string", "minLength": 1, "maxLength": 120, "description": "The account's name as Basecamp shows it, for IT to recognise." }
+        "id": { "type": "string", "pattern": "^[A-Za-z0-9-]{1,64}$", "description": "The Basecamp account id (digits, the first path segment of the API base URL) or the Microsoft Entra tenant id (a GUID, the `tid` claim)." },
+        "name": { "type": "string", "minLength": 1, "maxLength": 120, "description": "The account's name as the provider shows it (a Basecamp account name, a Microsoft 365 organisation display name), for IT to recognise." }
       }
     },
     "SaasOauthClient": {
@@ -265,6 +265,23 @@
       "userModeApproval": "automatic",
       "createdAt": "2026-10-11T08:00:00Z",
       "updatedAt": "2026-10-11T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-sharepoint",
+      "kind": "saas",
+      "provider": "sharepoint",
+      "displayName": "Company SharePoint",
+      "status": "ACTIVE",
+      "version": 2,
+      "account": { "id": "3f2c9b1e-7d4a-4c6b-9e8f-0a1b2c3d4e5f", "name": "Fourier Labs" },
+      "channels": { "intranet": "fourier.sharepoint.com,8a1c6f2e-3b4d-4e5f-9a0b-1c2d3e4f5a6b,0f1e2d3c-4b5a-4968-8776-655443322110" },
+      "operations": ["sharepoint.list.list", "sharepoint.item.list", "sharepoint.item.create", "sharepoint.item.update", "sharepoint.drive.list", "sharepoint.file.list", "sharepoint.file.search", "sharepoint.file.read", "sharepoint.file.upload"],
+      "developmentPreapproval": { "enabled": true, "hours": 24 },
+      "userModeApproval": "automatic",
+      "createdAt": "2026-10-11T08:00:00Z",
+      "updatedAt": "2026-10-11T08:00:00Z"
     }
   ]
 }