@fourier-labs/harbour-contracts 0.77.0 → 0.79.0

package/gen-ts/app-integrations-declaration.ts

@@ -27,6 +27,15 @@ export type DeclaredConnection = {
     'basecamp.comment.post'?: UserModeChannelOperation;
     'basecamp.campfire.post'?: UserModeChannelOperation;
     'basecamp.people.list'?: UserModeChannelOperation;
+    'sharepoint.list.list'?: UserModeChannelOperation;
+    'sharepoint.item.list'?: UserModeChannelOperation;
+    'sharepoint.item.create'?: UserModeChannelOperation;
+    'sharepoint.item.update'?: UserModeChannelOperation;
+    'sharepoint.drive.list'?: UserModeChannelOperation;
+    'sharepoint.file.list'?: UserModeChannelOperation;
+    'sharepoint.file.search'?: UserModeChannelOperation;
+    'sharepoint.file.read'?: UserModeChannelOperation;
+    'sharepoint.file.upload'?: UserModeChannelOperation;
     'warehouse.view.read'?: AppModeViewOperation;
     'service.request'?: ServiceOperation;
   };
@@ -51,7 +60,7 @@ export type ResourceNames = IntegrationAlias[];
 export type ColumnName = string;
 
 /**
- * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (twenty-four operations since 0.76.0, ADR 0018 and ADR 0022). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, every basecamp.* operation=user, warehouse.view.read=app, service.request=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack, Gmail and Basecamp operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. Basecamp (0.76.0, ADR 0022) is user-mode only too: basecamp.project.list runs on the fixed `account` alias (the company's pinned Basecamp account) and every other basecamp.* operation on a project alias IT mapped in the connection's `channels` map, so Basecamp itself refuses an id outside that project. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
+ * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (thirty-three operations since 0.78.0, ADR 0018, ADR 0022 and ADR 0024). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, every basecamp.* operation=user, every sharepoint.* operation=user, warehouse.view.read=app, service.request=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack, Gmail, Basecamp and SharePoint operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. Basecamp (0.76.0, ADR 0022) is user-mode only too: basecamp.project.list runs on the fixed `account` alias (the company's pinned Basecamp account) and every other basecamp.* operation on a project alias IT mapped in the connection's `channels` map, so Basecamp itself refuses an id outside that project. SharePoint (0.78.0, ADR 0024) is user-mode only as well: every sharepoint.* operation runs on a site alias IT mapped in the connection's `channels` map (a Microsoft Graph site id), so Graph itself refuses a list, item or file outside that site. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
  */
 export interface AppIntegrationsDeclaration {
   schema: 'isomorph.app-integrations/2.0';
@@ -87,7 +96,7 @@ export interface AppModeChannelOperation {
   resources: ResourceNames;
 }
 /**
- * Every gmail.* operation (resource: the fixed `inbox` alias) and, since 0.76.0, every basecamp.* operation (resource: a project alias from the connection's `channels` map, or the fixed `account` alias for basecamp.project.list): user mode only — the app acts as the signed-in person after their own consent.
+ * Every gmail.* operation (resource: the fixed `inbox` alias), since 0.76.0 every basecamp.* operation (resource: a project alias from the connection's `channels` map, or the fixed `account` alias for basecamp.project.list) and since 0.78.0 every sharepoint.* operation (resource: a site alias from the connection's `channels` map): user mode only — the app acts as the signed-in person after their own consent.
  */
 export interface UserModeChannelOperation {
   identity: 'user';

package/gen-ts/app-sign-in.ts

@@ -0,0 +1,12 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type AppSignIn = {
+  signIn?: 'company' | 'external';
+  /**
+   * @minItems 1
+   * @maxItems 1
+   */
+  signInMethods?: ('phone' | 'email')[];
+  clientId?: string;
+};

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.77.0.0" as const;
-export const ContractPublishVersion = "0.77.0" as const;
-export const ContractPublishTag = "v0.77.0" as const;
-export const ContractSchemasDigest = "sha256:4b1970124058b38db22026ca1f6f6c74d9e32d6753dac12a5452ba090d19c667" as const;
+export const ContractRepositoryVersion = "0.79.0.0" as const;
+export const ContractPublishVersion = "0.79.0" as const;
+export const ContractPublishTag = "v0.79.0" as const;
+export const ContractSchemasDigest = "sha256:c4d332b1b1a8500a010e2a857ea6ccc435e95cef9b825205bd3474c3b5dee7c8" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:e61b74f464a07c98fcb02dfa7d62af79cc4634455ade7195602ec0632af9f9ba" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:442a4b31bff9288ca5a2dd4e9fb0eb74945c7abbe6b8a7eede8694ad9c44f1fd" as const;
+export const ContractGeneratedGoDigest = "sha256:3e67916611e03ab198c2d06d1cf87234aa5fca15df7e6f3a658f2b7690fd970c" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:dcca50e4cd5f629f24371ca42755b7b05fe581d01e69c7e3ebfd2d860fed205a" as const;

package/gen-ts/data-grant-v2.ts

@@ -12,7 +12,7 @@ export type DataGrantV2ProvisioningStatus = 'NONE' | 'PENDING' | 'FAILED' | 'DON
 export type DataGrantV2CleanupStatus = 'PENDING' | 'FAILED' | 'DONE';
 
 /**
- * An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON ["v2",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. An app-mode Slack grant may carry `presentation` (0.53.0): the IT-approved display name and icon the app's posts go out under, copied from the approved request and read by every post — never from the call. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.
+ * An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON ["v2",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias, a SharePoint site alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. An app-mode Slack grant may carry `presentation` (0.53.0): the IT-approved display name and icon the app's posts go out under, copied from the approved request and read by every post — never from the call. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.
  */
 export interface DataGrantV2 {
   schema: 'harbour.data-grant/2.0';
@@ -33,9 +33,9 @@ export interface DataGrantV2 {
   kind: 'saas' | 'database' | 'service';
   status: DataGrantV2Status;
   /**
-   * Approved operations; each must match this grant's mode. Empty until the first approval. At most the twenty-two SaaS operations (0.76.0: eleven Slack and Gmail, eleven Basecamp); a database grant holds one.
+   * Approved operations; each must match this grant's mode. Empty until the first approval. At most the thirty-one SaaS operations (0.78.0: eleven Slack and Gmail, eleven Basecamp, nine SharePoint); a database grant holds one.
    *
-   * @maxItems 22
+   * @maxItems 31
    */
   operations: (
     | 'slack.channel.history'
@@ -60,6 +60,15 @@ export interface DataGrantV2 {
     | 'basecamp.comment.post'
     | 'basecamp.campfire.post'
     | 'basecamp.people.list'
+    | 'sharepoint.list.list'
+    | 'sharepoint.item.list'
+    | 'sharepoint.item.create'
+    | 'sharepoint.item.update'
+    | 'sharepoint.drive.list'
+    | 'sharepoint.file.list'
+    | 'sharepoint.file.search'
+    | 'sharepoint.file.read'
+    | 'sharepoint.file.upload'
     | 'warehouse.view.read'
     | 'service.request'
   )[];
@@ -111,7 +120,7 @@ export interface DataGrantV2 {
   installation?: string;
 }
 /**
- * One approved logical resource: a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias (0.76.0), or a warehouse view alias with the approved columns.
+ * One approved logical resource: a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias (0.76.0), a SharePoint site alias (0.78.0), or a warehouse view alias with the approved columns.
  */
 export interface IntegrationResource {
   /**

package/gen-ts/deployment-app-registration.ts

@@ -4,7 +4,7 @@
 /**
  * IAM/SigV4 POST /v1/internal/deployment/apps/{appId}/register (Internal API) or POST /v1/deployment/apps/register body. Governance derives tenant identity-provider configuration; no identity secrets are supplied. apiHostnames explicitly identifies API hosts among backendHostnames; runtime validates that subset. Omission preserves legacy .api. inference during the coordinated V2 auth migration.
  */
-export interface DeploymentAppRegistration {
+export type DeploymentAppRegistration = {
   tenantId: string;
   appId: string;
   origin: string;
@@ -18,4 +18,10 @@ export interface DeploymentAppRegistration {
   allowedGroups?: string[];
   enabled?: boolean;
   workloadPrincipalArn?: string;
-}
+  signIn?: 'company' | 'external';
+  /**
+   * @minItems 1
+   * @maxItems 1
+   */
+  signInMethods?: ('phone' | 'email')[];
+};

package/gen-ts/external-sign-in.ts

@@ -0,0 +1,32 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export interface ExternalSignIn {
+  enabledMethods: ('phone' | 'email')[];
+  email?: {
+    senderEmail: string;
+    senderDomain?: string;
+    sesRegion: string;
+    configurationSet?: string;
+  };
+  sms?: {
+    originationIdentity?: string;
+    region: string;
+    inEntityId?: string;
+    inTemplateId?: string;
+  };
+  directory?: {
+    accountId: string;
+    region: string;
+    userPoolId: string;
+  };
+  readiness?: {
+    email?: {
+      senderVerified: boolean;
+      productionAccess: boolean;
+    };
+    sms?: {
+      sandbox: boolean;
+    };
+  };
+}

package/gen-ts/identity-context.ts

@@ -0,0 +1,21 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+export type IdentityContext = {
+  iss: string;
+  aud: string;
+  sub: string;
+  tenant: string;
+  app: string;
+  iat: number;
+  exp: number;
+  session_id?: string;
+  email?: string;
+  name?: string;
+  phone_number?: string;
+  email_verified?: boolean;
+  phone_number_verified?: boolean;
+  directory?: 'company' | 'external';
+  groups?: string[];
+  role?: 'builder' | 'member';
+};

package/gen-ts/index.ts

@@ -23,6 +23,7 @@ export * from './ai-transform-result.js';
 export * from './ai-verification-evidence.js';
 export * from './api-error-response.js';
 export * from './app-integrations-declaration.js';
+export * from './app-sign-in.js';
 export * from './artifact-contract.js';
 export * from './binding-classification-digest-helper.js';
 export * from './binding-classification-subject.js';
@@ -46,6 +47,8 @@ export * from './env-bindings.js';
 export * from './error-category-registry.js';
 export * from './error-category.js';
 export * from './error-envelope.js';
+export * from './external-sign-in.js';
+export * from './identity-context.js';
 export * from './integration-connect-result.js';
 export * from './integration-error-details.js';
 export * from './integration-execute-input-rules.js';

package/gen-ts/integration-execute-input-rules.ts

@@ -16,11 +16,15 @@ export type IntegrationExecuteInputFieldRule =
   | { kind: 'enum'; required: boolean; values: readonly string[]; default?: string }
   | { kind: 'object[]'; required: boolean; minItems: number; maxItems: number; fields: Readonly<Record<string, IntegrationExecuteInputFieldRule>> }
   | { kind: 'value'; required: boolean; types: readonly IntegrationExecuteInputValueType[]; maxLength?: number; list?: { minItems: number; maxItems: number; types: readonly IntegrationExecuteInputValueType[] } }
-  | { kind: 'boolean'; required: boolean };
+  | { kind: 'boolean'; required: boolean }
+  | { kind: 'record'; required: boolean; minProperties: number; maxProperties: number; types: readonly IntegrationExecuteInputRecordValueType[]; maxLength?: number };
 
 /** The scalar types a `value` input accepts, alone or in its list form. */
 export type IntegrationExecuteInputValueType = 'string' | 'number' | 'boolean';
 
+/** The value types a `record` input accepts under each of its keys (0.78.0): a value type or null. */
+export type IntegrationExecuteInputRecordValueType = IntegrationExecuteInputValueType | 'null';
+
 export type IntegrationExecuteOperationRule = { idempotencyKey: boolean; fields: Record<string, IntegrationExecuteInputFieldRule> };
 
 export const IntegrationExecuteInputRules = {
@@ -195,6 +199,75 @@ export const IntegrationExecuteInputRules = {
       pageToken: { kind: "string", required: false, minLength: 1, maxLength: 256 },
     },
   },
+  "sharepoint.list.list": {
+    idempotencyKey: false,
+    fields: {
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 2048 },
+    },
+  },
+  "sharepoint.item.list": {
+    idempotencyKey: false,
+    fields: {
+      listId: { kind: "string", required: true, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      filter: { kind: "string", required: false, minLength: 1, maxLength: 512 },
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 2048 },
+    },
+  },
+  "sharepoint.item.create": {
+    idempotencyKey: true,
+    fields: {
+      listId: { kind: "string", required: true, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      fields: { kind: "record", required: true, minProperties: 1, maxProperties: 32, types: ["string", "number", "boolean", "null"], maxLength: 4000 },
+    },
+  },
+  "sharepoint.item.update": {
+    idempotencyKey: false,
+    fields: {
+      listId: { kind: "string", required: true, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      itemId: { kind: "string", required: true, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      fields: { kind: "record", required: true, minProperties: 1, maxProperties: 32, types: ["string", "number", "boolean", "null"], maxLength: 4000 },
+    },
+  },
+  "sharepoint.drive.list": {
+    idempotencyKey: false,
+    fields: {
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 2048 },
+    },
+  },
+  "sharepoint.file.list": {
+    idempotencyKey: false,
+    fields: {
+      driveId: { kind: "string", required: false, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      folderId: { kind: "string", required: false, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 2048 },
+    },
+  },
+  "sharepoint.file.search": {
+    idempotencyKey: false,
+    fields: {
+      q: { kind: "string", required: true, minLength: 1, maxLength: 256 },
+      driveId: { kind: "string", required: false, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      pageToken: { kind: "string", required: false, minLength: 1, maxLength: 2048 },
+    },
+  },
+  "sharepoint.file.read": {
+    idempotencyKey: false,
+    fields: {
+      fileId: { kind: "string", required: true, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      driveId: { kind: "string", required: false, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+    },
+  },
+  "sharepoint.file.upload": {
+    idempotencyKey: true,
+    fields: {
+      filename: { kind: "string", required: true, minLength: 1, maxLength: 255 },
+      contentType: { kind: "string", required: true, minLength: 1, maxLength: 128 },
+      dataBase64: { kind: "string", required: true, minLength: 1, maxLength: 2796203 },
+      driveId: { kind: "string", required: false, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      folderId: { kind: "string", required: false, minLength: 0, pattern: "^[A-Za-z0-9!._,=-]{1,256}$" },
+      conflict: { kind: "enum", required: false, values: ["rename", "replace", "fail"], default: "rename" },
+    },
+  },
   "warehouse.view.read": {
     idempotencyKey: false,
     fields: {
@@ -252,15 +325,19 @@ function matches(pattern: string, value: string): boolean {
 type Refusal = { ok: false; problem: IntegrationExecuteInputProblem };
 function refuse(field: string, message: string): Refusal { return { ok: false, problem: { field, message } }; }
 
-const valueNouns = { string: ['a string', 'strings'], number: ['a number', 'numbers'], boolean: ['a boolean', 'booleans'] } as const;
+const valueNouns = { string: ['a string', 'strings'], number: ['a number', 'numbers'], boolean: ['a boolean', 'booleans'], null: ['null', 'nulls'] } as const;
 function either(parts: readonly string[]): string {
   return parts.length > 1 ? `${parts.slice(0, -1).join(', ')} or ${parts[parts.length - 1]}` : parts.join('');
 }
-function isScalar(types: readonly IntegrationExecuteInputValueType[], maxLength: number | undefined, value: unknown): boolean {
+function isScalar(types: readonly IntegrationExecuteInputRecordValueType[], maxLength: number | undefined, value: unknown): boolean {
+  if (value === null) return types.includes('null');
   if (typeof value === 'string') return types.includes('string') && (maxLength === undefined || value.length <= maxLength);
   if (typeof value === 'number') return types.includes('number') && Number.isFinite(value);
   return typeof value === 'boolean' && types.includes('boolean');
 }
+function scalarShapes(types: readonly IntegrationExecuteInputRecordValueType[], maxLength: number | undefined): string[] {
+  return types.map(type => (type === 'string' && maxLength !== undefined ? `a string of at most ${maxLength} characters` : valueNouns[type][0]));
+}
 
 /**
  * Checks one object's fields in rule order and applies defaults: the input
@@ -294,6 +371,15 @@ function checkField(operation: string, path: string, name: string, field: Integr
     case 'boolean':
       if (typeof value !== 'boolean') return refuse(path, `${path} must be a boolean`);
       return { ok: true, value };
+    case 'record': {
+      if (value === null || typeof value !== 'object' || Array.isArray(value)) return refuse(path, `${path} must be a JSON object`);
+      const keys = Object.keys(value);
+      if (keys.length < field.minProperties || keys.length > field.maxProperties) return refuse(path, `${path} must have ${field.minProperties} to ${field.maxProperties} properties`);
+      for (const key of keys) {
+        if (!isScalar(field.types, field.maxLength, (value as Record<string, unknown>)[key])) return refuse(`${path}.${key}`, `${path}.${key} must be ${either(scalarShapes(field.types, field.maxLength))}`);
+      }
+      return { ok: true, value };
+    }
     case 'integer':
       if (typeof value !== 'number' || !Number.isInteger(value) || value < field.minimum || value > field.maximum) return refuse(path, `${path} must be an integer between ${field.minimum} and ${field.maximum}`);
       return { ok: true, value };
@@ -328,7 +414,7 @@ function checkField(operation: string, path: string, name: string, field: Integr
     case 'value': {
       const { types, maxLength, list } = field;
       if (isScalar(types, maxLength, value) || (list !== undefined && Array.isArray(value) && value.length >= list.minItems && value.length <= list.maxItems && value.every(item => isScalar(list.types, maxLength, item)))) return { ok: true, value };
-      const shapes = types.map(type => (type === 'string' && maxLength !== undefined ? `a string of at most ${maxLength} characters` : valueNouns[type][0]));
+      const shapes = scalarShapes(types, maxLength);
       if (list !== undefined) shapes.push(`a list of ${list.minItems} to ${list.maxItems} ${either(list.types.map(type => valueNouns[type][1]))}`);
       return refuse(path, `${path} must be ${either(shapes)}`);
     }

package/gen-ts/integration-execute-request.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is fixed by the operation for every operation but the declared-mode Slack operations (slack.channel.history, slack.message.post, slack.message.update, slack.message.delete; 0.71.0 widened history), and always enforced from an approved grant; any identity/userId/scope field is rejected by additionalProperties. A declared-mode operation runs as the app (for a post: the IT-approved per-app name from the grant, plus a "Posted by <app> on Isomorph" footer) or as the signed-in person (no name, no footer) — the same input either way — and since 0.55.0 the call names which of the app's approved modes it runs under (`mode`): required when IT approved both modes for the app (MODE_REQUIRED otherwise), optional when it approved one (that one is used), and a named mode without an approved grant is refused (MODE_NOT_GRANTED) rather than served under the other, so approval order never decides what a call does. Per-operation input bounds (0.71.0, ADR 0018): slack.channel.history {limit? 1..100, default 15, cursor?, oldest?, latest?}; slack.message.post {text 1..4000 chars, threadId?, format? plain|mrkdwn} and a required idempotencyKey retained across retries of one explicit Send; slack.message.update {messageId, text, format?}; slack.message.delete {messageId}; slack.dm.send {to 1..8 addresses, text, format?} (app mode only) with a required idempotencyKey; slack.user.lookup {email}; gmail.thread.list {limit? 1..50, default 15, q?, labelIds? default [INBOX], pageToken?}; gmail.thread.read {threadId}; gmail.message.read {messageId}; gmail.attachment.read {messageId, attachmentId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, html? <= 64 KiB, attachments? 1..5 of <= 2 MiB each as base64, replyToMessageId?} and a required idempotencyKey like slack.message.post; warehouse.view.read {columns? 1..32, where? 1..16 filters, groupBy? 1..8 columns, aggregates? 1..16, orderBy? 1..8, limit? 1..1000, default 100} (0.70.0: a plain read names columns, an aggregate read names aggregates and optionally groupBy; the cross-field rules — exactly one of columns or aggregates, groupBy needs aggregates, a filter value that fits its op, orderBy naming a returned column, every named column approved — are enforced by governance, not expressible here; ADR 0017). Basecamp (0.76.0, ADR 0022; every id a string of 1..20 digits, every operation user mode): basecamp.project.list {pageToken?, projectStatus? active|archived} on the fixed `account` alias; on a project alias basecamp.todolist.list {pageToken?}; basecamp.todo.list {todolistId, completed?, pageToken?}; basecamp.todo.create {todolistId, content 1..1000 (the to-do title), description? <= 16384, contentFormat? plain|html, dueOn? YYYY-MM-DD, assigneeIds? 1..20, notify?} with a required idempotencyKey; basecamp.todo.complete {todoId} (idempotent at Basecamp, so no key); basecamp.message.list {pageToken?}; basecamp.message.post {subject 1..256, content 1..65536, contentFormat?} with a required idempotencyKey; basecamp.comment.list {recordingId, pageToken?}; basecamp.comment.post {recordingId, content 1..16384, contentFormat?} with a required idempotencyKey; basecamp.campfire.post {content 1..4000, contentFormat?} with a required idempotencyKey; basecamp.people.list {pageToken?}. `pageToken` is the previous page's `nextPageToken` (a Basecamp page number as digits). Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB except a gmail.message.send carrying attachments (governance sizes that route for the attachment bound) and a basecamp.message.post (its 64 KiB body; governance allows 80 KiB there), total deadline 10 s.
+ * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is fixed by the operation for every operation but the declared-mode Slack operations (slack.channel.history, slack.message.post, slack.message.update, slack.message.delete; 0.71.0 widened history), and always enforced from an approved grant; any identity/userId/scope field is rejected by additionalProperties. A declared-mode operation runs as the app (for a post: the IT-approved per-app name from the grant, plus a "Posted by <app> on Isomorph" footer) or as the signed-in person (no name, no footer) — the same input either way — and since 0.55.0 the call names which of the app's approved modes it runs under (`mode`): required when IT approved both modes for the app (MODE_REQUIRED otherwise), optional when it approved one (that one is used), and a named mode without an approved grant is refused (MODE_NOT_GRANTED) rather than served under the other, so approval order never decides what a call does. Per-operation input bounds (0.71.0, ADR 0018): slack.channel.history {limit? 1..100, default 15, cursor?, oldest?, latest?}; slack.message.post {text 1..4000 chars, threadId?, format? plain|mrkdwn} and a required idempotencyKey retained across retries of one explicit Send; slack.message.update {messageId, text, format?}; slack.message.delete {messageId}; slack.dm.send {to 1..8 addresses, text, format?} (app mode only) with a required idempotencyKey; slack.user.lookup {email}; gmail.thread.list {limit? 1..50, default 15, q?, labelIds? default [INBOX], pageToken?}; gmail.thread.read {threadId}; gmail.message.read {messageId}; gmail.attachment.read {messageId, attachmentId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, html? <= 64 KiB, attachments? 1..5 of <= 2 MiB each as base64, replyToMessageId?} and a required idempotencyKey like slack.message.post; warehouse.view.read {columns? 1..32, where? 1..16 filters, groupBy? 1..8 columns, aggregates? 1..16, orderBy? 1..8, limit? 1..1000, default 100} (0.70.0: a plain read names columns, an aggregate read names aggregates and optionally groupBy; the cross-field rules — exactly one of columns or aggregates, groupBy needs aggregates, a filter value that fits its op, orderBy naming a returned column, every named column approved — are enforced by governance, not expressible here; ADR 0017). Basecamp (0.76.0, ADR 0022; every id a string of 1..20 digits, every operation user mode): basecamp.project.list {pageToken?, projectStatus? active|archived} on the fixed `account` alias; on a project alias basecamp.todolist.list {pageToken?}; basecamp.todo.list {todolistId, completed?, pageToken?}; basecamp.todo.create {todolistId, content 1..1000 (the to-do title), description? <= 16384, contentFormat? plain|html, dueOn? YYYY-MM-DD, assigneeIds? 1..20, notify?} with a required idempotencyKey; basecamp.todo.complete {todoId} (idempotent at Basecamp, so no key); basecamp.message.list {pageToken?}; basecamp.message.post {subject 1..256, content 1..65536, contentFormat?} with a required idempotencyKey; basecamp.comment.list {recordingId, pageToken?}; basecamp.comment.post {recordingId, content 1..16384, contentFormat?} with a required idempotencyKey; basecamp.campfire.post {content 1..4000, contentFormat?} with a required idempotencyKey; basecamp.people.list {pageToken?}. `pageToken` is the previous page's `nextPageToken` (a Basecamp page number as digits). SharePoint (0.78.0, ADR 0024; every id a Microsoft Graph id — GraphId, 1..256 characters — every operation user mode on a site alias): sharepoint.list.list {pageToken?}; sharepoint.item.list {listId, filter? 1..512 (an OData filter on `fields/...`), pageToken?}; sharepoint.item.create {listId, fields (1..32 columns, each a string <= 4000, a number, a boolean or null)} with a required idempotencyKey; sharepoint.item.update {listId, itemId, fields} (a PATCH, idempotent at Graph, so no key); sharepoint.drive.list {pageToken?}; sharepoint.file.list {driveId?, folderId?, pageToken?} (no driveId: the site's default drive; no folderId: its root); sharepoint.file.search {q 1..256, driveId?, pageToken?}; sharepoint.file.read {fileId, driveId?}; sharepoint.file.upload {filename 1..255, contentType, dataBase64 <= 2 MiB, driveId?, folderId?, conflict? rename|replace|fail} with a required idempotencyKey. A SharePoint `pageToken` is Graph's `$skiptoken` (up to 2048 characters; the shared field is that wide, the Gmail and Basecamp operations narrow it back to 256). Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB except a gmail.message.send carrying attachments (governance sizes that route for the attachment bound) and a basecamp.message.post (its 64 KiB body; governance allows 80 KiB there) and a sharepoint.file.upload (its 2 MiB file as base64; governance sizes it like the Gmail attachment route), total deadline 10 s.
  */
 export type IntegrationExecuteRequest = {
   /**
@@ -10,7 +10,7 @@ export type IntegrationExecuteRequest = {
    */
   connection: string;
   /**
-   * Closed operation set. Extending it is a contracts change. 0.76.0 (ADR 0022) adds the eleven Basecamp operations, every one user mode only like gmail.*: basecamp.project.list (the projects of the company's pinned Basecamp account; its resource is the fixed `account` alias), and on one mapped project (the resource is a project alias, a key of the connection's `channels` map) basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create (a receipted write: explicit action, idempotencyKey), basecamp.todo.complete (idempotent at Basecamp, no key), basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post (the three posts are receipted writes) and basecamp.people.list. gmail.message.send (0.50.0) sends one email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity; since 0.71.0 it may carry an HTML body and attachments. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent); since 0.55.0 each call names which of the approved modes it runs under. 0.71.0 (ADR 0018) adds slack.message.update and slack.message.delete (declared mode, like post), slack.dm.send (app mode: a direct message to 1..8 workspace members named by email), slack.user.lookup (app mode: email to Slack user id), gmail.thread.read (every message of one thread) and gmail.attachment.read (one attachment's bytes), and lets slack.channel.history run in app mode as well as user mode.
+   * Closed operation set. Extending it is a contracts change. 0.78.0 (ADR 0024) adds the nine SharePoint operations, every one user mode only on a site alias (a key of the connection's `channels` map, holding a Microsoft Graph site id): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create (a receipted write: explicit action, idempotencyKey), sharepoint.item.update (a PATCH, idempotent at Graph, no key), sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read and sharepoint.file.upload (a receipted write). 0.76.0 (ADR 0022) adds the eleven Basecamp operations, every one user mode only like gmail.*: basecamp.project.list (the projects of the company's pinned Basecamp account; its resource is the fixed `account` alias), and on one mapped project (the resource is a project alias, a key of the connection's `channels` map) basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create (a receipted write: explicit action, idempotencyKey), basecamp.todo.complete (idempotent at Basecamp, no key), basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post (the three posts are receipted writes) and basecamp.people.list. gmail.message.send (0.50.0) sends one email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity; since 0.71.0 it may carry an HTML body and attachments. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent); since 0.55.0 each call names which of the approved modes it runs under. 0.71.0 (ADR 0018) adds slack.message.update and slack.message.delete (declared mode, like post), slack.dm.send (app mode: a direct message to 1..8 workspace members named by email), slack.user.lookup (app mode: email to Slack user id), gmail.thread.read (every message of one thread) and gmail.attachment.read (one attachment's bytes), and lets slack.channel.history run in app mode as well as user mode.
    */
   operation:
     | 'slack.channel.history'
@@ -35,6 +35,15 @@ export type IntegrationExecuteRequest = {
     | 'basecamp.comment.post'
     | 'basecamp.campfire.post'
     | 'basecamp.people.list'
+    | 'sharepoint.list.list'
+    | 'sharepoint.item.list'
+    | 'sharepoint.item.create'
+    | 'sharepoint.item.update'
+    | 'sharepoint.drive.list'
+    | 'sharepoint.file.list'
+    | 'sharepoint.file.search'
+    | 'sharepoint.file.read'
+    | 'sharepoint.file.upload'
     | 'warehouse.view.read'
     | 'service.request';
   /**
@@ -79,7 +88,7 @@ export type IntegrationExecuteRequest = {
      */
     latest?: string;
     /**
-     * gmail.thread.list (0.71.0): a Gmail search query (the search-box syntax, e.g. `from:jane newer_than:7d`).
+     * gmail.thread.list (0.71.0): a Gmail search query (the search-box syntax, e.g. `from:jane newer_than:7d`). sharepoint.file.search (0.78.0): the words to search a drive's file names and contents for.
      */
     q?: string;
     /**
@@ -90,7 +99,7 @@ export type IntegrationExecuteRequest = {
      */
     labelIds?: string[];
     /**
-     * gmail.thread.list (0.71.0) and every basecamp.*.list operation (0.76.0): the `nextPageToken` of the previous page; absent reads the first page.
+     * gmail.thread.list (0.71.0), every basecamp.*.list operation (0.76.0) and the paged sharepoint.* reads (0.78.0: list.list, item.list, drive.list, file.list, file.search): the `nextPageToken` of the previous page; absent reads the first page. At most 2048 characters for a Graph `$skiptoken`; the Gmail and Basecamp operations narrow it to 256.
      */
     pageToken?: string;
     /**
@@ -166,6 +175,52 @@ export type IntegrationExecuteRequest = {
      * basecamp.project.list (0.76.0): which projects to list; active when absent.
      */
     projectStatus?: 'active' | 'archived';
+    /**
+     * sharepoint.item.list / sharepoint.item.create / sharepoint.item.update (0.78.0): the SharePoint list, as a sharepoint.list.list result named it.
+     */
+    listId?: string;
+    /**
+     * sharepoint.item.update (0.78.0): the list item, as a sharepoint.item.list or sharepoint.item.create result named it.
+     */
+    itemId?: string;
+    /**
+     * sharepoint.file.list / sharepoint.file.search / sharepoint.file.read / sharepoint.file.upload (0.78.0): the document library, as a sharepoint.drive.list result named it; absent means the site's default drive (its Documents library).
+     */
+    driveId?: string;
+    /**
+     * sharepoint.file.list / sharepoint.file.upload (0.78.0): the folder to list or upload into, as a sharepoint.file.list result named it (an entry with isFolder); absent means the drive's root.
+     */
+    folderId?: string;
+    /**
+     * sharepoint.file.read (0.78.0): the file, as a sharepoint.file.list, sharepoint.file.search or sharepoint.file.upload result named it.
+     */
+    fileId?: string;
+    /**
+     * sharepoint.item.create / sharepoint.item.update (0.78.0): the item's column values keyed by the column's internal name (`Title`, `Status`, `DueDate`...), 1..32 of them; each a string of at most 4000 characters, a number, a boolean or null (which clears the column on an update). Which columns the list has, and whether a value fits its column type, is Graph's check.
+     */
+    fields?: {
+      [k: string]: string | number | boolean | null;
+    };
+    /**
+     * sharepoint.item.list (0.78.0): an OData `$filter` over the item's columns as `fields/<column> <op> <value>`, e.g. `fields/Status eq 'Open'`; absent lists every item. A filter on a column SharePoint has not indexed may be refused by Graph on a large list.
+     */
+    filter?: string;
+    /**
+     * sharepoint.file.upload (0.78.0): what happens when a file of that name already exists in the folder; rename when absent.
+     */
+    conflict?: 'rename' | 'replace' | 'fail';
+    /**
+     * sharepoint.file.upload (0.78.0): the name the file is stored under (the result's `filename` is the stored name, which `conflict` rename may have changed).
+     */
+    filename?: string;
+    /**
+     * sharepoint.file.upload (0.78.0): the file's MIME type, e.g. application/pdf.
+     */
+    contentType?: string;
+    /**
+     * sharepoint.file.upload (0.78.0): the file bytes, standard base64, at most 2 MiB of bytes (2,796,203 base64 characters) — the Gmail attachment bound.
+     */
+    dataBase64?: string;
     /**
      * warehouse.view.read, a plain read: explicit columns, or `*` alone when the app's approved resource grant allows all current and future columns. An aggregate read names aggregates instead.
      *
@@ -217,7 +272,7 @@ export type IntegrationExecuteRequest = {
     };
   };
   /**
-   * UUID of one explicit Send action; required for the sends (slack.message.post, slack.dm.send, gmail.message.send) and the receipted Basecamp writes (basecamp.todo.create, basecamp.message.post, basecamp.comment.post, basecamp.campfire.post; 0.76.0), refused everywhere else. The same key with the same payload and subject returns the recorded outcome for seven days.
+   * UUID of one explicit Send action; required for the sends (slack.message.post, slack.dm.send, gmail.message.send), the receipted Basecamp writes (basecamp.todo.create, basecamp.message.post, basecamp.comment.post, basecamp.campfire.post; 0.76.0) and the receipted SharePoint writes (sharepoint.item.create, sharepoint.file.upload; 0.78.0), refused everywhere else. The same key with the same payload and subject returns the recorded outcome for seven days.
    */
   idempotencyKey?: string;
   /**

package/gen-ts/integration-execute-result.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the operation results (twenty-four operations since 0.76.0, ADR 0018 and ADR 0022): slack.channel.history -> {messages, hasMore, nextCursor?} (plain text/IDs/time, plus the display name and emoji icon a per-app-named app post carries — authorName/authorIcon, 0.55.0 — never the provider payload; `nextCursor` when hasMore, to pass as the next read's `cursor`); slack.message.post, slack.message.update, slack.message.delete -> {messageId} (the Slack ts); slack.dm.send -> {messageId, channelId} (the ts and the DM channel it went to); slack.user.lookup -> {userId, displayName}; gmail.thread.list -> {threads, hasMore, nextPageToken?} (newest matching threads; each `messageId` is the thread's newest message, what gmail.message.read takes; `nextPageToken` when hasMore); gmail.thread.read -> {id, emails} (every message of the thread, oldest first, each shaped like a gmail.message.read result); gmail.message.read -> {id, threadId, subject, from, to, date, text, truncated, attachments?} (headers plus the plain text with html stripped, cut at 16 KiB with `truncated` set; `attachments` lists the files without their bytes, which gmail.attachment.read fetches by id); gmail.attachment.read -> {filename, mimeType, size, dataBase64}; gmail.message.send -> {messageId, threadId} (the Gmail ids of the sent message and its thread); warehouse.view.read -> {rows, truncated} (rows keyed by the selected columns, or for an aggregate read by the groupBy columns then the aggregate aliases; decimal/64-bit values as strings, dates as ISO strings; since 0.70.0 every server sends `truncated`, true when more rows matched than `limit` — the server reads limit+1 rows to know — so the rows are incomplete and must not be totalled or averaged; a server before 0.70.0 omitted it). Basecamp (0.76.0, ADR 0022; every id a string of digits, every page at most 100 items, `nextPageToken` only when hasMore, text cut at 16 KiB like Gmail): basecamp.project.list -> {projects, hasMore, nextPageToken?}; basecamp.todolist.list -> {todolists, hasMore, nextPageToken?}; basecamp.todo.list -> {todos, hasMore, nextPageToken?}; basecamp.message.list -> {boardMessages, hasMore, nextPageToken?} (`boardMessages`, not `messages`, which is the Slack history shape); basecamp.comment.list -> {comments, hasMore, nextPageToken?}; basecamp.people.list -> {people, hasMore, nextPageToken?}; basecamp.todo.create, basecamp.message.post, basecamp.comment.post, basecamp.campfire.post -> {id, appUrl} (the new recording and its Basecamp page); basecamp.todo.complete -> {id, completed} with completed always true. An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. A whole result over 1 MiB is rejected, never cut down to fit — except a gmail.attachment.read, whose single attachment is bounded by its own 2 MiB.
+ * The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the operation results (thirty-three operations since 0.78.0, ADR 0018, ADR 0022 and ADR 0024): slack.channel.history -> {messages, hasMore, nextCursor?} (plain text/IDs/time, plus the display name and emoji icon a per-app-named app post carries — authorName/authorIcon, 0.55.0 — never the provider payload; `nextCursor` when hasMore, to pass as the next read's `cursor`); slack.message.post, slack.message.update, slack.message.delete -> {messageId} (the Slack ts); slack.dm.send -> {messageId, channelId} (the ts and the DM channel it went to); slack.user.lookup -> {userId, displayName}; gmail.thread.list -> {threads, hasMore, nextPageToken?} (newest matching threads; each `messageId` is the thread's newest message, what gmail.message.read takes; `nextPageToken` when hasMore); gmail.thread.read -> {id, emails} (every message of the thread, oldest first, each shaped like a gmail.message.read result); gmail.message.read -> {id, threadId, subject, from, to, date, text, truncated, attachments?} (headers plus the plain text with html stripped, cut at 16 KiB with `truncated` set; `attachments` lists the files without their bytes, which gmail.attachment.read fetches by id); gmail.attachment.read -> {filename, mimeType, size, dataBase64}; gmail.message.send -> {messageId, threadId} (the Gmail ids of the sent message and its thread); warehouse.view.read -> {rows, truncated} (rows keyed by the selected columns, or for an aggregate read by the groupBy columns then the aggregate aliases; decimal/64-bit values as strings, dates as ISO strings; since 0.70.0 every server sends `truncated`, true when more rows matched than `limit` — the server reads limit+1 rows to know — so the rows are incomplete and must not be totalled or averaged; a server before 0.70.0 omitted it). Basecamp (0.76.0, ADR 0022; every id a string of digits, every page at most 100 items, `nextPageToken` only when hasMore, text cut at 16 KiB like Gmail): basecamp.project.list -> {projects, hasMore, nextPageToken?}; basecamp.todolist.list -> {todolists, hasMore, nextPageToken?}; basecamp.todo.list -> {todos, hasMore, nextPageToken?}; basecamp.message.list -> {boardMessages, hasMore, nextPageToken?} (`boardMessages`, not `messages`, which is the Slack history shape); basecamp.comment.list -> {comments, hasMore, nextPageToken?}; basecamp.people.list -> {people, hasMore, nextPageToken?}; basecamp.todo.create, basecamp.message.post, basecamp.comment.post, basecamp.campfire.post -> {id, appUrl} (the new recording and its Basecamp page); basecamp.todo.complete -> {id, completed} with completed always true. SharePoint (0.78.0, ADR 0024; every id a Microsoft Graph id, `nextPageToken` only when hasMore and up to 2048 characters for a Graph `$skiptoken`): sharepoint.list.list -> {lists, hasMore, nextPageToken?} (at most 100, hidden lists dropped); sharepoint.item.list -> {items, hasMore, nextPageToken?} (at most 50; each item's `fields` are the column values as Graph returns them with the system columns dropped, the whole object cut at 16 KiB); sharepoint.drive.list -> {drives, hasMore, nextPageToken?}; sharepoint.file.list and sharepoint.file.search -> {files, hasMore, nextPageToken?} (at most 100 entries, folders included with isFolder); sharepoint.file.read -> {id, filename, mimeType, size, dataBase64} (the Gmail attachment shape plus the file's id; at most 2 MiB of bytes); sharepoint.item.create -> {id, webUrl} (the new item and its SharePoint page); sharepoint.item.update -> {id}; sharepoint.file.upload -> {id, filename, webUrl} (the stored file, under the name `conflict` rename may have given it). An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. A whole result over 1 MiB is rejected, never cut down to fit — except a gmail.attachment.read or a sharepoint.file.read, whose single file is bounded by its own 2 MiB.
  */
 export type IntegrationExecuteResult = {
   /**
@@ -32,9 +32,12 @@ export type IntegrationExecuteResult = {
    */
   threads?: GmailThread[];
   /**
-   * gmail.thread.list (0.71.0): the token of the next page, present only when hasMore.
+   * gmail.thread.list (0.71.0), the basecamp.* lists (0.76.0) and the paged sharepoint.* reads (0.78.0): the token of the next page, present only when hasMore; up to 2048 characters since 0.78.0 for a Graph $skiptoken.
    */
   nextPageToken?: string;
+  /**
+   * gmail.thread.read / gmail.message.read: the Gmail id; the Basecamp writes and complete (0.76.0): the recording's id; the SharePoint writes and sharepoint.file.read (0.78.0): the Graph id of the item or file (up to 256 characters since 0.78.0, the GraphId bound).
+   */
   id?: string;
   threadId?: string;
   subject?: string;
@@ -122,6 +125,34 @@ export type IntegrationExecuteResult = {
    * basecamp.todo.complete (0.76.0): always true; the to-do is complete whether this call or an earlier one completed it.
    */
   completed?: boolean;
+  /**
+   * sharepoint.list.list (0.78.0): one page of the site's lists the signed-in person can see, hidden lists dropped.
+   *
+   * @maxItems 100
+   */
+  lists?: SharePointList[];
+  /**
+   * sharepoint.item.list (0.78.0): one page of the list's items (Graph pages of 50), filtered when the read said `filter`.
+   *
+   * @maxItems 50
+   */
+  items?: SharePointListItem[];
+  /**
+   * sharepoint.drive.list (0.78.0): one page of the site's document libraries.
+   *
+   * @maxItems 100
+   */
+  drives?: SharePointDrive[];
+  /**
+   * sharepoint.file.list / sharepoint.file.search (0.78.0): one page of a folder's entries (files and folders) or of the files matching the search.
+   *
+   * @maxItems 100
+   */
+  files?: SharePointFile[];
+  /**
+   * sharepoint.item.create / sharepoint.file.upload (0.78.0): the SharePoint page of the new item or file, for a person to open.
+   */
+  webUrl?: string;
   status?: number;
   headers?: {
     [k: string]: string;
@@ -296,3 +327,60 @@ export interface BasecampPerson {
    */
   admin: boolean;
 }
+/**
+ * One list of a sharepoint.list.list result (0.78.0); `id` is what sharepoint.item.list, sharepoint.item.create and sharepoint.item.update take as `listId`. `template` is the list template Graph reports (genericList, documentLibrary, tasks, events...) when it does.
+ */
+export interface SharePointList {
+  /**
+   * A Microsoft Graph id (0.78.0): a SharePoint list (a GUID), list item (digits), drive (`b!...`) or drive item, as Graph names it — opaque, 1..256 characters of letters, digits and `!._,=-`. How every sharepoint.* result names one and every sharepoint.* input takes one back.
+   */
+  id: string;
+  name: string;
+  description?: string;
+  webUrl: string;
+  template?: string;
+}
+/**
+ * One item of a sharepoint.item.list result (0.78.0): `fields` are its column values keyed by internal column name, as Graph returns them with the system columns (@odata.etag, ContentType, Attachments, Edit, LinkTitle*, ItemChildCount, FolderChildCount, _UIVersionString, _ComplianceFlags...) dropped and the whole object cut at 16 KiB; `id` is what sharepoint.item.update takes as `itemId`.
+ */
+export interface SharePointListItem {
+  /**
+   * A Microsoft Graph id (0.78.0): a SharePoint list (a GUID), list item (digits), drive (`b!...`) or drive item, as Graph names it — opaque, 1..256 characters of letters, digits and `!._,=-`. How every sharepoint.* result names one and every sharepoint.* input takes one back.
+   */
+  id: string;
+  /**
+   * Column values as Graph returns them (strings, numbers, booleans, and lookup or person values as Graph shapes them).
+   */
+  fields: {
+    [k: string]: unknown;
+  };
+  webUrl: string;
+  createdAt: string;
+  modifiedAt: string;
+}
+/**
+ * One document library of a sharepoint.drive.list result (0.78.0); `id` is what the sharepoint.file.* operations take as `driveId`.
+ */
+export interface SharePointDrive {
+  /**
+   * A Microsoft Graph id (0.78.0): a SharePoint list (a GUID), list item (digits), drive (`b!...`) or drive item, as Graph names it — opaque, 1..256 characters of letters, digits and `!._,=-`. How every sharepoint.* result names one and every sharepoint.* input takes one back.
+   */
+  id: string;
+  name: string;
+  webUrl: string;
+}
+/**
+ * One entry of a sharepoint.file.list or sharepoint.file.search result (0.78.0): a file (`mimeType` set, `id` is what sharepoint.file.read takes as `fileId`) or a folder (`isFolder`, `id` is what sharepoint.file.list and sharepoint.file.upload take as `folderId`). `size` is in bytes; a folder's is the total of its contents.
+ */
+export interface SharePointFile {
+  /**
+   * A Microsoft Graph id (0.78.0): a SharePoint list (a GUID), list item (digits), drive (`b!...`) or drive item, as Graph names it — opaque, 1..256 characters of letters, digits and `!._,=-`. How every sharepoint.* result names one and every sharepoint.* input takes one back.
+   */
+  id: string;
+  name: string;
+  isFolder: boolean;
+  size: number;
+  mimeType?: string;
+  webUrl: string;
+  modifiedAt: string;
+}