@fourier-labs/harbour-contracts 0.77.0 → 0.79.0

package/gen-ts/integration-operations.ts

@@ -205,6 +205,87 @@ export const IntegrationOperations = {
     "declaredMode": false,
     "idempotencyKey": false
   },
+  "sharepoint.list.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sharepoint.item.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sharepoint.item.create": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "sharepoint.item.update": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sharepoint.drive.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sharepoint.file.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sharepoint.file.search": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sharepoint.file.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sharepoint.file.upload": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
   "warehouse.view.read": {
     "kind": "database",
     "identities": [

package/gen-ts/saas-connection.ts

@@ -2,9 +2,9 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`.
+ * Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`.
  */
-export type SaasProvider = 'slack' | 'gmail' | 'basecamp';
+export type SaasProvider = 'slack' | 'gmail' | 'basecamp' | 'sharepoint';
 /**
  * DISABLED stops every app call immediately (details.code CONNECTION_DISABLED).
  */
@@ -27,7 +27,7 @@ export type ExternalRecipientMode = 'block' | 'allowlist' | 'allow';
 export type InstallationName = string;
 
 /**
- * Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.
+ * Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. A SharePoint connection (0.78.0, ADR 0024) is shaped the same way: IT pins the company's Microsoft 365 tenant in `account` (the Entra tenant id and the organisation's display name, from IT's own Microsoft sign-in) and maps site aliases to Microsoft Graph site ids (`hostname,siteCollectionGuid,webGuid`) in `channels`; every sharepoint.* operation runs on a site alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.
  */
 export interface SaasConnection {
   schema: 'harbour.saas-connection/1.0';
@@ -47,19 +47,19 @@ export interface SaasConnection {
   installation?: SaasInstallation;
   account?: BasecampAccount;
   /**
-   * Logical alias → provider resource id: a Slack channel id or a Basecamp project id. Always empty for Gmail.
+   * Logical alias → provider resource id: a Slack channel id, a Basecamp project id or a SharePoint site id. Always empty for Gmail.
    */
   channels: {
     /**
-     * A Slack channel id (public, non-archived) or a Basecamp project id (digits).
+     * A Slack channel id (public, non-archived), a Basecamp project id (digits) or a SharePoint site id (0.78.0: the Microsoft Graph composite `hostname,siteCollectionGuid,webGuid`).
      */
     [k: string]: string;
   };
   /**
-   * Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list). Never warehouse.view.read.
+   * Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload). Never warehouse.view.read.
    *
    * @minItems 1
-   * @maxItems 22
+   * @maxItems 31
    */
   operations: (
     | 'slack.channel.history'
@@ -84,6 +84,15 @@ export interface SaasConnection {
     | 'basecamp.comment.post'
     | 'basecamp.campfire.post'
     | 'basecamp.people.list'
+    | 'sharepoint.list.list'
+    | 'sharepoint.item.list'
+    | 'sharepoint.item.create'
+    | 'sharepoint.item.update'
+    | 'sharepoint.drive.list'
+    | 'sharepoint.file.list'
+    | 'sharepoint.file.search'
+    | 'sharepoint.file.read'
+    | 'sharepoint.file.upload'
     | 'warehouse.view.read'
     | 'service.request'
   )[];
@@ -151,15 +160,15 @@ export interface SaasInstallation {
   botName?: string;
 }
 /**
- * The pinned Basecamp account (0.76.0, Basecamp only): the one account, among those IT's own Basecamp sign-in belongs to, that every user token on this connection must also belong to and that every project id in `channels` lives in. Absent until IT chooses it; governance refuses every basecamp.* call until then.
+ * The pinned provider account (0.76.0, Basecamp; 0.78.0, SharePoint — the name keeps its 0.76.0 spelling so consumers need not move): the one account, among those IT's own provider sign-in belongs to, that every user token on this connection must also belong to and that every resource id in `channels` lives in. For Basecamp the account (digits); for SharePoint the Microsoft 365 tenant (the Entra tenant GUID). Absent until IT chooses it; governance refuses every basecamp.* and sharepoint.* call until then.
  */
 export interface BasecampAccount {
   /**
-   * The Basecamp account id, the first path segment of the API base URL.
+   * The Basecamp account id (digits, the first path segment of the API base URL) or the Microsoft Entra tenant id (a GUID, the `tid` claim).
    */
   id: string;
   /**
-   * The account's name as Basecamp shows it, for IT to recognise.
+   * The account's name as the provider shows it (a Basecamp account name, a Microsoft 365 organisation display name), for IT to recognise.
    */
   name: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.77.0",
+  "version": "0.79.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/app-integrations-declaration.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/app-integrations-declaration.schema.json",
   "title": "AppIntegrationsDeclaration",
-  "description": "Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (twenty-four operations since 0.76.0, ADR 0018 and ADR 0022). Each operation carries a fixed identity mode \u2014 slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, every basecamp.* operation=user, warehouse.view.read=app, service.request=app \u2014 except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) \u2014 a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack, Gmail and Basecamp operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. Basecamp (0.76.0, ADR 0022) is user-mode only too: basecamp.project.list runs on the fixed `account` alias (the company's pinned Basecamp account) and every other basecamp.* operation on a project alias IT mapped in the connection's `channels` map, so Basecamp itself refuses an id outside that project. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.",
+  "description": "Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (thirty-three operations since 0.78.0, ADR 0018, ADR 0022 and ADR 0024). Each operation carries a fixed identity mode \u2014 slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, every basecamp.* operation=user, every sharepoint.* operation=user, warehouse.view.read=app, service.request=app \u2014 except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) \u2014 a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack, Gmail, Basecamp and SharePoint operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. Basecamp (0.76.0, ADR 0022) is user-mode only too: basecamp.project.list runs on the fixed `account` alias (the company's pinned Basecamp account) and every other basecamp.* operation on a project alias IT mapped in the connection's `channels` map, so Basecamp itself refuses an id outside that project. SharePoint (0.78.0, ADR 0024) is user-mode only as well: every sharepoint.* operation runs on a site alias IT mapped in the connection's `channels` map (a Microsoft Graph site id), so Graph itself refuses a list, item or file outside that site. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -37,6 +37,11 @@
       "pattern": "^[0-9]{1,20}$",
       "description": "A Basecamp id (0.76.0): an account, project, to-do list, to-do, recording or person, as a string of 1..20 digits \u2014 how every basecamp.* result names one and every basecamp.* input takes one back."
     },
+    "GraphId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9!._,=-]{1,256}$",
+      "description": "A Microsoft Graph id (0.78.0): a SharePoint list (a GUID), list item (digits), drive (`b!...`) or drive item, as Graph names it \u2014 opaque, 1..256 characters of letters, digits and `!._,=-`. How every sharepoint.* result names one and every sharepoint.* input takes one back."
+    },
     "IntegrationConnectionKind": {
       "type": "string",
       "enum": [
@@ -70,10 +75,19 @@
         "basecamp.comment.post",
         "basecamp.campfire.post",
         "basecamp.people.list",
+        "sharepoint.list.list",
+        "sharepoint.item.list",
+        "sharepoint.item.create",
+        "sharepoint.item.update",
+        "sharepoint.drive.list",
+        "sharepoint.file.list",
+        "sharepoint.file.search",
+        "sharepoint.file.read",
+        "sharepoint.file.upload",
         "warehouse.view.read",
         "service.request"
       ],
-      "description": "Closed operation set. Extending it is a contracts change. 0.76.0 (ADR 0022) adds the eleven Basecamp operations, every one user mode only like gmail.*: basecamp.project.list (the projects of the company's pinned Basecamp account; its resource is the fixed `account` alias), and on one mapped project (the resource is a project alias, a key of the connection's `channels` map) basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create (a receipted write: explicit action, idempotencyKey), basecamp.todo.complete (idempotent at Basecamp, no key), basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post (the three posts are receipted writes) and basecamp.people.list. gmail.message.send (0.50.0) sends one email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity; since 0.71.0 it may carry an HTML body and attachments. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent); since 0.55.0 each call names which of the approved modes it runs under. 0.71.0 (ADR 0018) adds slack.message.update and slack.message.delete (declared mode, like post), slack.dm.send (app mode: a direct message to 1..8 workspace members named by email), slack.user.lookup (app mode: email to Slack user id), gmail.thread.read (every message of one thread) and gmail.attachment.read (one attachment's bytes), and lets slack.channel.history run in app mode as well as user mode."
+      "description": "Closed operation set. Extending it is a contracts change. 0.78.0 (ADR 0024) adds the nine SharePoint operations, every one user mode only on a site alias (a key of the connection's `channels` map, holding a Microsoft Graph site id): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create (a receipted write: explicit action, idempotencyKey), sharepoint.item.update (a PATCH, idempotent at Graph, no key), sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read and sharepoint.file.upload (a receipted write). 0.76.0 (ADR 0022) adds the eleven Basecamp operations, every one user mode only like gmail.*: basecamp.project.list (the projects of the company's pinned Basecamp account; its resource is the fixed `account` alias), and on one mapped project (the resource is a project alias, a key of the connection's `channels` map) basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create (a receipted write: explicit action, idempotencyKey), basecamp.todo.complete (idempotent at Basecamp, no key), basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post (the three posts are receipted writes) and basecamp.people.list. gmail.message.send (0.50.0) sends one email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity; since 0.71.0 it may carry an HTML body and attachments. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent); since 0.55.0 each call names which of the approved modes it runs under. 0.71.0 (ADR 0018) adds slack.message.update and slack.message.delete (declared mode, like post), slack.dm.send (app mode: a direct message to 1..8 workspace members named by email), slack.user.lookup (app mode: email to Slack user id), gmail.thread.read (every message of one thread) and gmail.attachment.read (one attachment's bytes), and lets slack.channel.history run in app mode as well as user mode."
     },
     "IntegrationIdentityMode": {
       "type": "string",
@@ -163,7 +177,7 @@
         "identity",
         "resources"
       ],
-      "description": "Every gmail.* operation (resource: the fixed `inbox` alias) and, since 0.76.0, every basecamp.* operation (resource: a project alias from the connection's `channels` map, or the fixed `account` alias for basecamp.project.list): user mode only — the app acts as the signed-in person after their own consent.",
+      "description": "Every gmail.* operation (resource: the fixed `inbox` alias), since 0.76.0 every basecamp.* operation (resource: a project alias from the connection's `channels` map, or the fixed `account` alias for basecamp.project.list) and since 0.78.0 every sharepoint.* operation (resource: a site alias from the connection's `channels` map): user mode only — the app acts as the signed-in person after their own consent.",
       "properties": {
         "identity": {
           "type": "string",
@@ -320,6 +334,33 @@
             "basecamp.people.list": {
               "$ref": "#/definitions/UserModeChannelOperation"
             },
+            "sharepoint.list.list": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "sharepoint.item.list": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "sharepoint.item.create": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "sharepoint.item.update": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "sharepoint.drive.list": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "sharepoint.file.list": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "sharepoint.file.search": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "sharepoint.file.read": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "sharepoint.file.upload": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
             "warehouse.view.read": {
               "$ref": "#/definitions/AppModeViewOperation"
             },
@@ -482,6 +523,51 @@
                         "basecamp.people.list"
                       ]
                     },
+                    {
+                      "required": [
+                        "sharepoint.list.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.item.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.item.create"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.item.update"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.drive.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.file.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.file.search"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.file.read"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.file.upload"
+                      ]
+                    },
                     {
                       "required": [
                         "service.request"
@@ -621,6 +707,51 @@
                         "basecamp.people.list"
                       ]
                     },
+                    {
+                      "required": [
+                        "sharepoint.list.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.item.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.item.create"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.item.update"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.drive.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.file.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.file.search"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.file.read"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "sharepoint.file.upload"
+                      ]
+                    },
                     {
                       "required": [
                         "warehouse.view.read"
@@ -818,6 +949,65 @@
             }
           }
         },
+        "company-sharepoint": {
+          "kind": "saas",
+          "operations": {
+            "sharepoint.list.list": {
+              "identity": "user",
+              "resources": [
+                "intranet"
+              ]
+            },
+            "sharepoint.item.list": {
+              "identity": "user",
+              "resources": [
+                "intranet"
+              ]
+            },
+            "sharepoint.item.create": {
+              "identity": "user",
+              "resources": [
+                "intranet"
+              ]
+            },
+            "sharepoint.item.update": {
+              "identity": "user",
+              "resources": [
+                "intranet"
+              ]
+            },
+            "sharepoint.drive.list": {
+              "identity": "user",
+              "resources": [
+                "intranet"
+              ]
+            },
+            "sharepoint.file.list": {
+              "identity": "user",
+              "resources": [
+                "intranet"
+              ]
+            },
+            "sharepoint.file.search": {
+              "identity": "user",
+              "resources": [
+                "intranet"
+              ]
+            },
+            "sharepoint.file.read": {
+              "identity": "user",
+              "resources": [
+                "intranet"
+              ]
+            },
+            "sharepoint.file.upload": {
+              "identity": "user",
+              "resources": [
+                "intranet"
+              ]
+            }
+          }
+        },
         "sales-warehouse": {
           "kind": "database",
           "operations": {

package/schema/app-sign-in.schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://schemas.harbour.dev/app-sign-in.schema.json",
+  "title": "AppSignIn",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "signIn": {
+      "type": "string",
+      "enum": [
+        "company",
+        "external"
+      ]
+    },
+    "signInMethods": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "phone",
+          "email"
+        ]
+      },
+      "minItems": 1,
+      "maxItems": 1
+    },
+    "clientId": {
+      "type": "string"
+    }
+  },
+  "required": [],
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "signIn": {
+            "const": "external"
+          }
+        },
+        "required": [
+          "signIn"
+        ]
+      },
+      "then": {
+        "required": [
+          "signInMethods"
+        ]
+      }
+    }
+  ]
+}

package/schema/data-grant-v2.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/data-grant-v2.schema.json",
   "title": "DataGrantV2",
-  "description": "An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON [\"v2\",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. An app-mode Slack grant may carry `presentation` (0.53.0): the IT-approved display name and icon the app's posts go out under, copied from the approved request and read by every post — never from the call. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.",
+  "description": "An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON [\"v2\",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias, a SharePoint site alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. An app-mode Slack grant may carry `presentation` (0.53.0): the IT-approved display name and icon the app's posts go out under, copied from the approved request and read by every post — never from the call. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "tenantId", "appId", "environment", "sourceId", "mode", "kind", "status", "operations", "resources", "version", "provisioning", "createdAt", "updatedAt"],
@@ -17,10 +17,10 @@
     "status": { "$ref": "#/definitions/DataGrantV2Status" },
     "operations": {
       "type": "array",
-      "maxItems": 22,
+      "maxItems": 31,
       "uniqueItems": true,
       "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" },
-      "description": "Approved operations; each must match this grant's mode. Empty until the first approval. At most the twenty-two SaaS operations (0.76.0: eleven Slack and Gmail, eleven Basecamp); a database grant holds one."
+      "description": "Approved operations; each must match this grant's mode. Empty until the first approval. At most the thirty-one SaaS operations (0.78.0: eleven Slack and Gmail, eleven Basecamp, nine SharePoint); a database grant holds one."
     },
     "resources": {
       "type": "array",
@@ -62,7 +62,7 @@
       "type": "object",
       "additionalProperties": false,
       "required": ["name"],
-      "description": "One approved logical resource: a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias (0.76.0), or a warehouse view alias with the approved columns.",
+      "description": "One approved logical resource: a Slack channel alias, the fixed Gmail `inbox` alias, a Basecamp project alias or the fixed Basecamp `account` alias (0.76.0), a SharePoint site alias (0.78.0), or a warehouse view alias with the approved columns.",
       "properties": {
         "name": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationAlias" },
         "columns": {

package/schema/deployment-app-registration.schema.json

@@ -19,6 +19,9 @@
     "allowedUsers": {"type": "array", "items": {"type": "string"}},
     "allowedGroups": {"type": "array", "items": {"type": "string"}},
     "enabled": {"type": "boolean"},
-    "workloadPrincipalArn": {"type": "string", "pattern": "^arn:aws:(iam|sts)::[0-9]+:"}
-  }
+    "workloadPrincipalArn": {"type": "string", "pattern": "^arn:aws:(iam|sts)::[0-9]+:"},
+    "signIn": {"type": "string", "enum": ["company", "external"]},
+    "signInMethods": {"type": "array", "items": {"type": "string", "enum": ["phone", "email"]}, "minItems": 1, "maxItems": 1}
+  },
+  "allOf": [{"if": {"properties": {"signIn": {"const": "external"}}, "required": ["signIn"]}, "then": {"required": ["signInMethods"]}}]
 }

package/schema/external-sign-in.schema.json

@@ -0,0 +1,120 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://schemas.harbour.dev/external-sign-in.schema.json",
+  "title": "ExternalSignIn",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "enabledMethods": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "phone",
+          "email"
+        ]
+      },
+      "uniqueItems": true
+    },
+    "email": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "senderEmail": {
+          "type": "string"
+        },
+        "senderDomain": {
+          "type": "string"
+        },
+        "sesRegion": {
+          "type": "string"
+        },
+        "configurationSet": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "senderEmail",
+        "sesRegion"
+      ]
+    },
+    "sms": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "originationIdentity": {
+          "type": "string"
+        },
+        "region": {
+          "type": "string"
+        },
+        "inEntityId": {
+          "type": "string"
+        },
+        "inTemplateId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "region"
+      ]
+    },
+    "directory": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "accountId": {
+          "type": "string"
+        },
+        "region": {
+          "type": "string"
+        },
+        "userPoolId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "accountId",
+        "region",
+        "userPoolId"
+      ]
+    },
+    "readiness": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "email": {
+          "type": "object",
+          "properties": {
+            "senderVerified": {
+              "type": "boolean"
+            },
+            "productionAccess": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "senderVerified",
+            "productionAccess"
+          ],
+          "additionalProperties": false
+        },
+        "sms": {
+          "type": "object",
+          "properties": {
+            "sandbox": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "sandbox"
+          ],
+          "additionalProperties": false
+        }
+      }
+    }
+  },
+  "required": [
+    "enabledMethods"
+  ]
+}