@fourier-labs/harbour-contracts 0.84.0 → 0.86.0

package/gen-ts/integration-operations.ts

@@ -304,6 +304,411 @@ export const IntegrationOperations = {
     "declaredMode": false,
     "idempotencyKey": false
   },
+  "calendar.calendar.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "calendar.event.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "calendar.event.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "calendar.event.create": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "calendar.event.update": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "calendar.event.cancel": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "drive.file.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "drive.file.search": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "drive.file.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "drive.file.upload": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "drive.folder.create": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "docs.document.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "docs.document.create": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "docs.document.append": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "docs.text.replace": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sheets.spreadsheet.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sheets.values.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sheets.values.append": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "sheets.values.update": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sheets.values.clear": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "sheets.spreadsheet.create": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "outlook.message.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "outlook.message.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "outlook.attachment.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "outlook.message.send": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "outlook.message.reply": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "outlook.event.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "outlook.event.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "outlook.event.create": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "outlook.event.update": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "outlook.event.cancel": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "onedrive.file.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "onedrive.file.search": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "onedrive.file.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "onedrive.file.upload": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "onedrive.folder.create": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "excel.worksheet.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "excel.range.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "excel.range.update": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "excel.table.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "excel.row.add": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "excel.worksheet.add": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "teams.message.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "teams.message.post": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "teams.reply.post": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
   "warehouse.view.read": {
     "kind": "database",
     "identities": [

package/gen-ts/saas-connection.ts

@@ -2,9 +2,22 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`. Phone (0.82.0) is app mode only with no installation: the tenant's inbound SMS numbers (E.164) mapped from aliases in `channels`, and the SMS the platform received on them listed by phone.sms.list; since 0.83.0 an app reads the number an alias maps to with phone.number.get.
+ * Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`. Phone (0.82.0) is app mode only with no installation: the tenant's inbound SMS numbers (E.164) mapped from aliases in `channels`, and the SMS the platform received on them listed by phone.sms.list; since 0.83.0 an app reads the number an alias maps to with phone.number.get. Google Workspace (0.86.0, ADR 0032: calendar, drive, docs, sheets on the Google OAuth client) and Microsoft 365 (outlook, onedrive, excel, teams on the Microsoft client) are user-consent only like Gmail, one connection per provider with its own consent and scopes; the seven personal providers have no `account` and empty `channels` (their one fixed alias is the signed-in person's own calendar, drive, documents, spreadsheets, mailbox or workbooks); teams is pinned to the Microsoft 365 tenant in `account` like SharePoint and maps channel aliases in `channels`.
  */
-export type SaasProvider = 'slack' | 'gmail' | 'basecamp' | 'sharepoint' | 'phone';
+export type SaasProvider =
+  | 'slack'
+  | 'gmail'
+  | 'basecamp'
+  | 'sharepoint'
+  | 'phone'
+  | 'calendar'
+  | 'drive'
+  | 'docs'
+  | 'sheets'
+  | 'outlook'
+  | 'onedrive'
+  | 'excel'
+  | 'teams';
 /**
  * DISABLED stops every app call immediately (details.code CONNECTION_DISABLED).
  */
@@ -27,7 +40,7 @@ export type ExternalRecipientMode = 'block' | 'allowlist' | 'allow';
 export type InstallationName = string;
 
 /**
- * Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. A SharePoint connection (0.78.0, ADR 0024) is shaped the same way: IT pins the company's Microsoft 365 tenant in `account` (the Entra tenant id and the organisation's display name, from IT's own Microsoft sign-in) and maps site aliases to Microsoft Graph site ids (`hostname,siteCollectionGuid,webGuid`) in `channels`; every sharepoint.* operation runs on a site alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.
+ * Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. A SharePoint connection (0.78.0, ADR 0024) is shaped the same way: IT pins the company's Microsoft 365 tenant in `account` (the Entra tenant id and the organisation's display name, from IT's own Microsoft sign-in) and maps site aliases to Microsoft Graph site ids (`hostname,siteCollectionGuid,webGuid`) in `channels`; every sharepoint.* operation runs on a site alias. The eight Google Workspace and Microsoft 365 connections (0.86.0, ADR 0032) are Gmail-shaped: user consent only, one connection per provider (calendar, drive, docs, sheets on the Google client; outlook, onedrive, excel, teams on the Microsoft client), no installation. Seven of them carry no `account` and empty `channels`, acting on the signed-in person's own data through one fixed alias; a Teams connection pins the Microsoft 365 tenant in `account` like SharePoint and maps channel aliases to `<teamId>/<channelId>` in `channels`. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.
  */
 export interface SaasConnection {
   schema: 'harbour.saas-connection/1.0';
@@ -47,19 +60,19 @@ export interface SaasConnection {
   installation?: SaasInstallation;
   account?: BasecampAccount;
   /**
-   * Logical alias → provider resource id: a Slack channel id, a Basecamp project id, a SharePoint site id or a phone number. Always empty for Gmail.
+   * Logical alias → provider resource id: a Slack channel id, a Basecamp project id, a SharePoint site id, a phone number or a Teams channel. Always empty for Gmail and for the seven personal Google Workspace and Microsoft 365 providers (0.86.0: calendar, drive, docs, sheets, outlook, onedrive, excel), whose one fixed alias governance resolves.
    */
   channels: {
     /**
-     * A Slack channel id (public, non-archived), a Basecamp project id (digits), a SharePoint site id (0.78.0: the Microsoft Graph composite `hostname,siteCollectionGuid,webGuid`) or a phone number (0.82.0: E.164, a leading `+` and digits).
+     * A Slack channel id (public, non-archived), a Basecamp project id (digits), a SharePoint site id (0.78.0: the Microsoft Graph composite `hostname,siteCollectionGuid,webGuid`), a phone number (0.82.0: E.164, a leading `+` and digits) or a Teams channel (0.86.0: `<teamId>/<channelId>`, the team's GUID and the channel id `19:...@thread.tacv2`, so the alphabet admits `@`, `!` and `/`).
      */
     [k: string]: string;
   };
   /**
-   * Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload). Never warehouse.view.read. Phone (0.82.0): phone.sms.list; 0.83.0 adds phone.number.get.
+   * Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload; Google Workspace and Microsoft 365 (0.86.0): the calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operations of the connection's provider). Never warehouse.view.read. Phone (0.82.0): phone.sms.list; 0.83.0 adds phone.number.get. Seventy-eight SaaS operations in all since 0.86.0.
    *
    * @minItems 1
-   * @maxItems 33
+   * @maxItems 78
    */
   operations: (
     | 'slack.channel.history'
@@ -95,6 +108,51 @@ export interface SaasConnection {
     | 'sharepoint.file.upload'
     | 'phone.sms.list'
     | 'phone.number.get'
+    | 'calendar.calendar.list'
+    | 'calendar.event.list'
+    | 'calendar.event.read'
+    | 'calendar.event.create'
+    | 'calendar.event.update'
+    | 'calendar.event.cancel'
+    | 'drive.file.list'
+    | 'drive.file.search'
+    | 'drive.file.read'
+    | 'drive.file.upload'
+    | 'drive.folder.create'
+    | 'docs.document.read'
+    | 'docs.document.create'
+    | 'docs.document.append'
+    | 'docs.text.replace'
+    | 'sheets.spreadsheet.read'
+    | 'sheets.values.read'
+    | 'sheets.values.append'
+    | 'sheets.values.update'
+    | 'sheets.values.clear'
+    | 'sheets.spreadsheet.create'
+    | 'outlook.message.list'
+    | 'outlook.message.read'
+    | 'outlook.attachment.read'
+    | 'outlook.message.send'
+    | 'outlook.message.reply'
+    | 'outlook.event.list'
+    | 'outlook.event.read'
+    | 'outlook.event.create'
+    | 'outlook.event.update'
+    | 'outlook.event.cancel'
+    | 'onedrive.file.list'
+    | 'onedrive.file.search'
+    | 'onedrive.file.read'
+    | 'onedrive.file.upload'
+    | 'onedrive.folder.create'
+    | 'excel.worksheet.list'
+    | 'excel.range.read'
+    | 'excel.range.update'
+    | 'excel.table.list'
+    | 'excel.row.add'
+    | 'excel.worksheet.add'
+    | 'teams.message.list'
+    | 'teams.message.post'
+    | 'teams.reply.post'
     | 'warehouse.view.read'
     | 'warehouse.table.append'
     | 'service.request'
@@ -169,7 +227,7 @@ export interface SaasInstallation {
   botName?: string;
 }
 /**
- * The pinned provider account (0.76.0, Basecamp; 0.78.0, SharePoint — the name keeps its 0.76.0 spelling so consumers need not move): the one account, among those IT's own provider sign-in belongs to, that every user token on this connection must also belong to and that every resource id in `channels` lives in. For Basecamp the account (digits); for SharePoint the Microsoft 365 tenant (the Entra tenant GUID). Absent until IT chooses it; governance refuses every basecamp.* and sharepoint.* call until then.
+ * The pinned provider account (0.76.0, Basecamp; 0.78.0, SharePoint; 0.86.0, Teams — the name keeps its 0.76.0 spelling so consumers need not move): the one account, among those IT's own provider sign-in belongs to, that every user token on this connection must also belong to and that every resource id in `channels` lives in. For Basecamp the account (digits); for SharePoint and Teams the Microsoft 365 tenant (the Entra tenant GUID). Absent until IT chooses it; governance refuses every basecamp.*, sharepoint.* and teams.* call until then. The seven personal Google Workspace and Microsoft 365 providers carry none.
  */
 export interface BasecampAccount {
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,