@fourier-labs/harbour-contracts 0.85.0 → 0.87.0

package/schema/kit-bundle-manifest.schema.json

@@ -35,6 +35,7 @@
       "description": "Native local App Gateway executables for supported builder platforms; hosted workloads continue to use images.",
       "properties": {
         "darwinArm64": { "$ref": "#/definitions/NativeExecutable" },
+        "linuxArm64": { "$ref": "#/definitions/NativeExecutable" },
         "linuxX64": { "$ref": "#/definitions/NativeExecutable" },
         "windowsX64": { "$ref": "#/definitions/NativeExecutable" }
       }

package/schema/saas-connection.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/saas-connection.schema.json",
   "title": "SaasConnection",
-  "description": "Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. A SharePoint connection (0.78.0, ADR 0024) is shaped the same way: IT pins the company's Microsoft 365 tenant in `account` (the Entra tenant id and the organisation's display name, from IT's own Microsoft sign-in) and maps site aliases to Microsoft Graph site ids (`hostname,siteCollectionGuid,webGuid`) in `channels`; every sharepoint.* operation runs on a site alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.",
+  "description": "Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. A SharePoint connection (0.78.0, ADR 0024) is shaped the same way: IT pins the company's Microsoft 365 tenant in `account` (the Entra tenant id and the organisation's display name, from IT's own Microsoft sign-in) and maps site aliases to Microsoft Graph site ids (`hostname,siteCollectionGuid,webGuid`) in `channels`; every sharepoint.* operation runs on a site alias. The eight Google Workspace and Microsoft 365 connections (0.86.0, ADR 0032) are Gmail-shaped: user consent only, one connection per provider (calendar, drive, docs, sheets on the Google client; outlook, onedrive, excel, teams on the Microsoft client), no installation. Seven of them carry no `account` and empty `channels`, acting on the signed-in person's own data through one fixed alias; a Teams connection pins the Microsoft 365 tenant in `account` like SharePoint and maps channel aliases to `<teamId>/<channelId>` in `channels`. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "tenantId", "sourceId", "kind", "provider", "displayName", "status", "version", "channels", "operations", "developmentPreapproval", "createdAt", "updatedAt"],
@@ -21,17 +21,17 @@
       "type": "object",
       "maxProperties": 64,
       "propertyNames": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationAlias" },
-      "additionalProperties": { "type": "string", "pattern": "^[+A-Za-z0-9][A-Za-z0-9.,_:-]{0,255}$", "description": "A Slack channel id (public, non-archived), a Basecamp project id (digits), a SharePoint site id (0.78.0: the Microsoft Graph composite `hostname,siteCollectionGuid,webGuid`) or a phone number (0.82.0: E.164, a leading `+` and digits)." },
-      "description": "Logical alias → provider resource id: a Slack channel id, a Basecamp project id, a SharePoint site id or a phone number. Always empty for Gmail."
+      "additionalProperties": { "type": "string", "pattern": "^[+A-Za-z0-9][A-Za-z0-9.,_:@!/-]{0,255}$", "description": "A Slack channel id (public, non-archived), a Basecamp project id (digits), a SharePoint site id (0.78.0: the Microsoft Graph composite `hostname,siteCollectionGuid,webGuid`), a phone number (0.82.0: E.164, a leading `+` and digits) or a Teams channel (0.86.0: `<teamId>/<channelId>`, the team's GUID and the channel id `19:...@thread.tacv2`, so the alphabet admits `@`, `!` and `/`)." },
+      "description": "Logical alias → provider resource id: a Slack channel id, a Basecamp project id, a SharePoint site id, a phone number or a Teams channel. Always empty for Gmail and for the seven personal Google Workspace and Microsoft 365 providers (0.86.0: calendar, drive, docs, sheets, outlook, onedrive, excel), whose one fixed alias governance resolves."
     },
     "operations": {
       "type": "array",
       "minItems": 1,
-      "maxItems": 33,
+      "maxItems": 78,
       "uniqueItems": true,
       "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" },
       "not": { "anyOf": [{ "contains": { "const": "warehouse.view.read" } }, { "contains": { "const": "warehouse.table.append" } }] },
-      "description": "Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload). Never warehouse.view.read. Phone (0.82.0): phone.sms.list; 0.83.0 adds phone.number.get."
+      "description": "Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload; Google Workspace and Microsoft 365 (0.86.0): the calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operations of the connection's provider). Never warehouse.view.read. Phone (0.82.0): phone.sms.list; 0.83.0 adds phone.number.get. Seventy-eight SaaS operations in all since 0.86.0."
     },
     "developmentPreapproval": { "$ref": "#/definitions/DevelopmentPreapproval" },
     "oauthClient": { "$ref": "#/definitions/SaasOauthClient" },
@@ -84,14 +84,14 @@
   "definitions": {
     "SaasProvider": {
       "type": "string",
-      "enum": ["slack", "gmail", "basecamp", "sharepoint", "phone"],
-      "description": "Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`. Phone (0.82.0) is app mode only with no installation: the tenant's inbound SMS numbers (E.164) mapped from aliases in `channels`, and the SMS the platform received on them listed by phone.sms.list; since 0.83.0 an app reads the number an alias maps to with phone.number.get."
+      "enum": ["slack", "gmail", "basecamp", "sharepoint", "phone", "calendar", "drive", "docs", "sheets", "outlook", "onedrive", "excel", "teams"],
+      "description": "Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`. Phone (0.82.0) is app mode only with no installation: the tenant's inbound SMS numbers (E.164) mapped from aliases in `channels`, and the SMS the platform received on them listed by phone.sms.list; since 0.83.0 an app reads the number an alias maps to with phone.number.get. Google Workspace (0.86.0, ADR 0032: calendar, drive, docs, sheets on the Google OAuth client) and Microsoft 365 (outlook, onedrive, excel, teams on the Microsoft client) are user-consent only like Gmail, one connection per provider with its own consent and scopes; the seven personal providers have no `account` and empty `channels` (their one fixed alias is the signed-in person's own calendar, drive, documents, spreadsheets, mailbox or workbooks); teams is pinned to the Microsoft 365 tenant in `account` like SharePoint and maps channel aliases in `channels`."
     },
     "BasecampAccount": {
       "type": "object",
       "additionalProperties": false,
       "required": ["id", "name"],
-      "description": "The pinned provider account (0.76.0, Basecamp; 0.78.0, SharePoint — the name keeps its 0.76.0 spelling so consumers need not move): the one account, among those IT's own provider sign-in belongs to, that every user token on this connection must also belong to and that every resource id in `channels` lives in. For Basecamp the account (digits); for SharePoint the Microsoft 365 tenant (the Entra tenant GUID). Absent until IT chooses it; governance refuses every basecamp.* and sharepoint.* call until then.",
+      "description": "The pinned provider account (0.76.0, Basecamp; 0.78.0, SharePoint; 0.86.0, Teams — the name keeps its 0.76.0 spelling so consumers need not move): the one account, among those IT's own provider sign-in belongs to, that every user token on this connection must also belong to and that every resource id in `channels` lives in. For Basecamp the account (digits); for SharePoint and Teams the Microsoft 365 tenant (the Entra tenant GUID). Absent until IT chooses it; governance refuses every basecamp.*, sharepoint.* and teams.* call until then. The seven personal Google Workspace and Microsoft 365 providers carry none.",
       "properties": {
         "id": { "type": "string", "pattern": "^[A-Za-z0-9-]{1,64}$", "description": "The Basecamp account id (digits, the first path segment of the API base URL) or the Microsoft Entra tenant id (a GUID, the `tid` claim)." },
         "name": { "type": "string", "minLength": 1, "maxLength": 120, "description": "The account's name as the provider shows it (a Basecamp account name, a Microsoft 365 organisation display name), for IT to recognise." }
@@ -305,6 +305,137 @@
       "developmentPreapproval": { "enabled": false, "hours": 24 },
       "createdAt": "2026-10-17T08:00:00Z",
       "updatedAt": "2026-10-17T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-calendar",
+      "kind": "saas",
+      "provider": "calendar",
+      "displayName": "Company Google Calendar",
+      "status": "ACTIVE",
+      "version": 1,
+      "channels": {},
+      "operations": ["calendar.calendar.list", "calendar.event.list", "calendar.event.read", "calendar.event.create", "calendar.event.update", "calendar.event.cancel"],
+      "developmentPreapproval": { "enabled": true, "hours": 24 },
+      "userModeApproval": "automatic",
+      "createdAt": "2026-10-17T08:00:00Z",
+      "updatedAt": "2026-10-17T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-drive",
+      "kind": "saas",
+      "provider": "drive",
+      "displayName": "Company Google Drive",
+      "status": "ACTIVE",
+      "version": 2,
+      "channels": {},
+      "operations": ["drive.file.list", "drive.file.search", "drive.file.read", "drive.file.upload", "drive.folder.create"],
+      "developmentPreapproval": { "enabled": true, "hours": 24 },
+      "oauthClient": { "clientId": "987334312340-abc123def456.apps.googleusercontent.com", "secretRef": "secretref://tenant/fourier/saas/company-drive/oauth-client", "setAt": "2026-10-17T08:00:00Z", "setBy": "it-admin@example.com" },
+      "userModeApproval": "it",
+      "createdAt": "2026-10-17T08:00:00Z",
+      "updatedAt": "2026-10-17T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-docs",
+      "kind": "saas",
+      "provider": "docs",
+      "displayName": "Company Google Docs",
+      "status": "ACTIVE",
+      "version": 1,
+      "channels": {},
+      "operations": ["docs.document.read", "docs.document.create", "docs.document.append", "docs.text.replace"],
+      "developmentPreapproval": { "enabled": true, "hours": 24 },
+      "userModeApproval": "automatic",
+      "createdAt": "2026-10-17T08:00:00Z",
+      "updatedAt": "2026-10-17T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-sheets",
+      "kind": "saas",
+      "provider": "sheets",
+      "displayName": "Company Google Sheets",
+      "status": "ACTIVE",
+      "version": 1,
+      "channels": {},
+      "operations": ["sheets.spreadsheet.read", "sheets.values.read", "sheets.values.append", "sheets.values.update", "sheets.values.clear", "sheets.spreadsheet.create"],
+      "developmentPreapproval": { "enabled": true, "hours": 24 },
+      "userModeApproval": "automatic",
+      "createdAt": "2026-10-17T08:00:00Z",
+      "updatedAt": "2026-10-17T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-outlook",
+      "kind": "saas",
+      "provider": "outlook",
+      "displayName": "Company Outlook",
+      "status": "ACTIVE",
+      "version": 1,
+      "channels": {},
+      "operations": ["outlook.message.list", "outlook.message.read", "outlook.attachment.read", "outlook.message.send", "outlook.message.reply", "outlook.event.list", "outlook.event.read", "outlook.event.create", "outlook.event.update", "outlook.event.cancel"],
+      "developmentPreapproval": { "enabled": false, "hours": 24 },
+      "userModeApproval": "it",
+      "externalRecipients": { "mode": "block" },
+      "createdAt": "2026-10-17T08:00:00Z",
+      "updatedAt": "2026-10-17T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-onedrive",
+      "kind": "saas",
+      "provider": "onedrive",
+      "displayName": "Company OneDrive",
+      "status": "ACTIVE",
+      "version": 1,
+      "channels": {},
+      "operations": ["onedrive.file.list", "onedrive.file.search", "onedrive.file.read", "onedrive.file.upload", "onedrive.folder.create"],
+      "developmentPreapproval": { "enabled": true, "hours": 24 },
+      "userModeApproval": "automatic",
+      "createdAt": "2026-10-17T08:00:00Z",
+      "updatedAt": "2026-10-17T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-excel",
+      "kind": "saas",
+      "provider": "excel",
+      "displayName": "Company Excel",
+      "status": "ACTIVE",
+      "version": 1,
+      "channels": {},
+      "operations": ["excel.worksheet.list", "excel.range.read", "excel.range.update", "excel.table.list", "excel.row.add", "excel.worksheet.add"],
+      "developmentPreapproval": { "enabled": true, "hours": 24 },
+      "userModeApproval": "automatic",
+      "createdAt": "2026-10-17T08:00:00Z",
+      "updatedAt": "2026-10-17T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-teams",
+      "kind": "saas",
+      "provider": "teams",
+      "displayName": "Company Teams",
+      "status": "ACTIVE",
+      "version": 2,
+      "account": { "id": "3f2c9b1e-7d4a-4c6b-9e8f-0a1b2c3d4e5f", "name": "Fourier Labs" },
+      "channels": { "engineering": "0f1e2d3c-4b5a-4968-8776-655443322110/19:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6@thread.tacv2" },
+      "operations": ["teams.message.list", "teams.message.post", "teams.reply.post"],
+      "developmentPreapproval": { "enabled": true, "hours": 24 },
+      "userModeApproval": "automatic",
+      "createdAt": "2026-10-17T08:00:00Z",
+      "updatedAt": "2026-10-17T08:00:00Z"
     }
   ]
 }