@fourier-labs/harbour-contracts 0.85.0 → 0.87.0

package/dist/gen-ts/integration-operations.js

@@ -303,6 +303,411 @@ export const IntegrationOperations = {
         "declaredMode": false,
         "idempotencyKey": false
     },
+    "calendar.calendar.list": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "calendar.event.list": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "calendar.event.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "calendar.event.create": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "calendar.event.update": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "calendar.event.cancel": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "drive.file.list": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "drive.file.search": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "drive.file.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "drive.file.upload": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "drive.folder.create": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "docs.document.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "docs.document.create": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "docs.document.append": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "docs.text.replace": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "sheets.spreadsheet.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "sheets.values.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "sheets.values.append": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "sheets.values.update": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "sheets.values.clear": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "sheets.spreadsheet.create": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "outlook.message.list": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "outlook.message.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "outlook.attachment.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "outlook.message.send": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "outlook.message.reply": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "outlook.event.list": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "outlook.event.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "outlook.event.create": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "outlook.event.update": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "outlook.event.cancel": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "onedrive.file.list": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "onedrive.file.search": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "onedrive.file.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "onedrive.file.upload": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "onedrive.folder.create": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "excel.worksheet.list": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "excel.range.read": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "excel.range.update": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "excel.table.list": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "excel.row.add": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "excel.worksheet.add": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "teams.message.list": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": true,
+        "declaredMode": false,
+        "idempotencyKey": false
+    },
+    "teams.message.post": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
+    "teams.reply.post": {
+        "kind": "saas",
+        "identities": [
+            "user"
+        ],
+        "readOnly": false,
+        "declaredMode": false,
+        "idempotencyKey": true
+    },
     "warehouse.view.read": {
         "kind": "database",
         "identities": [

package/dist/gen-ts/kit-bundle-manifest.d.ts

@@ -36,6 +36,7 @@ export interface KitBundleManifest {
      */
     nativeRuntime?: {
         darwinArm64?: NativeExecutable;
+        linuxArm64?: NativeExecutable;
         linuxX64?: NativeExecutable;
         windowsX64?: NativeExecutable;
     };

package/dist/gen-ts/kit-lock.d.ts

@@ -48,6 +48,7 @@ interface KitBundleManifest {
      */
     nativeRuntime?: {
         darwinArm64?: NativeExecutable;
+        linuxArm64?: NativeExecutable;
         linuxX64?: NativeExecutable;
         windowsX64?: NativeExecutable;
     };

package/dist/gen-ts/saas-connection.d.ts

@@ -1,7 +1,7 @@
 /**
- * Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`. Phone (0.82.0) is app mode only with no installation: the tenant's inbound SMS numbers (E.164) mapped from aliases in `channels`, and the SMS the platform received on them listed by phone.sms.list; since 0.83.0 an app reads the number an alias maps to with phone.number.get.
+ * Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`. Phone (0.82.0) is app mode only with no installation: the tenant's inbound SMS numbers (E.164) mapped from aliases in `channels`, and the SMS the platform received on them listed by phone.sms.list; since 0.83.0 an app reads the number an alias maps to with phone.number.get. Google Workspace (0.86.0, ADR 0032: calendar, drive, docs, sheets on the Google OAuth client) and Microsoft 365 (outlook, onedrive, excel, teams on the Microsoft client) are user-consent only like Gmail, one connection per provider with its own consent and scopes; the seven personal providers have no `account` and empty `channels` (their one fixed alias is the signed-in person's own calendar, drive, documents, spreadsheets, mailbox or workbooks); teams is pinned to the Microsoft 365 tenant in `account` like SharePoint and maps channel aliases in `channels`.
  */
-export type SaasProvider = 'slack' | 'gmail' | 'basecamp' | 'sharepoint' | 'phone';
+export type SaasProvider = 'slack' | 'gmail' | 'basecamp' | 'sharepoint' | 'phone' | 'calendar' | 'drive' | 'docs' | 'sheets' | 'outlook' | 'onedrive' | 'excel' | 'teams';
 /**
  * DISABLED stops every app call immediately (details.code CONNECTION_DISABLED).
  */
@@ -23,7 +23,7 @@ export type ExternalRecipientMode = 'block' | 'allowlist' | 'allow';
  */
 export type InstallationName = string;
 /**
- * Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. A SharePoint connection (0.78.0, ADR 0024) is shaped the same way: IT pins the company's Microsoft 365 tenant in `account` (the Entra tenant id and the organisation's display name, from IT's own Microsoft sign-in) and maps site aliases to Microsoft Graph site ids (`hostname,siteCollectionGuid,webGuid`) in `channels`; every sharepoint.* operation runs on a site alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.
+ * Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. A SharePoint connection (0.78.0, ADR 0024) is shaped the same way: IT pins the company's Microsoft 365 tenant in `account` (the Entra tenant id and the organisation's display name, from IT's own Microsoft sign-in) and maps site aliases to Microsoft Graph site ids (`hostname,siteCollectionGuid,webGuid`) in `channels`; every sharepoint.* operation runs on a site alias. The eight Google Workspace and Microsoft 365 connections (0.86.0, ADR 0032) are Gmail-shaped: user consent only, one connection per provider (calendar, drive, docs, sheets on the Google client; outlook, onedrive, excel, teams on the Microsoft client), no installation. Seven of them carry no `account` and empty `channels`, acting on the signed-in person's own data through one fixed alias; a Teams connection pins the Microsoft 365 tenant in `account` like SharePoint and maps channel aliases to `<teamId>/<channelId>` in `channels`. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.
  */
 export interface SaasConnection {
     schema: 'harbour.saas-connection/1.0';
@@ -43,21 +43,21 @@ export interface SaasConnection {
     installation?: SaasInstallation;
     account?: BasecampAccount;
     /**
-     * Logical alias → provider resource id: a Slack channel id, a Basecamp project id, a SharePoint site id or a phone number. Always empty for Gmail.
+     * Logical alias → provider resource id: a Slack channel id, a Basecamp project id, a SharePoint site id, a phone number or a Teams channel. Always empty for Gmail and for the seven personal Google Workspace and Microsoft 365 providers (0.86.0: calendar, drive, docs, sheets, outlook, onedrive, excel), whose one fixed alias governance resolves.
      */
     channels: {
         /**
-         * A Slack channel id (public, non-archived), a Basecamp project id (digits), a SharePoint site id (0.78.0: the Microsoft Graph composite `hostname,siteCollectionGuid,webGuid`) or a phone number (0.82.0: E.164, a leading `+` and digits).
+         * A Slack channel id (public, non-archived), a Basecamp project id (digits), a SharePoint site id (0.78.0: the Microsoft Graph composite `hostname,siteCollectionGuid,webGuid`), a phone number (0.82.0: E.164, a leading `+` and digits) or a Teams channel (0.86.0: `<teamId>/<channelId>`, the team's GUID and the channel id `19:...@thread.tacv2`, so the alphabet admits `@`, `!` and `/`).
          */
         [k: string]: string;
     };
     /**
-     * Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload). Never warehouse.view.read. Phone (0.82.0): phone.sms.list; 0.83.0 adds phone.number.get.
+     * Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload; Google Workspace and Microsoft 365 (0.86.0): the calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operations of the connection's provider). Never warehouse.view.read. Phone (0.82.0): phone.sms.list; 0.83.0 adds phone.number.get. Seventy-eight SaaS operations in all since 0.86.0.
      *
      * @minItems 1
-     * @maxItems 33
+     * @maxItems 78
      */
-    operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'basecamp.project.list' | 'basecamp.todolist.list' | 'basecamp.todo.list' | 'basecamp.todo.create' | 'basecamp.todo.complete' | 'basecamp.message.list' | 'basecamp.message.post' | 'basecamp.comment.list' | 'basecamp.comment.post' | 'basecamp.campfire.post' | 'basecamp.people.list' | 'sharepoint.list.list' | 'sharepoint.item.list' | 'sharepoint.item.create' | 'sharepoint.item.update' | 'sharepoint.drive.list' | 'sharepoint.file.list' | 'sharepoint.file.search' | 'sharepoint.file.read' | 'sharepoint.file.upload' | 'phone.sms.list' | 'phone.number.get' | 'warehouse.view.read' | 'warehouse.table.append' | 'service.request')[];
+    operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'basecamp.project.list' | 'basecamp.todolist.list' | 'basecamp.todo.list' | 'basecamp.todo.create' | 'basecamp.todo.complete' | 'basecamp.message.list' | 'basecamp.message.post' | 'basecamp.comment.list' | 'basecamp.comment.post' | 'basecamp.campfire.post' | 'basecamp.people.list' | 'sharepoint.list.list' | 'sharepoint.item.list' | 'sharepoint.item.create' | 'sharepoint.item.update' | 'sharepoint.drive.list' | 'sharepoint.file.list' | 'sharepoint.file.search' | 'sharepoint.file.read' | 'sharepoint.file.upload' | 'phone.sms.list' | 'phone.number.get' | 'calendar.calendar.list' | 'calendar.event.list' | 'calendar.event.read' | 'calendar.event.create' | 'calendar.event.update' | 'calendar.event.cancel' | 'drive.file.list' | 'drive.file.search' | 'drive.file.read' | 'drive.file.upload' | 'drive.folder.create' | 'docs.document.read' | 'docs.document.create' | 'docs.document.append' | 'docs.text.replace' | 'sheets.spreadsheet.read' | 'sheets.values.read' | 'sheets.values.append' | 'sheets.values.update' | 'sheets.values.clear' | 'sheets.spreadsheet.create' | 'outlook.message.list' | 'outlook.message.read' | 'outlook.attachment.read' | 'outlook.message.send' | 'outlook.message.reply' | 'outlook.event.list' | 'outlook.event.read' | 'outlook.event.create' | 'outlook.event.update' | 'outlook.event.cancel' | 'onedrive.file.list' | 'onedrive.file.search' | 'onedrive.file.read' | 'onedrive.file.upload' | 'onedrive.folder.create' | 'excel.worksheet.list' | 'excel.range.read' | 'excel.range.update' | 'excel.table.list' | 'excel.row.add' | 'excel.worksheet.add' | 'teams.message.list' | 'teams.message.post' | 'teams.reply.post' | 'warehouse.view.read' | 'warehouse.table.append' | 'service.request')[];
     developmentPreapproval: DevelopmentPreapproval;
     oauthClient?: SaasOauthClient;
     userModeApproval?: UserModeApproval;
@@ -128,7 +128,7 @@ export interface SaasInstallation {
     botName?: string;
 }
 /**
- * The pinned provider account (0.76.0, Basecamp; 0.78.0, SharePoint — the name keeps its 0.76.0 spelling so consumers need not move): the one account, among those IT's own provider sign-in belongs to, that every user token on this connection must also belong to and that every resource id in `channels` lives in. For Basecamp the account (digits); for SharePoint the Microsoft 365 tenant (the Entra tenant GUID). Absent until IT chooses it; governance refuses every basecamp.* and sharepoint.* call until then.
+ * The pinned provider account (0.76.0, Basecamp; 0.78.0, SharePoint; 0.86.0, Teams — the name keeps its 0.76.0 spelling so consumers need not move): the one account, among those IT's own provider sign-in belongs to, that every user token on this connection must also belong to and that every resource id in `channels` lives in. For Basecamp the account (digits); for SharePoint and Teams the Microsoft 365 tenant (the Entra tenant GUID). Absent until IT chooses it; governance refuses every basecamp.*, sharepoint.* and teams.* call until then. The seven personal Google Workspace and Microsoft 365 providers carry none.
  */
 export interface BasecampAccount {
     /**

package/gen-ts/app-integrations-declaration.ts

@@ -38,6 +38,51 @@ export type DeclaredConnection = {
     'sharepoint.file.upload'?: UserModeChannelOperation;
     'phone.sms.list'?: AppModeChannelOperation;
     'phone.number.get'?: AppModeChannelOperation;
+    'calendar.calendar.list'?: UserModeChannelOperation;
+    'calendar.event.list'?: UserModeChannelOperation;
+    'calendar.event.read'?: UserModeChannelOperation;
+    'calendar.event.create'?: UserModeChannelOperation;
+    'calendar.event.update'?: UserModeChannelOperation;
+    'calendar.event.cancel'?: UserModeChannelOperation;
+    'drive.file.list'?: UserModeChannelOperation;
+    'drive.file.search'?: UserModeChannelOperation;
+    'drive.file.read'?: UserModeChannelOperation;
+    'drive.file.upload'?: UserModeChannelOperation;
+    'drive.folder.create'?: UserModeChannelOperation;
+    'docs.document.read'?: UserModeChannelOperation;
+    'docs.document.create'?: UserModeChannelOperation;
+    'docs.document.append'?: UserModeChannelOperation;
+    'docs.text.replace'?: UserModeChannelOperation;
+    'sheets.spreadsheet.read'?: UserModeChannelOperation;
+    'sheets.values.read'?: UserModeChannelOperation;
+    'sheets.values.append'?: UserModeChannelOperation;
+    'sheets.values.update'?: UserModeChannelOperation;
+    'sheets.values.clear'?: UserModeChannelOperation;
+    'sheets.spreadsheet.create'?: UserModeChannelOperation;
+    'outlook.message.list'?: UserModeChannelOperation;
+    'outlook.message.read'?: UserModeChannelOperation;
+    'outlook.attachment.read'?: UserModeChannelOperation;
+    'outlook.message.send'?: UserModeChannelOperation;
+    'outlook.message.reply'?: UserModeChannelOperation;
+    'outlook.event.list'?: UserModeChannelOperation;
+    'outlook.event.read'?: UserModeChannelOperation;
+    'outlook.event.create'?: UserModeChannelOperation;
+    'outlook.event.update'?: UserModeChannelOperation;
+    'outlook.event.cancel'?: UserModeChannelOperation;
+    'onedrive.file.list'?: UserModeChannelOperation;
+    'onedrive.file.search'?: UserModeChannelOperation;
+    'onedrive.file.read'?: UserModeChannelOperation;
+    'onedrive.file.upload'?: UserModeChannelOperation;
+    'onedrive.folder.create'?: UserModeChannelOperation;
+    'excel.worksheet.list'?: UserModeChannelOperation;
+    'excel.range.read'?: UserModeChannelOperation;
+    'excel.range.update'?: UserModeChannelOperation;
+    'excel.table.list'?: UserModeChannelOperation;
+    'excel.row.add'?: UserModeChannelOperation;
+    'excel.worksheet.add'?: UserModeChannelOperation;
+    'teams.message.list'?: UserModeChannelOperation;
+    'teams.message.post'?: UserModeChannelOperation;
+    'teams.reply.post'?: UserModeChannelOperation;
     'warehouse.view.read'?: AppModeViewOperation;
     'warehouse.table.append'?: AppModeViewOperation;
     'service.request'?: ServiceOperation;
@@ -63,7 +108,7 @@ export type ResourceNames = IntegrationAlias[];
 export type ColumnName = string;
 
 /**
- * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (thirty-three operations since 0.78.0, ADR 0018, ADR 0022 and ADR 0024). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, every basecamp.* operation=user, every sharepoint.* operation=user, warehouse.view.read=app, service.request=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack, Gmail, Basecamp and SharePoint operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. Basecamp (0.76.0, ADR 0022) is user-mode only too: basecamp.project.list runs on the fixed `account` alias (the company's pinned Basecamp account) and every other basecamp.* operation on a project alias IT mapped in the connection's `channels` map, so Basecamp itself refuses an id outside that project. SharePoint (0.78.0, ADR 0024) is user-mode only as well: every sharepoint.* operation runs on a site alias IT mapped in the connection's `channels` map (a Microsoft Graph site id), so Graph itself refuses a list, item or file outside that site. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
+ * Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (eighty-one operations since 0.86.0, ADR 0018, ADR 0022, ADR 0024, ADR 0028, ADR 0029 and ADR 0032). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, every basecamp.* operation=user, every sharepoint.* operation=user, every calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operation=user (0.86.0), warehouse.view.read=app, service.request=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack, Gmail, Basecamp, SharePoint, phone, Google Workspace (calendar, drive, docs, sheets) and Microsoft 365 (outlook, onedrive, excel, teams) operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. Basecamp (0.76.0, ADR 0022) is user-mode only too: basecamp.project.list runs on the fixed `account` alias (the company's pinned Basecamp account) and every other basecamp.* operation on a project alias IT mapped in the connection's `channels` map, so Basecamp itself refuses an id outside that project. SharePoint (0.78.0, ADR 0024) is user-mode only as well: every sharepoint.* operation runs on a site alias IT mapped in the connection's `channels` map (a Microsoft Graph site id), so Graph itself refuses a list, item or file outside that site. Google Workspace and Microsoft 365 (0.86.0, ADR 0032) are user-mode only too: every calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.* and excel.* operation runs on the provider's one fixed alias for the signed-in person's own data (governance resolves it, the way Gmail's is `inbox`; the contract does not pin the literal), and every teams.* operation on a channel alias IT mapped in the connection's `channels` map (a Teams team and channel id), so Graph itself refuses a message outside that channel. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
  */
 export interface AppIntegrationsDeclaration {
   schema: 'isomorph.app-integrations/2.0';
@@ -99,7 +144,7 @@ export interface AppModeChannelOperation {
   resources: ResourceNames;
 }
 /**
- * Every gmail.* operation (resource: the fixed `inbox` alias), since 0.76.0 every basecamp.* operation (resource: a project alias from the connection's `channels` map, or the fixed `account` alias for basecamp.project.list) and since 0.78.0 every sharepoint.* operation (resource: a site alias from the connection's `channels` map): user mode only — the app acts as the signed-in person after their own consent.
+ * Every gmail.* operation (resource: the fixed `inbox` alias), since 0.76.0 every basecamp.* operation (resource: a project alias from the connection's `channels` map, or the fixed `account` alias for basecamp.project.list), since 0.78.0 every sharepoint.* operation (resource: a site alias from the connection's `channels` map) and since 0.86.0 every calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operation (resource: the provider's fixed alias for the person's own data, or for teams.* a channel alias from the connection's `channels` map): user mode only — the app acts as the signed-in person after their own consent.
  */
 export interface UserModeChannelOperation {
   identity: 'user';

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.85.0.0" as const;
-export const ContractPublishVersion = "0.85.0" as const;
-export const ContractPublishTag = "v0.85.0" as const;
-export const ContractSchemasDigest = "sha256:21e2aecbcb5c267d542bd02948f7af08e715c6b693c9a82bd5f411fbcb824d06" as const;
+export const ContractRepositoryVersion = "0.87.0.0" as const;
+export const ContractPublishVersion = "0.87.0" as const;
+export const ContractPublishTag = "v0.87.0" as const;
+export const ContractSchemasDigest = "sha256:8ee0ace66f836f6ab8ce11a98de223c84e17fc7d02fe18d7d85f2ed92851a8fb" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:455df746638c7046878cc52b628b24438f9c8b8f4f114364cd27344c623bca85" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:9be04d9c634ce7c4331af07209b5cef1c451d96faeed2219d53e5b78f1f525b3" as const;
+export const ContractGeneratedGoDigest = "sha256:50f4b6d760c87b4d71fcef869b685e77f807d2e635f1300faa89b9061c23d326" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:44368a588929e44460d15f8985dc411e0806abd26bf83d07571750f7abe30da5" as const;