@fourier-labs/harbour-contracts 0.86.0 → 0.88.0

package/README.md

@@ -40,7 +40,7 @@ exist here first.
 | `ai-pricing-revision`, `ai-metering-policy`, `ai-budget-ledger-event`, `ai-trace-event-v2` | Additive metering v2 records, including media dimensions and P5 trace attribution; v1 records remain readable | AI governance §9 |
 | `app-integrations-declaration.schema.json` | Committed `.isomorph/integrations.json` (`isomorph.app-integrations/2.0`): closed eighty-one-operation set (Slack read/post/update/delete/DM/lookup, Gmail list/thread/read/send/attachment — ADR 0018; Basecamp project/to-do list/to-do/message/comment/people lists, to-do create and complete, message, comment and Campfire posts — ADR 0022; SharePoint list/item/drive/file lists, file search and read, item create and update, file upload — ADR 0024; phone SMS list — ADR 0028; phone number read — ADR 0029; Google Calendar, Drive, Docs and Sheets and Outlook, OneDrive, Excel and Teams reads and writes as the signed-in person — ADR 0032; warehouse view read and table append, the view mapping saying `access: read|append` — ADR 0028; service request) with fixed or declared identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
 | `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds (a warehouse read filters, groups, aggregates and sorts in the warehouse and says when it was `truncated` — ADR 0017; Slack and Gmail reads page, posts thread, mail carries HTML and attachments — ADR 0018; a development warehouse read may carry the app's `sampleRows` and the result says `sample` — ADR 0021; Basecamp lists page by `pageToken`, ids are digit strings, writes answer `{id, appUrl}` — ADR 0022; SharePoint lists page by a Graph `$skiptoken`, ids are Graph ids, `fields` is a bounded record, writes answer `{id, webUrl}` — ADR 0024; a warehouse append takes `rows`, a bounded list of records, and a phone SMS list takes `since`/`from` — ADR 0028; a phone number read takes no input — ADR 0029; calendar events take RFC 3339 `start`/`end`, Sheets and Excel take `values`, a bounded matrix of cells, Docs take `replacements`, and the event read, document read, values and worksheet results have their own shapes — ADR 0032), the per-operation result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
-| `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider; IT's optional `oauthClient`, `userModeApproval`, `directMessages`, `externalRecipients` — ADR 0018; a Basecamp connection's pinned `account` and project ids in `channels` — ADR 0022; a SharePoint connection's pinned Microsoft 365 tenant in `account` and site ids in `channels` — ADR 0024; up to 20 `approvers` who may approve access requests beside the tenant admins — ADR 0026; a phone connection's E.164 numbers in `channels` — ADR 0028, which an app reads back by alias — ADR 0029; eight Google Workspace and Microsoft 365 providers, user-consent only, a Teams connection's pinned tenant and `<teamId>/<channelId>` channel map — ADR 0032) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
+| `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider; IT's optional `oauthClient`, `userModeApproval`, `directMessages`, `externalRecipients` — ADR 0018; a Basecamp connection's pinned `account` and project ids in `channels` — ADR 0022; a SharePoint connection's pinned Microsoft 365 tenant in `account` and site ids in `channels` — ADR 0024; up to 20 `approvers` who may approve access requests beside the tenant admins — ADR 0026; a phone connection's E.164 numbers in `channels` — ADR 0028, which an app reads back by alias — ADR 0029; eight Google Workspace and Microsoft 365 providers, user-consent only, a Teams connection's pinned tenant and `<teamId>/<channelId>` channel map — ADR 0032; optional `startedBy` when a builder's first request created the connection — ADR 0034) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
 | `kit-bundle-manifest.schema.json`, `kit-lock.schema.json` | Published kit bundle identity (SDK tarball digest plus optional `sdk.version` and https `sdk.url` download location) and the committed `.isomorph/kit.lock.json` the CodeBuild SDK-vendoring gate compares against | Dev kit §3 |
 | `deploy-response.schema.json` | 202 Accepted body for `POST /v1/tenants/{tenant}/apps/{app}/deployments`, returned only after the authoritative QUEUED version exists and its SQS message is accepted | — |
 | `deployment-source.schema.json` | Credential-free source in the `DeployRequest` body: `provider` is `github` or `gitlab`, `repositoryUrl` is shape-only and the deployment control plane checks the host against the tenant's source connection (ADR 0023); credentials are resolved internally by MaterializeSource | — |

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.86.0.0",
-  "publishVersion": "0.86.0",
-  "publishTag": "v0.86.0",
-  "schemasDigest": "sha256:f510802c5ba082d403b8f4c5210da322861197b8ea5558384ac5c6403777fbd7",
+  "repositoryVersion": "0.88.0.0",
+  "publishVersion": "0.88.0",
+  "publishTag": "v0.88.0",
+  "schemasDigest": "sha256:23e1cb0d9f92c4ea5c2b827aeab9266dfee0ed503457ba5bdc101c39212e8c6f",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:641550cc398b29feeec00af2b0e79b52ceb4ee5ac77b0a4f0e6e7b7447adde39",
-  "generatedTypeScriptDigest": "sha256:6961f95736c7a41ac7af014d78bc877a07677bdedccfed2255395c956a3ef405",
+  "generatedGoDigest": "sha256:05eef493dc05e9f7ef4fbbf0aa4dbba5743ceb12a9baded16c875c33e9ed50bb",
+  "generatedTypeScriptDigest": "sha256:20e6bfe9e9c7689331b42ea841f6bcc6b0450fb0accc81b451ffba2f1ec2befb",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -60,13 +60,13 @@
     "schema/integration-execute-request.schema.json": "sha256:57506400fdf5dcf64b2d7b5bec995c4d7c0ef2e819a35e4bef4e14ff43d79937",
     "schema/integration-execute-result.schema.json": "sha256:75ab17fa611b72221ece10883ad206813aaeee005695bfbc46d7558d201e94b9",
     "schema/internal-configuration-request.schema.json": "sha256:229d44a3458f68dceddfba802e5c1adcd95523a45af29b93b972706b88461a7d",
-    "schema/kit-bundle-manifest.schema.json": "sha256:4a9fcdd52ba0d55718ef4dbdab112b145ef90471d9356d4d3fb41e50fe9e400d",
+    "schema/kit-bundle-manifest.schema.json": "sha256:d8fc6ca9c30d791e785b021687e084e9171c0ea1a3a176d0f1582fcccf2c0e19",
     "schema/kit-lock.schema.json": "sha256:a48154d9471e49a893d928f7b0e1e0bc77708a4a7edce4fdf14073203e0e8987",
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
     "schema/resolved-app-serving.schema.json": "sha256:1912f3224db1a1699618e6322358e07f76425d3097aec2fbe5d38a10e5c967e3",
-    "schema/saas-connection.schema.json": "sha256:aaec4b21bf50ab3935541d564fc2339fb626be1cbc5d171e8e0709d3bc360b09",
+    "schema/saas-connection.schema.json": "sha256:1bdccb9212ce6d4e448ea1331d023ed42e1e79afb2ef93a946e36d1e5cfcb69b",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
     "schema/security-scan-input-v2.schema.json": "sha256:0d418342078c9b5046ea6f4bef3c2c57539285dfee99cc0850d4f0d03739ee13",
@@ -116,7 +116,7 @@
     "gen-go/integration_execute_input_rules_test.go": "sha256:eb7650cc66b7bebe9b36cfd6e7233eb20f74aba0006977f2f009bfdf8e05d83a",
     "gen-go/integration_operations.go": "sha256:43ada077eca1da6666929e724096f93ddab6469826834f55a8b7332828efa898",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:07dfe0e26ff93e706d5f4ee05178eae66c4daf126d47df611c8c90b85527e8c8",
+    "gen-go/types.go": "sha256:bf9ee7498942f73b4c0434ec826007cf1d4b0f834ab4fd0a82add61953b8cf54",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -175,13 +175,13 @@
     "gen-ts/integration-execute-result.ts": "sha256:d6aa0edc16bea60271414ee78cc96b380522246eb223cf4ff729b19d2e3c7fe4",
     "gen-ts/integration-operations.ts": "sha256:871cc5a777b155733373d6fa66aa846a9f6cd2b1c5d1229b11bb4aaee8d948fb",
     "gen-ts/internal-configuration-request.ts": "sha256:7032437797473fa1c581d134adef2f3d4b4f4132f482cd17743e9d47097886bc",
-    "gen-ts/kit-bundle-manifest.ts": "sha256:2777a268aef8787b81e71d154a7d05f6f5ded09d66f378211ff5493ddb885171",
-    "gen-ts/kit-lock.ts": "sha256:00ceeb97e9b7d0187bec00728f5099fd34e775e9cc44c85c4714f7a3a4118ef6",
+    "gen-ts/kit-bundle-manifest.ts": "sha256:73f5271d2eb3b5ce91e28933c5ab6883615c72a3808aa386f860f58f6df8edf6",
+    "gen-ts/kit-lock.ts": "sha256:06bddeaf1e2c449c9cc0dbbc696210355a9005349c604d4050eb22385fb4c22e",
     "gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
     "gen-ts/resolved-app-serving.ts": "sha256:584792e8e0dcaf4322129b6f78579cd8cd21652c8db8a1606f802408c892534c",
-    "gen-ts/saas-connection.ts": "sha256:af333b238862d7cf23d1a7ecfcf5cd1a3d2140593d01e44d7e9f29022485924d",
+    "gen-ts/saas-connection.ts": "sha256:aeb6d57d8fdedc8d151df1dad60aae2d5176b7457ebe536c45c4c3175ea75f45",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.86.0.0";
-export declare const ContractPublishVersion: "0.86.0";
-export declare const ContractPublishTag: "v0.86.0";
-export declare const ContractSchemasDigest: "sha256:f510802c5ba082d403b8f4c5210da322861197b8ea5558384ac5c6403777fbd7";
+export declare const ContractRepositoryVersion: "0.88.0.0";
+export declare const ContractPublishVersion: "0.88.0";
+export declare const ContractPublishTag: "v0.88.0";
+export declare const ContractSchemasDigest: "sha256:23e1cb0d9f92c4ea5c2b827aeab9266dfee0ed503457ba5bdc101c39212e8c6f";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:641550cc398b29feeec00af2b0e79b52ceb4ee5ac77b0a4f0e6e7b7447adde39";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:6961f95736c7a41ac7af014d78bc877a07677bdedccfed2255395c956a3ef405";
+export declare const ContractGeneratedGoDigest: "sha256:05eef493dc05e9f7ef4fbbf0aa4dbba5743ceb12a9baded16c875c33e9ed50bb";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:20e6bfe9e9c7689331b42ea841f6bcc6b0450fb0accc81b451ffba2f1ec2befb";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.86.0.0";
-export const ContractPublishVersion = "0.86.0";
-export const ContractPublishTag = "v0.86.0";
-export const ContractSchemasDigest = "sha256:f510802c5ba082d403b8f4c5210da322861197b8ea5558384ac5c6403777fbd7";
+export const ContractRepositoryVersion = "0.88.0.0";
+export const ContractPublishVersion = "0.88.0";
+export const ContractPublishTag = "v0.88.0";
+export const ContractSchemasDigest = "sha256:23e1cb0d9f92c4ea5c2b827aeab9266dfee0ed503457ba5bdc101c39212e8c6f";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:641550cc398b29feeec00af2b0e79b52ceb4ee5ac77b0a4f0e6e7b7447adde39";
-export const ContractGeneratedTypeScriptDigest = "sha256:6961f95736c7a41ac7af014d78bc877a07677bdedccfed2255395c956a3ef405";
+export const ContractGeneratedGoDigest = "sha256:05eef493dc05e9f7ef4fbbf0aa4dbba5743ceb12a9baded16c875c33e9ed50bb";
+export const ContractGeneratedTypeScriptDigest = "sha256:20e6bfe9e9c7689331b42ea841f6bcc6b0450fb0accc81b451ffba2f1ec2befb";

package/dist/gen-ts/kit-bundle-manifest.d.ts

@@ -36,6 +36,7 @@ export interface KitBundleManifest {
      */
     nativeRuntime?: {
         darwinArm64?: NativeExecutable;
+        linuxArm64?: NativeExecutable;
         linuxX64?: NativeExecutable;
         windowsX64?: NativeExecutable;
     };

package/dist/gen-ts/kit-lock.d.ts

@@ -48,6 +48,7 @@ interface KitBundleManifest {
      */
     nativeRuntime?: {
         darwinArm64?: NativeExecutable;
+        linuxArm64?: NativeExecutable;
         linuxX64?: NativeExecutable;
         windowsX64?: NativeExecutable;
     };

package/dist/gen-ts/saas-connection.d.ts

@@ -75,6 +75,7 @@ export interface SaasConnection {
      * @maxItems 20
      */
     approvers?: string[];
+    startedBy?: StartedBy;
     createdAt: string;
     updatedAt: string;
     /**
@@ -192,6 +193,20 @@ export interface ExternalRecipientPolicy {
      */
     allowedDomains?: string[];
 }
+/**
+ * Set when a builder's first access request created this connection instead of IT (0.88.0, ADR 0034): who, when, and the app that asked. Such a connection is an ordinary ACTIVE connection whose `userModeApproval` starts as `it`, so development is granted by the development preapproval and production waits for IT's one decision; IT may relax the switch afterwards. Absent on connections IT created.
+ */
+export interface StartedBy {
+    /**
+     * One bare email address (no display name).
+     */
+    email: string;
+    at: string;
+    /**
+     * The app whose request created the connection, when known.
+     */
+    appId?: string;
+}
 /**
  * @deprecated
  */

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.86.0.0" as const;
-export const ContractPublishVersion = "0.86.0" as const;
-export const ContractPublishTag = "v0.86.0" as const;
-export const ContractSchemasDigest = "sha256:f510802c5ba082d403b8f4c5210da322861197b8ea5558384ac5c6403777fbd7" as const;
+export const ContractRepositoryVersion = "0.88.0.0" as const;
+export const ContractPublishVersion = "0.88.0" as const;
+export const ContractPublishTag = "v0.88.0" as const;
+export const ContractSchemasDigest = "sha256:23e1cb0d9f92c4ea5c2b827aeab9266dfee0ed503457ba5bdc101c39212e8c6f" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:641550cc398b29feeec00af2b0e79b52ceb4ee5ac77b0a4f0e6e7b7447adde39" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:6961f95736c7a41ac7af014d78bc877a07677bdedccfed2255395c956a3ef405" as const;
+export const ContractGeneratedGoDigest = "sha256:05eef493dc05e9f7ef4fbbf0aa4dbba5743ceb12a9baded16c875c33e9ed50bb" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:20e6bfe9e9c7689331b42ea841f6bcc6b0450fb0accc81b451ffba2f1ec2befb" as const;

package/gen-ts/kit-bundle-manifest.ts

@@ -40,6 +40,7 @@ export interface KitBundleManifest {
    */
   nativeRuntime?: {
     darwinArm64?: NativeExecutable;
+    linuxArm64?: NativeExecutable;
     linuxX64?: NativeExecutable;
     windowsX64?: NativeExecutable;
   };

package/gen-ts/kit-lock.ts

@@ -51,6 +51,7 @@ interface KitBundleManifest {
    */
   nativeRuntime?: {
     darwinArm64?: NativeExecutable;
+    linuxArm64?: NativeExecutable;
     linuxX64?: NativeExecutable;
     windowsX64?: NativeExecutable;
   };

package/gen-ts/saas-connection.ts

@@ -174,6 +174,7 @@ export interface SaasConnection {
    * @maxItems 20
    */
   approvers?: string[];
+  startedBy?: StartedBy;
   createdAt: string;
   updatedAt: string;
   /**
@@ -291,6 +292,20 @@ export interface ExternalRecipientPolicy {
    */
   allowedDomains?: string[];
 }
+/**
+ * Set when a builder's first access request created this connection instead of IT (0.88.0, ADR 0034): who, when, and the app that asked. Such a connection is an ordinary ACTIVE connection whose `userModeApproval` starts as `it`, so development is granted by the development preapproval and production waits for IT's one decision; IT may relax the switch afterwards. Absent on connections IT created.
+ */
+export interface StartedBy {
+  /**
+   * One bare email address (no display name).
+   */
+  email: string;
+  at: string;
+  /**
+   * The app whose request created the connection, when known.
+   */
+  appId?: string;
+}
 /**
  * @deprecated
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.86.0",
+  "version": "0.88.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/kit-bundle-manifest.schema.json

@@ -35,6 +35,7 @@
       "description": "Native local App Gateway executables for supported builder platforms; hosted workloads continue to use images.",
       "properties": {
         "darwinArm64": { "$ref": "#/definitions/NativeExecutable" },
+        "linuxArm64": { "$ref": "#/definitions/NativeExecutable" },
         "linuxX64": { "$ref": "#/definitions/NativeExecutable" },
         "windowsX64": { "$ref": "#/definitions/NativeExecutable" }
       }

package/schema/saas-connection.schema.json

@@ -52,6 +52,7 @@
       "items": { "$ref": "integration-execute-request.schema.json#/definitions/EmailAddress" },
       "description": "Lower-cased emails who may approve an app's access requests for this connection, besides tenant admins. Empty or absent means tenant admins only."
     },
+    "startedBy": { "$ref": "#/definitions/StartedBy" },
     "createdAt": { "type": "string", "format": "date-time" },
     "updatedAt": { "type": "string", "format": "date-time" },
     "clientId": { "type": "string", "minLength": 1, "maxLength": 255, "deprecated": true, "description": "Deprecated (pre-T25 tenant-owned provider client). Dropped on read; never written." },
@@ -87,6 +88,17 @@
       "enum": ["slack", "gmail", "basecamp", "sharepoint", "phone", "calendar", "drive", "docs", "sheets", "outlook", "onedrive", "excel", "teams"],
       "description": "Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`. Phone (0.82.0) is app mode only with no installation: the tenant's inbound SMS numbers (E.164) mapped from aliases in `channels`, and the SMS the platform received on them listed by phone.sms.list; since 0.83.0 an app reads the number an alias maps to with phone.number.get. Google Workspace (0.86.0, ADR 0032: calendar, drive, docs, sheets on the Google OAuth client) and Microsoft 365 (outlook, onedrive, excel, teams on the Microsoft client) are user-consent only like Gmail, one connection per provider with its own consent and scopes; the seven personal providers have no `account` and empty `channels` (their one fixed alias is the signed-in person's own calendar, drive, documents, spreadsheets, mailbox or workbooks); teams is pinned to the Microsoft 365 tenant in `account` like SharePoint and maps channel aliases in `channels`."
     },
+    "StartedBy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["email", "at"],
+      "description": "Set when a builder's first access request created this connection instead of IT (0.88.0, ADR 0034): who, when, and the app that asked. Such a connection is an ordinary ACTIVE connection whose `userModeApproval` starts as `it`, so development is granted by the development preapproval and production waits for IT's one decision; IT may relax the switch afterwards. Absent on connections IT created.",
+      "properties": {
+        "email": { "$ref": "integration-execute-request.schema.json#/definitions/EmailAddress", "description": "The builder's lower-cased company email." },
+        "at": { "type": "string", "format": "date-time" },
+        "appId": { "type": "string", "minLength": 1, "maxLength": 128, "description": "The app whose request created the connection, when known." }
+      }
+    },
     "BasecampAccount": {
       "type": "object",
       "additionalProperties": false,
@@ -367,7 +379,8 @@
       "channels": {},
       "operations": ["sheets.spreadsheet.read", "sheets.values.read", "sheets.values.append", "sheets.values.update", "sheets.values.clear", "sheets.spreadsheet.create"],
       "developmentPreapproval": { "enabled": true, "hours": 24 },
-      "userModeApproval": "automatic",
+      "userModeApproval": "it",
+      "startedBy": { "email": "builder@example.com", "at": "2026-10-17T08:00:00Z", "appId": "app-7f3a2c91" },
       "createdAt": "2026-10-17T08:00:00Z",
       "updatedAt": "2026-10-17T08:00:00Z"
     },