@fourier-labs/harbour-contracts 0.87.0 → 0.90.0

package/README.md

@@ -40,7 +40,7 @@ exist here first.
 | `ai-pricing-revision`, `ai-metering-policy`, `ai-budget-ledger-event`, `ai-trace-event-v2` | Additive metering v2 records, including media dimensions and P5 trace attribution; v1 records remain readable | AI governance §9 |
 | `app-integrations-declaration.schema.json` | Committed `.isomorph/integrations.json` (`isomorph.app-integrations/2.0`): closed eighty-one-operation set (Slack read/post/update/delete/DM/lookup, Gmail list/thread/read/send/attachment — ADR 0018; Basecamp project/to-do list/to-do/message/comment/people lists, to-do create and complete, message, comment and Campfire posts — ADR 0022; SharePoint list/item/drive/file lists, file search and read, item create and update, file upload — ADR 0024; phone SMS list — ADR 0028; phone number read — ADR 0029; Google Calendar, Drive, Docs and Sheets and Outlook, OneDrive, Excel and Teams reads and writes as the signed-in person — ADR 0032; warehouse view read and table append, the view mapping saying `access: read|append` — ADR 0028; service request) with fixed or declared identity modes; owns the shared operation/identity/environment enums | Dev kit §4 |
 | `integration-execute-request`, `integration-execute-result`, `integration-connect-result`, `integration-error-details` | App SDK integrations wire contract on `/_harbour/integrations/*`: per-operation input bounds (a warehouse read filters, groups, aggregates and sorts in the warehouse and says when it was `truncated` — ADR 0017; Slack and Gmail reads page, posts thread, mail carries HTML and attachments — ADR 0018; a development warehouse read may carry the app's `sampleRows` and the result says `sample` — ADR 0021; Basecamp lists page by `pageToken`, ids are digit strings, writes answer `{id, appUrl}` — ADR 0022; SharePoint lists page by a Graph `$skiptoken`, ids are Graph ids, `fields` is a bounded record, writes answer `{id, webUrl}` — ADR 0024; a warehouse append takes `rows`, a bounded list of records, and a phone SMS list takes `since`/`from` — ADR 0028; a phone number read takes no input — ADR 0029; calendar events take RFC 3339 `start`/`end`, Sheets and Excel take `values`, a bounded matrix of cells, Docs take `replacements`, and the event read, document read, values and worksheet results have their own shapes — ADR 0032), the per-operation result shapes, consent states and the closed `details.code` reason set | Dev kit §4, §8 |
-| `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider; IT's optional `oauthClient`, `userModeApproval`, `directMessages`, `externalRecipients` — ADR 0018; a Basecamp connection's pinned `account` and project ids in `channels` — ADR 0022; a SharePoint connection's pinned Microsoft 365 tenant in `account` and site ids in `channels` — ADR 0024; up to 20 `approvers` who may approve access requests beside the tenant admins — ADR 0026; a phone connection's E.164 numbers in `channels` — ADR 0028, which an app reads back by alias — ADR 0029; eight Google Workspace and Microsoft 365 providers, user-consent only, a Teams connection's pinned tenant and `<teamId>/<channelId>` channel map — ADR 0032) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
+| `saas-connection.schema.json`, `data-grant-v2.schema.json` | Tenant SaaS connection record (one installation and channel map per tenant and provider; IT's optional `oauthClient`, `userModeApproval`, `directMessages`, `externalRecipients` — ADR 0018; a Basecamp connection's pinned `account` and project ids in `channels` — ADR 0022; a SharePoint connection's pinned Microsoft 365 tenant in `account` and site ids in `channels` — ADR 0024; up to 20 `approvers` who may approve access requests beside the tenant admins — ADR 0026; a phone connection's E.164 numbers in `channels` — ADR 0028, which an app reads back by alias — ADR 0029; eight Google Workspace and Microsoft 365 providers, user-consent only, a Teams connection's pinned tenant and `<teamId>/<channelId>` channel map — ADR 0032; optional `startedBy` when a builder's first request created the connection — ADR 0034) and the additive `harbour.data-grant/2.0` grant record with structured resources and provisioning lease/cleanup (status machine generated; legacy `data-grant` untouched) | Dev kit §5 |
 | `kit-bundle-manifest.schema.json`, `kit-lock.schema.json` | Published kit bundle identity (SDK tarball digest plus optional `sdk.version` and https `sdk.url` download location) and the committed `.isomorph/kit.lock.json` the CodeBuild SDK-vendoring gate compares against | Dev kit §3 |
 | `deploy-response.schema.json` | 202 Accepted body for `POST /v1/tenants/{tenant}/apps/{app}/deployments`, returned only after the authoritative QUEUED version exists and its SQS message is accepted | — |
 | `deployment-source.schema.json` | Credential-free source in the `DeployRequest` body: `provider` is `github` or `gitlab`, `repositoryUrl` is shape-only and the deployment control plane checks the host against the tenant's source connection (ADR 0023); credentials are resolved internally by MaterializeSource | — |

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.87.0.0",
-  "publishVersion": "0.87.0",
-  "publishTag": "v0.87.0",
-  "schemasDigest": "sha256:8ee0ace66f836f6ab8ce11a98de223c84e17fc7d02fe18d7d85f2ed92851a8fb",
+  "repositoryVersion": "0.90.0.0",
+  "publishVersion": "0.90.0",
+  "publishTag": "v0.90.0",
+  "schemasDigest": "sha256:332836a0ce8cb9ace1540cf172e5991f5e9b2fe4cfc48230f3956bc832a282d8",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:50f4b6d760c87b4d71fcef869b685e77f807d2e635f1300faa89b9061c23d326",
-  "generatedTypeScriptDigest": "sha256:44368a588929e44460d15f8985dc411e0806abd26bf83d07571750f7abe30da5",
+  "generatedGoDigest": "sha256:16ef224065767ea2fd06545bfdd22a4e3d58fe6c903512952424a010c29508fa",
+  "generatedTypeScriptDigest": "sha256:53846b6ac7df436c1dd49293fbb73e93d8f6cbf4d74e10c9cf8a020bd76de086",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -37,7 +37,7 @@
     "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/builder-input-proposal.schema.json": "sha256:fe85cffa6d76b1e1effe1f5d75525f8fe0e1eaa3be4a304e491aa23ad72c0e72",
     "schema/data-dependency.schema.json": "sha256:b4cc2b2484e982cfed64c0f56b8f1e9d1363c71854cd71f845b24fbe7d85c971",
-    "schema/data-grant-v2.schema.json": "sha256:495f60e44fce2e5aa00153b191c3bb93f99c4473a0f5bf8cf15b2751de1ff82b",
+    "schema/data-grant-v2.schema.json": "sha256:bc27332a9e8967f932ad52b34b15d4d103e611d0898ae5b7b6893b8471631536",
     "schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
     "schema/data-source.schema.json": "sha256:f32b2b4312bc06e023f4e1da60eed52ddfade59b74c1a1cc8e4b740a6f9c930b",
     "schema/deploy-request.schema.json": "sha256:c978406c273fa430db262888f0a8646b14e3057f64b0633780fcd6cfa646bc67",
@@ -65,8 +65,8 @@
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
-    "schema/resolved-app-serving.schema.json": "sha256:1912f3224db1a1699618e6322358e07f76425d3097aec2fbe5d38a10e5c967e3",
-    "schema/saas-connection.schema.json": "sha256:aaec4b21bf50ab3935541d564fc2339fb626be1cbc5d171e8e0709d3bc360b09",
+    "schema/resolved-app-serving.schema.json": "sha256:3b49268e189429310c2a5dcfd45e9d2187c80b6dbb9d329a0177e96e065c31c0",
+    "schema/saas-connection.schema.json": "sha256:f4ad2f72f8349f9a465767914ad70eb3c3407c43ee56ed70521479e80014b6c4",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
     "schema/security-scan-input-v2.schema.json": "sha256:0d418342078c9b5046ea6f4bef3c2c57539285dfee99cc0850d4f0d03739ee13",
@@ -116,7 +116,7 @@
     "gen-go/integration_execute_input_rules_test.go": "sha256:eb7650cc66b7bebe9b36cfd6e7233eb20f74aba0006977f2f009bfdf8e05d83a",
     "gen-go/integration_operations.go": "sha256:43ada077eca1da6666929e724096f93ddab6469826834f55a8b7332828efa898",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:480a624a58365b00ca3e000ea525225bfac8bdffe1ff6dc53983b3e6823c841f",
+    "gen-go/types.go": "sha256:bc0acfe7b5ce8ac053bc509b63d5c06c567816096fbdb66b9cbb5b656c6b1cb7",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -148,7 +148,7 @@
     "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
     "gen-ts/builder-input-proposal.ts": "sha256:b0108c3787873d3cf1a39f00967379418a6766275d3474cfa55f5a9d93ead174",
     "gen-ts/data-dependency.ts": "sha256:259f19e2759395d72ead90b8ed74a6dcef0c2641124f4f182823138cfd19bedf",
-    "gen-ts/data-grant-v2.ts": "sha256:19d3e2c942f1628861715dcac3213673910ffc45817a8e07dfd1bd04d9e76aa1",
+    "gen-ts/data-grant-v2.ts": "sha256:ed8bb2c68d76631c5821b908db27706a6a7f415224b9a9c35bf6de0e394154b4",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
     "gen-ts/data-source.ts": "sha256:2566f0d5c72e44278869f55211cf3d433aeb3552e57ae0ace0ff0b85e769dde6",
     "gen-ts/deploy-request.ts": "sha256:913245577a95354849d3a8cb43fbaedbf895efe7b653c8502d25edfa22b7a864",
@@ -180,8 +180,8 @@
     "gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
-    "gen-ts/resolved-app-serving.ts": "sha256:584792e8e0dcaf4322129b6f78579cd8cd21652c8db8a1606f802408c892534c",
-    "gen-ts/saas-connection.ts": "sha256:af333b238862d7cf23d1a7ecfcf5cd1a3d2140593d01e44d7e9f29022485924d",
+    "gen-ts/resolved-app-serving.ts": "sha256:3264e85827be47bf391781cb13a1e58318d356f7bee8c2ff3e5b00a062253b23",
+    "gen-ts/saas-connection.ts": "sha256:edd55d84416673a5689e5ab56e1264036e69f3b116d7cfbd73b03244dfb71c3e",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.87.0.0";
-export declare const ContractPublishVersion: "0.87.0";
-export declare const ContractPublishTag: "v0.87.0";
-export declare const ContractSchemasDigest: "sha256:8ee0ace66f836f6ab8ce11a98de223c84e17fc7d02fe18d7d85f2ed92851a8fb";
+export declare const ContractRepositoryVersion: "0.90.0.0";
+export declare const ContractPublishVersion: "0.90.0";
+export declare const ContractPublishTag: "v0.90.0";
+export declare const ContractSchemasDigest: "sha256:332836a0ce8cb9ace1540cf172e5991f5e9b2fe4cfc48230f3956bc832a282d8";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:50f4b6d760c87b4d71fcef869b685e77f807d2e635f1300faa89b9061c23d326";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:44368a588929e44460d15f8985dc411e0806abd26bf83d07571750f7abe30da5";
+export declare const ContractGeneratedGoDigest: "sha256:16ef224065767ea2fd06545bfdd22a4e3d58fe6c903512952424a010c29508fa";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:53846b6ac7df436c1dd49293fbb73e93d8f6cbf4d74e10c9cf8a020bd76de086";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.87.0.0";
-export const ContractPublishVersion = "0.87.0";
-export const ContractPublishTag = "v0.87.0";
-export const ContractSchemasDigest = "sha256:8ee0ace66f836f6ab8ce11a98de223c84e17fc7d02fe18d7d85f2ed92851a8fb";
+export const ContractRepositoryVersion = "0.90.0.0";
+export const ContractPublishVersion = "0.90.0";
+export const ContractPublishTag = "v0.90.0";
+export const ContractSchemasDigest = "sha256:332836a0ce8cb9ace1540cf172e5991f5e9b2fe4cfc48230f3956bc832a282d8";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:50f4b6d760c87b4d71fcef869b685e77f807d2e635f1300faa89b9061c23d326";
-export const ContractGeneratedTypeScriptDigest = "sha256:44368a588929e44460d15f8985dc411e0806abd26bf83d07571750f7abe30da5";
+export const ContractGeneratedGoDigest = "sha256:16ef224065767ea2fd06545bfdd22a4e3d58fe6c903512952424a010c29508fa";
+export const ContractGeneratedTypeScriptDigest = "sha256:53846b6ac7df436c1dd49293fbb73e93d8f6cbf4d74e10c9cf8a020bd76de086";

package/dist/gen-ts/data-grant-v2.d.ts

@@ -40,6 +40,7 @@ export interface DataGrantV2 {
      * @maxItems 64
      */
     resources: IntegrationResource[];
+    reviewedScope?: ReviewedIntegrationScope;
     /**
      * Absent only for explicitly approved ongoing production access.
      */
@@ -97,6 +98,19 @@ export interface IntegrationResource {
      */
     columns?: string[];
 }
+/**
+ * Only for SaaS grants mixing reviewed and automatic access: the previously human-reviewed scope. The remaining scope must satisfy current automatic rules. Homogeneous grants continue using approvedBy alone. Governance validates this is a subset of the grant; database behaviour is unchanged.
+ */
+export interface ReviewedIntegrationScope {
+    /**
+     * @maxItems 78
+     */
+    operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'basecamp.project.list' | 'basecamp.todolist.list' | 'basecamp.todo.list' | 'basecamp.todo.create' | 'basecamp.todo.complete' | 'basecamp.message.list' | 'basecamp.message.post' | 'basecamp.comment.list' | 'basecamp.comment.post' | 'basecamp.campfire.post' | 'basecamp.people.list' | 'sharepoint.list.list' | 'sharepoint.item.list' | 'sharepoint.item.create' | 'sharepoint.item.update' | 'sharepoint.drive.list' | 'sharepoint.file.list' | 'sharepoint.file.search' | 'sharepoint.file.read' | 'sharepoint.file.upload' | 'phone.sms.list' | 'phone.number.get' | 'calendar.calendar.list' | 'calendar.event.list' | 'calendar.event.read' | 'calendar.event.create' | 'calendar.event.update' | 'calendar.event.cancel' | 'drive.file.list' | 'drive.file.search' | 'drive.file.read' | 'drive.file.upload' | 'drive.folder.create' | 'docs.document.read' | 'docs.document.create' | 'docs.document.append' | 'docs.text.replace' | 'sheets.spreadsheet.read' | 'sheets.values.read' | 'sheets.values.append' | 'sheets.values.update' | 'sheets.values.clear' | 'sheets.spreadsheet.create' | 'outlook.message.list' | 'outlook.message.read' | 'outlook.attachment.read' | 'outlook.message.send' | 'outlook.message.reply' | 'outlook.event.list' | 'outlook.event.read' | 'outlook.event.create' | 'outlook.event.update' | 'outlook.event.cancel' | 'onedrive.file.list' | 'onedrive.file.search' | 'onedrive.file.read' | 'onedrive.file.upload' | 'onedrive.folder.create' | 'excel.worksheet.list' | 'excel.range.read' | 'excel.range.update' | 'excel.table.list' | 'excel.row.add' | 'excel.worksheet.add' | 'teams.message.list' | 'teams.message.post' | 'teams.reply.post' | 'warehouse.view.read' | 'warehouse.table.append' | 'service.request')[];
+    /**
+     * @maxItems 64
+     */
+    resources: IntegrationResource[];
+}
 /**
  * App-mode Slack grants only: how the app's posts are presented, as IT approved it. Absent means the posts carry the bot's own name.
  */

package/dist/gen-ts/resolved-app-serving.d.ts

@@ -19,6 +19,10 @@ export interface ResolvedAppServing {
      * The platform cell (LLD §3.7) whose routing store and template distribution serve this app.
      */
     cellId?: string;
+    /**
+     * How the tenant's cells run the app's server (ADR 0035): `kubernetes`, the cluster cell, or `serverless`, the gateway service with Lambda Web Functions, which serves kit apps only. One choice per tenant, the same in every environment; governance copies it from the tenant's deployment destination, and build and Provision branch on it. Absent means kubernetes.
+     */
+    hosting?: 'kubernetes' | 'serverless';
     /**
      * The cell's CloudFront KeyValueStore ARN; equals edge.routingStoreArn unless the cell record names its own.
      */

package/dist/gen-ts/saas-connection.d.ts

@@ -58,6 +58,18 @@ export interface SaasConnection {
      * @maxItems 78
      */
     operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'basecamp.project.list' | 'basecamp.todolist.list' | 'basecamp.todo.list' | 'basecamp.todo.create' | 'basecamp.todo.complete' | 'basecamp.message.list' | 'basecamp.message.post' | 'basecamp.comment.list' | 'basecamp.comment.post' | 'basecamp.campfire.post' | 'basecamp.people.list' | 'sharepoint.list.list' | 'sharepoint.item.list' | 'sharepoint.item.create' | 'sharepoint.item.update' | 'sharepoint.drive.list' | 'sharepoint.file.list' | 'sharepoint.file.search' | 'sharepoint.file.read' | 'sharepoint.file.upload' | 'phone.sms.list' | 'phone.number.get' | 'calendar.calendar.list' | 'calendar.event.list' | 'calendar.event.read' | 'calendar.event.create' | 'calendar.event.update' | 'calendar.event.cancel' | 'drive.file.list' | 'drive.file.search' | 'drive.file.read' | 'drive.file.upload' | 'drive.folder.create' | 'docs.document.read' | 'docs.document.create' | 'docs.document.append' | 'docs.text.replace' | 'sheets.spreadsheet.read' | 'sheets.values.read' | 'sheets.values.append' | 'sheets.values.update' | 'sheets.values.clear' | 'sheets.spreadsheet.create' | 'outlook.message.list' | 'outlook.message.read' | 'outlook.attachment.read' | 'outlook.message.send' | 'outlook.message.reply' | 'outlook.event.list' | 'outlook.event.read' | 'outlook.event.create' | 'outlook.event.update' | 'outlook.event.cancel' | 'onedrive.file.list' | 'onedrive.file.search' | 'onedrive.file.read' | 'onedrive.file.upload' | 'onedrive.folder.create' | 'excel.worksheet.list' | 'excel.range.read' | 'excel.range.update' | 'excel.table.list' | 'excel.row.add' | 'excel.worksheet.add' | 'teams.message.list' | 'teams.message.post' | 'teams.reply.post' | 'warehouse.view.read' | 'warehouse.table.append' | 'service.request')[];
+    /**
+     * Explicit user-mode operations eligible for automatic app access, subject to the connection operation ceiling and personal consent. Empty means review all; absent inherits company defaults or the existing userModeApproval migration rule. Governance validates provider and mode compatibility. Background execution still requires personal background consent, not a separate admin grant.
+     *
+     * @maxItems 78
+     */
+    automaticUserOperations?: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'basecamp.project.list' | 'basecamp.todolist.list' | 'basecamp.todo.list' | 'basecamp.todo.create' | 'basecamp.todo.complete' | 'basecamp.message.list' | 'basecamp.message.post' | 'basecamp.comment.list' | 'basecamp.comment.post' | 'basecamp.campfire.post' | 'basecamp.people.list' | 'sharepoint.list.list' | 'sharepoint.item.list' | 'sharepoint.item.create' | 'sharepoint.item.update' | 'sharepoint.drive.list' | 'sharepoint.file.list' | 'sharepoint.file.search' | 'sharepoint.file.read' | 'sharepoint.file.upload' | 'phone.sms.list' | 'phone.number.get' | 'calendar.calendar.list' | 'calendar.event.list' | 'calendar.event.read' | 'calendar.event.create' | 'calendar.event.update' | 'calendar.event.cancel' | 'drive.file.list' | 'drive.file.search' | 'drive.file.read' | 'drive.file.upload' | 'drive.folder.create' | 'docs.document.read' | 'docs.document.create' | 'docs.document.append' | 'docs.text.replace' | 'sheets.spreadsheet.read' | 'sheets.values.read' | 'sheets.values.append' | 'sheets.values.update' | 'sheets.values.clear' | 'sheets.spreadsheet.create' | 'outlook.message.list' | 'outlook.message.read' | 'outlook.attachment.read' | 'outlook.message.send' | 'outlook.message.reply' | 'outlook.event.list' | 'outlook.event.read' | 'outlook.event.create' | 'outlook.event.update' | 'outlook.event.cancel' | 'onedrive.file.list' | 'onedrive.file.search' | 'onedrive.file.read' | 'onedrive.file.upload' | 'onedrive.folder.create' | 'excel.worksheet.list' | 'excel.range.read' | 'excel.range.update' | 'excel.table.list' | 'excel.row.add' | 'excel.worksheet.add' | 'teams.message.list' | 'teams.message.post' | 'teams.reply.post' | 'warehouse.view.read' | 'warehouse.table.append' | 'service.request')[];
+    /**
+     * Reusable permissions for admitted builders on explicit shared SaaS resources. Governance checks registered resources, provider/mode compatibility and the connection operation ceiling. Connection version and audit record changes; no per-entry approval metadata.
+     *
+     * @maxItems 128
+     */
+    reusableAccess?: ReusableSaasAccess[];
     developmentPreapproval: DevelopmentPreapproval;
     oauthClient?: SaasOauthClient;
     userModeApproval?: UserModeApproval;
@@ -75,6 +87,7 @@ export interface SaasConnection {
      * @maxItems 20
      */
     approvers?: string[];
+    startedBy?: StartedBy;
     createdAt: string;
     updatedAt: string;
     /**
@@ -140,6 +153,21 @@ export interface BasecampAccount {
      */
     name: string;
 }
+export interface ReusableSaasAccess {
+    /**
+     * Tenant-wide logical alias of a connection (governance sourceId) or of a resource under it.
+     */
+    resource: string;
+    /**
+     * Whose authority an operation runs under. Fixed per operation, except the declared-mode Slack operations (slack.message.post; since 0.71.0 also slack.channel.history, slack.message.update, slack.message.delete): declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
+     */
+    mode: 'app' | 'user';
+    /**
+     * @minItems 1
+     * @maxItems 78
+     */
+    operations: ('slack.channel.history' | 'slack.message.post' | 'slack.message.update' | 'slack.message.delete' | 'slack.dm.send' | 'slack.user.lookup' | 'gmail.thread.list' | 'gmail.thread.read' | 'gmail.message.read' | 'gmail.message.send' | 'gmail.attachment.read' | 'basecamp.project.list' | 'basecamp.todolist.list' | 'basecamp.todo.list' | 'basecamp.todo.create' | 'basecamp.todo.complete' | 'basecamp.message.list' | 'basecamp.message.post' | 'basecamp.comment.list' | 'basecamp.comment.post' | 'basecamp.campfire.post' | 'basecamp.people.list' | 'sharepoint.list.list' | 'sharepoint.item.list' | 'sharepoint.item.create' | 'sharepoint.item.update' | 'sharepoint.drive.list' | 'sharepoint.file.list' | 'sharepoint.file.search' | 'sharepoint.file.read' | 'sharepoint.file.upload' | 'phone.sms.list' | 'phone.number.get' | 'calendar.calendar.list' | 'calendar.event.list' | 'calendar.event.read' | 'calendar.event.create' | 'calendar.event.update' | 'calendar.event.cancel' | 'drive.file.list' | 'drive.file.search' | 'drive.file.read' | 'drive.file.upload' | 'drive.folder.create' | 'docs.document.read' | 'docs.document.create' | 'docs.document.append' | 'docs.text.replace' | 'sheets.spreadsheet.read' | 'sheets.values.read' | 'sheets.values.append' | 'sheets.values.update' | 'sheets.values.clear' | 'sheets.spreadsheet.create' | 'outlook.message.list' | 'outlook.message.read' | 'outlook.attachment.read' | 'outlook.message.send' | 'outlook.message.reply' | 'outlook.event.list' | 'outlook.event.read' | 'outlook.event.create' | 'outlook.event.update' | 'outlook.event.cancel' | 'onedrive.file.list' | 'onedrive.file.search' | 'onedrive.file.read' | 'onedrive.file.upload' | 'onedrive.folder.create' | 'excel.worksheet.list' | 'excel.range.read' | 'excel.range.update' | 'excel.table.list' | 'excel.row.add' | 'excel.worksheet.add' | 'teams.message.list' | 'teams.message.post' | 'teams.reply.post' | 'warehouse.view.read' | 'warehouse.table.append' | 'service.request')[];
+}
 export interface DevelopmentPreapproval {
     /**
      * Auto-approve development requests within the allowlist.
@@ -192,6 +220,20 @@ export interface ExternalRecipientPolicy {
      */
     allowedDomains?: string[];
 }
+/**
+ * Set when a builder's first access request created this connection instead of IT (0.88.0, ADR 0034): who, when, and the app that asked. Such a connection is an ordinary ACTIVE connection whose `userModeApproval` starts as `it`, so development is granted by the development preapproval and production waits for IT's one decision; IT may relax the switch afterwards. Absent on connections IT created.
+ */
+export interface StartedBy {
+    /**
+     * One bare email address (no display name).
+     */
+    email: string;
+    at: string;
+    /**
+     * The app whose request created the connection, when known.
+     */
+    appId?: string;
+}
 /**
  * @deprecated
  */

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.87.0.0" as const;
-export const ContractPublishVersion = "0.87.0" as const;
-export const ContractPublishTag = "v0.87.0" as const;
-export const ContractSchemasDigest = "sha256:8ee0ace66f836f6ab8ce11a98de223c84e17fc7d02fe18d7d85f2ed92851a8fb" as const;
+export const ContractRepositoryVersion = "0.90.0.0" as const;
+export const ContractPublishVersion = "0.90.0" as const;
+export const ContractPublishTag = "v0.90.0" as const;
+export const ContractSchemasDigest = "sha256:332836a0ce8cb9ace1540cf172e5991f5e9b2fe4cfc48230f3956bc832a282d8" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:50f4b6d760c87b4d71fcef869b685e77f807d2e635f1300faa89b9061c23d326" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:44368a588929e44460d15f8985dc411e0806abd26bf83d07571750f7abe30da5" as const;
+export const ContractGeneratedGoDigest = "sha256:16ef224065767ea2fd06545bfdd22a4e3d58fe6c903512952424a010c29508fa" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:53846b6ac7df436c1dd49293fbb73e93d8f6cbf4d74e10c9cf8a020bd76de086" as const;

package/gen-ts/data-grant-v2.ts

@@ -126,6 +126,7 @@ export interface DataGrantV2 {
    * @maxItems 64
    */
   resources: IntegrationResource[];
+  reviewedScope?: ReviewedIntegrationScope;
   /**
    * Absent only for explicitly approved ongoing production access.
    */
@@ -183,6 +184,101 @@ export interface IntegrationResource {
    */
   columns?: string[];
 }
+/**
+ * Only for SaaS grants mixing reviewed and automatic access: the previously human-reviewed scope. The remaining scope must satisfy current automatic rules. Homogeneous grants continue using approvedBy alone. Governance validates this is a subset of the grant; database behaviour is unchanged.
+ */
+export interface ReviewedIntegrationScope {
+  /**
+   * @maxItems 78
+   */
+  operations: (
+    | 'slack.channel.history'
+    | 'slack.message.post'
+    | 'slack.message.update'
+    | 'slack.message.delete'
+    | 'slack.dm.send'
+    | 'slack.user.lookup'
+    | 'gmail.thread.list'
+    | 'gmail.thread.read'
+    | 'gmail.message.read'
+    | 'gmail.message.send'
+    | 'gmail.attachment.read'
+    | 'basecamp.project.list'
+    | 'basecamp.todolist.list'
+    | 'basecamp.todo.list'
+    | 'basecamp.todo.create'
+    | 'basecamp.todo.complete'
+    | 'basecamp.message.list'
+    | 'basecamp.message.post'
+    | 'basecamp.comment.list'
+    | 'basecamp.comment.post'
+    | 'basecamp.campfire.post'
+    | 'basecamp.people.list'
+    | 'sharepoint.list.list'
+    | 'sharepoint.item.list'
+    | 'sharepoint.item.create'
+    | 'sharepoint.item.update'
+    | 'sharepoint.drive.list'
+    | 'sharepoint.file.list'
+    | 'sharepoint.file.search'
+    | 'sharepoint.file.read'
+    | 'sharepoint.file.upload'
+    | 'phone.sms.list'
+    | 'phone.number.get'
+    | 'calendar.calendar.list'
+    | 'calendar.event.list'
+    | 'calendar.event.read'
+    | 'calendar.event.create'
+    | 'calendar.event.update'
+    | 'calendar.event.cancel'
+    | 'drive.file.list'
+    | 'drive.file.search'
+    | 'drive.file.read'
+    | 'drive.file.upload'
+    | 'drive.folder.create'
+    | 'docs.document.read'
+    | 'docs.document.create'
+    | 'docs.document.append'
+    | 'docs.text.replace'
+    | 'sheets.spreadsheet.read'
+    | 'sheets.values.read'
+    | 'sheets.values.append'
+    | 'sheets.values.update'
+    | 'sheets.values.clear'
+    | 'sheets.spreadsheet.create'
+    | 'outlook.message.list'
+    | 'outlook.message.read'
+    | 'outlook.attachment.read'
+    | 'outlook.message.send'
+    | 'outlook.message.reply'
+    | 'outlook.event.list'
+    | 'outlook.event.read'
+    | 'outlook.event.create'
+    | 'outlook.event.update'
+    | 'outlook.event.cancel'
+    | 'onedrive.file.list'
+    | 'onedrive.file.search'
+    | 'onedrive.file.read'
+    | 'onedrive.file.upload'
+    | 'onedrive.folder.create'
+    | 'excel.worksheet.list'
+    | 'excel.range.read'
+    | 'excel.range.update'
+    | 'excel.table.list'
+    | 'excel.row.add'
+    | 'excel.worksheet.add'
+    | 'teams.message.list'
+    | 'teams.message.post'
+    | 'teams.reply.post'
+    | 'warehouse.view.read'
+    | 'warehouse.table.append'
+    | 'service.request'
+  )[];
+  /**
+   * @maxItems 64
+   */
+  resources: IntegrationResource[];
+}
 /**
  * App-mode Slack grants only: how the app's posts are presented, as IT approved it. Absent means the posts carry the bot's own name.
  */

package/gen-ts/resolved-app-serving.ts

@@ -22,6 +22,10 @@ export interface ResolvedAppServing {
    * The platform cell (LLD §3.7) whose routing store and template distribution serve this app.
    */
   cellId?: string;
+  /**
+   * How the tenant's cells run the app's server (ADR 0035): `kubernetes`, the cluster cell, or `serverless`, the gateway service with Lambda Web Functions, which serves kit apps only. One choice per tenant, the same in every environment; governance copies it from the tenant's deployment destination, and build and Provision branch on it. Absent means kubernetes.
+   */
+  hosting?: 'kubernetes' | 'serverless';
   /**
    * The cell's CloudFront KeyValueStore ARN; equals edge.routingStoreArn unless the cell record names its own.
    */

package/gen-ts/saas-connection.ts

@@ -157,6 +157,100 @@ export interface SaasConnection {
     | 'warehouse.table.append'
     | 'service.request'
   )[];
+  /**
+   * Explicit user-mode operations eligible for automatic app access, subject to the connection operation ceiling and personal consent. Empty means review all; absent inherits company defaults or the existing userModeApproval migration rule. Governance validates provider and mode compatibility. Background execution still requires personal background consent, not a separate admin grant.
+   *
+   * @maxItems 78
+   */
+  automaticUserOperations?: (
+    | 'slack.channel.history'
+    | 'slack.message.post'
+    | 'slack.message.update'
+    | 'slack.message.delete'
+    | 'slack.dm.send'
+    | 'slack.user.lookup'
+    | 'gmail.thread.list'
+    | 'gmail.thread.read'
+    | 'gmail.message.read'
+    | 'gmail.message.send'
+    | 'gmail.attachment.read'
+    | 'basecamp.project.list'
+    | 'basecamp.todolist.list'
+    | 'basecamp.todo.list'
+    | 'basecamp.todo.create'
+    | 'basecamp.todo.complete'
+    | 'basecamp.message.list'
+    | 'basecamp.message.post'
+    | 'basecamp.comment.list'
+    | 'basecamp.comment.post'
+    | 'basecamp.campfire.post'
+    | 'basecamp.people.list'
+    | 'sharepoint.list.list'
+    | 'sharepoint.item.list'
+    | 'sharepoint.item.create'
+    | 'sharepoint.item.update'
+    | 'sharepoint.drive.list'
+    | 'sharepoint.file.list'
+    | 'sharepoint.file.search'
+    | 'sharepoint.file.read'
+    | 'sharepoint.file.upload'
+    | 'phone.sms.list'
+    | 'phone.number.get'
+    | 'calendar.calendar.list'
+    | 'calendar.event.list'
+    | 'calendar.event.read'
+    | 'calendar.event.create'
+    | 'calendar.event.update'
+    | 'calendar.event.cancel'
+    | 'drive.file.list'
+    | 'drive.file.search'
+    | 'drive.file.read'
+    | 'drive.file.upload'
+    | 'drive.folder.create'
+    | 'docs.document.read'
+    | 'docs.document.create'
+    | 'docs.document.append'
+    | 'docs.text.replace'
+    | 'sheets.spreadsheet.read'
+    | 'sheets.values.read'
+    | 'sheets.values.append'
+    | 'sheets.values.update'
+    | 'sheets.values.clear'
+    | 'sheets.spreadsheet.create'
+    | 'outlook.message.list'
+    | 'outlook.message.read'
+    | 'outlook.attachment.read'
+    | 'outlook.message.send'
+    | 'outlook.message.reply'
+    | 'outlook.event.list'
+    | 'outlook.event.read'
+    | 'outlook.event.create'
+    | 'outlook.event.update'
+    | 'outlook.event.cancel'
+    | 'onedrive.file.list'
+    | 'onedrive.file.search'
+    | 'onedrive.file.read'
+    | 'onedrive.file.upload'
+    | 'onedrive.folder.create'
+    | 'excel.worksheet.list'
+    | 'excel.range.read'
+    | 'excel.range.update'
+    | 'excel.table.list'
+    | 'excel.row.add'
+    | 'excel.worksheet.add'
+    | 'teams.message.list'
+    | 'teams.message.post'
+    | 'teams.reply.post'
+    | 'warehouse.view.read'
+    | 'warehouse.table.append'
+    | 'service.request'
+  )[];
+  /**
+   * Reusable permissions for admitted builders on explicit shared SaaS resources. Governance checks registered resources, provider/mode compatibility and the connection operation ceiling. Connection version and audit record changes; no per-entry approval metadata.
+   *
+   * @maxItems 128
+   */
+  reusableAccess?: ReusableSaasAccess[];
   developmentPreapproval: DevelopmentPreapproval;
   oauthClient?: SaasOauthClient;
   userModeApproval?: UserModeApproval;
@@ -174,6 +268,7 @@ export interface SaasConnection {
    * @maxItems 20
    */
   approvers?: string[];
+  startedBy?: StartedBy;
   createdAt: string;
   updatedAt: string;
   /**
@@ -239,6 +334,103 @@ export interface BasecampAccount {
    */
   name: string;
 }
+export interface ReusableSaasAccess {
+  /**
+   * Tenant-wide logical alias of a connection (governance sourceId) or of a resource under it.
+   */
+  resource: string;
+  /**
+   * Whose authority an operation runs under. Fixed per operation, except the declared-mode Slack operations (slack.message.post; since 0.71.0 also slack.channel.history, slack.message.update, slack.message.delete): declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
+   */
+  mode: 'app' | 'user';
+  /**
+   * @minItems 1
+   * @maxItems 78
+   */
+  operations: (
+    | 'slack.channel.history'
+    | 'slack.message.post'
+    | 'slack.message.update'
+    | 'slack.message.delete'
+    | 'slack.dm.send'
+    | 'slack.user.lookup'
+    | 'gmail.thread.list'
+    | 'gmail.thread.read'
+    | 'gmail.message.read'
+    | 'gmail.message.send'
+    | 'gmail.attachment.read'
+    | 'basecamp.project.list'
+    | 'basecamp.todolist.list'
+    | 'basecamp.todo.list'
+    | 'basecamp.todo.create'
+    | 'basecamp.todo.complete'
+    | 'basecamp.message.list'
+    | 'basecamp.message.post'
+    | 'basecamp.comment.list'
+    | 'basecamp.comment.post'
+    | 'basecamp.campfire.post'
+    | 'basecamp.people.list'
+    | 'sharepoint.list.list'
+    | 'sharepoint.item.list'
+    | 'sharepoint.item.create'
+    | 'sharepoint.item.update'
+    | 'sharepoint.drive.list'
+    | 'sharepoint.file.list'
+    | 'sharepoint.file.search'
+    | 'sharepoint.file.read'
+    | 'sharepoint.file.upload'
+    | 'phone.sms.list'
+    | 'phone.number.get'
+    | 'calendar.calendar.list'
+    | 'calendar.event.list'
+    | 'calendar.event.read'
+    | 'calendar.event.create'
+    | 'calendar.event.update'
+    | 'calendar.event.cancel'
+    | 'drive.file.list'
+    | 'drive.file.search'
+    | 'drive.file.read'
+    | 'drive.file.upload'
+    | 'drive.folder.create'
+    | 'docs.document.read'
+    | 'docs.document.create'
+    | 'docs.document.append'
+    | 'docs.text.replace'
+    | 'sheets.spreadsheet.read'
+    | 'sheets.values.read'
+    | 'sheets.values.append'
+    | 'sheets.values.update'
+    | 'sheets.values.clear'
+    | 'sheets.spreadsheet.create'
+    | 'outlook.message.list'
+    | 'outlook.message.read'
+    | 'outlook.attachment.read'
+    | 'outlook.message.send'
+    | 'outlook.message.reply'
+    | 'outlook.event.list'
+    | 'outlook.event.read'
+    | 'outlook.event.create'
+    | 'outlook.event.update'
+    | 'outlook.event.cancel'
+    | 'onedrive.file.list'
+    | 'onedrive.file.search'
+    | 'onedrive.file.read'
+    | 'onedrive.file.upload'
+    | 'onedrive.folder.create'
+    | 'excel.worksheet.list'
+    | 'excel.range.read'
+    | 'excel.range.update'
+    | 'excel.table.list'
+    | 'excel.row.add'
+    | 'excel.worksheet.add'
+    | 'teams.message.list'
+    | 'teams.message.post'
+    | 'teams.reply.post'
+    | 'warehouse.view.read'
+    | 'warehouse.table.append'
+    | 'service.request'
+  )[];
+}
 export interface DevelopmentPreapproval {
   /**
    * Auto-approve development requests within the allowlist.
@@ -291,6 +483,20 @@ export interface ExternalRecipientPolicy {
    */
   allowedDomains?: string[];
 }
+/**
+ * Set when a builder's first access request created this connection instead of IT (0.88.0, ADR 0034): who, when, and the app that asked. Such a connection is an ordinary ACTIVE connection whose `userModeApproval` starts as `it`, so development is granted by the development preapproval and production waits for IT's one decision; IT may relax the switch afterwards. Absent on connections IT created.
+ */
+export interface StartedBy {
+  /**
+   * One bare email address (no display name).
+   */
+  email: string;
+  at: string;
+  /**
+   * The app whose request created the connection, when known.
+   */
+  appId?: string;
+}
 /**
  * @deprecated
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.87.0",
+  "version": "0.90.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/data-grant-v2.schema.json

@@ -29,6 +29,7 @@
       "items": { "$ref": "#/definitions/IntegrationResource" },
       "description": "Approved logical resources. Never inherited by wildcard. Empty until the first approval."
     },
+    "reviewedScope": { "$ref": "#/definitions/ReviewedIntegrationScope" },
     "expiresAt": { "type": "string", "format": "date-time", "description": "Absent only for explicitly approved ongoing production access." },
     "expiredAt": { "type": "string", "format": "date-time", "description": "Set by the recovery sweep once expiry has passed; enforcement itself is the UTC check on every call." },
     "approvedBy": { "type": "string", "minLength": 1, "maxLength": 255 },
@@ -58,6 +59,21 @@
     }
   },
   "definitions": {
+    "ReviewedIntegrationScope": {
+      "type": "object", "additionalProperties": false,
+      "required": ["operations", "resources"],
+      "description": "Only for SaaS grants mixing reviewed and automatic access: the previously human-reviewed scope. The remaining scope must satisfy current automatic rules. Homogeneous grants continue using approvedBy alone. Governance validates this is a subset of the grant; database behaviour is unchanged.",
+      "properties": {
+        "operations": {
+          "type": "array", "maxItems": 78, "uniqueItems": true,
+          "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" }
+        },
+        "resources": {
+          "type": "array", "maxItems": 64, "uniqueItems": true,
+          "items": { "$ref": "#/definitions/IntegrationResource" }
+        }
+      }
+    },
     "IntegrationResource": {
       "type": "object",
       "additionalProperties": false,

package/schema/resolved-app-serving.schema.json

@@ -24,6 +24,7 @@
       }
     },
     "cellId": {"type": "string", "minLength": 1, "description": "The platform cell (LLD §3.7) whose routing store and template distribution serve this app."},
+    "hosting": {"type": "string", "enum": ["kubernetes", "serverless"], "description": "How the tenant's cells run the app's server (ADR 0035): `kubernetes`, the cluster cell, or `serverless`, the gateway service with Lambda Web Functions, which serves kit apps only. One choice per tenant, the same in every environment; governance copies it from the tenant's deployment destination, and build and Provision branch on it. Absent means kubernetes."},
     "routingStoreArn": {"type": "string", "minLength": 1, "description": "The cell's CloudFront KeyValueStore ARN; equals edge.routingStoreArn unless the cell record names its own."},
     "pageHost": {"type": "string", "format": "hostname", "description": "Bare hostname of frontendUrl."},
     "apiHost": {"type": "string", "format": "hostname", "description": "Bare hostname of apiUrl."},

package/schema/saas-connection.schema.json

@@ -33,6 +33,17 @@
       "not": { "anyOf": [{ "contains": { "const": "warehouse.view.read" } }, { "contains": { "const": "warehouse.table.append" } }] },
       "description": "Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload; Google Workspace and Microsoft 365 (0.86.0): the calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operations of the connection's provider). Never warehouse.view.read. Phone (0.82.0): phone.sms.list; 0.83.0 adds phone.number.get. Seventy-eight SaaS operations in all since 0.86.0."
     },
+    "automaticUserOperations": {
+      "type": "array", "maxItems": 78, "uniqueItems": true,
+      "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" },
+      "not": { "anyOf": [{ "contains": { "const": "warehouse.view.read" } }, { "contains": { "const": "warehouse.table.append" } }, { "contains": { "const": "service.request" } }] },
+      "description": "Explicit user-mode operations eligible for automatic app access, subject to the connection operation ceiling and personal consent. Empty means review all; absent inherits company defaults or the existing userModeApproval migration rule. Governance validates provider and mode compatibility. Background execution still requires personal background consent, not a separate admin grant."
+    },
+    "reusableAccess": {
+      "type": "array", "maxItems": 128, "uniqueItems": true,
+      "items": { "$ref": "#/definitions/ReusableSaasAccess" },
+      "description": "Reusable permissions for admitted builders on explicit shared SaaS resources. Governance checks registered resources, provider/mode compatibility and the connection operation ceiling. Connection version and audit record changes; no per-entry approval metadata."
+    },
     "developmentPreapproval": { "$ref": "#/definitions/DevelopmentPreapproval" },
     "oauthClient": { "$ref": "#/definitions/SaasOauthClient" },
     "userModeApproval": { "$ref": "#/definitions/UserModeApproval" },
@@ -52,6 +63,7 @@
       "items": { "$ref": "integration-execute-request.schema.json#/definitions/EmailAddress" },
       "description": "Lower-cased emails who may approve an app's access requests for this connection, besides tenant admins. Empty or absent means tenant admins only."
     },
+    "startedBy": { "$ref": "#/definitions/StartedBy" },
     "createdAt": { "type": "string", "format": "date-time" },
     "updatedAt": { "type": "string", "format": "date-time" },
     "clientId": { "type": "string", "minLength": 1, "maxLength": 255, "deprecated": true, "description": "Deprecated (pre-T25 tenant-owned provider client). Dropped on read; never written." },
@@ -82,11 +94,35 @@
     }
   },
   "definitions": {
+    "ReusableSaasAccess": {
+      "type": "object", "additionalProperties": false,
+      "required": ["resource", "mode", "operations"],
+      "properties": {
+        "resource": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationAlias" },
+        "mode": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationIdentityMode" },
+        "operations": {
+          "type": "array", "minItems": 1, "maxItems": 78, "uniqueItems": true,
+          "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" },
+          "not": { "anyOf": [{ "contains": { "const": "warehouse.view.read" } }, { "contains": { "const": "warehouse.table.append" } }, { "contains": { "const": "service.request" } }] }
+        }
+      }
+    },
     "SaasProvider": {
       "type": "string",
       "enum": ["slack", "gmail", "basecamp", "sharepoint", "phone", "calendar", "drive", "docs", "sheets", "outlook", "onedrive", "excel", "teams"],
       "description": "Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`; SharePoint (0.78.0) is user-consent only, pinned to the company's Microsoft 365 tenant in `account`, with a site map in `channels`. Phone (0.82.0) is app mode only with no installation: the tenant's inbound SMS numbers (E.164) mapped from aliases in `channels`, and the SMS the platform received on them listed by phone.sms.list; since 0.83.0 an app reads the number an alias maps to with phone.number.get. Google Workspace (0.86.0, ADR 0032: calendar, drive, docs, sheets on the Google OAuth client) and Microsoft 365 (outlook, onedrive, excel, teams on the Microsoft client) are user-consent only like Gmail, one connection per provider with its own consent and scopes; the seven personal providers have no `account` and empty `channels` (their one fixed alias is the signed-in person's own calendar, drive, documents, spreadsheets, mailbox or workbooks); teams is pinned to the Microsoft 365 tenant in `account` like SharePoint and maps channel aliases in `channels`."
     },
+    "StartedBy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["email", "at"],
+      "description": "Set when a builder's first access request created this connection instead of IT (0.88.0, ADR 0034): who, when, and the app that asked. Such a connection is an ordinary ACTIVE connection whose `userModeApproval` starts as `it`, so development is granted by the development preapproval and production waits for IT's one decision; IT may relax the switch afterwards. Absent on connections IT created.",
+      "properties": {
+        "email": { "$ref": "integration-execute-request.schema.json#/definitions/EmailAddress", "description": "The builder's lower-cased company email." },
+        "at": { "type": "string", "format": "date-time" },
+        "appId": { "type": "string", "minLength": 1, "maxLength": 128, "description": "The app whose request created the connection, when known." }
+      }
+    },
     "BasecampAccount": {
       "type": "object",
       "additionalProperties": false,
@@ -367,7 +403,8 @@
       "channels": {},
       "operations": ["sheets.spreadsheet.read", "sheets.values.read", "sheets.values.append", "sheets.values.update", "sheets.values.clear", "sheets.spreadsheet.create"],
       "developmentPreapproval": { "enabled": true, "hours": 24 },
-      "userModeApproval": "automatic",
+      "userModeApproval": "it",
+      "startedBy": { "email": "builder@example.com", "at": "2026-10-17T08:00:00Z", "appId": "app-7f3a2c91" },
       "createdAt": "2026-10-17T08:00:00Z",
       "updatedAt": "2026-10-17T08:00:00Z"
     },