@fourier-labs/harbour-contracts 0.88.0 → 0.91.0

package/gen-ts/integration-operations.ts

@@ -735,5 +735,77 @@ export const IntegrationOperations = {
     "readOnly": false,
     "declaredMode": false,
     "idempotencyKey": false
+  },
+  "zohobooks.contact.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "zohobooks.purchaseorder.list": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "zohobooks.purchaseorder.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "zohobooks.bill.create": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "zohobooks.bill.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "zohobooks.invoice.create": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": false,
+    "declaredMode": false,
+    "idempotencyKey": true
+  },
+  "zohobooks.invoice.read": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
+  },
+  "zohobooks.invoice.pdf": {
+    "kind": "saas",
+    "identities": [
+      "user"
+    ],
+    "readOnly": true,
+    "declaredMode": false,
+    "idempotencyKey": false
   }
 } as const;

package/gen-ts/resolved-app-serving.ts

@@ -22,6 +22,10 @@ export interface ResolvedAppServing {
    * The platform cell (LLD §3.7) whose routing store and template distribution serve this app.
    */
   cellId?: string;
+  /**
+   * How the tenant's cells run the app's server (ADR 0035): `kubernetes`, the cluster cell, or `serverless`, the gateway service with Lambda Web Functions, which serves kit apps only. One choice per tenant, the same in every environment; governance copies it from the tenant's deployment destination, and build and Provision branch on it. Absent means kubernetes.
+   */
+  hosting?: 'kubernetes' | 'serverless';
   /**
    * The cell's CloudFront KeyValueStore ARN; equals edge.routingStoreArn unless the cell record names its own.
    */

package/gen-ts/saas-connection.ts

@@ -17,7 +17,8 @@ export type SaasProvider =
   | 'outlook'
   | 'onedrive'
   | 'excel'
-  | 'teams';
+  | 'teams'
+  | 'zohobooks';
 /**
  * DISABLED stops every app call immediately (details.code CONNECTION_DISABLED).
  */
@@ -72,7 +73,7 @@ export interface SaasConnection {
    * Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list; SharePoint (0.78.0): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create, sharepoint.item.update, sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read, sharepoint.file.upload; Google Workspace and Microsoft 365 (0.86.0): the calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operations of the connection's provider). Never warehouse.view.read. Phone (0.82.0): phone.sms.list; 0.83.0 adds phone.number.get. Seventy-eight SaaS operations in all since 0.86.0.
    *
    * @minItems 1
-   * @maxItems 78
+   * @maxItems 86
    */
   operations: (
     | 'slack.channel.history'
@@ -156,7 +157,117 @@ export interface SaasConnection {
     | 'warehouse.view.read'
     | 'warehouse.table.append'
     | 'service.request'
+    | 'zohobooks.contact.list'
+    | 'zohobooks.purchaseorder.list'
+    | 'zohobooks.purchaseorder.read'
+    | 'zohobooks.bill.create'
+    | 'zohobooks.bill.read'
+    | 'zohobooks.invoice.create'
+    | 'zohobooks.invoice.read'
+    | 'zohobooks.invoice.pdf'
   )[];
+  /**
+   * Explicit user-mode operations eligible for automatic app access, subject to the connection operation ceiling and personal consent. Empty means review all; absent inherits company defaults or the existing userModeApproval migration rule. Governance validates provider and mode compatibility. Background execution still requires personal background consent, not a separate admin grant.
+   *
+   * @maxItems 86
+   */
+  automaticUserOperations?: (
+    | 'slack.channel.history'
+    | 'slack.message.post'
+    | 'slack.message.update'
+    | 'slack.message.delete'
+    | 'slack.dm.send'
+    | 'slack.user.lookup'
+    | 'gmail.thread.list'
+    | 'gmail.thread.read'
+    | 'gmail.message.read'
+    | 'gmail.message.send'
+    | 'gmail.attachment.read'
+    | 'basecamp.project.list'
+    | 'basecamp.todolist.list'
+    | 'basecamp.todo.list'
+    | 'basecamp.todo.create'
+    | 'basecamp.todo.complete'
+    | 'basecamp.message.list'
+    | 'basecamp.message.post'
+    | 'basecamp.comment.list'
+    | 'basecamp.comment.post'
+    | 'basecamp.campfire.post'
+    | 'basecamp.people.list'
+    | 'sharepoint.list.list'
+    | 'sharepoint.item.list'
+    | 'sharepoint.item.create'
+    | 'sharepoint.item.update'
+    | 'sharepoint.drive.list'
+    | 'sharepoint.file.list'
+    | 'sharepoint.file.search'
+    | 'sharepoint.file.read'
+    | 'sharepoint.file.upload'
+    | 'phone.sms.list'
+    | 'phone.number.get'
+    | 'calendar.calendar.list'
+    | 'calendar.event.list'
+    | 'calendar.event.read'
+    | 'calendar.event.create'
+    | 'calendar.event.update'
+    | 'calendar.event.cancel'
+    | 'drive.file.list'
+    | 'drive.file.search'
+    | 'drive.file.read'
+    | 'drive.file.upload'
+    | 'drive.folder.create'
+    | 'docs.document.read'
+    | 'docs.document.create'
+    | 'docs.document.append'
+    | 'docs.text.replace'
+    | 'sheets.spreadsheet.read'
+    | 'sheets.values.read'
+    | 'sheets.values.append'
+    | 'sheets.values.update'
+    | 'sheets.values.clear'
+    | 'sheets.spreadsheet.create'
+    | 'outlook.message.list'
+    | 'outlook.message.read'
+    | 'outlook.attachment.read'
+    | 'outlook.message.send'
+    | 'outlook.message.reply'
+    | 'outlook.event.list'
+    | 'outlook.event.read'
+    | 'outlook.event.create'
+    | 'outlook.event.update'
+    | 'outlook.event.cancel'
+    | 'onedrive.file.list'
+    | 'onedrive.file.search'
+    | 'onedrive.file.read'
+    | 'onedrive.file.upload'
+    | 'onedrive.folder.create'
+    | 'excel.worksheet.list'
+    | 'excel.range.read'
+    | 'excel.range.update'
+    | 'excel.table.list'
+    | 'excel.row.add'
+    | 'excel.worksheet.add'
+    | 'teams.message.list'
+    | 'teams.message.post'
+    | 'teams.reply.post'
+    | 'warehouse.view.read'
+    | 'warehouse.table.append'
+    | 'service.request'
+    | 'zohobooks.contact.list'
+    | 'zohobooks.purchaseorder.list'
+    | 'zohobooks.purchaseorder.read'
+    | 'zohobooks.bill.create'
+    | 'zohobooks.bill.read'
+    | 'zohobooks.invoice.create'
+    | 'zohobooks.invoice.read'
+    | 'zohobooks.invoice.pdf'
+  )[];
+  /**
+   * Reusable permissions for admitted builders on explicit shared SaaS resources. Governance checks registered resources, provider/mode compatibility and the connection operation ceiling. Connection version and audit record changes; no per-entry approval metadata.
+   *
+   * @maxItems 128
+   */
+  reusableAccess?: ReusableSaasAccess[];
   developmentPreapproval: DevelopmentPreapproval;
   oauthClient?: SaasOauthClient;
   userModeApproval?: UserModeApproval;
@@ -203,6 +314,10 @@ export interface SaasConnection {
   installations?: {
     [k: string]: LegacySaasInstallation;
   };
+  /**
+   * Zoho data center. Chosen by the connection administrator, never by an app call.
+   */
+  region?: 'us' | 'in' | 'eu' | 'au' | 'jp' | 'ca' | 'sa' | 'cn' | 'ae';
 }
 /**
  * The one bot installation of the platform-owned provider app in this tenant's workspace.
@@ -240,6 +355,111 @@ export interface BasecampAccount {
    */
   name: string;
 }
+export interface ReusableSaasAccess {
+  /**
+   * Tenant-wide logical alias of a connection (governance sourceId) or of a resource under it.
+   */
+  resource: string;
+  /**
+   * Whose authority an operation runs under. Fixed per operation, except the declared-mode Slack operations (slack.message.post; since 0.71.0 also slack.channel.history, slack.message.update, slack.message.delete): declared per app for the access request, and named per call among the app's approved modes (execute request `mode`, 0.55.0).
+   */
+  mode: 'app' | 'user';
+  /**
+   * @minItems 1
+   * @maxItems 86
+   */
+  operations: (
+    | 'slack.channel.history'
+    | 'slack.message.post'
+    | 'slack.message.update'
+    | 'slack.message.delete'
+    | 'slack.dm.send'
+    | 'slack.user.lookup'
+    | 'gmail.thread.list'
+    | 'gmail.thread.read'
+    | 'gmail.message.read'
+    | 'gmail.message.send'
+    | 'gmail.attachment.read'
+    | 'basecamp.project.list'
+    | 'basecamp.todolist.list'
+    | 'basecamp.todo.list'
+    | 'basecamp.todo.create'
+    | 'basecamp.todo.complete'
+    | 'basecamp.message.list'
+    | 'basecamp.message.post'
+    | 'basecamp.comment.list'
+    | 'basecamp.comment.post'
+    | 'basecamp.campfire.post'
+    | 'basecamp.people.list'
+    | 'sharepoint.list.list'
+    | 'sharepoint.item.list'
+    | 'sharepoint.item.create'
+    | 'sharepoint.item.update'
+    | 'sharepoint.drive.list'
+    | 'sharepoint.file.list'
+    | 'sharepoint.file.search'
+    | 'sharepoint.file.read'
+    | 'sharepoint.file.upload'
+    | 'phone.sms.list'
+    | 'phone.number.get'
+    | 'calendar.calendar.list'
+    | 'calendar.event.list'
+    | 'calendar.event.read'
+    | 'calendar.event.create'
+    | 'calendar.event.update'
+    | 'calendar.event.cancel'
+    | 'drive.file.list'
+    | 'drive.file.search'
+    | 'drive.file.read'
+    | 'drive.file.upload'
+    | 'drive.folder.create'
+    | 'docs.document.read'
+    | 'docs.document.create'
+    | 'docs.document.append'
+    | 'docs.text.replace'
+    | 'sheets.spreadsheet.read'
+    | 'sheets.values.read'
+    | 'sheets.values.append'
+    | 'sheets.values.update'
+    | 'sheets.values.clear'
+    | 'sheets.spreadsheet.create'
+    | 'outlook.message.list'
+    | 'outlook.message.read'
+    | 'outlook.attachment.read'
+    | 'outlook.message.send'
+    | 'outlook.message.reply'
+    | 'outlook.event.list'
+    | 'outlook.event.read'
+    | 'outlook.event.create'
+    | 'outlook.event.update'
+    | 'outlook.event.cancel'
+    | 'onedrive.file.list'
+    | 'onedrive.file.search'
+    | 'onedrive.file.read'
+    | 'onedrive.file.upload'
+    | 'onedrive.folder.create'
+    | 'excel.worksheet.list'
+    | 'excel.range.read'
+    | 'excel.range.update'
+    | 'excel.table.list'
+    | 'excel.row.add'
+    | 'excel.worksheet.add'
+    | 'teams.message.list'
+    | 'teams.message.post'
+    | 'teams.reply.post'
+    | 'warehouse.view.read'
+    | 'warehouse.table.append'
+    | 'service.request'
+    | 'zohobooks.contact.list'
+    | 'zohobooks.purchaseorder.list'
+    | 'zohobooks.purchaseorder.read'
+    | 'zohobooks.bill.create'
+    | 'zohobooks.bill.read'
+    | 'zohobooks.invoice.create'
+    | 'zohobooks.invoice.read'
+    | 'zohobooks.invoice.pdf'
+  )[];
+}
 export interface DevelopmentPreapproval {
   /**
    * Auto-approve development requests within the allowlist.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.88.0",
+  "version": "0.91.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/app-integrations-declaration.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/app-integrations-declaration.schema.json",
   "title": "AppIntegrationsDeclaration",
-  "description": "Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (eighty-one operations since 0.86.0, ADR 0018, ADR 0022, ADR 0024, ADR 0028, ADR 0029 and ADR 0032). Each operation carries a fixed identity mode \u2014 slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, every basecamp.* operation=user, every sharepoint.* operation=user, every calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operation=user (0.86.0), warehouse.view.read=app, service.request=app \u2014 except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) \u2014 a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack, Gmail, Basecamp, SharePoint, phone, Google Workspace (calendar, drive, docs, sheets) and Microsoft 365 (outlook, onedrive, excel, teams) operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. Basecamp (0.76.0, ADR 0022) is user-mode only too: basecamp.project.list runs on the fixed `account` alias (the company's pinned Basecamp account) and every other basecamp.* operation on a project alias IT mapped in the connection's `channels` map, so Basecamp itself refuses an id outside that project. SharePoint (0.78.0, ADR 0024) is user-mode only as well: every sharepoint.* operation runs on a site alias IT mapped in the connection's `channels` map (a Microsoft Graph site id), so Graph itself refuses a list, item or file outside that site. Google Workspace and Microsoft 365 (0.86.0, ADR 0032) are user-mode only too: every calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.* and excel.* operation runs on the provider's one fixed alias for the signed-in person's own data (governance resolves it, the way Gmail's is `inbox`; the contract does not pin the literal), and every teams.* operation on a channel alias IT mapped in the connection's `channels` map (a Teams team and channel id), so Graph itself refuses a message outside that channel. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.",
+  "description": "Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (eighty-one operations since 0.86.0, ADR 0018, ADR 0022, ADR 0024, ADR 0028, ADR 0029 and ADR 0032). Each operation carries a fixed identity mode — slack.dm.send=app, slack.user.lookup=app, every gmail.* operation=user, every basecamp.* operation=user, every sharepoint.* operation=user, every calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operation=user (0.86.0), warehouse.view.read=app, service.request=app — except the declared-mode Slack operations (slack.message.post, and since 0.71.0 slack.channel.history, slack.message.update and slack.message.delete), whose mode the app DECLARES: `app` acts as the company's Slack app (the one audited bot identity; a post goes out under the IT-approved per-app display name when the connection declares `presentation`), `user` acts as the signed-in person after their own consent (reads what they can read, edits what they wrote). The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each declared-mode call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack, Gmail, Basecamp, SharePoint, phone, Google Workspace (calendar, drive, docs, sheets) and Microsoft 365 (outlook, onedrive, excel, teams) operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads, one send); its single resource is the fixed `inbox` alias. Basecamp (0.76.0, ADR 0022) is user-mode only too: basecamp.project.list runs on the fixed `account` alias (the company's pinned Basecamp account) and every other basecamp.* operation on a project alias IT mapped in the connection's `channels` map, so Basecamp itself refuses an id outside that project. SharePoint (0.78.0, ADR 0024) is user-mode only as well: every sharepoint.* operation runs on a site alias IT mapped in the connection's `channels` map (a Microsoft Graph site id), so Graph itself refuses a list, item or file outside that site. Google Workspace and Microsoft 365 (0.86.0, ADR 0032) are user-mode only too: every calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.* and excel.* operation runs on the provider's one fixed alias for the signed-in person's own data (governance resolves it, the way Gmail's is `inbox`; the contract does not pin the literal), and every teams.* operation on a channel alias IT mapped in the connection's `channels` map (a Teams team and channel id), so Graph itself refuses a message outside that channel. slack.dm.send and slack.user.lookup address people by email rather than a channel, so their single resource is the fixed `workspace` alias (the connection's installed workspace), the way Gmail's is `inbox`. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -35,12 +35,12 @@
     "BasecampId": {
       "type": "string",
       "pattern": "^[0-9]{1,20}$",
-      "description": "A Basecamp id (0.76.0): an account, project, to-do list, to-do, recording or person, as a string of 1..20 digits \u2014 how every basecamp.* result names one and every basecamp.* input takes one back."
+      "description": "A Basecamp id (0.76.0): an account, project, to-do list, to-do, recording or person, as a string of 1..20 digits — how every basecamp.* result names one and every basecamp.* input takes one back."
     },
     "GraphId": {
       "type": "string",
       "pattern": "^[A-Za-z0-9!._,=-]{1,256}$",
-      "description": "A Microsoft Graph id (0.78.0): a SharePoint list (a GUID), list item (digits), drive (`b!...`) or drive item, as Graph names it \u2014 opaque, 1..256 characters of letters, digits and `!._,=-`. How every sharepoint.* result names one and every sharepoint.* input takes one back."
+      "description": "A Microsoft Graph id (0.78.0): a SharePoint list (a GUID), list item (digits), drive (`b!...`) or drive item, as Graph names it — opaque, 1..256 characters of letters, digits and `!._,=-`. How every sharepoint.* result names one and every sharepoint.* input takes one back."
     },
     "IntegrationConnectionKind": {
       "type": "string",
@@ -133,9 +133,17 @@
         "teams.reply.post",
         "warehouse.view.read",
         "warehouse.table.append",
-        "service.request"
+        "service.request",
+        "zohobooks.contact.list",
+        "zohobooks.purchaseorder.list",
+        "zohobooks.purchaseorder.read",
+        "zohobooks.bill.create",
+        "zohobooks.bill.read",
+        "zohobooks.invoice.create",
+        "zohobooks.invoice.read",
+        "zohobooks.invoice.pdf"
       ],
-      "description": "Closed operation set. Extending it is a contracts change. 0.86.0 (ADR 0032) adds the forty-five Google Workspace and Microsoft 365 operations, every one user mode only: on the provider's fixed alias for the signed-in person's own data, calendar.calendar.list, calendar.event.list, calendar.event.read, calendar.event.create (a receipted write: explicit action, idempotencyKey), calendar.event.update and calendar.event.cancel (idempotent at Google, no key); drive.file.list, drive.file.search, drive.file.read, drive.file.upload and drive.folder.create (receipted writes); docs.document.read, docs.document.create (receipted), docs.document.append and docs.text.replace (no key); sheets.spreadsheet.read, sheets.values.read, sheets.values.append (receipted), sheets.values.update and sheets.values.clear (no key), sheets.spreadsheet.create (receipted); outlook.message.list, outlook.message.read, outlook.attachment.read, outlook.message.send and outlook.message.reply (receipted sends, as gmail.message.send), outlook.event.list, outlook.event.read, outlook.event.create (receipted), outlook.event.update and outlook.event.cancel (no key); onedrive.file.list, onedrive.file.search, onedrive.file.read, onedrive.file.upload and onedrive.folder.create (receipted); excel.worksheet.list, excel.range.read, excel.range.update (no key), excel.table.list, excel.row.add and excel.worksheet.add (receipted); and on a Teams channel alias (a key of the connection's `channels` map) teams.message.list, teams.message.post and teams.reply.post (receipted). 0.78.0 (ADR 0024) adds the nine SharePoint operations, every one user mode only on a site alias (a key of the connection's `channels` map, holding a Microsoft Graph site id): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create (a receipted write: explicit action, idempotencyKey), sharepoint.item.update (a PATCH, idempotent at Graph, no key), sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read and sharepoint.file.upload (a receipted write). 0.76.0 (ADR 0022) adds the eleven Basecamp operations, every one user mode only like gmail.*: basecamp.project.list (the projects of the company's pinned Basecamp account; its resource is the fixed `account` alias), and on one mapped project (the resource is a project alias, a key of the connection's `channels` map) basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create (a receipted write: explicit action, idempotencyKey), basecamp.todo.complete (idempotent at Basecamp, no key), basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post (the three posts are receipted writes) and basecamp.people.list. gmail.message.send (0.50.0) sends one email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity; since 0.71.0 it may carry an HTML body and attachments. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent); since 0.55.0 each call names which of the approved modes it runs under. 0.71.0 (ADR 0018) adds slack.message.update and slack.message.delete (declared mode, like post), slack.dm.send (app mode: a direct message to 1..8 workspace members named by email), slack.user.lookup (app mode: email to Slack user id), gmail.thread.read (every message of one thread) and gmail.attachment.read (one attachment's bytes), and lets slack.channel.history run in app mode as well as user mode. 0.82.0 (ADR 0028) adds phone.sms.list (app mode only, a number alias from a phone connection's `channels` map: the SMS received on that number since a time) and warehouse.table.append (app mode only on a database connection, a receipted write with idempotencyKey: rows appended to a view alias whose mapping says `access: append`). 0.83.0 (ADR 0029) adds phone.number.get (app mode only, read-only, no input, on a number alias from a phone connection's `channels` map: the E.164 number that alias maps to, so the app \u2014 or a computer-use agent it drives \u2014 can type it into a portal that signs in by mobile number). 0.85.0 (ADR 0031) raises warehouse.table.append's `rows` from 1..500 to 1..5000 records (the byte cap stays governance's, now 8 MiB), so a downloaded report of a few thousand rows lands in one call."
+      "description": "Closed operation set. Extending it is a contracts change. 0.86.0 (ADR 0032) adds the forty-five Google Workspace and Microsoft 365 operations, every one user mode only: on the provider's fixed alias for the signed-in person's own data, calendar.calendar.list, calendar.event.list, calendar.event.read, calendar.event.create (a receipted write: explicit action, idempotencyKey), calendar.event.update and calendar.event.cancel (idempotent at Google, no key); drive.file.list, drive.file.search, drive.file.read, drive.file.upload and drive.folder.create (receipted writes); docs.document.read, docs.document.create (receipted), docs.document.append and docs.text.replace (no key); sheets.spreadsheet.read, sheets.values.read, sheets.values.append (receipted), sheets.values.update and sheets.values.clear (no key), sheets.spreadsheet.create (receipted); outlook.message.list, outlook.message.read, outlook.attachment.read, outlook.message.send and outlook.message.reply (receipted sends, as gmail.message.send), outlook.event.list, outlook.event.read, outlook.event.create (receipted), outlook.event.update and outlook.event.cancel (no key); onedrive.file.list, onedrive.file.search, onedrive.file.read, onedrive.file.upload and onedrive.folder.create (receipted); excel.worksheet.list, excel.range.read, excel.range.update (no key), excel.table.list, excel.row.add and excel.worksheet.add (receipted); and on a Teams channel alias (a key of the connection's `channels` map) teams.message.list, teams.message.post and teams.reply.post (receipted). 0.78.0 (ADR 0024) adds the nine SharePoint operations, every one user mode only on a site alias (a key of the connection's `channels` map, holding a Microsoft Graph site id): sharepoint.list.list, sharepoint.item.list, sharepoint.item.create (a receipted write: explicit action, idempotencyKey), sharepoint.item.update (a PATCH, idempotent at Graph, no key), sharepoint.drive.list, sharepoint.file.list, sharepoint.file.search, sharepoint.file.read and sharepoint.file.upload (a receipted write). 0.76.0 (ADR 0022) adds the eleven Basecamp operations, every one user mode only like gmail.*: basecamp.project.list (the projects of the company's pinned Basecamp account; its resource is the fixed `account` alias), and on one mapped project (the resource is a project alias, a key of the connection's `channels` map) basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create (a receipted write: explicit action, idempotencyKey), basecamp.todo.complete (idempotent at Basecamp, no key), basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post (the three posts are receipted writes) and basecamp.people.list. gmail.message.send (0.50.0) sends one email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity; since 0.71.0 it may carry an HTML body and attachments. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent); since 0.55.0 each call names which of the approved modes it runs under. 0.71.0 (ADR 0018) adds slack.message.update and slack.message.delete (declared mode, like post), slack.dm.send (app mode: a direct message to 1..8 workspace members named by email), slack.user.lookup (app mode: email to Slack user id), gmail.thread.read (every message of one thread) and gmail.attachment.read (one attachment's bytes), and lets slack.channel.history run in app mode as well as user mode. 0.82.0 (ADR 0028) adds phone.sms.list (app mode only, a number alias from a phone connection's `channels` map: the SMS received on that number since a time) and warehouse.table.append (app mode only on a database connection, a receipted write with idempotencyKey: rows appended to a view alias whose mapping says `access: append`). 0.83.0 (ADR 0029) adds phone.number.get (app mode only, read-only, no input, on a number alias from a phone connection's `channels` map: the E.164 number that alias maps to, so the app — or a computer-use agent it drives — can type it into a portal that signs in by mobile number). 0.85.0 (ADR 0031) raises warehouse.table.append's `rows` from 1..500 to 1..5000 records (the byte cap stays governance's, now 8 MiB), so a downloaded report of a few thousand rows lands in one call."
     },
     "IntegrationIdentityMode": {
       "type": "string",
@@ -160,7 +168,7 @@
       "required": [
         "displayName"
       ],
-      "description": "How an app's app-mode Slack posts are presented (0.53.0): the display name and optional icon the platform bot posts under, so each app's posts are distinguishable while the bot stays the one audited identity. Declared by the app, shown to IT on the access request (\"posts as\"), copied onto the approved grant and applied only from there \u2014 a call can never name itself. Needs the Slack app scope chat:write.customize on the tenant's installation; without it the post goes out under the bot's own name and the receipt says so.",
+      "description": "How an app's app-mode Slack posts are presented (0.53.0): the display name and optional icon the platform bot posts under, so each app's posts are distinguishable while the bot stays the one audited identity. Declared by the app, shown to IT on the access request (\"posts as\"), copied onto the approved grant and applied only from there — a call can never name itself. Needs the Slack app scope chat:write.customize on the tenant's installation; without it the post goes out under the bot's own name and the receipt says so.",
       "properties": {
         "displayName": {
           "type": "string",
@@ -234,7 +242,7 @@
         "identity",
         "resources"
       ],
-      "description": "Every gmail.* operation (resource: the fixed `inbox` alias), since 0.76.0 every basecamp.* operation (resource: a project alias from the connection's `channels` map, or the fixed `account` alias for basecamp.project.list), since 0.78.0 every sharepoint.* operation (resource: a site alias from the connection's `channels` map) and since 0.86.0 every calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operation (resource: the provider's fixed alias for the person's own data, or for teams.* a channel alias from the connection's `channels` map): user mode only \u2014 the app acts as the signed-in person after their own consent.",
+      "description": "Every gmail.* operation (resource: the fixed `inbox` alias), since 0.76.0 every basecamp.* operation (resource: a project alias from the connection's `channels` map, or the fixed `account` alias for basecamp.project.list), since 0.78.0 every sharepoint.* operation (resource: a site alias from the connection's `channels` map) and since 0.86.0 every calendar.*, drive.*, docs.*, sheets.*, outlook.*, onedrive.*, excel.* and teams.* operation (resource: the provider's fixed alias for the person's own data, or for teams.* a channel alias from the connection's `channels` map): user mode only — the app acts as the signed-in person after their own consent.",
       "properties": {
         "identity": {
           "type": "string",
@@ -252,7 +260,7 @@
         "identity",
         "resources"
       ],
-      "description": "slack.message.post, slack.channel.history, slack.message.update, slack.message.delete: the app declares the mode \u2014 app (acts as the company's Slack app) or user (acts as the signed-in person).",
+      "description": "slack.message.post, slack.channel.history, slack.message.update, slack.message.delete: the app declares the mode — app (acts as the company's Slack app) or user (acts as the signed-in person).",
       "properties": {
         "identity": {
           "$ref": "#/definitions/IntegrationIdentityMode"
@@ -269,7 +277,7 @@
         "identity",
         "resources"
       ],
-      "description": "slack.dm.send, slack.user.lookup (0.71.0): app mode only \u2014 the company's Slack app messages people or resolves them by email; the resource is the fixed `workspace` alias.",
+      "description": "slack.dm.send, slack.user.lookup (0.71.0): app mode only — the company's Slack app messages people or resolves them by email; the resource is the fixed `workspace` alias.",
       "properties": {
         "identity": {
           "type": "string",
@@ -567,6 +575,30 @@
             },
             "service.request": {
               "$ref": "#/definitions/ServiceOperation"
+            },
+            "zohobooks.contact.list": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "zohobooks.purchaseorder.list": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "zohobooks.purchaseorder.read": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "zohobooks.bill.create": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "zohobooks.bill.read": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "zohobooks.invoice.create": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "zohobooks.invoice.read": {
+              "$ref": "#/definitions/UserModeChannelOperation"
+            },
+            "zohobooks.invoice.pdf": {
+              "$ref": "#/definitions/UserModeChannelOperation"
             }
           }
         }
@@ -1013,6 +1045,46 @@
                       "required": [
                         "service.request"
                       ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.contact.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.purchaseorder.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.purchaseorder.read"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.bill.create"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.bill.read"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.invoice.create"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.invoice.read"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.invoice.pdf"
+                      ]
                     }
                   ]
                 }
@@ -1437,6 +1509,46 @@
                       "required": [
                         "warehouse.table.append"
                       ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.contact.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.purchaseorder.list"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.purchaseorder.read"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.bill.create"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.bill.read"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.invoice.create"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.invoice.read"
+                      ]
+                    },
+                    {
+                      "required": [
+                        "zohobooks.invoice.pdf"
+                      ]
                     }
                   ]
                 }

package/schema/data-grant-v2.schema.json

@@ -17,7 +17,7 @@
     "status": { "$ref": "#/definitions/DataGrantV2Status" },
     "operations": {
       "type": "array",
-      "maxItems": 78,
+      "maxItems": 86,
       "uniqueItems": true,
       "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" },
       "description": "Approved operations; each must match this grant's mode. Empty until the first approval. At most the seventy-eight SaaS operations (0.86.0: eleven Slack and Gmail, eleven Basecamp, nine SharePoint, two phone, forty-five Google Workspace and Microsoft 365); a database grant holds up to two (warehouse.view.read, warehouse.table.append)."
@@ -29,6 +29,7 @@
       "items": { "$ref": "#/definitions/IntegrationResource" },
       "description": "Approved logical resources. Never inherited by wildcard. Empty until the first approval."
     },
+    "reviewedScope": { "$ref": "#/definitions/ReviewedIntegrationScope" },
     "expiresAt": { "type": "string", "format": "date-time", "description": "Absent only for explicitly approved ongoing production access." },
     "expiredAt": { "type": "string", "format": "date-time", "description": "Set by the recovery sweep once expiry has passed; enforcement itself is the UTC check on every call." },
     "approvedBy": { "type": "string", "minLength": 1, "maxLength": 255 },
@@ -58,6 +59,21 @@
     }
   },
   "definitions": {
+    "ReviewedIntegrationScope": {
+      "type": "object", "additionalProperties": false,
+      "required": ["operations", "resources"],
+      "description": "Only for SaaS grants mixing reviewed and automatic access: the previously human-reviewed scope. The remaining scope must satisfy current automatic rules. Homogeneous grants continue using approvedBy alone. Governance validates this is a subset of the grant; database behaviour is unchanged.",
+      "properties": {
+        "operations": {
+          "type": "array", "maxItems": 86, "uniqueItems": true,
+          "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" }
+        },
+        "resources": {
+          "type": "array", "maxItems": 64, "uniqueItems": true,
+          "items": { "$ref": "#/definitions/IntegrationResource" }
+        }
+      }
+    },
     "IntegrationResource": {
       "type": "object",
       "additionalProperties": false,