One-install Square front door preserving all 21 existing compatibility contracts, adding 277 operations across five bounded domain packs, and bundling 32 non-chat operating workflows. It admits 298 of 334 operations from immutable official OpenAPI commit f9ff8da9443ade43f823f9100f390b9797c1dcd6 at Square-Version 2026-07-15. The pack matches and executes only against the production origin https://connect.squareup.com; the separate Square sandbox origin is documented but not admitted. The explicit exclusions are 26 deprecated routes, three OAuth token-lifecycle routes, four multipart binary uploads, and three executable storefront-snippet routes. Coverage spans payments, refunds, checkout, cards, bank accounts, disputes, Terminal, catalog, inventory, orders, vendors, customers, loyalty, gift cards, bookings, workforce, locations, merchants, invoices, subscriptions, events, and webhooks. Existing root reads retain their 60-second cache and approval behavior; every new leaf mutation is grant-off and approval-gated, and every new leaf read is uncached. Unsafe response integers remain exact strings, nested int64 and provider-keyed-map request bodies use bounded raw JSON, and documented cursor collections walk automatically where the request can be composed safely. No write is hidden behind a read contract, no arbitrary passthrough exists, and no Square record is misrepresented as a task, note, or user-work project Source.