Xero file metadata, isolated file downloads, folders, and accounting-object associations. Generated from Xero's official OpenAPI repository at immutable commit e952d0bda3628facbf7afc5990ad6a0e7e77bd1e; the exact xero_files.yaml bytes are SHA-256 pinned. Every tenant-scoped call exposes the required Xero-tenant-id as an explicit approval-bound header argument; OAuth credentials, Authorization, and API authority are never caller inputs. Reads are uncached; all mutations are grant-off and require approval every run. JSON responses preserve unsafe integer literals as exact strings. The two multipart upload routes are explicitly excluded because the current REST adapter cannot emit binary multipart bodies; file content downloads are captured as isolated file_ref values. No work-entity Source is declared because the official response contracts do not guarantee both a mandatory stable identity and a mandatory version field for an honest task, note, or project projection.