@jskit-ai/connectors-catalog 0.1.1

package/docs/mapbox.md

@@ -0,0 +1,174 @@
+# Mapbox
+
+Import `mapboxProvider` from `@jskit-ai/connectors-catalog/server/mapbox`.
+This fragment verifies a backend token and performs forward/reverse geocoding.
+Browser maps may use a separate public-token reference in the same configuration.
+
+## Manual provider setup
+
+1. Sign into Mapbox and open **Access Tokens** in Developer Console.
+2. Choose **Create a token** and name it for the application/environment.
+   Copy a secret token immediately: Mapbox shows it only once.
+   Select only the scopes needed by the intended APIs. Geocoding accepts a
+   public token; secret scopes produce a private token that stays on the server.
+3. Store the backend token as `MAPBOX_BACKEND_TOKEN`. In Vibe64, enter
+   `env:MAPBOX_BACKEND_TOKEN` in **Backend access token reference**.
+4. For browser maps, create a separate public token with the map scopes the
+   chosen SDK requires, including `styles:read` and `fonts:read` for styled maps. Add its allowed application URLs and store it as
+   `MAPBOX_PUBLIC_TOKEN`; enter `env:MAPBOX_PUBLIC_TOKEN` in the optional field.
+5. **Save configuration**, then use **Set credential in Env** for
+   `MAPBOX_BACKEND_TOKEN`. Use **Open Env** to store `MAPBOX_PUBLIC_TOKEN` if
+   supplied. Token values belong in Env, not the reference fields.
+6. **Connect account** verifies the backend token through the application runtime.
+   It does not render a map, test geocoding entitlement or validate the optional
+   browser token. No OAuth registration or callback is involved.
+7. To rotate, create a replacement token, update Env and verify again before
+   deleting the old token in Mapbox. Redeploy browser configuration when its
+   public token changes. Local disconnect does not delete provider tokens.
+
+URL-restricted tokens can return 403 for backend or CLI requests with no
+matching referrer. Use a backend token appropriate for server calls; the runtime
+does not fabricate a browser referrer. The default public token cannot have URL
+restrictions added. Create a separate token for a restricted browser deployment.
+[Token management](https://docs.mapbox.com/accounts/guides/tokens/).
+
+## Portable configuration and runtime
+
+```json
+{
+  "schemaVersion": 1,
+  "registrations": {},
+  "integrations": {
+    "maps": {
+      "provider": "mapbox",
+      "displayName": "Places",
+      "accountMode": "shared",
+      "scopes": [],
+      "authentication": { "method": "api-key", "secretRef": "env:MAPBOX_BACKEND_TOKEN" },
+      "settings": { "publicTokenRef": "env:MAPBOX_PUBLIC_TOKEN" }
+    }
+  }
+}
+```
+
+Compose the [API-key pattern](../patterns/api-key-connection/PATTERN.md) with
+this provider and an application authorization policy. The file store uses
+private text files outside source; the CLI does not need an editor or database.
+
+```js
+await connections.connectApiKey({ context, integrationId: "maps" });
+const places = await connections.invoke({
+  context, integrationId: "maps", operation: "geocoding.forward",
+  input: { q: "Perth", limit: 5 }
+});
+const address = await connections.invoke({
+  context, integrationId: "maps", operation: "geocoding.reverse",
+  input: { longitude: 115.86, latitude: -31.95 }
+});
+```
+
+`token.read` calls `GET /tokens/v2?access_token=...`. Mapbox returns a parsed
+token and a validity code. Invalid, expired or revoked tokens can arrive with
+HTTP 200; the adapter rejects those codes and records reconnection when an
+existing connection becomes invalid. Token validity does not establish access
+to every Mapbox API. The returned token description is not an application login.
+[Token verification](https://docs.mapbox.com/api/accounts/tokens/).
+
+Geocoding uses `/search/geocode/v6/forward` and `/reverse`, preserving the
+GeoJSON feature collection and attribution. Forward queries have a 256-character,
+20-word/number limit and cannot contain semicolons. The result limit is 1–10.
+Reverse queries require longitude and latitude. `permanent: true` declares an
+intent to retain results and requires the appropriate provider account terms;
+temporary results must not be stored as permanent application data.
+[Geocoding API](https://docs.mapbox.com/api/search/geocoding/).
+
+Local defaults are limit 5, autocomplete off and permanent off. Reverse inputs
+are bounded to longitude ±180 and latitude ±90. Empty feature collections are
+valid. This fragment omits batch requests, structured addresses, routing,
+map rendering and advanced filters. It performs no geocoding during token
+verification and does not automatically store query results.
+
+Only the primary backend reference is resolved by connection verification and
+operations. The optional browser reference is preserved in source and never
+silently resolved, checked or substituted by this service. A public token can
+be the primary backend token if its restrictions permit server calls, so a
+secret token is not mandatory. An application that renders maps deliberately
+resolves and publishes its separate browser token; it must never publish a
+secret token. Clearing the optional reference removes it from saved JSON.
+
+The runtime retains references, not token values. Rotation updates the binding;
+a configuration change requires verification again. Failures use safe connector
+errors and do not expose credential query strings. Disconnect is local and does
+not delete Mapbox tokens. Redact authenticated URLs in HTTP logs.
+
+## API provisioning and application ownership
+
+The Tokens API supports creating tokens with `POST /tokens/v2/{username}`,
+using an existing token with `tokens:write`. Supply a descriptive `note`, the
+needed `scopes` and, for browser tokens, `allowedUrls`. The creating credential
+cannot grant scopes it does not hold. An AI can prepare creation/update/rotation
+requests after an authorized operator supplies bootstrap access. Account signup
+and billing are separate; the normal geocoding adapter exposes no token-writing
+operation. [Token creation](https://docs.mapbox.com/api/accounts/tokens/).
+
+Use separate browser and backend tokens owned by the application. Mapbox's API guide
+describes rate limits per access token; account billing and contractual capacity
+are still separate concerns. Application budgets and the desired account-level
+isolation must be explicit. Two token names do not create two billing accounts.
+[API limits](https://docs.mapbox.com/api/guides/).
+
+For browser restrictions, allow the actual deployed application and preview
+origins. A per-user editor VM domain is not necessarily the origin of the app
+that loads the map. Mapbox does not accept wildcard characters in these
+restrictions; consult its matching rules when adding subdomains or custom
+domains. No OAuth callback is involved in these token operations.
+
+## Focused evidence
+
+Six fixture tests cover file restart, rotation, ownership, optional references,
+HTTP-200 validity failures, coordinates, query bounds, attribution, permanent
+intent and permission/quota failures. The editor test covers both reference
+fields, invalid raw values, save/reload and removing the optional value.
+No live Mapbox account, geocoding use or generated application is exercised.
+
+## Browser-only maps and native SDK composition
+
+Select **Browser maps only** for `settings.usage: "browser"`, authentication
+`{ "method": "none" }` and required `settings.publicTokenRef`. This means no
+server account grant: the public token still comes from that project Env reference.
+Backend mode uses `settings.usage: "backend"` and its normal API-key reference.
+The editor omits connection commands in browser-only mode. Resolve only the
+selected public reference, reject a value that does not start with `pk.`, and
+expose it as deliberate browser configuration. Do not copy all Env values.
+
+The app installs Mapbox GL JS using its framework package workflow, imports
+`mapbox-gl/dist/mapbox-gl.css`, and supplies a visible container with a height.
+The following goes in its existing mount/unmount lifecycle, not in Vibe64:
+
+```js
+const map = new mapboxgl.Map({ container: mapElement,
+  accessToken: publicConfiguration.mapboxToken,
+  center: [115.86, -31.95], zoom: 12 });
+map.on("error", showMapError);
+// On view teardown: map.remove();
+```
+
+The app supplies the SDK import, element, public configuration and error handler.
+Preserve SDK attribution. JSKIT CLI apps and other frameworks use the same source
+contract with native frontend composition; neither requires an editor runtime.
+[Map composition](https://docs.mapbox.com/mapbox-gl-js/example/simple-map/).
+
+## Routes
+
+Backend `directions.get` accepts `profile` (driving, driving-traffic, walking or
+cycling), 2–25 `coordinates` objects with longitude/latitude, and optional `steps`.
+It returns GeoJSON route geometry, distance in metres and duration in seconds.
+Treat `NoRoute` and `NoSegment` as unavailable routes, not successful directions.
+Draw successful geometry with the app's existing GeoJSON line layer; the app
+controls destination input, location permission and route refresh frequency.
+[Directions API](https://docs.mapbox.com/api/navigation/directions/).
+
+**LIMITATIONS:** No map editor, navigation UI, offline tiles, automatic SDK install
+or editor-tool attachment. Example: calculate a walking route and draw it in an
+app-owned map, but not run a turn-by-turn navigation product from this connector.
+Native map mounting is documented, not executed as a generated app.

package/docs/microsoft-excel.md

@@ -0,0 +1,97 @@
+# Microsoft Excel
+
+Provider ID `microsoft-excel`; export `microsoftExcelProvider` from
+`@jskit-ai/connectors-catalog/server/microsoft-excel`.
+
+Follow all [Microsoft registration steps](microsoft-oauth.md). Choose the
+organizational + personal account audience. In **API permissions → Microsoft
+Graph → Delegated permissions**, add **`Files.Read`** and `offline_access` for file browsing and verification.
+Add **`Files.ReadWrite`** for worksheet access.
+Microsoft's worksheet-list reference currently requires this permission even
+for a GET, and lists delegated organizational and personal accounts as supported.
+Application-only permission is unsupported for this operation. The form makes
+the broader permission explicit. [Worksheet API](https://learn.microsoft.com/en-us/graph/api/workbook-list-worksheets?view=graph-rest-1.0).
+
+Use an existing accessible Excel workbook in the signed-in user's drive. Obtain
+its drive item ID from your app's file picker or drive listing; this is not a
+share URL or the worksheet ID. Connection verification lists the drive root and needs no workbook ID.
+`items.list` accepts an optional `folderId` and bounded `pageSize` (default 25,
+maximum 100). Its returned `id` supplies `worksheets.list`'s `itemId`; do not use
+a sharing URL or worksheet ID. Missing or malformed worksheet IDs fail before
+transport. Files.Read-only connections can browse but cannot list worksheets.
+The form includes the captured optional Files.Read.All and Files.ReadWrite.All
+permissions; the runtime requires the operation's explicit Files.Read or
+Files.ReadWrite grant and does not infer one permission from another.
+
+`worksheets.list` calls
+`/v1.0/me/drive/items/{itemId}/workbook/worksheets`. Its required `itemId` and
+optional `nextLink` are validated. It returns the worksheet `value` collection.
+The adapter also exposes bounded range reads/updates and explicit workbook sessions, described below.
+
+AI provisioning is **API-capable after operator authorization**: create the
+registration and secret using the common guide, with the permission above.
+The AI can prepare the resource input and JSON, but cannot grant access to a
+workbook the user does not own or cannot open. The application owner supplies
+its registration and private Env bindings; shared tenant limits still apply.
+
+The common guide gives console navigation, ownership and file-store composition.
+Automated tests cover ID validation, delegated scope, verification read,
+pagination resource binding, cancellation, refresh and encrypted restart.
+Live workbook use and application generation are outside this delivery.
+
+## Editor and CLI handoff
+
+The screen includes app-registration navigation, audience/tenant selection,
+Web callback registration, delegated permissions and one-time secret **Value**.
+Save the references `env:MICROSOFT_EXCEL_CLIENT_SECRET` and
+`env:MICROSOFT_EXCEL_CALLBACK_URL`; use **Set credential in Env** and **Open Env**
+to supply their values. The callback must exactly match the app's registered Web
+redirect URI and its implemented backend route. Shared/assistant mode connects
+one project account; per-user mode requires each app user to authorize separately.
+Microsoft connection does not establish application login.
+
+After connection, the same JSKIT service can browse and read worksheet metadata:
+
+```js
+const files = await connections.invoke({ context, integrationId: "excel",
+  operation: "items.list", input: { pageSize: 25 } });
+// Select an accessible Excel workbook's id from the result (or browse folderId).
+const sheets = await connections.invoke({ context, integrationId: "excel",
+  operation: "worksheets.list", input: { itemId: selectedWorkbookId } });
+```
+
+File browsing returns folders and other file types too. The framework owns the
+picker and decides which workbook to open. No file ID is requested before OAuth.
+Connection success proves drive-list access, not worksheet support or access to
+every workbook. The worksheet API still requires Files.ReadWrite; range updates explicitly edit cells. Laravel implements its own Graph integration and reads
+its own environment; it does not depend on the JavaScript runtime.
+
+## Cell operations and sessions
+
+Use `ranges.get` with `{ itemId, worksheetId, address: "A1:B1" }`.
+Use `ranges.update` with the same inputs plus exactly one of
+`values: [[2, 3]]` or `formulas: [["=SUM(C1:C3)", null]]`.
+Matrices must exactly match the address, with at most 10,000 cells. Null leaves
+the corresponding cell unchanged. Files.ReadWrite is required even for reading.
+The application owns workbook/worksheet selection, cell-edit authorization and
+presentation; Vibe64 only configures credentials. CLI applications use the same
+connection service without Vibe64; another framework calls Graph itself.
+
+For a work/school account, call `sessions.create` with
+`{ itemId, persistChanges: true }` and pass returned `id` as `sessionId` to range
+calls. Use false for a temporary analysis copy. Close using `sessions.close`
+with `{ itemId, sessionId }` in cleanup. Calls without a session persist edits.
+Never silently create a persistent replacement for an expired temporary session.
+Do not blindly retry uncertain writes; read the affected cells and let the app
+resolve uncertainty. Formula text is app-approved content, not trusted instructions.
+
+**LIMITATIONS:** Synchronous session creation only; asynchronous 202 responses
+are not claimed as sessions. No workbook creation, formatting editor, charts,
+pivot tables or editor assistant attachment. Example: update a budget and formula,
+but no spreadsheet designer appears. Microsoft documents personal-account range
+permissions but excludes personal accounts from session close; use work/school
+for the session workflow. No live workbook or generated-app proof.
+
+References: [range updates](https://learn.microsoft.com/en-us/graph/api/range-update?view=graph-rest-1.0),
+[create session](https://learn.microsoft.com/en-us/graph/api/workbook-createsession?view=graph-rest-1.0),
+[close session](https://learn.microsoft.com/en-us/graph/api/workbook-closesession?view=graph-rest-1.0).

package/docs/microsoft-fabric.md

@@ -0,0 +1,249 @@
+# Microsoft Fabric
+
+This fragment connects one existing **API for GraphQL** in the global Microsoft
+Fabric service. It supports a confidential user-consent registration and a service
+principal. It does not create a workspace, lakehouse, database, data pipeline or
+application login. Both CLI and editor use the configurations below.
+
+## Choose the identity
+
+| Choice | Token request | Permission and ownership |
+| --- | --- | --- |
+| User consent | Authorization code with PKCE; client secret sent by the backend | `https://analysis.windows.net/powerbi/api/GraphQLApi.Execute.All`, optional `offline_access`; shared, assistant or per-user connection |
+| Service account | Client credentials; no browser or refresh token | `https://api.fabric.microsoft.com/.default`; shared or assistant connection |
+
+The two resource scopes are deliberately different. Microsoft documents the
+[delegated scope](https://learn.microsoft.com/en-us/fabric/data-engineering/connect-apps-api-graphql)
+and [service principal scope](https://learn.microsoft.com/en-us/fabric/data-engineering/api-graphql-service-principal)
+separately. Neither is a Microsoft Graph permission. Acquiring a token does not
+establish access to the API or its underlying data.
+
+## Register the application
+
+1. Open [Microsoft Entra admin center](https://entra.microsoft.com/) in the
+   resource-owning directory. Go to **Entra ID → App registrations → New registration**.
+2. Enter an application name. For a customer-owned setup, select accounts in this
+   directory only and register it. Copy **Application (client) ID** and
+   **Directory (tenant) ID** from its overview. This fragment requires the directory
+   GUID; it does not use `common`, personal Microsoft accounts or tenant aliases.
+3. Under **Certificates & secrets → Client secrets → New client secret**, supply
+   a description and expiry. Copy the secret **Value**, not its identifier, into
+   the backend's secret binding. Record when it needs rotation.
+4. For **User consent**, open **Authentication → Redirect URI configuration → Add Redirect URI → Web** and enter
+   the exact callback implemented by your backend. Add **Power BI Service →
+   Delegated permissions → GraphQLApi.Execute.All** under API permissions.
+   Complete any consent required by the tenant's policy. Request `offline_access`
+   when ongoing access is needed. This server library uses a confidential Web
+   client; do not copy the SPA/public-client settings from Microsoft's React demo.
+5. For **Service account**, omit the callback and delegated permission. Use the
+   app's client ID and secret to authenticate its service principal.
+
+See Microsoft's [registration procedure](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)
+and [client credentials protocol](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow).
+Never bundle a confidential client secret into a distributed editor or frontend.
+
+## Allow access to the existing API
+
+1. Open the Fabric workspace and the existing GraphQL API. In its toolbar select
+   **Copy endpoint**, then copy the complete link. Keep the workspace and API IDs.
+   The accepted address has this form:
+   `https://api.fabric.microsoft.com/v1/workspaces/<workspace-id>/graphqlapis/<api-id>/graphql`.
+   It must not contain credentials, an added port, query parameters or a fragment.
+   Custom gateways and sovereign clouds need a separate provider contract.
+2. For service principals, a tenant administrator opens **Admin portal → Tenant
+   settings → Developer settings**, enables **Service principals can use Fabric
+   APIs**, and applies the setting for the intended principals or group.
+3. From the API item's **… → Manage permissions → Add user**, select the user or
+   service principal and grant **Run Queries and Mutations**. Prefer item access
+   when it meets the requirement rather than automatically assigning a broad
+   workspace role.
+4. Confirm access to the source as well. With single sign-on, the calling identity
+   needs the applicable source permissions. With a saved connection, its saved
+   credential needs them. Permission to an API is not permission to every table.
+5. Schema discovery is optional. If needed, a workspace administrator opens the
+   API settings, selects **Introspection**, enables it and confirms. It is disabled
+   by default. Alternatively, export the SDL schema from the toolbar and give
+   that file to the app author or AI.
+
+The [access guide](https://learn.microsoft.com/en-us/fabric/data-engineering/api-graphql-service-principal)
+explains the service-principal setup; the
+[schema guide](https://learn.microsoft.com/en-us/fabric/data-engineering/api-graphql-introspection-schema-export)
+explains introspection and export. The connection check requests only `__typename`;
+it does not enable introspection or query a business table. Actual access to each
+document still needs verification against the customer's schema and permissions.
+
+## Portable user configuration
+
+Store this as the same integration JSON that the editor reads and writes. Resolve
+the `env:` references on the backend. Example IDs are placeholders.
+
+```json
+{
+  "schemaVersion": 1,
+  "registrations": {
+    "fabric": {
+      "source": "own",
+      "grantType": "authorization_code",
+      "clientId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+      "clientSecretRef": "env:FABRIC_SECRET",
+      "callbackUrlRef": "env:FABRIC_CALLBACK"
+    }
+  },
+  "integrations": {
+    "fabric": {
+      "provider": "microsoft-fabric",
+      "accountMode": "per-user",
+      "settings": {
+        "tenantId": "11111111-2222-3333-4444-555555555555",
+        "graphqlEndpoint": "https://api.fabric.microsoft.com/v1/workspaces/11111111-2222-3333-4444-555555555555/graphqlapis/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/graphql"
+      },
+      "scopes": ["https://analysis.windows.net/powerbi/api/GraphQLApi.Execute.All", "offline_access"],
+      "authentication": { "method": "oauth2", "registrationRef": "fabric" }
+    }
+  }
+}
+```
+
+## Portable service configuration
+
+```json
+{
+  "schemaVersion": 1,
+  "registrations": {
+    "fabric": {
+      "source": "own",
+      "grantType": "client_credentials",
+      "clientId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+      "clientSecretRef": "env:FABRIC_SECRET"
+    }
+  },
+  "integrations": {
+    "fabric": {
+      "provider": "microsoft-fabric",
+      "accountMode": "shared",
+      "settings": {
+        "tenantId": "11111111-2222-3333-4444-555555555555",
+        "graphqlEndpoint": "https://api.fabric.microsoft.com/v1/workspaces/11111111-2222-3333-4444-555555555555/graphqlapis/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/graphql"
+      },
+      "scopes": ["https://api.fabric.microsoft.com/.default"],
+      "authentication": { "method": "oauth2", "registrationRef": "fabric" }
+    }
+  }
+}
+```
+
+## Runtime and AI wiring
+
+Import `microsoftFabricProvider` from
+`@jskit-ai/connectors-catalog/server/microsoft-fabric`. Compose the normal
+`createConnectionService` or `ConnectorsFeature` with trusted application
+authorization, reference resolution and the file store. The library already owns
+PKCE/state, confidential token exchange, encrypted token persistence, locking,
+refresh or service-token renewal, permission checks and disconnect. Do not generate
+a second token manager. User consent uses `beginAuthorization` and
+`completeAuthorization`; service accounts use `connectClientCredentials` or
+`connectors.verifyClientCredentials`.
+
+| Operation | Input | Result |
+| --- | --- | --- |
+| `connection.check` | None | `data.__typename` from a fixed document |
+| `schema.types` | None; introspection must be enabled | Type names/kinds and root query/mutation type names |
+| `graphql.execute` | `query`, optional JSON `variables` and `operationName` | One GraphQL response with object `data` |
+
+Documents and encoded variables each have a 65,536-character library bound;
+operation names have a 256-character bound. Only JSON variables are accepted.
+There is no schema-specific generated client, automatic pagination or subscription
+transport. Use fields and cursor arguments defined by the actual API. For example,
+an app with an `inventory` field might execute the following *app-owned* document:
+
+```js
+const result = await connections.invoke({
+  context: authenticatedAppContext,
+  integrationId: "fabric",
+  operation: "graphql.execute",
+  input: {
+    query: "query Stock($after: String) { inventory(first: 10, after: $after) { items { id } endCursor hasNextPage } }",
+    operationName: "Stock",
+    variables: { after: null }
+  }
+});
+```
+
+This is a wiring fragment, not a claim that every API has an inventory table.
+`graphql.execute` accepts mutations too. Keep allowed documents in server code,
+validate their variables in the app's action, and authorize each invocation.
+Do not expose this operation as an unrestricted browser proxy or call it read-only.
+GraphQL errors fail the operation even when partial data accompanies them. A
+mutation may already have taken effect, so the library never automatically retries
+it. Provider error bodies are not exposed. See the
+[Fabric query editor](https://learn.microsoft.com/en-us/fabric/data-engineering/api-graphql-editor)
+for variables and supported documents.
+
+## What an AI can automate
+
+With explicitly authorized administrative credentials, provisioning can create an
+[Entra application](https://learn.microsoft.com/en-us/graph/api/application-post-applications?view=graph-rest-1.0),
+configure its Web redirect URIs and delegated resource access, create its
+[service principal](https://learn.microsoft.com/en-us/graph/api/serviceprincipal-post-serviceprincipals?view=graph-rest-1.0),
+and [generate an application secret](https://learn.microsoft.com/en-us/graph/api/application-addpassword?view=graph-rest-1.0).
+The application object ID and client ID are different; return secret values go
+directly to the secret store. Check for an existing owned registration first to
+avoid duplicates and record the secret expiry.
+
+Fabric also has [GraphQL item management APIs](https://learn.microsoft.com/en-us/rest/api/fabric/graphqlapi/items).
+Those are provisioning APIs, not this GraphQL execution adapter. Tenant enablement,
+consent policy, resource access, capacity entitlement and data-source configuration
+still need an authorized administrator. These setup actions are documented here;
+the runtime does not perform them automatically or request admin rights.
+
+## Application ownership, callbacks and capacity
+
+The application owner creates the provider registration and stores its secret
+in the application's private Env. Public Vibe64, Vibe64 Online and CLI users use
+this same ownership model. The configuration file holds the client ID and Env
+references; the editor does not own the application's grants.
+
+Register the exact callback implemented by the application. For a hosted project,
+start with its assigned application URL and append the implemented callback path.
+Save that same URL through the application's callback Env reference. On a domain
+or host change, update both the provider registration and callback Env if the URL
+changes. Preserve the application's identity and persistent grant store when
+moving it; neither a new editor URL nor a new hosting address creates a new owner.
+See the [callback guide](../../connectors-core/docs/oauth-callbacks.md) and
+[application setup command](../../connectors-core/docs/setup-command.md).
+
+The callback applies to user-consent connections. Service accounts have no OAuth
+callback. The application's Entra registration does not by itself grant access to
+a customer's Fabric workspace: each directory needs its service principal,
+consent where applicable, and Fabric/resource permissions. Multitenant access
+still requires the relevant approval and configuration.
+
+Separate registrations support different credentials and policies. They do not
+partition a customer's shared Fabric capacity or guarantee separate quotas.
+
+## Verification boundary
+
+Local automated tests use controlled HTTP responses and encrypted temporary files.
+They cover both grants, endpoint/tenant binding, variables, partial errors,
+renewal, authorization, malformed responses, cancellation and configuration.
+They create no Entra applications, service principals, Fabric resources or sample
+apps and execute no live documents. Real tenant policy, consent, capacity, API
+endpoint reachability, root-type verification and customer schemas remain live
+acceptance checks requiring the owner's credentials.
+
+## Editor credential handoff
+
+Save the Application ID, tenant GUID, endpoint and reference fields first. The
+screen's **Set credential in Env** link supplies the client secret value; the
+default reference is `env:MICROSOFT_FABRIC_CLIENT_SECRET`. For **User consent**,
+use **Open Env** to save the exact registered Web callback as
+`MICROSOFT_FABRIC_CALLBACK_URL`. Custom reference names remain supported.
+**Service account** omits the callback and delegates no user permission.
+
+Once the generated application's runtime is prepared, **Connect account** starts
+its configured shared/assistant connection. User consent opens authorization;
+service credentials connect without a browser. Per-user mode requires individual
+connections inside the application. Saving alone grants neither API nor source
+access. Both methods use app-owned credentials and persistent grants.
+
+**LIMITATIONS (acceptance review):** No automatic table browser, schema-specific client, subscriptions, automatic pagination or Vibe64 assistant attachment. Example: the app can execute an inventory query using its real schema; this does not provide an inventory dashboard. Both authentication modes and operation/error handling have fixture proof, not live Fabric resource proof.