@lanes-sh/link 0.6.10 → 0.7.0

package/src/providers/index.ts

@@ -16,10 +16,94 @@ import { icloudCalendar } from './icloud/calendar/index.ts';
 import { icloudContacts } from './icloud/contacts/index.ts';
 import { icloudDrive } from './icloud/drive/index.ts';
 import { icloudMail } from './icloud/mail/index.ts';
+import { microsoftTodo } from './microsoft/todo/index.ts';
+import { onedrive } from './microsoft/drive/index.ts';
+import { outlookCalendar } from './microsoft/calendar/index.ts';
+import { outlookContacts } from './microsoft/contacts/index.ts';
+import { outlookMail } from './microsoft/mail/index.ts';
+import { fastmailCalendar } from './fastmail/calendar/index.ts';
+import { fastmailContacts } from './fastmail/contacts/index.ts';
+import { fastmailMail } from './fastmail/mail/index.ts';
+import { yahooMail } from './yahoo_mail/index.ts';
+import { zohoMail } from './zoho_mail/index.ts';
+import { mailbox } from './mailbox/index.ts';
+import { nextcloudCalendar } from './nextcloud/calendar/index.ts';
+import { nextcloudContacts } from './nextcloud/contacts/index.ts';
 import { linear } from './linear/index.ts';
 import { notion } from './notion/index.ts';
 import { reddit } from './reddit/index.ts';
 import { slack } from './slack/index.ts';
+import { asana } from './asana/index.ts';
+import { stripe } from './stripe/index.ts';
+import { sentry } from './sentry/index.ts';
+import { figma } from './figma/index.ts';
+import { canva } from './canva/index.ts';
+import { dropbox } from './dropbox/index.ts';
+import { todoist } from './todoist/index.ts';
+import { clickup } from './clickup/index.ts';
+import { monday } from './monday/index.ts';
+import { airtable } from './airtable/index.ts';
+import { miro } from './miro/index.ts';
+import { calendly } from './calendly/index.ts';
+import { close } from './close/index.ts';
+import { zapier } from './zapier/index.ts';
+import { paypal } from './paypal/index.ts';
+import { square } from './square/index.ts';
+import { mercury } from './mercury/index.ts';
+import { vercel } from './vercel/index.ts';
+import { netlify } from './netlify/index.ts';
+import { supabase } from './supabase/index.ts';
+import { neon } from './neon/index.ts';
+import { prisma } from './prisma/index.ts';
+import { sanity } from './sanity/index.ts';
+import { webflow } from './webflow/index.ts';
+import { wix } from './wix/index.ts';
+import { datadog } from './datadog/index.ts';
+import { grafana } from './grafana/index.ts';
+import { fireflies } from './fireflies/index.ts';
+import { gamma } from './gamma/index.ts';
+import { jam } from './jam/index.ts';
+import { cloudflareObservability } from './cloudflare_observability/index.ts';
+import { cloudflareBindings } from './cloudflare_bindings/index.ts';
+import { atlassian } from './atlassian/index.ts';
+import { hubspot } from './hubspot/index.ts';
+import { box } from './box/index.ts';
+import { render } from './render/index.ts';
+import { algolia } from './algolia/index.ts';
+import { amplitude } from './amplitude/index.ts';
+import { apify } from './apify/index.ts';
+import { attio } from './attio/index.ts';
+import { betterstack } from './betterstack/index.ts';
+import { brightdata } from './brightdata/index.ts';
+import { buildkite } from './buildkite/index.ts';
+import { circleci } from './circleci/index.ts';
+import { contentful } from './contentful/index.ts';
+import { expensify } from './expensify/index.ts';
+import { flagsmith } from './flagsmith/index.ts';
+import { heroku } from './heroku/index.ts';
+import { hygraph } from './hygraph/index.ts';
+import { insightly } from './insightly/index.ts';
+import { klaviyo } from './klaviyo/index.ts';
+import { mixpanel } from './mixpanel/index.ts';
+import { mux } from './mux/index.ts';
+import { navan } from './navan/index.ts';
+import { paddle } from './paddle/index.ts';
+import { posthog } from './posthog/index.ts';
+import { ramp } from './ramp/index.ts';
+import { recurly } from './recurly/index.ts';
+import { remote } from './remote/index.ts';
+import { replicate } from './replicate/index.ts';
+import { resend } from './resend/index.ts';
+import { riverside } from './riverside/index.ts';
+import { rootly } from './rootly/index.ts';
+import { rudderstack } from './rudderstack/index.ts';
+import { salesloft } from './salesloft/index.ts';
+import { shortcut } from './shortcut/index.ts';
+import { storyblok } from './storyblok/index.ts';
+import { tavily } from './tavily/index.ts';
+import { vimeo } from './vimeo/index.ts';
+import { whimsical } from './whimsical/index.ts';
+import { workable } from './workable/index.ts';
 
 /**
  * Every provider, in one list.
@@ -72,7 +156,94 @@ export const PROVIDERS: readonly (ProviderManifest | ProviderDefinition)[] = [
   icloudCalendar,
   icloudContacts,
   icloudDrive,
+  outlookMail,
+  outlookCalendar,
+  outlookContacts,
+  onedrive,
+  microsoftTodo,
+  fastmailMail,
+  fastmailCalendar,
+  fastmailContacts,
+  zohoMail,
+  yahooMail,
+  nextcloudCalendar,
+  nextcloudContacts,
+  mailbox,
   bunq,
+
+  // Vendors running an official MCP server that offers Dynamic Client
+  // Registration. Each is a declaration and nothing else; see the header above.
+  asana,
+  stripe,
+  sentry,
+  figma,
+  canva,
+  dropbox,
+  todoist,
+  clickup,
+  monday,
+  airtable,
+  miro,
+  calendly,
+  close,
+  zapier,
+  paypal,
+  square,
+  mercury,
+  vercel,
+  netlify,
+  supabase,
+  neon,
+  prisma,
+  sanity,
+  webflow,
+  wix,
+  datadog,
+  grafana,
+  fireflies,
+  gamma,
+  jam,
+  cloudflareObservability,
+  cloudflareBindings,
+  atlassian,
+  hubspot,
+  box,
+  render,
+  algolia,
+  amplitude,
+  apify,
+  attio,
+  betterstack,
+  brightdata,
+  buildkite,
+  circleci,
+  contentful,
+  expensify,
+  flagsmith,
+  heroku,
+  hygraph,
+  insightly,
+  klaviyo,
+  mixpanel,
+  mux,
+  navan,
+  paddle,
+  posthog,
+  ramp,
+  recurly,
+  remote,
+  replicate,
+  resend,
+  riverside,
+  rootly,
+  rudderstack,
+  salesloft,
+  shortcut,
+  storyblok,
+  tavily,
+  vimeo,
+  whimsical,
+  workable,
 ];
 
 /** The manifest half of an entry, whichever shape it arrived in. */
@@ -101,6 +272,18 @@ export {
   sheets,
 } from './google/index.ts';
 export { icloudCalendar, icloudContacts, icloudDrive, icloudMail } from './icloud/index.ts';
+export {
+  microsoftTodo,
+  onedrive,
+  outlookCalendar,
+  outlookContacts,
+  outlookMail,
+} from './microsoft/index.ts';
+export { fastmailCalendar, fastmailContacts, fastmailMail } from './fastmail/index.ts';
+export { yahooMail } from './yahoo_mail/index.ts';
+export { zohoMail } from './zoho_mail/index.ts';
+export { nextcloudCalendar, nextcloudContacts } from './nextcloud/index.ts';
+export { mailbox } from './mailbox/index.ts';
 export { bunq } from './bunq/index.ts';
 export { discord } from './discord/index.ts';
 export { github } from './github/index.ts';
@@ -108,4 +291,76 @@ export { linear } from './linear/index.ts';
 export { notion } from './notion/index.ts';
 export { reddit } from './reddit/index.ts';
 export { slack } from './slack/index.ts';
+export { asana } from './asana/index.ts';
+export { stripe } from './stripe/index.ts';
+export { sentry } from './sentry/index.ts';
+export { figma } from './figma/index.ts';
+export { canva } from './canva/index.ts';
+export { dropbox } from './dropbox/index.ts';
+export { todoist } from './todoist/index.ts';
+export { clickup } from './clickup/index.ts';
+export { monday } from './monday/index.ts';
+export { airtable } from './airtable/index.ts';
+export { miro } from './miro/index.ts';
+export { calendly } from './calendly/index.ts';
+export { close } from './close/index.ts';
+export { zapier } from './zapier/index.ts';
+export { paypal } from './paypal/index.ts';
+export { square } from './square/index.ts';
+export { mercury } from './mercury/index.ts';
+export { vercel } from './vercel/index.ts';
+export { netlify } from './netlify/index.ts';
+export { supabase } from './supabase/index.ts';
+export { neon } from './neon/index.ts';
+export { prisma } from './prisma/index.ts';
+export { sanity } from './sanity/index.ts';
+export { webflow } from './webflow/index.ts';
+export { wix } from './wix/index.ts';
+export { datadog } from './datadog/index.ts';
+export { grafana } from './grafana/index.ts';
+export { fireflies } from './fireflies/index.ts';
+export { gamma } from './gamma/index.ts';
+export { jam } from './jam/index.ts';
+export { cloudflareObservability } from './cloudflare_observability/index.ts';
+export { cloudflareBindings } from './cloudflare_bindings/index.ts';
+export { atlassian } from './atlassian/index.ts';
+export { hubspot } from './hubspot/index.ts';
+export { box } from './box/index.ts';
+export { render } from './render/index.ts';
+export { algolia } from './algolia/index.ts';
+export { amplitude } from './amplitude/index.ts';
+export { apify } from './apify/index.ts';
+export { attio } from './attio/index.ts';
+export { betterstack } from './betterstack/index.ts';
+export { brightdata } from './brightdata/index.ts';
+export { buildkite } from './buildkite/index.ts';
+export { circleci } from './circleci/index.ts';
+export { contentful } from './contentful/index.ts';
+export { expensify } from './expensify/index.ts';
+export { flagsmith } from './flagsmith/index.ts';
+export { heroku } from './heroku/index.ts';
+export { hygraph } from './hygraph/index.ts';
+export { insightly } from './insightly/index.ts';
+export { klaviyo } from './klaviyo/index.ts';
+export { mixpanel } from './mixpanel/index.ts';
+export { mux } from './mux/index.ts';
+export { navan } from './navan/index.ts';
+export { paddle } from './paddle/index.ts';
+export { posthog } from './posthog/index.ts';
+export { ramp } from './ramp/index.ts';
+export { recurly } from './recurly/index.ts';
+export { remote } from './remote/index.ts';
+export { replicate } from './replicate/index.ts';
+export { resend } from './resend/index.ts';
+export { riverside } from './riverside/index.ts';
+export { rootly } from './rootly/index.ts';
+export { rudderstack } from './rudderstack/index.ts';
+export { salesloft } from './salesloft/index.ts';
+export { shortcut } from './shortcut/index.ts';
+export { storyblok } from './storyblok/index.ts';
+export { tavily } from './tavily/index.ts';
+export { vimeo } from './vimeo/index.ts';
+export { whimsical } from './whimsical/index.ts';
+export { workable } from './workable/index.ts';
 export { SCOPE_MEANINGS, type ScopeMeaning } from './scopes.ts';
+export { UNTESTED_PROVIDERS } from './untested.ts';

package/src/providers/insightly/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Insightly registers us at connect time — nothing for an operator to set up. */
+export const insightly = defineProvider({
+  id: 'insightly',
+  name: 'Insightly',
+  description: 'Contacts, organisations, opportunities, and projects, via Insightly\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.insightly.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/jam/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Jam registers us at connect time — nothing for an operator to set up. */
+export const jam = defineProvider({
+  id: 'jam',
+  name: 'Jam',
+  description: 'Bug reports, with their console logs, network calls, and repro steps, via Jam\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.jam.dev/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/klaviyo/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Klaviyo registers us at connect time — nothing for an operator to set up. */
+export const klaviyo = defineProvider({
+  id: 'klaviyo',
+  name: 'Klaviyo',
+  description: 'Profiles, lists, segments, campaigns, and flows, via Klaviyo\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.klaviyo.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/mailbox/index.ts

@@ -0,0 +1,87 @@
+import { defineProvider } from '#connectivity';
+import { HOSTNAME } from '../nextcloud/shared/setup.ts';
+
+/**
+ * Any mailbox, over IMAP and SMTP.
+ *
+ * The generic one, and the reason connection variables were worth building. Every
+ * other mail provider here is the same twenty lines with a different pair of
+ * hostnames — `icloud_mail`, `gmail_imap`, `fastmail_mail`, `zoho_mail`,
+ * `yahoo_mail` — and each exists because a manifest could hold exactly one
+ * address. A named provider is still better where there is one: it can carry the
+ * vendor's own setup walkthrough, its message-size limit, and the sentence about
+ * app passwords that a generic one cannot. This is for everything else — a
+ * company Dovecot, a Migadu, a Mailcow, a host nobody has written a manifest for.
+ *
+ * Two variables rather than one, because the two hosts genuinely differ:
+ * submission is conventionally `smtp.` where retrieval is `imap.`, and plenty of
+ * servers do neither.
+ */
+export const mailbox = defineProvider({
+  id: 'mailbox',
+  name: 'Mailbox (any IMAP server)',
+  description:
+    'Read, search, and send mail in any IMAP mailbox — a company server, or a host with no provider of its own.',
+  connector: {
+    kind: 'imap',
+    host: '{imap_host}',
+    port: 993,
+    smtp: { host: '{smtp_host}', port: 587, starttls: true },
+  },
+  auth: { kind: 'basic' },
+  identity: { kind: 'connector' },
+  variables: [
+    {
+      key: 'imap_host',
+      label: 'IMAP server',
+      description: 'Where mail is read from. Usually imap.<your domain>, on port 993.',
+      example: 'imap.example.com',
+      pattern: HOSTNAME,
+    },
+    {
+      key: 'smtp_host',
+      label: 'SMTP server',
+      description: 'Where mail is sent from. Often the same host, often smtp.<your domain>.',
+      example: 'smtp.example.com',
+      pattern: HOSTNAME,
+    },
+  ],
+  setup: {
+    summary:
+      'A mailbox on a server this program has no manifest for. It asks for the two hostnames and the ' +
+      'login; TLS is required on both, and the ports are the standard 993 and 587. Where your provider ' +
+      'has a named entry here — iCloud, Fastmail, Gmail, Zoho, Yahoo — use that instead: it carries the ' +
+      'setup steps and the limits this one cannot know.',
+    steps: [
+      'Find your provider\'s IMAP and SMTP hostnames. They are usually in a page called "IMAP settings" or "Mail client setup".',
+      'If the account has two-factor authentication, create an app password for it. Most servers refuse the account password over IMAP once 2FA is on.',
+      'This provider assumes IMAP on 993 and SMTP submission on 587 with STARTTLS, which is what almost every host uses. A server on 465, or on a non-standard port, needs a manifest of its own in providers.d/ — see docs/detailed/creating-a-provider.md.',
+    ],
+    troubleshooting:
+      'A connection refused is usually the wrong hostname or a server that wants port 465 rather than 587. ' +
+      'A rejected login on the right host is usually an account password where an app password belongs.',
+    prompts: [
+      {
+        key: 'username',
+        label: 'Username (usually the full email address)',
+        secret: false,
+        scope: 'connection' as const,
+        field: 'username' as const,
+      },
+      {
+        key: 'password',
+        label: 'Password or app password',
+        secret: true,
+        scope: 'connection' as const,
+        field: 'password' as const,
+      },
+    ],
+  },
+  redact: {
+    search_messages: ['mailbox', 'limit', 'unseen', 'flagged'],
+    get_message: ['mailbox', 'uid', 'include_body'],
+    mark_messages: ['mailbox', 'add_flags', 'remove_flags'],
+    move_messages: ['mailbox', 'destination', 'destination_flag'],
+    send_message: [],
+  },
+});

package/src/providers/memory/provider.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { splitOptionalFrontmatter, stringList, withFrontmatter } from '#providers/shared/frontmatter.ts';
+import { slugify as slugifyText } from '#providers/shared/slug.ts';
 import {
   defineLocalProvider,
   keepKeys,
@@ -11,7 +12,7 @@ import {
  * `memory` — the owner's accumulated knowledge.
  *
  * **Reading and writing are separate capabilities**, and that separation is the
- * whole security argument for this provider (ADR-012 §2, `docs/detailed/security.md`).
+ * whole security argument for this provider (ADR-012 §2, `https://lanes.sh/docs/link/security`).
  * Upstream content is already treated as potentially prompt-injecting and passed
  * through unscreened; memory an agent can *write to* changes the shape of that
  * risk rather than its size, because an injected instruction is stored once and
@@ -167,13 +168,7 @@ async function allEntries(storage: BlobStore): Promise<Entry[]> {
 
 /** A stable id from a title, so writing does not demand one be invented. */
 function slugify(title: string): string {
-  const slug = title
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-    .slice(0, 60);
-
-  return slug.length > 0 ? slug : `entry-${title.length}`;
+  return slugifyText(title, 'entry');
 }
 
 export const memoryProvider: ProviderDefinition = defineLocalProvider({

package/src/providers/mercury/index.ts

@@ -0,0 +1,10 @@
+import { defineProvider } from '#connectivity';
+
+/** Mercury registers us at connect time — nothing for an operator to set up. */
+export const mercury = defineProvider({
+  id: 'mercury',
+  name: 'Mercury',
+  description: 'Accounts, balances, transactions, and cards, via Mercury\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.mercury.com/mcp' },
+  auth: { kind: 'oauth', registration: 'dynamic' },
+});

package/src/providers/microsoft/calendar/index.ts

@@ -0,0 +1,49 @@
+import { defineProvider } from '#connectivity';
+import {
+  CALENDAR_SCOPES,
+  CONTACTS_SCOPES,
+  FILES_SCOPES,
+  GRAPH_BASE_URL,
+  MAIL_SCOPES,
+  MICROSOFT_APP,
+  MICROSOFT_AUTHORIZE_URL,
+  MICROSOFT_IDENTITY,
+  MICROSOFT_TOKEN_URL,
+  TODO_SCOPES,
+  specPath,
+} from '../shared/oauth.ts';
+import { microsoftSetup } from '../shared/setup.ts';
+
+export const outlookCalendar = defineProvider({
+  id: 'outlook_calendar',
+  name: 'Outlook Calendar',
+  description:
+    'Read and write events in Outlook calendars — list, search, create, reschedule, and cancel — via Microsoft Graph.',
+  connector: { kind: 'http', base_url: GRAPH_BASE_URL, openapi: specPath('outlook-calendar.v1.json') },
+  auth: {
+    kind: 'oauth',
+    registration: 'manual',
+    app: MICROSOFT_APP,
+    // Declared rather than discovered. An `http` connector has no metadata
+    // document to read — a REST API does not announce where its authorization
+    // server lives — so the two endpoints are part of the manifest.
+    authorize_url: MICROSOFT_AUTHORIZE_URL,
+    token_url: MICROSOFT_TOKEN_URL,
+    scopes: CALENDAR_SCOPES,
+    revoke_url: 'https://account.live.com/consent/Manage',
+  },
+  identity: MICROSOFT_IDENTITY,
+  setup: microsoftSetup('Outlook Calendar', CALENDAR_SCOPES),
+  redact: {
+    'me.ListCalendars': ['top', 'orderby', 'select'],
+    'me.ListEvents': ['top', 'orderby', 'select'],
+    // The window is not content; what is in it is.
+    'me.ListCalendarView': ['startDateTime', 'endDateTime', 'top', 'orderby', 'select'],
+    'me.GetEvents': ['event-id', 'select'],
+    // The id says *which* event changed, which is what makes the log worth
+    // having; the subject, the location, and the attendees are the content of it.
+    'me.CreateEvents': ['isAllDay', 'showAs'],
+    'me.UpdateEvents': ['event-id', 'isAllDay', 'showAs'],
+    'me.DeleteEvents': ['event-id'],
+  },
+});

package/src/providers/microsoft/contacts/index.ts

@@ -0,0 +1,50 @@
+import { defineProvider } from '#connectivity';
+import {
+  CALENDAR_SCOPES,
+  CONTACTS_SCOPES,
+  FILES_SCOPES,
+  GRAPH_BASE_URL,
+  MAIL_SCOPES,
+  MICROSOFT_APP,
+  MICROSOFT_AUTHORIZE_URL,
+  MICROSOFT_IDENTITY,
+  MICROSOFT_TOKEN_URL,
+  TODO_SCOPES,
+  specPath,
+} from '../shared/oauth.ts';
+import { microsoftSetup } from '../shared/setup.ts';
+
+/**
+ * Read-only, deliberately, and the same call as Google's contacts provider.
+ *
+ * Graph would allow writes and the vendored spec could carry them. What an
+ * address book is for here is making "email Bob" resolve, and `Contacts.Read`
+ * is a materially smaller grant than `Contacts.ReadWrite` for a surface nobody
+ * has asked to write.
+ */
+export const outlookContacts = defineProvider({
+  id: 'outlook_contacts',
+  name: 'Outlook Contacts',
+  description: 'Look up an address in Outlook contacts, so "email Bob" resolves. Read-only.',
+  connector: { kind: 'http', base_url: GRAPH_BASE_URL, openapi: specPath('outlook-contacts.v1.json') },
+  auth: {
+    kind: 'oauth',
+    registration: 'manual',
+    app: MICROSOFT_APP,
+    // Declared rather than discovered. An `http` connector has no metadata
+    // document to read — a REST API does not announce where its authorization
+    // server lives — so the two endpoints are part of the manifest.
+    authorize_url: MICROSOFT_AUTHORIZE_URL,
+    token_url: MICROSOFT_TOKEN_URL,
+    scopes: CONTACTS_SCOPES,
+    revoke_url: 'https://account.live.com/consent/Manage',
+  },
+  identity: MICROSOFT_IDENTITY,
+  setup: microsoftSetup('Outlook Contacts', CONTACTS_SCOPES),
+  redact: {
+    // Not `search`: a name is content.
+    'me.ListContacts': ['top', 'orderby', 'select'],
+    'me.GetContacts': ['contact-id', 'select'],
+    'me.ListContactFolders': ['top', 'orderby', 'select'],
+  },
+});

package/src/providers/microsoft/drive/index.ts

@@ -0,0 +1,62 @@
+import { defineProvider } from '#connectivity';
+import {
+  CALENDAR_SCOPES,
+  CONTACTS_SCOPES,
+  FILES_SCOPES,
+  GRAPH_BASE_URL,
+  MAIL_SCOPES,
+  MICROSOFT_APP,
+  MICROSOFT_AUTHORIZE_URL,
+  MICROSOFT_IDENTITY,
+  MICROSOFT_TOKEN_URL,
+  TODO_SCOPES,
+  specPath,
+} from '../shared/oauth.ts';
+import { microsoftSetup } from '../shared/setup.ts';
+
+/**
+ * OneDrive, through Graph — a drive reached over HTTPS rather than a folder on
+ * this machine.
+ *
+ * The counterpart to `icloud_drive` and the opposite shape: Apple publishes no
+ * protocol, so iCloud Drive is the synced folder on a Mac and nothing else;
+ * Microsoft publishes an API, so this works from a deployed endpoint that has no
+ * filesystem of the operator's at all.
+ *
+ * Every item operation names a drive, which `me.GetDrive` reports. That is one
+ * extra call before the first read and it is Graph's shape rather than a choice
+ * here — the `/me/drive/...` shorthand exists but is not in the published
+ * OpenAPI as addressable operations.
+ */
+export const onedrive = defineProvider({
+  id: 'onedrive',
+  name: 'OneDrive',
+  description: 'Browse, search, read, and organise files in OneDrive, via Microsoft Graph.',
+  connector: { kind: 'http', base_url: GRAPH_BASE_URL, openapi: specPath('onedrive.v1.json') },
+  auth: {
+    kind: 'oauth',
+    registration: 'manual',
+    app: MICROSOFT_APP,
+    // Declared rather than discovered. An `http` connector has no metadata
+    // document to read — a REST API does not announce where its authorization
+    // server lives — so the two endpoints are part of the manifest.
+    authorize_url: MICROSOFT_AUTHORIZE_URL,
+    token_url: MICROSOFT_TOKEN_URL,
+    scopes: FILES_SCOPES,
+    revoke_url: 'https://account.live.com/consent/Manage',
+  },
+  identity: MICROSOFT_IDENTITY,
+  setup: microsoftSetup('OneDrive', FILES_SCOPES),
+  redact: {
+    'me.GetDrive': ['select'],
+    'drives.GetRoot': ['drive-id', 'select'],
+    'drives.GetItems': ['drive-id', 'driveItem-id', 'select'],
+    'drives.items.ListChildren': ['drive-id', 'driveItem-id', 'top', 'orderby', 'select'],
+    'drives.GetItemsContent': ['drive-id', 'driveItem-id'],
+    // Where a file was created, never what it is called — a filename is content,
+    // and "Divorce settlement draft.docx" is the whole document.
+    'drives.items.CreateChildren': ['drive-id', 'driveItem-id'],
+    // Not `q` or `search`: what someone searched their own drive for is content.
+    'drives.drive.items.driveItem.search': ['drive-id', 'driveItem-id', 'top', 'orderby', 'select'],
+  },
+});

package/src/providers/microsoft/index.ts

@@ -0,0 +1,12 @@
+/**
+ * Microsoft's five providers, sharing one Entra app registration.
+ *
+ * One API behind all of them, so unlike Google there is one client and one
+ * consent screen shape — but the tokens still land per provider, so connecting
+ * Outlook mail does not grant OneDrive.
+ */
+export { microsoftTodo } from './todo/index.ts';
+export { onedrive } from './drive/index.ts';
+export { outlookCalendar } from './calendar/index.ts';
+export { outlookContacts } from './contacts/index.ts';
+export { outlookMail } from './mail/index.ts';