@oddington/cli 0.1.28 → 0.1.29

package/README.md

@@ -252,6 +252,38 @@ Airtable expects:
 Creating a connection verifies access before saving it. It does not grant
 anyone permission to use it.
 
+Outlook and SharePoint are separate connections for one mailbox or site. Both
+require tenant and application IDs, declared access, and protected credential
+JSON from stdin:
+
+```sh
+credential-source | os connection create outlook \
+  --workspace <workspace> \
+  --name accounts-payable \
+  --tenant-id <tenant-id> \
+  --client-id <client-id> \
+  --mailbox-email invoices@example.test \
+  --access read \
+  --credentials-stdin
+
+credential-source | os connection create sharepoint \
+  --workspace <workspace> \
+  --name operations \
+  --tenant-id <tenant-id> \
+  --client-id <client-id> \
+  --site-url https://example.sharepoint.com/sites/Operations \
+  --access read-write \
+  --credentials-stdin
+```
+
+Each expects an object containing only `clientSecret`. The entire UTF-8 stdin
+input must fit within 4,096 bytes. The secret never belongs in command arguments.
+Outlook accepts only `read`; SharePoint accepts `read` or `read-write`. OS resolves
+the SharePoint site ID during verification; callers cannot supply it.
+The Entra application's Microsoft permissions and site or mailbox grants must
+already be configured upstream. V0 manages and verifies these connections;
+it does not provide Microsoft routine operations or SharePoint File storage.
+
 ### Test a connection
 
 ```sh
@@ -271,6 +303,13 @@ Gmail verification checks the configured account and scopes without reading
 messages. Airtable verification makes a read-only schema request; it does not
 prove that the credential can write records.
 
+Outlook testing reads only the configured mailbox's inbox folder identity,
+without reading messages or attachments. SharePoint testing resolves the site
+URL to its saved ID and reads that site. Success establishes readable access
+only, including when declared access is `read-write`; it does not prove write
+access or the absence of broader Microsoft access. Inspect shows the complete
+public configuration, including the verified SharePoint site ID.
+
 ### Grant and use a connection
 
 Use `os whoami` to find your user ID, then grant access explicitly:
@@ -308,6 +347,13 @@ To rotate Gmail or Airtable credentials, repeat the matching `create` command
 with the same name and external account or base. The new credentials are tested
 before replacing the old ones.
 
+For Outlook or SharePoint, repeat the matching `create` command with the same
+provider and name and fresh credential stdin. Successful verification replaces
+the credential while preserving the connection ID and history; failure leaves
+the prior connection intact. Disconnect removes that connection's protected
+credential without changing Microsoft permissions or other connections using
+the same secret. Reconnecting requires fresh verified credentials.
+
 To stop new use of a connection:
 
 ```sh