@oddington/cli 0.1.28 → 0.1.30

package/README.md

@@ -252,6 +252,38 @@ Airtable expects:
 Creating a connection verifies access before saving it. It does not grant
 anyone permission to use it.
 
+Outlook and SharePoint are separate connections for one mailbox or site. Both
+require tenant and application IDs, declared access, and protected credential
+JSON from stdin:
+
+```sh
+credential-source | os connection create outlook \
+  --workspace <workspace> \
+  --name accounts-payable \
+  --tenant-id <tenant-id> \
+  --client-id <client-id> \
+  --mailbox-email invoices@example.test \
+  --access read \
+  --credentials-stdin
+
+credential-source | os connection create sharepoint \
+  --workspace <workspace> \
+  --name operations \
+  --tenant-id <tenant-id> \
+  --client-id <client-id> \
+  --site-url https://example.sharepoint.com/sites/Operations \
+  --access read-write \
+  --credentials-stdin
+```
+
+Each expects an object containing only `clientSecret`. The entire UTF-8 stdin
+input must fit within 4,096 bytes. The secret never belongs in command arguments.
+Outlook accepts only `read`; SharePoint accepts `read` or `read-write`. OS resolves
+the SharePoint site ID during verification; callers cannot supply it.
+The Entra application's Microsoft permissions and site or mailbox grants must
+already be configured upstream. V0 manages and verifies these connections;
+it does not provide Microsoft routine operations or SharePoint File storage.
+
 ### Test a connection
 
 ```sh
@@ -271,6 +303,13 @@ Gmail verification checks the configured account and scopes without reading
 messages. Airtable verification makes a read-only schema request; it does not
 prove that the credential can write records.
 
+Outlook testing reads only the configured mailbox's inbox folder identity,
+without reading messages or attachments. SharePoint testing resolves the site
+URL to its saved ID and reads that site. Success establishes readable access
+only, including when declared access is `read-write`; it does not prove write
+access or the absence of broader Microsoft access. Inspect shows the complete
+public configuration, including the verified SharePoint site ID.
+
 ### Grant and use a connection
 
 Use `os whoami` to find your user ID, then grant access explicitly:
@@ -308,6 +347,13 @@ To rotate Gmail or Airtable credentials, repeat the matching `create` command
 with the same name and external account or base. The new credentials are tested
 before replacing the old ones.
 
+For Outlook or SharePoint, repeat the matching `create` command with the same
+provider and name and fresh credential stdin. Successful verification replaces
+the credential while preserving the connection ID and history; failure leaves
+the prior connection intact. Disconnect removes that connection's protected
+credential without changing Microsoft permissions or other connections using
+the same secret. Reconnecting requires fresh verified credentials.
+
 To stop new use of a connection:
 
 ```sh
@@ -425,7 +471,26 @@ is required unless an authored item declares executable handlers. JSON input
 is validated before business work; its file/stdin path is transport, not input.
 Omitted input is `{}`. Each JSON value is bounded to 256 KiB.
 
-Before execution, the command names installed connections and explains that
+To execute the active deployed version on OS, use:
+
+```sh
+os routine run invoice-import --remote --input input.json
+os routine run invoice-import --remote --input - --json
+os routine cancel <run> --json
+```
+
+Remote start reads only worktree identity and business input. It neither uploads
+local source nor creates a local captured change set. It reports the accepted
+Run's `id`, `state` and inspection URL, then returns; disconnecting does not cancel
+the Run. OS-owned changes apply during execution and need no publish command.
+Uncertain acknowledgements retry the same start key and input. If recovery is
+still unavailable, output retains `startKey` and warns that OS may have accepted
+the action; repeating the command deliberately requests another Run. Cancellation
+resolves the Run through current workspace membership, works outside a checkout,
+and reports the recorded state while OS stops execution. Neither command accepts
+workspace, version, command, environment or authority overrides.
+
+Before local execution, the command names installed connections and explains that
 local filesystem changes, model calls and provider effects happen immediately.
 Only Record, File, Ask and Digest changes stay local for review. The child
 receives temporary installed authority, which is revoked when execution ends.