fix(docs): caveat the Dataverse scope, and correct four descriptions

The Dataverse row is the resource scope the connector declares, but binding
an environment requests that environment's `/.default` instead
(`microsoft-dataverse.ts:8`), so the table alone claimed a request the
runtime does not make. Added `SERVICE_SCOPE_NOTES` for a caveat the rows of
one service cannot carry, rendered in the same slot as the opt-in note.

The Word page contradicted itself: its Permissions prose said connecting
grants `Files.Read` and `Files.ReadWrite` and that those cover SharePoint,
while the table right below lists the `.All` pair added in this PR. The
prose predates that change and was wrong on its own terms, since the basic
pair reaches only the signed-in user's own drive. It now says which pair
does what and links to the table.

Three labels understated their grant: `LicenseAssignment.ReadWrite.All`
omitted read, Shopify's `write_merchant_managed_fulfillment_orders` omitted
the read that every Shopify `write_` scope carries, and
`meetings.space.created` read as covering every Meet space rather than the
ones created through Sim. Swept the whole table for the same shape rather
than fix them one per review round.

Author: mzxchandra

apps/docs/content/docs/integrations/google_meet.mdx

@@ -40,7 +40,7 @@ Connecting Google Meet through OAuth requests these scopes.
 | ----- | ----------- |
 | `https://www.googleapis.com/auth/userinfo.email` | View email address |
 | `https://www.googleapis.com/auth/userinfo.profile` | View basic profile info |
-| `https://www.googleapis.com/auth/meetings.space.created` | Create and manage Google Meet meeting spaces |
+| `https://www.googleapis.com/auth/meetings.space.created` | Create Google Meet spaces and manage the ones created through Sim |
 | `https://www.googleapis.com/auth/meetings.space.readonly` | View Google Meet meeting space details |
 
 ## Actions

apps/docs/content/docs/integrations/microsoft_ad.mdx

@@ -47,7 +47,7 @@ Connecting Azure AD through OAuth requests these scopes.
 | `Group.ReadWrite.All` | Read and write all groups |
 | `GroupMember.ReadWrite.All` | Read and write all group memberships |
 | `LicenseAssignment.Read.All` | Read license assignments and subscribed SKUs |
-| `LicenseAssignment.ReadWrite.All` | Assign and remove user licenses |
+| `LicenseAssignment.ReadWrite.All` | Read, assign, and remove user licenses |
 | `UserAuthenticationMethod.ReadWrite.All` | Read and reset authentication methods and passwords for all users |
 | `AuditLog.Read.All` | Read sign-in and directory audit logs |
 | `Application.Read.All` | Read all applications and service principals |

apps/docs/content/docs/integrations/microsoft_dataverse.mdx

@@ -45,6 +45,8 @@ Connecting Microsoft Dataverse through OAuth requests these scopes.
 | `https://dynamics.microsoft.com/user_impersonation` | Access Microsoft Dataverse on your behalf |
 | `offline_access` | Access account when not using the application |
 
+Connecting a specific environment requests `<environment-url>/.default` instead of the resource scope above, so the scope Sim asks for depends on the environment you pick.
+
 ## Actions
 
 ### Associate Microsoft Dataverse Records

apps/docs/content/docs/integrations/microsoft_dynamics_365.mdx

@@ -39,6 +39,8 @@ Connecting Microsoft Dynamics 365 CRM through OAuth requests these scopes.
 | `https://dynamics.microsoft.com/user_impersonation` | Access Microsoft Dataverse on your behalf |
 | `offline_access` | Access account when not using the application |
 
+Connecting a specific environment requests `<environment-url>/.default` instead of the resource scope above, so the scope Sim asks for depends on the environment you pick.
+
 ## Actions
 
 ### List Microsoft Dynamics 365 CRM Records

apps/docs/content/docs/integrations/microsoft_word.mdx

@@ -65,7 +65,7 @@ Word splits a sentence across several internal runs whenever formatting changes
 
 ### Permissions
 
-Connecting a Microsoft account grants Sim `Files.Read` and `Files.ReadWrite`, the permissions Microsoft Graph requires to read and write drive items. The same permissions cover SharePoint document libraries the account can already reach — Sim never gains access to anything the signed-in account could not open itself.
+Connecting a Microsoft account grants Sim the `Files` permissions Microsoft Graph requires to read and write drive items, listed in full under [Scopes](#scopes). `Files.Read` and `Files.ReadWrite` cover your own OneDrive; the `.All` variants are what make a SharePoint document library work, because the basic pair reaches only the signed-in user's own drive. Sim never gains access to anything the signed-in account could not open itself.
 {/* MANUAL-CONTENT-END */}
 
 

apps/docs/content/docs/integrations/shopify.mdx

@@ -40,7 +40,7 @@ Connecting Shopify through OAuth requests these scopes.
 | `write_customers` | Read and manage Shopify customers |
 | `write_inventory` | Read and manage Shopify inventory levels |
 | `read_locations` | View store locations |
-| `write_merchant_managed_fulfillment_orders` | Create fulfillments for orders |
+| `write_merchant_managed_fulfillment_orders` | Read orders and create fulfillments for them |
 
 ## Actions
 

apps/docs/content/docs/platform/self-hosting/integrations-oauth.mdx

@@ -262,6 +262,8 @@ Every connector below also requests `openid`, `profile`, `email`, `offline_acces
 | OneDrive | `onedrive` | `Files.Read`, `Files.ReadWrite` |
 | SharePoint | `sharepoint` | `Sites.Read.All`, `Sites.ReadWrite.All`, `Sites.Manage.All` |
 
+Connecting a specific environment requests `<environment-url>/.default` instead of the resource scope above, so the scope Sim asks for depends on the environment you pick.
+
 ### Monday.com
 
 `MONDAY_CLIENT_ID` / `MONDAY_CLIENT_SECRET`

apps/sim/lib/oauth/scopes.ts

@@ -577,6 +577,21 @@ export const OAUTH_SCOPES = {
 /** Service ids that declare a scope set. */
 export type OAuthScopedService = keyof typeof OAUTH_SCOPES
 
+/**
+ * A caveat the scope rows of one service cannot carry on their own, keyed by
+ * service id.
+ *
+ * Dataverse is the case that forced this: the row below is the resource scope
+ * the connector declares, but binding an environment swaps it for that
+ * environment's `/.default`, so a table printed without the caveat claims to
+ * list a request the runtime does not make.
+ */
+export const SERVICE_SCOPE_NOTES = {
+  'microsoft-dataverse':
+    'Connecting a specific environment requests `<environment-url>/.default` instead of the ' +
+    'resource scope above, so the scope Sim asks for depends on the environment you pick.',
+} as const satisfies Record<string, string>
+
 /**
  * Scopes a service requests only where the deployment has opted in, keyed by
  * service id.
@@ -643,7 +658,7 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
   'https://www.googleapis.com/auth/chat.messages.readonly':
     'View messages in Google Chat spaces you are a member of',
   'https://www.googleapis.com/auth/meetings.space.created':
-    'Create and manage Google Meet meeting spaces',
+    'Create Google Meet spaces and manage the ones created through Sim',
   'https://www.googleapis.com/auth/meetings.space.readonly':
     'View Google Meet meeting space details',
   'https://www.googleapis.com/auth/cloud-platform':
@@ -859,7 +874,7 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
   'GroupMember.ReadWrite.All': 'Read and write all group memberships',
   'Directory.Read.All': 'Read directory data',
   'LicenseAssignment.Read.All': 'Read license assignments and subscribed SKUs',
-  'LicenseAssignment.ReadWrite.All': 'Assign and remove user licenses',
+  'LicenseAssignment.ReadWrite.All': 'Read, assign, and remove user licenses',
   'UserAuthenticationMethod.ReadWrite.All':
     'Read and reset authentication methods and passwords for all users',
   'AuditLog.Read.All': 'Read sign-in and directory audit logs',
@@ -997,7 +1012,7 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
   write_customers: 'Read and manage Shopify customers',
   write_inventory: 'Read and manage Shopify inventory levels',
   read_locations: 'View store locations',
-  write_merchant_managed_fulfillment_orders: 'Create fulfillments for orders',
+  write_merchant_managed_fulfillment_orders: 'Read orders and create fulfillments for them',
 
   // Zoom scopes
   'user:read:user': 'View Zoom profile information',

scripts/generate-docs.test.ts

@@ -988,6 +988,18 @@ describe('the generated Scopes section', () => {
    * app: Slack rejects the whole authorization when the app is not approved for
    * one, so omitting them entirely costs that reader the integration.
    */
+  /**
+   * Dataverse declares a resource scope, but binding an environment swaps it for
+   * that environment's `/.default`, so the rows alone claim a request the
+   * runtime does not make.
+   */
+  it('carries a service caveat the rows cannot state on their own', () => {
+    const section = buildScopesSection('microsoft-dataverse', 'Microsoft Dataverse')
+
+    expect(section).toContain('`<environment-url>/.default`')
+    expect(buildScopesSection('sharepoint', 'SharePoint')).not.toContain('.default')
+  })
+
   it('names the opt-in scopes in prose even though the table omits them', () => {
     const section = buildScopesSection('slack', 'Slack')
 

scripts/generate-docs.ts

@@ -7,7 +7,12 @@ import { isVersionedType, stripVersionSuffix } from '@sim/utils/string'
 import { glob } from 'glob'
 import type { BlockCategory } from '../apps/sim/blocks/types'
 import { IntegrationType } from '../apps/sim/blocks/types'
-import { ENV_GATED_SCOPES, getScopeDescription, OAUTH_SCOPES } from '../apps/sim/lib/oauth/scopes'
+import {
+  ENV_GATED_SCOPES,
+  getScopeDescription,
+  OAUTH_SCOPES,
+  SERVICE_SCOPE_NOTES,
+} from '../apps/sim/lib/oauth/scopes'
 import type { ToolOutputProperty } from '../apps/sim/tools/types'
 
 /**
@@ -1516,12 +1521,20 @@ const SELF_HOSTING_GENERATED_END = '{/* GENERATED-END:oauth-apps */}'
  * in prose keeps the page honest for the reader who does set the flag.
  */
 function renderEnvGatedScopeNote(serviceId: string): string {
+  const notes: string[] = []
+
   const gated = ENV_GATED_SCOPES[serviceId as keyof typeof ENV_GATED_SCOPES]
-  if (!gated) return ''
-  return (
-    `With \`${gated.envVar}\` set, Sim also requests ${renderScopeList(gated.scopes)}. ` +
-    `Add them to the app as well, or leave the flag unset.`
-  )
+  if (gated) {
+    notes.push(
+      `With \`${gated.envVar}\` set, Sim also requests ${renderScopeList(gated.scopes)}. ` +
+        `Add them to the app as well, or leave the flag unset.`
+    )
+  }
+
+  const caveat = SERVICE_SCOPE_NOTES[serviceId as keyof typeof SERVICE_SCOPE_NOTES]
+  if (caveat) notes.push(caveat)
+
+  return notes.join(' ')
 }
 
 const renderScopeList = (scopes: readonly string[]): string =>