@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.9022f22

package/dist/packages/server/src/teams/runner.d.ts

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import { type CredentialKey } from "../secrets.js";
+import { type Fetch } from "../../../connector-kit/src/types.js";
+import { type ClaudeFactory, type SessionState } from "./claude.js";
+import type { RunRow, TeamsStore, TriggerRow } from "./store.js";
+export declare const CLAUDE_RUNNER = "claude-managed-agents";
+export type RunnerContext = {
+    teams: Pick<TeamsStore, "claudeKey">;
+    key: CredentialKey;
+    publicUrl: string | null;
+};
+export type RunnerTrigger = Pick<TriggerRow, "agentId" | "runner" | "settings" | "managedAgentId" | "environmentId" | "vaultIds">;
+export type RunInput = {
+    org: string;
+    agentId: string;
+    runId: string;
+    botId: string;
+    requestedBy: string;
+    text: string;
+    replyToken: string;
+    budgetCents: number;
+    trigger: TriggerRow;
+    secret: string | null;
+};
+export type EventRunInput = {
+    org: string;
+    agentId: string;
+    runId: string;
+    text: string;
+    budgetCents: number;
+    trigger: RunnerTrigger;
+    secret: string | null;
+    event: {
+        app: string;
+        type: string;
+        deliveryId: string;
+        data: Record<string, unknown>;
+    };
+};
+export type RunnerRun = Pick<RunRow, "sessionId" | "replyCount"> & {
+    awaitsReply?: boolean;
+};
+export type RunCounts = {
+    active: number;
+    lastHour: number;
+    spentToday: number;
+};
+export type Caps = Pick<TriggerRow, "budgetCents" | "maxRunsPerHour" | "maxCentsPerDay" | "maxConcurrent">;
+/** The cap one more run would pass, or null: runs in the last hour, spending in 24 hours
+ *  (what was spent plus every live run's budget), runs at once. */
+export declare function capReached(counts: RunCounts, caps: Caps): "hour" | "day" | "concurrent" | null;
+export interface TriggerRunner {
+    id: string;
+    settings: z.ZodType<Record<string, unknown>>;
+    unready(org: string): Promise<string | null>;
+    verify(trigger: RunnerTrigger, org: string, secret: string | null, when: "save" | "answer"): Promise<void>;
+    start(input: RunInput): Promise<string>;
+    startEvent?(input: EventRunInput): Promise<string>;
+    continue(sessionId: string, input: RunInput): Promise<void>;
+    state(run: RunnerRun, org: string): Promise<SessionState | {
+        gone: string;
+    }>;
+    stop(sessionId: string, org: string): Promise<void>;
+}
+export type RunnerFactory = (ctx: RunnerContext) => TriggerRunner;
+export declare const triggerAad: (org: string, agentId: string) => string;
+/** The trigger's signing secret, opened, or null when it has none. */
+export declare function openTriggerSecret(key: CredentialKey, org: string, trigger: TriggerRow): string | null;
+/** Claude Managed Agents with the organization's own Claude key (providers row anthropic). Its
+ *  settings are the trigger's managedAgentId, environmentId and vaultIds. */
+export declare const claudeManagedAgents: (claude?: ClaudeFactory) => RunnerFactory;
+export declare const SIGNATURE_HEADER = "x-agent-connect-signature";
+/** `t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">`; receivers reject an old `t`. */
+export declare function signature(secret: string, body: string, t?: number): string;
+/** A signed POST of the message and its context to the trigger's `url`, for any agent
+ *  framework. The receiver answers through MCP teams_reply with the reply token and this
+ *  agent's own key, as a Claude agent does. It reports no cost; the trigger's caps still
+ *  apply. A run is answered once a reply arrives, and stopped after the turn timeout. An app
+ *  event is posted as `type: "event"` with its data and needs no reply: 2xx answers it. */
+export declare const signedWebhook: (fetchImpl?: Fetch) => RunnerFactory;

package/dist/packages/server/src/teams/runner.js

@@ -0,0 +1,187 @@
+import { createHmac } from "node:crypto";
+import { z } from "zod";
+import { brand } from "../../../connector-kit/src/branding.js";
+import { credentialAad } from "../secrets.js";
+import { InvalidInput } from "../service.js";
+import { ConnectError } from "../../../connector-kit/src/types.js";
+import { agentMcpUrl, claudeClient, verifyTrigger, } from "./claude.js";
+// What answers a Teams message, or an app's event, once the core decided it should be answered
+// (who may ask, reply mode, the caps, the reply token and teams_reply stay in teams/runtime.ts;
+// matching, limits and caps for events in events/runtime.ts, whatever the runner).
+export const CLAUDE_RUNNER = "claude-managed-agents";
+/** The cap one more run would pass, or null: runs in the last hour, spending in 24 hours
+ *  (what was spent plus every live run's budget), runs at once. */
+export function capReached(counts, caps) {
+    if (counts.lastHour >= caps.maxRunsPerHour)
+        return "hour";
+    if (counts.spentToday + caps.budgetCents * (counts.active + 1) > caps.maxCentsPerDay)
+        return "day";
+    if (counts.active >= caps.maxConcurrent)
+        return "concurrent";
+    return null;
+}
+export const triggerAad = (org, agentId) => credentialAad(org, `teams-trigger:${agentId}`);
+/** The trigger's signing secret, opened, or null when it has none. */
+export function openTriggerSecret(key, org, trigger) {
+    if (!trigger.secret || !trigger.secretKeyId)
+        return null;
+    return String(key.open({ ciphertext: trigger.secret, keyId: trigger.secretKeyId }, triggerAad(org, trigger.agentId)).secret);
+}
+/** Claude Managed Agents with the organization's own Claude key (providers row anthropic). Its
+ *  settings are the trigger's managedAgentId, environmentId and vaultIds. */
+export const claudeManagedAgents = (claude = claudeClient) => (ctx) => {
+    async function claudeFor(org) {
+        const row = await ctx.teams.claudeKey(org);
+        if (!row)
+            return null;
+        const { api_key } = ctx.key.open({ ciphertext: row.credential, keyId: row.credentialKeyId }, credentialAad(org, "provider:anthropic"));
+        return claude(api_key);
+    }
+    async function need(org) {
+        const c = await claudeFor(org);
+        if (!c)
+            throw new ConnectError("Set your organization's Claude API key first");
+        return c;
+    }
+    return {
+        id: CLAUDE_RUNNER,
+        settings: z.strictObject({}),
+        async unready(org) {
+            return (await ctx.teams.claudeKey(org)) ? null : "organization has no Claude API key";
+        },
+        async verify(trigger, org, _secret, when) {
+            if (!trigger.managedAgentId || !trigger.environmentId)
+                throw new InvalidInput("Choose the Claude agent and environment");
+            if (!ctx.publicUrl)
+                throw new ConnectError("This deployment has no public address");
+            const c = await need(org);
+            await verifyTrigger(c, ctx.publicUrl, trigger.agentId, {
+                managedAgentId: trigger.managedAgentId,
+                vaultIds: trigger.vaultIds,
+            });
+            if (when === "save" && !(await c.environmentExists(trigger.environmentId)))
+                throw new ConnectError("Claude has no environment with that id under your organization's key");
+        },
+        async start(input) {
+            return (await need(input.org)).createSession({
+                agentId: input.trigger.managedAgentId,
+                environmentId: input.trigger.environmentId,
+                vaultIds: input.trigger.vaultIds,
+                budgetCents: input.budgetCents,
+                metadata: {
+                    source: `${brand().resourcePrefix}-teams`,
+                    agent: input.agentId,
+                    bot: input.botId,
+                    run: input.runId,
+                    requested_by: input.requestedBy,
+                },
+                text: input.text,
+            });
+        },
+        async startEvent(input) {
+            return (await need(input.org)).createSession({
+                agentId: input.trigger.managedAgentId,
+                environmentId: input.trigger.environmentId,
+                vaultIds: input.trigger.vaultIds,
+                budgetCents: input.budgetCents,
+                metadata: {
+                    source: `${brand().resourcePrefix}-events`,
+                    agent: input.agentId,
+                    run: input.runId,
+                    app: input.event.app,
+                    event: input.event.type,
+                },
+                text: input.text,
+            });
+        },
+        async continue(sessionId, input) {
+            await (await need(input.org)).sendMessage(sessionId, input.text, input.budgetCents);
+        },
+        async state(run, org) {
+            const c = await claudeFor(org);
+            if (!c)
+                return { gone: "Claude API key removed" };
+            return (await c.session(run.sessionId)) ?? { gone: "The Claude session is gone" };
+        },
+        // Without the key there is nothing left to stop it with.
+        async stop(sessionId, org) {
+            await (await claudeFor(org))?.interrupt(sessionId);
+        },
+    };
+};
+export const SIGNATURE_HEADER = "x-agent-connect-signature";
+/** `t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">`; receivers reject an old `t`. */
+export function signature(secret, body, t = Math.floor(Date.now() / 1000)) {
+    return `t=${t},v1=${createHmac("sha256", secret).update(`${t}.${body}`).digest("hex")}`;
+}
+/** A signed POST of the message and its context to the trigger's `url`, for any agent
+ *  framework. The receiver answers through MCP teams_reply with the reply token and this
+ *  agent's own key, as a Claude agent does. It reports no cost; the trigger's caps still
+ *  apply. A run is answered once a reply arrives, and stopped after the turn timeout. An app
+ *  event is posted as `type: "event"` with its data and needs no reply: 2xx answers it. */
+export const signedWebhook = (fetchImpl = fetch) => (ctx) => {
+    async function post(trigger, secret, payload) {
+        if (!secret)
+            throw new InvalidInput("Give the webhook a signing secret");
+        const body = JSON.stringify(payload);
+        const res = await fetchImpl(String(trigger.settings.url), {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                [SIGNATURE_HEADER]: signature(secret, body),
+            },
+            body,
+            redirect: "error",
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok)
+            throw new ConnectError(`The webhook answered ${res.status}`);
+    }
+    const mcpUrl = (agentId) => ctx.publicUrl ? agentMcpUrl(ctx.publicUrl, agentId) : null;
+    const message = (input) => ({
+        type: "message",
+        run: input.runId,
+        agent: input.agentId,
+        bot: input.botId,
+        requestedBy: input.requestedBy,
+        text: input.text,
+        replyToken: input.replyToken,
+        mcpUrl: mcpUrl(input.agentId),
+    });
+    return {
+        id: "webhook",
+        settings: z.strictObject({ url: z.url({ protocol: /^https$/ }) }),
+        unready: async () => null,
+        async verify(trigger, _org, secret, when) {
+            if (when === "save")
+                await post(trigger, secret, { type: "ping", agent: trigger.agentId });
+        },
+        async start(input) {
+            await post(input.trigger, input.secret, message(input));
+            return `webhook:${input.runId}`;
+        },
+        async startEvent(input) {
+            await post(input.trigger, input.secret, {
+                type: "event",
+                run: input.runId,
+                agent: input.agentId,
+                app: input.event.app,
+                event: input.event.type,
+                deliveryId: input.event.deliveryId,
+                data: input.event.data,
+                text: input.text,
+                mcpUrl: mcpUrl(input.agentId),
+            });
+            return `webhook:${input.runId}`;
+        },
+        async continue(_sessionId, input) {
+            await post(input.trigger, input.secret, message(input));
+        },
+        async state(run) {
+            const answered = run.awaitsReply === false || run.replyCount > 0;
+            return { status: answered ? "idle" : "running", costCents: 0, atBudget: false };
+        },
+        async stop() { },
+    };
+};
+//# sourceMappingURL=runner.js.map

package/dist/packages/server/src/teams/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../../../packages/server/src/teams/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,wCAAwC,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAsB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAc,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,GAGd,MAAM,aAAa,CAAC;AAGrB,+FAA+F;AAC/F,gGAAgG;AAChG,mFAAmF;AAEnF,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAoDrD;mEACmE;AACnE,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,IAAU;IACtD,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC;IAC1D,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc;QAClF,OAAO,KAAK,CAAC;IACf,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,YAAY,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AA6BD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,OAAe,EAAE,EAAE,CACzD,aAAa,CAAC,GAAG,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAC;AAEjD,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,GAAkB,EAAE,GAAW,EAAE,OAAmB;IACpF,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,MAAM,CACX,GAAG,CAAC,IAAI,CACN,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,EAC1D,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CACjC,CAAC,MAAM,CACT,CAAC;AACJ,CAAC;AAED;6EAC6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAC9B,CAAC,SAAwB,YAAY,EAAiB,EAAE,CACxD,CAAC,GAAG,EAAE,EAAE;IACN,KAAK,UAAU,SAAS,CAAC,GAAW;QAClC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAC9B,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,eAAe,EAAE,EAC1D,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CACzC,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,UAAU,IAAI,CAAC,GAAW;QAC7B,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,8CAA8C,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oCAAoC,CAAC;QACxF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI;YACtC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,aAAa;gBACnD,MAAM,IAAI,YAAY,CAAC,yCAAyC,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG,CAAC,SAAS;gBAAE,MAAM,IAAI,YAAY,CAAC,uCAAuC,CAAC,CAAC;YACpF,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE;gBACrD,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;gBACxE,MAAM,IAAI,YAAY,CACpB,sEAAsE,CACvE,CAAC;QACN,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC3C,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,cAAe;gBACtC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAc;gBAC3C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;gBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE;oBACR,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,cAAc,QAAQ;oBACzC,KAAK,EAAE,KAAK,CAAC,OAAO;oBACpB,GAAG,EAAE,KAAK,CAAC,KAAK;oBAChB,GAAG,EAAE,KAAK,CAAC,KAAK;oBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;iBAChC;gBACD,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC3C,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,cAAe;gBACtC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAc;gBAC3C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;gBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE;oBACR,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,cAAc,SAAS;oBAC1C,KAAK,EAAE,KAAK,CAAC,OAAO;oBACpB,GAAG,EAAE,KAAK,CAAC,KAAK;oBAChB,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;oBACpB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;iBACxB;gBACD,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK;YAC7B,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG;YAClB,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;QACrF,CAAC;QACD,yDAAyD;QACzD,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG;YACvB,MAAM,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACvF,OAAO,KAAK,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;;2FAI2F;AAC3F,MAAM,CAAC,MAAM,aAAa,GACxB,CAAC,YAAmB,KAAK,EAAiB,EAAE,CAC5C,CAAC,GAAG,EAAE,EAAE;IACN,KAAK,UAAU,IAAI,CAAC,OAAsB,EAAE,MAAqB,EAAE,OAAgB;QACjF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC;aAC5C;YACD,IAAI;YACJ,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,YAAY,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,KAAK,CAAC,KAAK;QAChB,KAAK,EAAE,KAAK,CAAC,OAAO;QACpB,GAAG,EAAE,KAAK,CAAC,KAAK;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACzB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;YACtC,IAAI,IAAI,KAAK,MAAM;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,OAAO,WAAW,KAAK,CAAC,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE;gBACtC,IAAI,EAAE,OAAO;gBACb,GAAG,EAAE,KAAK,CAAC,KAAK;gBAChB,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBACvB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;gBAClC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC;YACH,OAAO,WAAW,KAAK,CAAC,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK;YAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG;YACb,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,KAAK,KAAK,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAClF,CAAC;QACD,KAAK,CAAC,IAAI,KAAI,CAAC;KAChB,CAAC;AACJ,CAAC,CAAC"}

package/dist/packages/server/src/teams/runtime.d.ts

@@ -0,0 +1,91 @@
+import { type Connector } from "../../../connector-kit/src/connector.js";
+import { type CredentialKey } from "../secrets.js";
+import type { Store } from "../store.js";
+import { type VendorResponse } from "../../../connector-kit/src/types.js";
+import { type ThreadMessage } from "./activity.js";
+import { type ApprovalFact, type ApprovalRow } from "./approval.js";
+import { type BotClient, type BotCredential } from "./bot.js";
+import { type TriggerRunner } from "./runner.js";
+import { type BotAuth } from "./jwt.js";
+import type { BotRow, ConversationRow, RunRow, TeamsStore } from "./store.js";
+/** The body as text, or null once it passes `max` bytes (read no further). */
+export declare function readCapped(req: Request, max?: number): Promise<string | null>;
+/** The body as sent (a signature covers these bytes), or null once it passes `max`. */
+export declare function readCappedBytes(req: Request, max: number): Promise<Buffer | null>;
+export declare const botAad: (org: string, botId: string) => string;
+/** The bot's sign-in: its app id, tenant, certificate and private key. */
+export declare function botCredential(key: CredentialKey, bot: BotRow): BotCredential;
+export type TeamsRuntimeDeps = {
+    store: Store;
+    teams: TeamsStore;
+    key: CredentialKey;
+    auth: BotAuth;
+    bots: BotClient;
+    runners: Map<string, TriggerRunner>;
+    connector: Connector | null;
+    publicUrl: string | null;
+};
+export declare function createTeamsRuntime(deps: TeamsRuntimeDeps): {
+    inbound: (botAppId: string, req: Request) => Promise<Response>;
+    kick: () => void;
+    watch: () => Promise<void>;
+    /** Drains the queue now and then (events from a worker that stopped) and watches sessions
+     *  every few seconds. */
+    start(): void;
+    /** Stops claiming events and waits for the one in hand, so a rollout neither strands it
+     *  in 'processing' nor answers it twice. */
+    stop(): Promise<void>;
+    /** What an agent's Teams tools reach: only its own bot. */
+    access(bot: BotRow): TeamsAccess;
+    /** Settles the queue (tests). */
+    idle: () => Promise<void>;
+};
+export type TeamsRuntime = ReturnType<typeof createTeamsRuntime>;
+export type GraphMessage = {
+    id?: string;
+    createdDateTime?: string;
+    messageType?: string;
+    from?: {
+        user?: {
+            displayName?: string;
+            id?: string;
+            userIdentityType?: string;
+        };
+        application?: {
+            displayName?: string;
+            id?: string;
+        };
+    } | null;
+    body?: {
+        content?: string;
+        contentType?: string;
+    };
+    replyToId?: string | null;
+};
+export declare function simplify(list: GraphMessage[]): ThreadMessage[];
+export type TeamsAccess = {
+    places(): Promise<ConversationRow[]>;
+    graph(path: string): Promise<VendorResponse>;
+    listChannels(team: ConversationRow): Promise<VendorResponse>;
+    post(serviceUrl: string, conversation: string, text: string, replyTo?: string): Promise<VendorResponse>;
+    newThread(team: ConversationRow, channelId: string, text: string): Promise<VendorResponse>;
+    postCard(serviceUrl: string, conversation: string, card: Record<string, unknown>): Promise<VendorResponse>;
+    newThreadCard(team: ConversationRow, channelId: string, card: Record<string, unknown>): Promise<VendorResponse>;
+    createApproval(input: {
+        tokenHash: string;
+        conversationId: string;
+        serviceUrl: string;
+        approverAadId: string;
+        approverName: string;
+        title: string;
+        body: string;
+        facts: ApprovalFact[];
+        days: number;
+    }): Promise<ApprovalRow>;
+    approvalPosted(id: string, threadId: string, activityId: string): Promise<void>;
+    discardApproval(id: string): Promise<void>;
+    approval(tokenHash: string): Promise<ApprovalRow | null>;
+    runForReply(tokenHash: string): Promise<RunRow | null>;
+    claimReply(runId: string): Promise<boolean>;
+    releaseReply(runId: string): Promise<void>;
+};