@codeam/shared 2.61.63 → 2.61.65

package/dist/index.d.mts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -462,6 +462,13 @@ interface IntegrationDefinition {
          *  (performed by the module that owns the connection, not by the generic
          *  integrations OAuth path). */
         connection?: DerivedCredentialSource;
+        /** For `kind: 'derived'` — the OTHER integration whose vaulted credential
+         *  this one reuses (Confluence → `jira`, since one Atlassian OAuth + the one
+         *  `mcp-atlassian` server serves both). Like `derivedFrom` but the source is
+         *  a vault-backed integration, not a `ProviderToken` connection: the backend
+         *  resolves the credential by delegating to the source integration, and the
+         *  client renders it as "part of <source>" with no Connect action of its own. */
+        aliasOf?: IntegrationId;
     };
     delivery: IntegrationDelivery;
 }

package/dist/index.d.ts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -462,6 +462,13 @@ interface IntegrationDefinition {
          *  (performed by the module that owns the connection, not by the generic
          *  integrations OAuth path). */
         connection?: DerivedCredentialSource;
+        /** For `kind: 'derived'` — the OTHER integration whose vaulted credential
+         *  this one reuses (Confluence → `jira`, since one Atlassian OAuth + the one
+         *  `mcp-atlassian` server serves both). Like `derivedFrom` but the source is
+         *  a vault-backed integration, not a `ProviderToken` connection: the backend
+         *  resolves the credential by delegating to the source integration, and the
+         *  client renders it as "part of <source>" with no Connect action of its own. */
+        aliasOf?: IntegrationId;
     };
     delivery: IntegrationDelivery;
 }

package/dist/index.js

@@ -840,13 +840,43 @@ var INTEGRATION_REGISTRY = {
     name: "Microsoft Teams",
     icon: "microsoft_teams",
     category: "comms",
-    // COMING SOON — placeholder catalog entry (no OAuth provider / MCP yet). The
-    // agent will post review pings + read threads AS THE USER over Microsoft Graph
-    // once the provider lands. `enabled:false` renders it as a dimmed "coming
-    // soon" tile inside the (live) comms category.
-    enabled: false,
-    auth: { kind: "oauth_redirect" },
-    delivery: {}
+    // LIVE — Microsoft identity platform v2.0 OAuth (multi-tenant, Confidential).
+    // The agent reads chats/channels + posts AS THE USER over Microsoft Graph.
+    // MS_TEAMS_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager (prod+dev);
+    // the backend TeamsOAuthProvider is config-gated (503 if env unset).
+    // ⚠️ Chat.* + ChannelMessage.Read.All (`.All`) require TENANT-ADMIN consent
+    // (MC1163922, Oct-2025) — the connecting user must be an org admin, or their
+    // IT admin approves the app for the tenant. Not a self-serve funnel like Slack.
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Delegated Microsoft Graph scopes. `offline_access` → rotating refresh
+      // (Teams access tokens are ~1h). ⚠️ Changing these requires the user to
+      // RE-LINK — the token carries only the scopes granted at link time.
+      scopes: [
+        "User.Read",
+        "User.ReadBasic.All",
+        "Team.ReadBasic.All",
+        "Channel.ReadBasic.All",
+        "ChannelMessage.Read.All",
+        "ChannelMessage.Send",
+        "Chat.Read",
+        "Chat.ReadWrite",
+        "offline_access"
+      ]
+    },
+    delivery: {
+      mcp: {
+        // @floriscornel/teams-mcp (Node): BYO Graph access token via AUTH_TOKEN
+        // (env only, never argv). Headless. Version PINNED; bump only after
+        // re-verifying headless. Tools: get/send channel + chat messages, replies.
+        command: "npx",
+        args: ["-y", "@floriscornel/teams-mcp@0.9.0"],
+        envMapping: {
+          AUTH_TOKEN: "accessToken"
+        }
+      }
+    }
   },
   google_chat: {
     id: "google_chat",
@@ -1455,6 +1485,34 @@ var INTEGRATION_REGISTRY = {
         }
       }
     }
+  },
+  confluence: {
+    id: "confluence",
+    name: "Confluence",
+    icon: "confluence",
+    category: "docs",
+    // Confluence is served by the SAME Atlassian OAuth + the SAME `mcp-atlassian`
+    // server as Jira (the `jira` entry already requests Confluence scopes). This
+    // entry is a DISPLAY ALIAS so Confluence is explicit in the Knowledge tab: it
+    // BORROWS jira's vaulted credential (`aliasOf: 'jira'`) and has no link flow of
+    // its own — connecting Atlassian (the Jira/Atlassian card) lights it up, and
+    // the backend resolves its token by delegating to `jira`.
+    enabled: true,
+    auth: { kind: "derived", aliasOf: "jira" },
+    delivery: {
+      mcp: {
+        // Same mcp-atlassian server + BYO-token env as Jira — it exposes the
+        // Confluence tools when the deploy selects Confluence without Jira. If
+        // BOTH are selected the deploy manifest dedupes identical MCP specs.
+        command: "uvx",
+        args: ["mcp-atlassian==0.22.1"],
+        envMapping: {
+          ATLASSIAN_OAUTH_ACCESS_TOKEN: "accessToken",
+          ATLASSIAN_OAUTH_CLOUD_ID: "cloudId"
+        },
+        staticEnv: { ATLASSIAN_OAUTH_ENABLE: "true" }
+      }
+    }
   }
 };
 function getEnabledIntegrations() {
@@ -1533,6 +1591,14 @@ var INTEGRATION_BRANDING = {
     brandColor: "#357DE8",
     logoSvg: '<svg viewBox="0 0 32 32" height="32" xmlns="http://www.w3.org/2000/svg" focusable="false" aria-hidden="true"><defs><linearGradient id="uid18" x1="14.8402" y1="15.8324" x2="8.6599" y2="26.5369" gradientUnits="userSpaceOnUse"><stop stop-color="#2684FF" stop-opacity="0.4" offset="0%"></stop><stop stop-color="#2684FF" offset="0.9228"></stop></linearGradient></defs><path fill="url(#uid18)" d="M11.6397 14.0398C11.2789 13.643 10.7378 13.679 10.4852 14.148L4.64091 25.8728C4.42446 26.3418 4.74912 26.8829 5.25419 26.8829H13.4074C13.6599 26.8829 13.9125 26.7386 14.0207 26.4861C15.7885 22.8424 14.7061 17.3227 11.6397 14.0398Z"></path><path fill="#357DE8" d="M15.9343 3.36124C12.6513 8.55622 12.8678 14.2923 15.0324 18.6215C17.1969 22.9506 18.8565 26.2336 18.9647 26.4861C19.0729 26.7386 19.3254 26.8829 19.578 26.8829H27.7312C28.2363 26.8829 28.597 26.3418 28.3445 25.8728C28.3445 25.8728 17.3774 3.93846 17.0887 3.39732C16.8723 2.89225 16.259 2.85618 15.9343 3.36124Z"></path></svg>'
   },
+  confluence: {
+    id: "confluence",
+    name: "Confluence",
+    vendor: "Atlassian",
+    tagline: "Part of Atlassian \xB7 docs & wiki",
+    brandColor: "#1868DB",
+    logoSvg: '<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Confluence</title><path fill="#FFFFFF" d="M.87 18.257c-.248.382-.53.875-.763 1.245a.764.764 0 0 0 .255 1.04l4.965 3.054a.764.764 0 0 0 1.058-.26c.199-.332.454-.763.733-1.221 1.967-3.247 3.945-2.853 7.508-1.146l4.957 2.337a.764.764 0 0 0 1.028-.382l2.364-5.346a.764.764 0 0 0-.382-1c-1.048-.494-3.124-1.478-4.965-2.361C10.911 10.97 5.224 11.185.87 18.257zM23.131 5.743c.249-.405.531-.875.764-1.25a.764.764 0 0 0-.256-1.034L18.675.404a.764.764 0 0 0-1.058.26c-.195.335-.451.763-.734 1.225-1.966 3.246-3.945 2.85-7.508 1.146L4.437.694a.764.764 0 0 0-1.027.382L1.046 6.422a.764.764 0 0 0 .382 1c1.039.49 3.105 1.467 4.965 2.361 6.698 3.246 12.392 3.029 16.738-4.04z"/></svg>'
+  },
   slack: {
     id: "slack",
     name: "Slack",