@codeam/shared 2.61.64 → 2.61.66

package/dist/index.d.mts

@@ -469,6 +469,18 @@ interface IntegrationDefinition {
          *  resolves the credential by delegating to the source integration, and the
          *  client renders it as "part of <source>" with no Connect action of its own. */
         aliasOf?: IntegrationId;
+        /** SECONDARY api-key / PAT path for a PRIMARY OAuth integration. OAuth
+         *  (`kind`) stays the primary/preferred flow; this lets the user paste a
+         *  personal access token instead — a fallback while the vendor's OAuth app
+         *  is in review, or a permanent alternative (like GitHub OAuth + PAT).
+         *  ⚠️ The PAT often needs a DIFFERENT delivery env var than the OAuth token
+         *  (e.g. Figma: OAuth → `FIGMA_OAUTH_TOKEN`/Bearer, PAT →
+         *  `FIGMA_API_KEY`/`X-Figma-Token`), so it carries its OWN `envMapping` used
+         *  INSTEAD of `delivery.mcp.envMapping` when the credential was linked via PAT. */
+        apiKeyFallback?: {
+            fields: IntegrationApiKeyField[];
+            envMapping: Record<string, string>;
+        };
     };
     delivery: IntegrationDelivery;
 }
@@ -575,7 +587,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.d.ts

@@ -469,6 +469,18 @@ interface IntegrationDefinition {
          *  resolves the credential by delegating to the source integration, and the
          *  client renders it as "part of <source>" with no Connect action of its own. */
         aliasOf?: IntegrationId;
+        /** SECONDARY api-key / PAT path for a PRIMARY OAuth integration. OAuth
+         *  (`kind`) stays the primary/preferred flow; this lets the user paste a
+         *  personal access token instead — a fallback while the vendor's OAuth app
+         *  is in review, or a permanent alternative (like GitHub OAuth + PAT).
+         *  ⚠️ The PAT often needs a DIFFERENT delivery env var than the OAuth token
+         *  (e.g. Figma: OAuth → `FIGMA_OAUTH_TOKEN`/Bearer, PAT →
+         *  `FIGMA_API_KEY`/`X-Figma-Token`), so it carries its OWN `envMapping` used
+         *  INSTEAD of `delivery.mcp.envMapping` when the credential was linked via PAT. */
+        apiKeyFallback?: {
+            fields: IntegrationApiKeyField[];
+            envMapping: Record<string, string>;
+        };
     };
     delivery: IntegrationDelivery;
 }
@@ -575,7 +587,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.js

@@ -840,13 +840,43 @@ var INTEGRATION_REGISTRY = {
     name: "Microsoft Teams",
     icon: "microsoft_teams",
     category: "comms",
-    // COMING SOON — placeholder catalog entry (no OAuth provider / MCP yet). The
-    // agent will post review pings + read threads AS THE USER over Microsoft Graph
-    // once the provider lands. `enabled:false` renders it as a dimmed "coming
-    // soon" tile inside the (live) comms category.
-    enabled: false,
-    auth: { kind: "oauth_redirect" },
-    delivery: {}
+    // LIVE — Microsoft identity platform v2.0 OAuth (multi-tenant, Confidential).
+    // The agent reads chats/channels + posts AS THE USER over Microsoft Graph.
+    // MS_TEAMS_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager (prod+dev);
+    // the backend TeamsOAuthProvider is config-gated (503 if env unset).
+    // ⚠️ Chat.* + ChannelMessage.Read.All (`.All`) require TENANT-ADMIN consent
+    // (MC1163922, Oct-2025) — the connecting user must be an org admin, or their
+    // IT admin approves the app for the tenant. Not a self-serve funnel like Slack.
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Delegated Microsoft Graph scopes. `offline_access` → rotating refresh
+      // (Teams access tokens are ~1h). ⚠️ Changing these requires the user to
+      // RE-LINK — the token carries only the scopes granted at link time.
+      scopes: [
+        "User.Read",
+        "User.ReadBasic.All",
+        "Team.ReadBasic.All",
+        "Channel.ReadBasic.All",
+        "ChannelMessage.Read.All",
+        "ChannelMessage.Send",
+        "Chat.Read",
+        "Chat.ReadWrite",
+        "offline_access"
+      ]
+    },
+    delivery: {
+      mcp: {
+        // @floriscornel/teams-mcp (Node): BYO Graph access token via AUTH_TOKEN
+        // (env only, never argv). Headless. Version PINNED; bump only after
+        // re-verifying headless. Tools: get/send channel + chat messages, replies.
+        command: "npx",
+        args: ["-y", "@floriscornel/teams-mcp@0.9.0"],
+        envMapping: {
+          AUTH_TOKEN: "accessToken"
+        }
+      }
+    }
   },
   google_chat: {
     id: "google_chat",
@@ -1117,11 +1147,12 @@ var INTEGRATION_REGISTRY = {
     name: "Figma",
     icon: "figma",
     category: "design",
-    // DARK — pending Figma's OAuth-app review approval (submitted 2026-07-16).
-    // Figma OAuth apps do NOT exist publicly until review passes (authorize URL
-    // errors "OAuth app ... doesn't exist"). Backend provider + secrets are
-    // already deployed; flip to true once approved (bead codeagent-m4ix).
-    enabled: false,
+    // LIVE. OAuth is the PRIMARY flow (app pending Figma's review — until it
+    // passes the authorize URL errors "OAuth app doesn't exist"), so a PAT
+    // fallback (`apiKeyFallback`) ships alongside it and works TODAY: the user
+    // pastes a Figma personal access token. Same OAuth-primary + PAT-secondary
+    // shape as GitHub. Flip of the OAuth review is transparent (bead codeagent-m4ix).
+    enabled: true,
     auth: {
       kind: "oauth_redirect",
       // Granular READ-ONLY scopes (legacy `files:read` is deprecated for
@@ -1135,7 +1166,25 @@ var INTEGRATION_REGISTRY = {
         "file_metadata:read",
         "file_dev_resources:read",
         "library_content:read"
-      ]
+      ],
+      // SECONDARY: paste a Figma personal access token instead of OAuth. The
+      // PAT uses the `X-Figma-Token` header, so the delivery env var differs
+      // from OAuth (`FIGMA_API_KEY` vs `FIGMA_OAUTH_TOKEN`) — hence its own
+      // envMapping, used when the credential was linked via PAT.
+      apiKeyFallback: {
+        fields: [
+          {
+            key: "accessToken",
+            label: "Figma personal access token",
+            placeholder: "figd_\u2026",
+            secret: true,
+            help: "Figma \u2192 Settings \u2192 Security \u2192 Personal access tokens (read-only scopes)."
+          }
+        ],
+        envMapping: {
+          FIGMA_API_KEY: "accessToken"
+        }
+      }
     },
     delivery: {
       mcp: {
@@ -1782,7 +1831,6 @@ var INTEGRATION_BRANDING = {
 };
 var UPCOMING_INTEGRATION_IDS = [
   "gmail",
-  "figma",
   "asana",
   "stripe",
   "pendo",