@cogitator-ai/channels 0.16.0 → 0.18.0

package/dist/channels/teams/auth.js

@@ -0,0 +1,213 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { z } from 'zod';
+/** Where Bot Framework publishes the OpenID metadata of the tokens it signs requests with. */
+export const BOT_FRAMEWORK_OPENID_METADATA = 'https://login.botframework.com/v1/.well-known/openidconfiguration';
+/** The issuer of the tokens Bot Framework sends with every activity. */
+export const BOT_FRAMEWORK_ISSUER = 'https://api.botframework.com';
+/** How far the clocks of Bot Framework and the bot may differ, in seconds. */
+const CLOCK_SKEW = 300;
+/** How long signing keys are used before they are loaded again, in ms. */
+const KEYS_MAX_AGE = 24 * 60 * 60 * 1000;
+/** How often a token signed with a key the bot does not know may load the keys again, in ms. */
+const UNKNOWN_KEY_REFRESH = 5 * 60 * 1000;
+/** How long after the keys failed to load requests are refused before they are tried again, in ms. */
+const FAILED_LOAD_BACKOFF = 10 * 1000;
+/** How long loading the metadata or the keys may take by default, in ms. */
+const KEYS_TIMEOUT = 10_000;
+/** The longest token taken, in characters: Bot Framework tokens are about 1.5 KB. */
+const MAX_TOKEN_LENGTH = 16 * 1024;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+/** Why a request was refused: `401` for a token that does not prove Bot Framework sent it, `403` for one it may not use. */
+export class TeamsAuthError extends Error {
+    status;
+    constructor(status, message, options) {
+        super(`[teams] ${message}`, options);
+        this.status = status;
+        this.name = 'TeamsAuthError';
+    }
+}
+const HeaderSchema = z.object({
+    alg: z.string(),
+    kid: z.string().optional(),
+    x5t: z.string().optional(),
+});
+const ClaimsSchema = z.object({
+    iss: z.string(),
+    aud: z.union([z.string(), z.array(z.string())]),
+    exp: z.number(),
+    nbf: z.number().optional(),
+    serviceurl: z.string().optional(),
+    serviceUrl: z.string().optional(),
+});
+const MetadataSchema = z.object({ jwks_uri: z.string() });
+const JwkSchema = z.object({
+    kty: z.string(),
+    kid: z.string().optional(),
+    n: z.string().optional(),
+    e: z.string().optional(),
+    endorsements: z.array(z.string()).optional(),
+});
+const JwksSchema = z.object({ keys: z.array(z.unknown()) });
+function decodeSegment(segment) {
+    return JSON.parse(Buffer.from(segment, 'base64url').toString('utf-8'));
+}
+/**
+ * Checks the JWT Bot Framework sends with every activity, with no dependency but `node:crypto`:
+ * RS256 only, signed by a key of the published JWKS, issued by {@link BOT_FRAMEWORK_ISSUER} for
+ * the bot's App ID, and valid now within five minutes of clock skew. The keys are cached and
+ * loaded again once a day, and a token signed by a key not seen yet loads them again at most
+ * every five minutes, so a rotated key is picked up and a flood of forged ones costs nothing.
+ */
+export class TeamsTokenVerifier {
+    options;
+    metadataUrl;
+    fetchImpl;
+    now;
+    timeout;
+    keys = new Map();
+    loadedAt = 0;
+    lastUnknownRefresh = Number.NEGATIVE_INFINITY;
+    lastFailure = Number.NEGATIVE_INFINITY;
+    loading;
+    constructor(options) {
+        this.options = options;
+        this.metadataUrl = options.metadataUrl ?? BOT_FRAMEWORK_OPENID_METADATA;
+        this.fetchImpl = options.fetch ?? fetch;
+        this.now = options.now ?? Date.now;
+        this.timeout = options.timeout ?? KEYS_TIMEOUT;
+    }
+    /** Checks a token, resolving with what it proves, or throws a {@link TeamsAuthError}. */
+    async verify(token) {
+        if (token.length > MAX_TOKEN_LENGTH)
+            throw new TeamsAuthError(401, 'The token is too long');
+        const parts = token.split('.');
+        if (parts.length !== 3 || !parts.every((part) => BASE64URL.test(part))) {
+            throw new TeamsAuthError(401, 'The token is not a signed JWT');
+        }
+        const [headerPart, payloadPart, signaturePart] = parts;
+        let header;
+        let claims;
+        try {
+            header = HeaderSchema.parse(decodeSegment(headerPart));
+            claims = ClaimsSchema.parse(decodeSegment(payloadPart));
+        }
+        catch (error) {
+            throw new TeamsAuthError(401, 'The token cannot be read', { cause: error });
+        }
+        if (header.alg !== 'RS256') {
+            throw new TeamsAuthError(401, `The token is signed with ${header.alg}, not RS256`);
+        }
+        const kid = header.kid ?? header.x5t;
+        if (!kid)
+            throw new TeamsAuthError(401, 'The token names no signing key');
+        const signingKey = await this.keyFor(kid);
+        if (!signingKey)
+            throw new TeamsAuthError(401, 'The token is signed by an unknown key');
+        const signed = verify('RSA-SHA256', Buffer.from(`${headerPart}.${payloadPart}`), signingKey.key, Buffer.from(signaturePart, 'base64url'));
+        if (!signed)
+            throw new TeamsAuthError(401, 'The token signature is invalid');
+        if (claims.iss !== BOT_FRAMEWORK_ISSUER) {
+            throw new TeamsAuthError(401, 'The token was not issued by Bot Framework');
+        }
+        const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+        if (!audiences.includes(this.options.appId)) {
+            throw new TeamsAuthError(401, 'The token was issued for another app');
+        }
+        const seconds = this.now() / 1000;
+        if (seconds > claims.exp + CLOCK_SKEW)
+            throw new TeamsAuthError(401, 'The token expired');
+        if (claims.nbf !== undefined && seconds < claims.nbf - CLOCK_SKEW) {
+            throw new TeamsAuthError(401, 'The token is not valid yet');
+        }
+        const serviceUrl = claims.serviceurl ?? claims.serviceUrl;
+        return {
+            ...(serviceUrl !== undefined && { serviceUrl }),
+            endorsements: signingKey.endorsements,
+        };
+    }
+    /**
+     * The signing key of `kid`. Cached keys are used at once, and once they are a day old they are
+     * loaded again in the background. Only a cache that is still empty waits for the keys. A key
+     * the cache lacks loads them again, at most every five minutes.
+     */
+    async keyFor(kid) {
+        if (this.keys.size === 0)
+            await this.refresh();
+        else if (this.now() - this.loadedAt > KEYS_MAX_AGE)
+            void this.refresh().catch(() => undefined);
+        const known = this.keys.get(kid);
+        if (known)
+            return known;
+        if (this.now() - this.lastUnknownRefresh < UNKNOWN_KEY_REFRESH)
+            return undefined;
+        if (!this.loading && this.now() - this.lastFailure < FAILED_LOAD_BACKOFF)
+            return undefined;
+        this.lastUnknownRefresh = this.now();
+        await this.refresh().catch(() => undefined);
+        return this.keys.get(kid);
+    }
+    /**
+     * Loads the keys once for every caller waiting. After a failure no load is tried for ten
+     * seconds, however many requests come, and the keys loaded before stay in use.
+     */
+    refresh() {
+        if (this.loading)
+            return this.loading;
+        if (this.now() - this.lastFailure < FAILED_LOAD_BACKOFF) {
+            return Promise.reject(new TeamsAuthError(503, 'The Bot Framework signing keys could not be loaded'));
+        }
+        this.loading = this.load()
+            .catch((error) => {
+            this.lastFailure = this.now();
+            if (this.keys.size > 0) {
+                console.warn('[teams] Could not reload the Bot Framework signing keys:', error);
+            }
+            throw new TeamsAuthError(503, 'The Bot Framework signing keys could not be loaded', {
+                cause: error,
+            });
+        })
+            .finally(() => {
+            this.loading = undefined;
+        });
+        return this.loading;
+    }
+    async load() {
+        const metadata = MetadataSchema.parse(await this.json(this.metadataUrl));
+        const jwksUrl = new URL(metadata.jwks_uri);
+        if (jwksUrl.protocol !== 'https:' && new URL(this.metadataUrl).protocol === 'https:') {
+            throw new Error(`The JWKS address ${metadata.jwks_uri} is not https`);
+        }
+        const jwks = JwksSchema.parse(await this.json(jwksUrl.href));
+        const keys = new Map();
+        for (const entry of jwks.keys) {
+            const jwk = JwkSchema.safeParse(entry);
+            if (!jwk.success || jwk.data.kty !== 'RSA' || !jwk.data.kid || !jwk.data.n || !jwk.data.e) {
+                continue;
+            }
+            try {
+                const key = createPublicKey({
+                    key: { kty: 'RSA', n: jwk.data.n, e: jwk.data.e },
+                    format: 'jwk',
+                });
+                keys.set(jwk.data.kid, { key, endorsements: jwk.data.endorsements ?? [] });
+            }
+            catch {
+                continue;
+            }
+        }
+        if (keys.size === 0)
+            throw new Error('The JWKS holds no RSA keys');
+        this.keys = keys;
+        this.loadedAt = this.now();
+    }
+    async json(url) {
+        const response = await this.fetchImpl(url, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(this.timeout),
+        });
+        if (!response.ok)
+            throw new Error(`GET ${url} answered ${response.status}`);
+        return response.json();
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/channels/teams/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/channels/teams/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8FAA8F;AAC9F,MAAM,CAAC,MAAM,6BAA6B,GACxC,mEAAmE,CAAC;AACtE,wEAAwE;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAEnE,8EAA8E;AAC9E,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,0EAA0E;AAC1E,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,gGAAgG;AAChG,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,4EAA4E;AAC5E,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,4HAA4H;AAC5H,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B;IADX,YACW,MAAuB,EAChC,OAAe,EACf,OAA6B;QAE7B,KAAK,CAAC,WAAW,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAJ5B,WAAM,GAAN,MAAM,CAAiB;QAKhC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE1D,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AA2B5D,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IAWA;IAVZ,WAAW,CAAS;IACpB,SAAS,CAAe;IACxB,GAAG,CAAe;IAClB,OAAO,CAAS;IACzB,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IACrC,QAAQ,GAAG,CAAC,CAAC;IACb,kBAAkB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC9C,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACvC,OAAO,CAAiB;IAEhC,YAA6B,OAAkC;QAAlC,YAAO,GAAP,OAAO,CAA2B;QAC7D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,6BAA6B,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;IACjD,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;QACvD,IAAI,MAAoC,CAAC;QACzC,IAAI,MAAoC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;YACvD,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,4BAA4B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,MAAM,CACnB,YAAY,EACZ,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,WAAW,EAAE,CAAC,EAC3C,UAAU,CAAC,GAAG,EACd,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CACxC,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACxC,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,IAAI,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,UAAU;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;YAClE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;QAC1D,OAAO;YACL,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,YAAY,EAAE,UAAU,CAAC,YAAY;SACtC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,MAAM,CAAC,GAAW;QAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;aAC1C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;YAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,GAAG,mBAAmB;YAAE,OAAO,SAAS,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAC3F,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACK,OAAO;QACb,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,mBAAmB,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,cAAc,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE;aACvB,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,oDAAoD,EAAE;gBAClF,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,QAAQ,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,eAAe,CAAC;oBAC1B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE;oBACjD,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACzC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/channels/teams/cards.d.ts

@@ -0,0 +1,23 @@
+import type { ChannelButton } from '@cogitator-ai/types';
+/** The content type of an Adaptive Card attachment. */
+export declare const ADAPTIVE_CARD = "application/vnd.microsoft.card.adaptive";
+/** The content type of the card that asks a user to accept a file upload. */
+export declare const FILE_CONSENT_CARD = "application/vnd.microsoft.teams.card.file.consent";
+/** The content type of the card that shows an uploaded file. */
+export declare const FILE_INFO_CARD = "application/vnd.microsoft.teams.card.file.info";
+/** The `verb` of the `Action.Execute` buttons the channel sends. */
+export declare const TEAMS_ACTION_VERB = "cogitator";
+/** An Adaptive Card, as JSON. */
+export type AdaptiveCard = Record<string, unknown>;
+/**
+ * An Adaptive Card with rows of buttons, one action set per row. A button with `data` is an
+ * `Action.Execute` that falls back to `Action.Submit` on clients without Universal Actions, a
+ * `url` opens it, `copyText` shows the text to copy, and a disabled button is shown as text in
+ * its color, since older clients cannot disable actions.
+ */
+export declare function buttonsCard(rows: ChannelButton[][]): AdaptiveCard;
+/** The button data of an `Action.Submit` press, the `value` of the message it sends. */
+export declare function submitDataOf(value: unknown): string | undefined;
+/** The button data of an `Action.Execute` press, the `value` of its `adaptiveCard/action` invoke. */
+export declare function executeDataOf(value: unknown): string | undefined;
+//# sourceMappingURL=cards.d.ts.map

package/dist/channels/teams/cards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cards.d.ts","sourceRoot":"","sources":["../../../src/channels/teams/cards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,uDAAuD;AACvD,eAAO,MAAM,aAAa,4CAA4C,CAAC;AACvE,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,sDAAsD,CAAC;AACrF,gEAAgE;AAChE,eAAO,MAAM,cAAc,mDAAmD,CAAC;AAC/E,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C,iCAAiC;AACjC,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA2CnD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,YAAY,CAqBjE;AAYD,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIhE"}

package/dist/channels/teams/cards.js

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+/** The content type of an Adaptive Card attachment. */
+export const ADAPTIVE_CARD = 'application/vnd.microsoft.card.adaptive';
+/** The content type of the card that asks a user to accept a file upload. */
+export const FILE_CONSENT_CARD = 'application/vnd.microsoft.teams.card.file.consent';
+/** The content type of the card that shows an uploaded file. */
+export const FILE_INFO_CARD = 'application/vnd.microsoft.teams.card.file.info';
+/** The `verb` of the `Action.Execute` buttons the channel sends. */
+export const TEAMS_ACTION_VERB = 'cogitator';
+const STYLES = {
+    primary: 'positive',
+    success: 'positive',
+    danger: 'destructive',
+};
+const COLORS = {
+    primary: 'accent',
+    success: 'good',
+    danger: 'attention',
+};
+function actionOf(button) {
+    const style = button.style ? { style: STYLES[button.style] } : {};
+    if (button.url !== undefined) {
+        return { type: 'Action.OpenUrl', title: button.text, url: button.url, ...style };
+    }
+    if (button.copyText !== undefined) {
+        return {
+            type: 'Action.ShowCard',
+            title: button.text,
+            card: {
+                type: 'AdaptiveCard',
+                body: [{ type: 'TextBlock', text: button.copyText, wrap: true, fontType: 'Monospace' }],
+            },
+        };
+    }
+    if (button.data !== undefined) {
+        const data = { [TEAMS_ACTION_VERB]: button.data };
+        return {
+            type: 'Action.Execute',
+            title: button.text,
+            verb: TEAMS_ACTION_VERB,
+            data,
+            ...style,
+            fallback: { type: 'Action.Submit', title: button.text, data, ...style },
+        };
+    }
+    throw new Error(`[teams] Button "${button.text}" needs data, url, copyText or disabled`);
+}
+/**
+ * An Adaptive Card with rows of buttons, one action set per row. A button with `data` is an
+ * `Action.Execute` that falls back to `Action.Submit` on clients without Universal Actions, a
+ * `url` opens it, `copyText` shows the text to copy, and a disabled button is shown as text in
+ * its color, since older clients cannot disable actions.
+ */
+export function buttonsCard(rows) {
+    const body = [];
+    for (const row of rows) {
+        for (const button of row.filter((candidate) => candidate.disabled)) {
+            body.push({
+                type: 'TextBlock',
+                text: button.text,
+                weight: 'Bolder',
+                wrap: true,
+                ...(button.style && { color: COLORS[button.style] }),
+            });
+        }
+        const actions = row.filter((button) => !button.disabled).map(actionOf);
+        if (actions.length > 0)
+            body.push({ type: 'ActionSet', actions });
+    }
+    return {
+        type: 'AdaptiveCard',
+        $schema: 'http://adaptivecards.io/schemas/adaptive-card.json',
+        version: '1.4',
+        body,
+    };
+}
+const SubmitValueSchema = z.object({ [TEAMS_ACTION_VERB]: z.string() });
+const ExecuteValueSchema = z.object({
+    action: z.object({
+        type: z.string().optional(),
+        verb: z.string().optional(),
+        data: z.unknown().optional(),
+    }),
+});
+/** The button data of an `Action.Submit` press, the `value` of the message it sends. */
+export function submitDataOf(value) {
+    const parsed = SubmitValueSchema.safeParse(value);
+    return parsed.success ? parsed.data[TEAMS_ACTION_VERB] : undefined;
+}
+/** The button data of an `Action.Execute` press, the `value` of its `adaptiveCard/action` invoke. */
+export function executeDataOf(value) {
+    const parsed = ExecuteValueSchema.safeParse(value);
+    if (!parsed.success || parsed.data.action.verb !== TEAMS_ACTION_VERB)
+        return undefined;
+    return submitDataOf(parsed.data.action.data);
+}
+//# sourceMappingURL=cards.js.map

package/dist/channels/teams/cards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cards.js","sourceRoot":"","sources":["../../../src/channels/teams/cards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,uDAAuD;AACvD,MAAM,CAAC,MAAM,aAAa,GAAG,yCAAyC,CAAC;AACvE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AACrF,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAC/E,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAK7C,MAAM,MAAM,GAAwD;IAClE,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,aAAa;CACtB,CAAC;AAEF,MAAM,MAAM,GAAwD;IAClE,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF,SAAS,QAAQ,CAAC,MAAqB;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;aACxF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,IAAI,EAAE,iBAAiB;YACvB,IAAI;YACJ,GAAG,KAAK;YACR,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,IAAI,yCAAyC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,IAAI,GAA8B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,IAAI;gBACV,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,oDAAoD;QAC7D,OAAO,EAAE,KAAK;QACd,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAExE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,SAAS,CAAC;IACvF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC"}

package/dist/channels/teams/channel.d.ts

@@ -0,0 +1,303 @@
+import { type RequestListener } from 'node:http';
+import type { Attachment, Channel, ChannelAction, ChannelButton, ChannelMessage, SendOptions } from '@cogitator-ai/types';
+import { type TeamsRetryOptions } from './client.js';
+import { type TeamsTokenProvider } from './token.js';
+/** The largest message Teams is advised to take, in bytes of the activity JSON. */
+export declare const TEAMS_MAX_MESSAGE_BYTES: number;
+/**
+ * The longest text sent as one message, in characters: JSON takes at most six bytes for one
+ * character (`\u0001`), so this many stay under {@link TEAMS_MAX_MESSAGE_BYTES} whatever they are.
+ */
+export declare const TEAMS_MESSAGE_CHARS: number;
+/** The port of the channel's own server by default, the port Bot Framework samples use. */
+export declare const TEAMS_DEFAULT_PORT = 3978;
+/** The path of the channel's own server by default, the messaging endpoint of Azure Bot Service. */
+export declare const TEAMS_DEFAULT_PATH = "/api/messages";
+/** The Bot Connector of the commercial cloud, for conversations no activity came from yet. */
+export declare const TEAMS_GLOBAL_SERVICE_URL = "https://smba.trafficmanager.net/teams/";
+/** The largest webhook body the channel's own server takes by default, in bytes. */
+export declare const TEAMS_DEFAULT_MAX_BODY: number;
+/**
+ * The shortest time between two updates of one message, in ms, so a streamed answer takes at
+ * most one of the 60 requests a conversation may have in 30 seconds every second, and new
+ * messages always find room.
+ */
+export declare const TEAMS_MIN_EDIT_INTERVAL = 1000;
+/**
+ * The kind of the app registration, as Azure Bot Service names it. New bots are single-tenant
+ * or use a user-assigned managed identity: multi-tenant bots cannot be created since July 2025.
+ */
+export type TeamsAppType = 'SingleTenant' | 'MultiTenant' | 'UserAssignedMSI';
+export interface TeamsWebhookConfig {
+    /**
+     * Run an HTTP server of the channel's own on this port. Without it, mount `handleWebhook` or
+     * `webhookListener()` in a server of yours.
+     */
+    port?: number;
+    /** The path of the channel's own server (default `/api/messages`) */
+    path?: string;
+    host?: string;
+    /** The largest body taken, in bytes (default 1 MB), larger ones get `413` */
+    maxBody?: number;
+    /**
+     * Plain HTTP routes served on the same port, by path, such as the webhook of another channel:
+     * `{ '/github/webhook': github.webhookListener() }`. Other paths answer `404`.
+     */
+    routes?: Record<string, RequestListener>;
+}
+export interface TeamsChannelConfig {
+    /** The Microsoft App ID of the bot's app registration */
+    appId: string;
+    /** A client secret of the app registration, which outbound tokens are requested with */
+    appPassword?: string;
+    /** The tenant of the app registration: required for a single-tenant bot */
+    tenantId?: string;
+    /** Default `SingleTenant` */
+    appType?: TeamsAppType;
+    /**
+     * A function that returns a Bot Connector token, in place of `appPassword`: required for
+     * `UserAssignedMSI`, such as a token of the managed identity from `@azure/identity`.
+     */
+    tokenProvider?: TeamsTokenProvider;
+    /** The server Bot Framework posts activities to. Without `port` mount `handleWebhook` */
+    webhook?: TeamsWebhookConfig;
+    /**
+     * The tenants whose users the bot answers, or `'*'` for every tenant the app is installed in.
+     * Default: the bot's own `tenantId`, so an app installed elsewhere answers nobody there.
+     */
+    tenants?: string[] | '*';
+    /** Answer only these users, by Entra object id (`aadObjectId`) or Teams user id */
+    users?: string[];
+    /**
+     * Which messages of group chats and channels the bot answers: `mention` (default) only those
+     * that @mention it, `all` every message it receives. Teams delivers messages without a mention
+     * only when the app has the resource-specific consent `ChannelMessage.Read.Group` or
+     * `ChatMessage.Read.Chat`. Personal chats are always answered.
+     */
+    trigger?: 'mention' | 'all';
+    /**
+     * The Bot Connector of conversations no activity came from since the start, such as a reminder
+     * after a restart (default the commercial cloud, {@link TEAMS_GLOBAL_SERVICE_URL}).
+     */
+    serviceUrl?: string;
+    /**
+     * The hosts a service URL may have, such as `smba.trafficmanager.net`. Activities naming
+     * another are refused. Default: any service URL a verified token was issued for.
+     */
+    serviceUrlHosts?: string[];
+    /** How requests Teams throttles or fails for a moment are tried again */
+    retry?: TeamsRetryOptions;
+    /** How long one Bot Connector request may take, in ms (default 30 000) */
+    requestTimeout?: number;
+    /** The OpenID metadata of inbound tokens (default Bot Framework's), for tests */
+    openIdMetadataUrl?: string;
+    /** Where outbound tokens come from (default `https://login.microsoftonline.com`), for tests and national clouds */
+    loginUrl?: string;
+    fetch?: typeof fetch;
+}
+/** A webhook request, as any HTTP server hands it over. */
+export interface TeamsWebhookRequest {
+    method: string;
+    headers: Record<string, string | string[] | undefined>;
+    /** The body as received */
+    rawBody?: string | Uint8Array;
+}
+export interface TeamsWebhookResponse {
+    status: number;
+    body: string;
+    /** `application/json` for the answer to an invoke, `text/plain` otherwise */
+    contentType: string;
+}
+/**
+ * Markdown with its images turned into links (`![alt](url)` becomes `[alt](url)`) and raw
+ * `<img>` tags into text, outside code: Teams loads an image as soon as it shows the message,
+ * so an answer steered by injected text could send what it read to any address in an image URL.
+ */
+export declare function withoutImages(text: string): string;
+/** Splits text into the messages Teams takes: at most {@link TEAMS_MESSAGE_CHARS} characters each. */
+export declare function splitTeamsText(text: string): string[];
+/**
+ * A Microsoft Teams channel on the Bot Framework protocol, with no SDK: Bot Framework posts
+ * activities to a webhook, each checked against its signed JWT, and answers go back through the
+ * Bot Connector REST API with a client credentials token of the app registration.
+ *
+ * Each chat is a conversation: `channelId` is the Teams conversation id of a personal or group
+ * chat, or of a team channel, whose threads are topics (`topicId` is the thread's root message
+ * id), so each channel thread is a conversation of its own. In group chats and channels the bot
+ * answers @mentions, without the mention in the text. Buttons are Adaptive Cards, answers are
+ * Markdown and can be edited, so they stream.
+ */
+export declare class TeamsChannel implements Channel {
+    readonly type = "teams";
+    readonly editable = true;
+    readonly nativeMarkdown = true;
+    readonly maxMessageChars: number;
+    private readonly config;
+    private readonly tenantId?;
+    private readonly verifier;
+    private readonly credentials;
+    private readonly client;
+    private readonly fetchImpl;
+    private handler;
+    private actionHandler;
+    /** Activities taken, by `conversation|id`, so one sent again is handled once */
+    private readonly delivered;
+    /** Messages handed to the gateway whose handler has not resolved yet, by delivery key */
+    private readonly inFlight;
+    /** Messages of `inFlight` the gateway handed back while they were being taken */
+    private readonly refused;
+    /** The delivery key of each message handed over, by message id */
+    private readonly deliveryKeys;
+    private readonly conversations;
+    private readonly sent;
+    private readonly updates;
+    private readonly pacer;
+    /** Conversations whose messages Teams blocks (`MessageWritesBlocked`), by pacing key */
+    private readonly blocked;
+    /** Messages whose webhook request was answered before the gateway took them, by delivery key */
+    private readonly answeredEarly;
+    private readonly activeRequests;
+    /** Waits that end at once when the channel stops */
+    private readonly onHalt;
+    /** Aborts every request and wait under way when the channel stops */
+    private halt;
+    private readonly answers;
+    /** The conversation of each button press, to answer it with a message once its request is over */
+    private readonly actionConversations;
+    private readonly uploads;
+    private server?;
+    private running;
+    private stopped;
+    constructor(config: TeamsChannelConfig);
+    onMessage(handler: (msg: ChannelMessage) => Promise<void>): void;
+    onAction(handler: (action: ChannelAction) => Promise<void>): void;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    /**
+     * Takes back a message the gateway does not answer because it stops. One it refuses while it
+     * is being handed over gets its webhook request answered `503`. One it dropped after its
+     * request was answered cannot come again, since Bot Framework does not send an activity twice
+     * once it was taken, so it is logged.
+     */
+    redeliver(msg: ChannelMessage): Promise<void>;
+    /**
+     * Answers a request Bot Framework posts: checks its token, answers at once and hands the
+     * activity to the agent after. A button press of an Adaptive Card (`Action.Execute`) is
+     * answered with the press's answer in the response, within a few seconds. Mount it in any HTTP
+     * server with the raw body. It works before `start()` too, answers a message `503` while no
+     * `onMessage` handler is set, so Bot Framework sends it again, and answers `503` once stopped.
+     */
+    handleWebhook(request: TeamsWebhookRequest): Promise<TeamsWebhookResponse>;
+    /**
+     * A Node request listener that answers Bot Framework's requests on any path it is mounted at.
+     * Bodies over `webhook.maxBody` (1 MB by default) are refused with `413`.
+     */
+    webhookListener(): RequestListener;
+    /**
+     * Sends `text` to the conversation `channelId`, in the channel thread of `topicId`, as several
+     * messages when it is longer than one holds. With `replyTo` the first one replies to that
+     * message, and `buttons` go under the last as an Adaptive Card. Resolves with the id of the
+     * first message.
+     */
+    sendText(channelId: string, text: string, options?: SendOptions): Promise<string>;
+    /**
+     * Replaces the text of a message the bot sent, keeping its buttons as they are now, also when
+     * a change of them is still on its way, unless `buttons` are given. Updates of one message go
+     * out one at a time, at least {@link TEAMS_MIN_EDIT_INTERVAL} apart and behind new messages
+     * when the conversation nears its limits, and those made meanwhile are folded into the next,
+     * the latest text winning, so a streamed answer never queues more than Teams takes.
+     */
+    editText(channelId: string, messageId: string, text: string, options?: SendOptions): Promise<void>;
+    /** Replaces the buttons of a message the bot sent, or removes them with `null`. */
+    editButtons(channelId: string, messageId: string, buttons: ChannelButton[][] | null): Promise<void>;
+    /** Deletes a message the bot sent. */
+    deleteMessage(channelId: string, messageId: string): Promise<void>;
+    /**
+     * Shows the typing indicator. It is skipped when the conversation has no room for it now, or
+     * Teams blocks the bot's messages there, since a late indicator says nothing.
+     */
+    sendTyping(channelId: string, options?: Pick<SendOptions, 'topicId'>): Promise<void>;
+    /**
+     * Sends a file. A `buffer` goes out in personal chats only: Teams asks the user to accept it
+     * with a file consent card and the file is uploaded to their OneDrive once they do, which needs
+     * `supportsFiles` in the app manifest. Bots cannot upload files to group chats and channels
+     * without Microsoft Graph, so there a file needs a public `url`: an image is shown inline,
+     * another file is sent as a link. Resolves with the id of the message sent.
+     */
+    sendFile(channelId: string, file: Attachment, options?: SendOptions): Promise<string>;
+    /**
+     * Answers a button press. An `Action.Execute` press still waiting for its answer gets it in
+     * the response, shown to the user who pressed. Otherwise a `text` is sent to the conversation
+     * as a message, since Teams has no other way to answer a press. An `alert`, meant for the one
+     * who pressed only (such as "this prompt expired"), is not posted where everyone reads it.
+     */
+    answerAction(actionId: string, options?: {
+        text?: string;
+        alert?: boolean;
+    }): Promise<void>;
+    private allowedTenants;
+    /** Whether the sender of an activity may talk to the bot: by their tenant and the user list. */
+    private admits;
+    private allowsServiceUrl;
+    /** Remembers the Bot Connector and kind of the conversation of a verified activity. */
+    private rememberConversation;
+    private serviceUrlOf;
+    private typeOf;
+    /**
+     * Calls the Bot Connector for a conversation, paced by its limits. A conversation where Teams
+     * blocks the bot's messages is not called again until an activity comes from it, and nothing
+     * is called once the channel stopped: its waits and requests under way are aborted.
+     */
+    private call;
+    /** Where a message of an activity goes: the chat, and the channel thread it is in. */
+    private placeOf;
+    /**
+     * Hands a message to the gateway and answers its request once the gateway took it, or after
+     * a few seconds. One the gateway refuses because it stops is answered `503`, and one it gives
+     * back after its request was answered is logged by `redeliver`.
+     */
+    private handOver;
+    private receive;
+    /**
+     * The files of a message the agent can read: files sent in a personal chat, by their download
+     * URL, and inline images, downloaded with the bot's token from the Bot Connector the activity
+     * came through (and from nowhere else, so the token never leaves it).
+     */
+    private inboundAttachments;
+    private download;
+    /** The action of a button press, from an `Action.Submit` message or an `Action.Execute` invoke. */
+    private actionOf;
+    private press;
+    private invoke;
+    /**
+     * Answers an `Action.Execute` press within the time Teams waits: with the text the press is
+     * answered with, or else the message's card once the press is handled (so it shows what the
+     * press changed, such as an approval's decision), or as it is when time runs out.
+     */
+    private execute;
+    /**
+     * Uploads a file the user accepted, in the conversation the consent card was sent to. A card
+     * the bot no longer knows (it restarted, or the file expired) and a declined one are answered
+     * with a short message.
+     */
+    private consented;
+    private upload;
+    private expireUploads;
+    /** Posts a message activity, as a reply to `replyTo` when given, and remembers what it holds. */
+    private post;
+    /**
+     * Updates a message the bot sent (`PUT`), one update of it at a time: changes made while one
+     * is under way are folded into the next, which sends the latest state.
+     */
+    private update;
+    /**
+     * Sends the updates of a message one at a time. When one fails while a newer state waits,
+     * the newer one is still sent, so a streamed answer ends with its final text, and only a
+     * failure of the latest state reaches the callers.
+     */
+    private drainUpdates;
+    private listen;
+}
+/** A Microsoft Teams channel on the Bot Framework protocol. */
+export declare function teamsChannel(config: TeamsChannelConfig): TeamsChannel;
+//# sourceMappingURL=channel.d.ts.map