@cogitator-ai/channels 0.17.0 → 0.18.1

package/dist/channels/teams/activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../../src/channels/teams/activity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,IAAI,EAAE,aAAa;IACnB,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,kBAAkB;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAWH,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,OAAgB;IAClE,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,GAAG,SAAS,GAAG,aAAa,GAAG,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,kBAAkB,CAAC,EAAU,EAAE,QAAiB;IAC9D,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAC3C,OAAO,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAuB;IAC9C,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC;AAC7F,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC;IACxD,OAAO,CACL,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAC9F,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,MAAM,CAAC,QAAuB;IAC5C,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,8FAA8F;AAC9F,SAAS,WAAW,CAAC,QAAuB;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,WAAW,CAAC,QAAuB;IACjD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAuB;IACxD,IAAI,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAAC,QAAuB;IACnD,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,OAAO;YAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,oDAAoD,CAAC;AAEvF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAC5B,UAA2B;IAE3B,IAAI,UAAU,CAAC,WAAW,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,GAA2B;IACzC,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,eAAe;IACnB,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,kBAAkB;IACxB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,yEAAyE;IAC/E,IAAI,EAAE,mEAAmE;IACzE,IAAI,EAAE,2EAA2E;CAClF,CAAC;AAEF,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAClD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAClD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,QAA4B;IACrD,OAAO,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,0BAA0B,CAAC;AACjF,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACxC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC"}

package/dist/channels/teams/auth.d.ts

@@ -0,0 +1,65 @@
+/** Where Bot Framework publishes the OpenID metadata of the tokens it signs requests with. */
+export declare const BOT_FRAMEWORK_OPENID_METADATA = "https://login.botframework.com/v1/.well-known/openidconfiguration";
+/** The issuer of the tokens Bot Framework sends with every activity. */
+export declare const BOT_FRAMEWORK_ISSUER = "https://api.botframework.com";
+/** Why a request was refused: `401` for a token that does not prove Bot Framework sent it, `403` for one it may not use. */
+export declare class TeamsAuthError extends Error {
+    readonly status: 401 | 403 | 503;
+    constructor(status: 401 | 403 | 503, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** A token Bot Framework signed: the service URL it was issued for and the channels its key may sign for. */
+export interface VerifiedTeamsToken {
+    /** The `serviceurl` claim: the only Bot Connector the activity may be answered through */
+    serviceUrl?: string;
+    /** The channels the signing key is endorsed for, such as `msteams` */
+    endorsements: readonly string[];
+}
+export interface TeamsTokenVerifierOptions {
+    /** The bot's Microsoft App ID, the audience every token must name */
+    appId: string;
+    /** The OpenID metadata URL (default {@link BOT_FRAMEWORK_OPENID_METADATA}) */
+    metadataUrl?: string;
+    fetch?: typeof fetch;
+    /** The current time in ms, for tests */
+    now?: () => number;
+    /** How long loading the metadata or the keys may take, in ms (default 10 000) */
+    timeout?: number;
+}
+/**
+ * Checks the JWT Bot Framework sends with every activity, with no dependency but `node:crypto`:
+ * RS256 only, signed by a key of the published JWKS, issued by {@link BOT_FRAMEWORK_ISSUER} for
+ * the bot's App ID, and valid now within five minutes of clock skew. The keys are cached and
+ * loaded again once a day, and a token signed by a key not seen yet loads them again at most
+ * every five minutes, so a rotated key is picked up and a flood of forged ones costs nothing.
+ */
+export declare class TeamsTokenVerifier {
+    private readonly options;
+    private readonly metadataUrl;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly timeout;
+    private keys;
+    private loadedAt;
+    private lastUnknownRefresh;
+    private lastFailure;
+    private loading?;
+    constructor(options: TeamsTokenVerifierOptions);
+    /** Checks a token, resolving with what it proves, or throws a {@link TeamsAuthError}. */
+    verify(token: string): Promise<VerifiedTeamsToken>;
+    /**
+     * The signing key of `kid`. Cached keys are used at once, and once they are a day old they are
+     * loaded again in the background. Only a cache that is still empty waits for the keys. A key
+     * the cache lacks loads them again, at most every five minutes.
+     */
+    private keyFor;
+    /**
+     * Loads the keys once for every caller waiting. After a failure no load is tried for ten
+     * seconds, however many requests come, and the keys loaded before stay in use.
+     */
+    private refresh;
+    private load;
+    private json;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/channels/teams/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/channels/teams/auth.ts"],"names":[],"mappings":"AAGA,8FAA8F;AAC9F,eAAO,MAAM,6BAA6B,sEAC2B,CAAC;AACtE,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,iCAAiC,CAAC;AAgBnE,4HAA4H;AAC5H,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG;gBAAvB,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKhC;AA6BD,6GAA6G;AAC7G,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,yBAAyB;IACxC,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAWD;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAWjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAVpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,IAAI,CAAiC;IAC7C,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,kBAAkB,CAA4B;IACtD,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,OAAO,CAAC,CAAgB;gBAEH,OAAO,EAAE,yBAAyB;IAO/D,yFAAyF;IACnF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgDxD;;;;OAIG;YACW,MAAM;IAYpB;;;OAGG;IACH,OAAO,CAAC,OAAO;YAuBD,IAAI;YA4BJ,IAAI;CAQnB"}

package/dist/channels/teams/auth.js

@@ -0,0 +1,213 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { z } from 'zod';
+/** Where Bot Framework publishes the OpenID metadata of the tokens it signs requests with. */
+export const BOT_FRAMEWORK_OPENID_METADATA = 'https://login.botframework.com/v1/.well-known/openidconfiguration';
+/** The issuer of the tokens Bot Framework sends with every activity. */
+export const BOT_FRAMEWORK_ISSUER = 'https://api.botframework.com';
+/** How far the clocks of Bot Framework and the bot may differ, in seconds. */
+const CLOCK_SKEW = 300;
+/** How long signing keys are used before they are loaded again, in ms. */
+const KEYS_MAX_AGE = 24 * 60 * 60 * 1000;
+/** How often a token signed with a key the bot does not know may load the keys again, in ms. */
+const UNKNOWN_KEY_REFRESH = 5 * 60 * 1000;
+/** How long after the keys failed to load requests are refused before they are tried again, in ms. */
+const FAILED_LOAD_BACKOFF = 10 * 1000;
+/** How long loading the metadata or the keys may take by default, in ms. */
+const KEYS_TIMEOUT = 10_000;
+/** The longest token taken, in characters: Bot Framework tokens are about 1.5 KB. */
+const MAX_TOKEN_LENGTH = 16 * 1024;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+/** Why a request was refused: `401` for a token that does not prove Bot Framework sent it, `403` for one it may not use. */
+export class TeamsAuthError extends Error {
+    status;
+    constructor(status, message, options) {
+        super(`[teams] ${message}`, options);
+        this.status = status;
+        this.name = 'TeamsAuthError';
+    }
+}
+const HeaderSchema = z.object({
+    alg: z.string(),
+    kid: z.string().optional(),
+    x5t: z.string().optional(),
+});
+const ClaimsSchema = z.object({
+    iss: z.string(),
+    aud: z.union([z.string(), z.array(z.string())]),
+    exp: z.number(),
+    nbf: z.number().optional(),
+    serviceurl: z.string().optional(),
+    serviceUrl: z.string().optional(),
+});
+const MetadataSchema = z.object({ jwks_uri: z.string() });
+const JwkSchema = z.object({
+    kty: z.string(),
+    kid: z.string().optional(),
+    n: z.string().optional(),
+    e: z.string().optional(),
+    endorsements: z.array(z.string()).optional(),
+});
+const JwksSchema = z.object({ keys: z.array(z.unknown()) });
+function decodeSegment(segment) {
+    return JSON.parse(Buffer.from(segment, 'base64url').toString('utf-8'));
+}
+/**
+ * Checks the JWT Bot Framework sends with every activity, with no dependency but `node:crypto`:
+ * RS256 only, signed by a key of the published JWKS, issued by {@link BOT_FRAMEWORK_ISSUER} for
+ * the bot's App ID, and valid now within five minutes of clock skew. The keys are cached and
+ * loaded again once a day, and a token signed by a key not seen yet loads them again at most
+ * every five minutes, so a rotated key is picked up and a flood of forged ones costs nothing.
+ */
+export class TeamsTokenVerifier {
+    options;
+    metadataUrl;
+    fetchImpl;
+    now;
+    timeout;
+    keys = new Map();
+    loadedAt = 0;
+    lastUnknownRefresh = Number.NEGATIVE_INFINITY;
+    lastFailure = Number.NEGATIVE_INFINITY;
+    loading;
+    constructor(options) {
+        this.options = options;
+        this.metadataUrl = options.metadataUrl ?? BOT_FRAMEWORK_OPENID_METADATA;
+        this.fetchImpl = options.fetch ?? fetch;
+        this.now = options.now ?? Date.now;
+        this.timeout = options.timeout ?? KEYS_TIMEOUT;
+    }
+    /** Checks a token, resolving with what it proves, or throws a {@link TeamsAuthError}. */
+    async verify(token) {
+        if (token.length > MAX_TOKEN_LENGTH)
+            throw new TeamsAuthError(401, 'The token is too long');
+        const parts = token.split('.');
+        if (parts.length !== 3 || !parts.every((part) => BASE64URL.test(part))) {
+            throw new TeamsAuthError(401, 'The token is not a signed JWT');
+        }
+        const [headerPart, payloadPart, signaturePart] = parts;
+        let header;
+        let claims;
+        try {
+            header = HeaderSchema.parse(decodeSegment(headerPart));
+            claims = ClaimsSchema.parse(decodeSegment(payloadPart));
+        }
+        catch (error) {
+            throw new TeamsAuthError(401, 'The token cannot be read', { cause: error });
+        }
+        if (header.alg !== 'RS256') {
+            throw new TeamsAuthError(401, `The token is signed with ${header.alg}, not RS256`);
+        }
+        const kid = header.kid ?? header.x5t;
+        if (!kid)
+            throw new TeamsAuthError(401, 'The token names no signing key');
+        const signingKey = await this.keyFor(kid);
+        if (!signingKey)
+            throw new TeamsAuthError(401, 'The token is signed by an unknown key');
+        const signed = verify('RSA-SHA256', Buffer.from(`${headerPart}.${payloadPart}`), signingKey.key, Buffer.from(signaturePart, 'base64url'));
+        if (!signed)
+            throw new TeamsAuthError(401, 'The token signature is invalid');
+        if (claims.iss !== BOT_FRAMEWORK_ISSUER) {
+            throw new TeamsAuthError(401, 'The token was not issued by Bot Framework');
+        }
+        const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+        if (!audiences.includes(this.options.appId)) {
+            throw new TeamsAuthError(401, 'The token was issued for another app');
+        }
+        const seconds = this.now() / 1000;
+        if (seconds > claims.exp + CLOCK_SKEW)
+            throw new TeamsAuthError(401, 'The token expired');
+        if (claims.nbf !== undefined && seconds < claims.nbf - CLOCK_SKEW) {
+            throw new TeamsAuthError(401, 'The token is not valid yet');
+        }
+        const serviceUrl = claims.serviceurl ?? claims.serviceUrl;
+        return {
+            ...(serviceUrl !== undefined && { serviceUrl }),
+            endorsements: signingKey.endorsements,
+        };
+    }
+    /**
+     * The signing key of `kid`. Cached keys are used at once, and once they are a day old they are
+     * loaded again in the background. Only a cache that is still empty waits for the keys. A key
+     * the cache lacks loads them again, at most every five minutes.
+     */
+    async keyFor(kid) {
+        if (this.keys.size === 0)
+            await this.refresh();
+        else if (this.now() - this.loadedAt > KEYS_MAX_AGE)
+            void this.refresh().catch(() => undefined);
+        const known = this.keys.get(kid);
+        if (known)
+            return known;
+        if (this.now() - this.lastUnknownRefresh < UNKNOWN_KEY_REFRESH)
+            return undefined;
+        if (!this.loading && this.now() - this.lastFailure < FAILED_LOAD_BACKOFF)
+            return undefined;
+        this.lastUnknownRefresh = this.now();
+        await this.refresh().catch(() => undefined);
+        return this.keys.get(kid);
+    }
+    /**
+     * Loads the keys once for every caller waiting. After a failure no load is tried for ten
+     * seconds, however many requests come, and the keys loaded before stay in use.
+     */
+    refresh() {
+        if (this.loading)
+            return this.loading;
+        if (this.now() - this.lastFailure < FAILED_LOAD_BACKOFF) {
+            return Promise.reject(new TeamsAuthError(503, 'The Bot Framework signing keys could not be loaded'));
+        }
+        this.loading = this.load()
+            .catch((error) => {
+            this.lastFailure = this.now();
+            if (this.keys.size > 0) {
+                console.warn('[teams] Could not reload the Bot Framework signing keys:', error);
+            }
+            throw new TeamsAuthError(503, 'The Bot Framework signing keys could not be loaded', {
+                cause: error,
+            });
+        })
+            .finally(() => {
+            this.loading = undefined;
+        });
+        return this.loading;
+    }
+    async load() {
+        const metadata = MetadataSchema.parse(await this.json(this.metadataUrl));
+        const jwksUrl = new URL(metadata.jwks_uri);
+        if (jwksUrl.protocol !== 'https:' && new URL(this.metadataUrl).protocol === 'https:') {
+            throw new Error(`The JWKS address ${metadata.jwks_uri} is not https`);
+        }
+        const jwks = JwksSchema.parse(await this.json(jwksUrl.href));
+        const keys = new Map();
+        for (const entry of jwks.keys) {
+            const jwk = JwkSchema.safeParse(entry);
+            if (!jwk.success || jwk.data.kty !== 'RSA' || !jwk.data.kid || !jwk.data.n || !jwk.data.e) {
+                continue;
+            }
+            try {
+                const key = createPublicKey({
+                    key: { kty: 'RSA', n: jwk.data.n, e: jwk.data.e },
+                    format: 'jwk',
+                });
+                keys.set(jwk.data.kid, { key, endorsements: jwk.data.endorsements ?? [] });
+            }
+            catch {
+                continue;
+            }
+        }
+        if (keys.size === 0)
+            throw new Error('The JWKS holds no RSA keys');
+        this.keys = keys;
+        this.loadedAt = this.now();
+    }
+    async json(url) {
+        const response = await this.fetchImpl(url, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(this.timeout),
+        });
+        if (!response.ok)
+            throw new Error(`GET ${url} answered ${response.status}`);
+        return response.json();
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/channels/teams/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/channels/teams/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8FAA8F;AAC9F,MAAM,CAAC,MAAM,6BAA6B,GACxC,mEAAmE,CAAC;AACtE,wEAAwE;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAEnE,8EAA8E;AAC9E,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,0EAA0E;AAC1E,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,gGAAgG;AAChG,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,4EAA4E;AAC5E,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,4HAA4H;AAC5H,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B;IADX,YACW,MAAuB,EAChC,OAAe,EACf,OAA6B;QAE7B,KAAK,CAAC,WAAW,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAJ5B,WAAM,GAAN,MAAM,CAAiB;QAKhC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE1D,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AA2B5D,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IAWA;IAVZ,WAAW,CAAS;IACpB,SAAS,CAAe;IACxB,GAAG,CAAe;IAClB,OAAO,CAAS;IACzB,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IACrC,QAAQ,GAAG,CAAC,CAAC;IACb,kBAAkB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC9C,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACvC,OAAO,CAAiB;IAEhC,YAA6B,OAAkC;QAAlC,YAAO,GAAP,OAAO,CAA2B;QAC7D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,6BAA6B,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;IACjD,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;QACvD,IAAI,MAAoC,CAAC;QACzC,IAAI,MAAoC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;YACvD,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,4BAA4B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,MAAM,CACnB,YAAY,EACZ,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,WAAW,EAAE,CAAC,EAC3C,UAAU,CAAC,GAAG,EACd,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CACxC,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACxC,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,IAAI,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,UAAU;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;YAClE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;QAC1D,OAAO;YACL,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,YAAY,EAAE,UAAU,CAAC,YAAY;SACtC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,MAAM,CAAC,GAAW;QAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;aAC1C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;YAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,GAAG,mBAAmB;YAAE,OAAO,SAAS,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAC3F,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACK,OAAO;QACb,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,mBAAmB,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,cAAc,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE;aACvB,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,oDAAoD,EAAE;gBAClF,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,QAAQ,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,eAAe,CAAC;oBAC1B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE;oBACjD,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACzC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/channels/teams/cards.d.ts

@@ -0,0 +1,23 @@
+import type { ChannelButton } from '@cogitator-ai/types';
+/** The content type of an Adaptive Card attachment. */
+export declare const ADAPTIVE_CARD = "application/vnd.microsoft.card.adaptive";
+/** The content type of the card that asks a user to accept a file upload. */
+export declare const FILE_CONSENT_CARD = "application/vnd.microsoft.teams.card.file.consent";
+/** The content type of the card that shows an uploaded file. */
+export declare const FILE_INFO_CARD = "application/vnd.microsoft.teams.card.file.info";
+/** The `verb` of the `Action.Execute` buttons the channel sends. */
+export declare const TEAMS_ACTION_VERB = "cogitator";
+/** An Adaptive Card, as JSON. */
+export type AdaptiveCard = Record<string, unknown>;
+/**
+ * An Adaptive Card with rows of buttons, one action set per row. A button with `data` is an
+ * `Action.Execute` that falls back to `Action.Submit` on clients without Universal Actions, a
+ * `url` opens it, `copyText` shows the text to copy, and a disabled button is shown as text in
+ * its color, since older clients cannot disable actions.
+ */
+export declare function buttonsCard(rows: ChannelButton[][]): AdaptiveCard;
+/** The button data of an `Action.Submit` press, the `value` of the message it sends. */
+export declare function submitDataOf(value: unknown): string | undefined;
+/** The button data of an `Action.Execute` press, the `value` of its `adaptiveCard/action` invoke. */
+export declare function executeDataOf(value: unknown): string | undefined;
+//# sourceMappingURL=cards.d.ts.map

package/dist/channels/teams/cards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cards.d.ts","sourceRoot":"","sources":["../../../src/channels/teams/cards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,uDAAuD;AACvD,eAAO,MAAM,aAAa,4CAA4C,CAAC;AACvE,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,sDAAsD,CAAC;AACrF,gEAAgE;AAChE,eAAO,MAAM,cAAc,mDAAmD,CAAC;AAC/E,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C,iCAAiC;AACjC,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA2CnD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,YAAY,CAqBjE;AAYD,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIhE"}

package/dist/channels/teams/cards.js

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+/** The content type of an Adaptive Card attachment. */
+export const ADAPTIVE_CARD = 'application/vnd.microsoft.card.adaptive';
+/** The content type of the card that asks a user to accept a file upload. */
+export const FILE_CONSENT_CARD = 'application/vnd.microsoft.teams.card.file.consent';
+/** The content type of the card that shows an uploaded file. */
+export const FILE_INFO_CARD = 'application/vnd.microsoft.teams.card.file.info';
+/** The `verb` of the `Action.Execute` buttons the channel sends. */
+export const TEAMS_ACTION_VERB = 'cogitator';
+const STYLES = {
+    primary: 'positive',
+    success: 'positive',
+    danger: 'destructive',
+};
+const COLORS = {
+    primary: 'accent',
+    success: 'good',
+    danger: 'attention',
+};
+function actionOf(button) {
+    const style = button.style ? { style: STYLES[button.style] } : {};
+    if (button.url !== undefined) {
+        return { type: 'Action.OpenUrl', title: button.text, url: button.url, ...style };
+    }
+    if (button.copyText !== undefined) {
+        return {
+            type: 'Action.ShowCard',
+            title: button.text,
+            card: {
+                type: 'AdaptiveCard',
+                body: [{ type: 'TextBlock', text: button.copyText, wrap: true, fontType: 'Monospace' }],
+            },
+        };
+    }
+    if (button.data !== undefined) {
+        const data = { [TEAMS_ACTION_VERB]: button.data };
+        return {
+            type: 'Action.Execute',
+            title: button.text,
+            verb: TEAMS_ACTION_VERB,
+            data,
+            ...style,
+            fallback: { type: 'Action.Submit', title: button.text, data, ...style },
+        };
+    }
+    throw new Error(`[teams] Button "${button.text}" needs data, url, copyText or disabled`);
+}
+/**
+ * An Adaptive Card with rows of buttons, one action set per row. A button with `data` is an
+ * `Action.Execute` that falls back to `Action.Submit` on clients without Universal Actions, a
+ * `url` opens it, `copyText` shows the text to copy, and a disabled button is shown as text in
+ * its color, since older clients cannot disable actions.
+ */
+export function buttonsCard(rows) {
+    const body = [];
+    for (const row of rows) {
+        for (const button of row.filter((candidate) => candidate.disabled)) {
+            body.push({
+                type: 'TextBlock',
+                text: button.text,
+                weight: 'Bolder',
+                wrap: true,
+                ...(button.style && { color: COLORS[button.style] }),
+            });
+        }
+        const actions = row.filter((button) => !button.disabled).map(actionOf);
+        if (actions.length > 0)
+            body.push({ type: 'ActionSet', actions });
+    }
+    return {
+        type: 'AdaptiveCard',
+        $schema: 'http://adaptivecards.io/schemas/adaptive-card.json',
+        version: '1.4',
+        body,
+    };
+}
+const SubmitValueSchema = z.object({ [TEAMS_ACTION_VERB]: z.string() });
+const ExecuteValueSchema = z.object({
+    action: z.object({
+        type: z.string().optional(),
+        verb: z.string().optional(),
+        data: z.unknown().optional(),
+    }),
+});
+/** The button data of an `Action.Submit` press, the `value` of the message it sends. */
+export function submitDataOf(value) {
+    const parsed = SubmitValueSchema.safeParse(value);
+    return parsed.success ? parsed.data[TEAMS_ACTION_VERB] : undefined;
+}
+/** The button data of an `Action.Execute` press, the `value` of its `adaptiveCard/action` invoke. */
+export function executeDataOf(value) {
+    const parsed = ExecuteValueSchema.safeParse(value);
+    if (!parsed.success || parsed.data.action.verb !== TEAMS_ACTION_VERB)
+        return undefined;
+    return submitDataOf(parsed.data.action.data);
+}
+//# sourceMappingURL=cards.js.map

package/dist/channels/teams/cards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cards.js","sourceRoot":"","sources":["../../../src/channels/teams/cards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,uDAAuD;AACvD,MAAM,CAAC,MAAM,aAAa,GAAG,yCAAyC,CAAC;AACvE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AACrF,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAC/E,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAK7C,MAAM,MAAM,GAAwD;IAClE,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,aAAa;CACtB,CAAC;AAEF,MAAM,MAAM,GAAwD;IAClE,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF,SAAS,QAAQ,CAAC,MAAqB;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;aACxF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,IAAI,EAAE,iBAAiB;YACvB,IAAI;YACJ,GAAG,KAAK;YACR,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,IAAI,yCAAyC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,IAAI,GAA8B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,IAAI;gBACV,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,oDAAoD;QAC7D,OAAO,EAAE,KAAK;QACd,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAExE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,SAAS,CAAC;IACvF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC"}