@mastra/teams 0.0.0 → 0.1.0-alpha.0

package/dist/index.js

@@ -0,0 +1,817 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes, randomUUID } from "crypto";
+import { AgentChannels, resolveWaitUntil } from "@mastra/core/channels";
+import { InMemoryChannelsStorage } from "@mastra/core/storage";
+import { TeamsAdapter, createTeamsAdapter, createTeamsAdapter as createTeamsAdapter$1 } from "@chat-adapter/teams";
+//#region src/types.ts
+/** Microsoft Graph origin used for Entra application provisioning. */
+const GRAPH_API_BASE_URL = "https://graph.microsoft.com";
+/** Teams Developer Portal origin used for Bot Framework registrations. */
+const DEV_PORTAL_BASE_URL = "https://dev.teams.microsoft.com";
+/** Microsoft login origin used to validate bot credentials (client-credentials mint). */
+const LOGIN_BASE_URL = "https://login.microsoftonline.com";
+/**
+* OAuth scope for Microsoft Graph control-plane calls (create Entra apps,
+* mint client secrets). Passed to the delegated {@link TeamsTokenResolver}.
+*/
+const TEAMS_GRAPH_SCOPE = "https://graph.microsoft.com/.default";
+/**
+* OAuth scope for the Teams Developer Portal API (bot registrations).
+* Tokens for this audience are distinct from Graph tokens — a single access
+* token cannot serve both APIs. Passed to the delegated
+* {@link TeamsTokenResolver}.
+*/
+const TEAMS_DEV_PORTAL_SCOPE = "https://dev.teams.microsoft.com/AppDefinitions.ReadWrite";
+/**
+* Teams Developer Portal page where minted bot registrations are managed and
+* packaged into a Teams app for distribution.
+*/
+const DEV_PORTAL_BOTS_URL = "https://dev.teams.microsoft.com/bots";
+//#endregion
+//#region src/microsoft-clients.ts
+/**
+* Thin fetch wrappers for the two Microsoft control planes the provider
+* provisions through — Microsoft Graph (Entra applications) and the Teams
+* Developer Portal (Bot Framework registrations) — plus a credential
+* validation helper against the Microsoft login endpoint.
+*
+* All calls are plain `fetch` with a 15s timeout so tests can intercept them
+* with undici's `MockAgent` (same pattern as `@mastra/telegram`'s client).
+*/
+const REQUEST_TIMEOUT_MS = 15e3;
+async function request(url, init, label) {
+	let response;
+	try {
+		response = await fetch(url, {
+			...init,
+			signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+		});
+	} catch (cause) {
+		throw Object.assign(new Error(`${label} request failed`, { cause }), { isTransportError: true });
+	}
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`${label} failed: HTTP ${response.status}${body ? ` — ${truncate(body)}` : ""}`);
+	}
+	return response;
+}
+function truncate(text, max = 300) {
+	return text.length > max ? `${text.slice(0, max)}…` : text;
+}
+function authJson(token) {
+	return {
+		authorization: `Bearer ${token}`,
+		"content-type": "application/json"
+	};
+}
+/**
+* Create an Entra application for a per-agent bot.
+* @see https://learn.microsoft.com/graph/api/application-post-applications
+*/
+async function createApplication(token, options, graphBaseUrl = GRAPH_API_BASE_URL) {
+	const body = await (await request(`${graphBaseUrl}/v1.0/applications`, {
+		method: "POST",
+		headers: authJson(token),
+		body: JSON.stringify({
+			displayName: options.displayName,
+			signInAudience: options.signInAudience
+		})
+	}, "Graph application create")).json();
+	if (!body.id || !body.appId) throw new Error("Graph application create returned an unexpected payload (missing id/appId)");
+	return {
+		id: body.id,
+		appId: body.appId
+	};
+}
+/**
+* Mint a client secret on an Entra application. The secret text is only
+* returned by this call — it cannot be read back later.
+* @see https://learn.microsoft.com/graph/api/application-addpassword
+*/
+async function addApplicationPassword(token, applicationObjectId, displayName, graphBaseUrl = GRAPH_API_BASE_URL) {
+	const body = await (await request(`${graphBaseUrl}/v1.0/applications/${encodeURIComponent(applicationObjectId)}/addPassword`, {
+		method: "POST",
+		headers: authJson(token),
+		body: JSON.stringify({ passwordCredential: { displayName } })
+	}, "Graph addPassword")).json();
+	if (!body.secretText) throw new Error("Graph addPassword returned an unexpected payload (missing secretText)");
+	return body.secretText;
+}
+/**
+* Delete an Entra application. Used to clean up provisioned bots on
+* disconnect and to roll back a partially provisioned connect.
+* @see https://learn.microsoft.com/graph/api/application-delete
+*/
+async function deleteApplication(token, applicationObjectId, graphBaseUrl = GRAPH_API_BASE_URL) {
+	await request(`${graphBaseUrl}/v1.0/applications/${encodeURIComponent(applicationObjectId)}`, {
+		method: "DELETE",
+		headers: { authorization: `Bearer ${token}` }
+	}, "Graph application delete");
+}
+/** Register a bot with the Teams Developer Portal. */
+async function createBotRegistration(token, registration, devPortalBaseUrl = DEV_PORTAL_BASE_URL) {
+	await request(`${devPortalBaseUrl}/api/botframework`, {
+		method: "POST",
+		headers: authJson(token),
+		body: JSON.stringify(registration)
+	}, "Dev Portal bot registration");
+}
+/** Delete a Teams Developer Portal bot registration. */
+async function deleteBotRegistration(token, botId, devPortalBaseUrl = DEV_PORTAL_BASE_URL) {
+	await request(`${devPortalBaseUrl}/api/botframework/${encodeURIComponent(botId)}`, {
+		method: "DELETE",
+		headers: { authorization: `Bearer ${token}` }
+	}, "Dev Portal bot deletion");
+}
+/**
+* Validate a bot's `appId`/`appPassword` by minting a Bot Framework token via
+* the OAuth2 client-credentials grant — the same exchange the adapter performs
+* at runtime, so a success here means outbound sends will authenticate.
+* Multi-tenant bots exchange against the `botframework.com` tenant.
+*
+* Throws when Microsoft rejects the credentials; transport failures are
+* surfaced as-is (tagged `isTransportError`) so callers can tell connectivity
+* problems apart from bad credentials.
+*/
+async function validateBotCredentials(options, loginBaseUrl = LOGIN_BASE_URL) {
+	const tenant = encodeURIComponent(options.appTenantId ?? "botframework.com");
+	const body = new URLSearchParams({
+		grant_type: "client_credentials",
+		client_id: options.appId,
+		client_secret: options.appPassword,
+		scope: "https://api.botframework.com/.default"
+	});
+	let response;
+	try {
+		response = await fetch(`${loginBaseUrl}/${tenant}/oauth2/v2.0/token`, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: body.toString(),
+			signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+		});
+	} catch (cause) {
+		throw Object.assign(new Error("Bot credential validation request failed", { cause }), { isTransportError: true });
+	}
+	if (!response.ok) {
+		const detail = await response.json().catch(() => null);
+		throw new Error(`Microsoft rejected the bot credentials: ${detail?.error_description ?? detail?.error ?? `HTTP ${response.status}`}`);
+	}
+}
+//#endregion
+//#region src/crypto.ts
+/**
+* Opt-in AES-256-GCM encryption for installation secrets at rest, with
+* HKDF-SHA256 key derivation (mirrors `@mastra/slack`'s `crypto.ts`). Each value
+* gets a fresh random 16-byte salt + 12-byte IV; the salt travels in the
+* ciphertext, so the same passphrase never derives the same key twice. The
+* algorithm prefix lets plaintext and encrypted values coexist during migration,
+* so {@link decrypt} can no-op on plaintext.
+*
+* Format: `aes-256-gcm-hkdf:base64(salt):base64(iv):base64(authTag):base64(ciphertext)`
+*/
+const ALGO_PREFIX = "aes-256-gcm-hkdf";
+const HKDF_INFO = "mastra-teams-encryption";
+function deriveKey(passphrase, salt) {
+	return Buffer.from(hkdfSync("sha256", passphrase, salt, HKDF_INFO, 32));
+}
+/** Whether a stored value was produced by {@link encrypt}. */
+function isEncrypted(value) {
+	return value.startsWith(`${ALGO_PREFIX}:`);
+}
+/** Encrypt a UTF-8 string with a per-value random salt + IV. */
+function encrypt(plaintext, passphrase) {
+	const salt = randomBytes(16);
+	const iv = randomBytes(12);
+	const cipher = createCipheriv("aes-256-gcm", deriveKey(passphrase, salt), iv);
+	const enc = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+	const tag = cipher.getAuthTag();
+	return `${ALGO_PREFIX}:${salt.toString("base64")}:${iv.toString("base64")}:${tag.toString("base64")}:${enc.toString("base64")}`;
+}
+/** Decrypt a value from {@link encrypt}. Plaintext (unprefixed) is returned unchanged. */
+function decrypt(value, passphrase) {
+	if (!isEncrypted(value)) return value;
+	const [, saltB64, ivB64, tagB64, ctB64] = value.split(":");
+	if (!saltB64 || !ivB64 || !tagB64 || ctB64 === void 0) throw new Error("Invalid ciphertext payload");
+	const decipher = createDecipheriv("aes-256-gcm", deriveKey(passphrase, Buffer.from(saltB64, "base64")), Buffer.from(ivB64, "base64"));
+	decipher.setAuthTag(Buffer.from(tagB64, "base64"));
+	return Buffer.concat([decipher.update(Buffer.from(ctB64, "base64")), decipher.final()]).toString("utf8");
+}
+//#endregion
+//#region src/install-store.ts
+/** Platform identifier used for every stored record and route. */
+const PLATFORM = "teams";
+/**
+* Persistence for Teams bot installations, layered over the platform-agnostic
+* `ChannelsStorage` (the same store `@mastra/slack` / `@mastra/telegram` use).
+* Installations are keyed by agent — one bot = one agent — and the per-bot
+* fields live in the record's `data` blob. When an `encryptionKey` is
+* supplied, `appPassword` (the bot's client secret) is AES-256-GCM encrypted
+* at rest.
+*/
+var TeamsInstallStore = class {
+	storage;
+	encryptionKey;
+	#warnedPlaintext = false;
+	constructor(storage, encryptionKey) {
+		this.storage = storage;
+		this.encryptionKey = encryptionKey;
+	}
+	/** Whether secrets written through this store are encrypted at rest. */
+	get canEncrypt() {
+		return Boolean(this.encryptionKey);
+	}
+	/** The active or pending installation for an agent, if any. */
+	async getByAgent(agentId) {
+		const record = await this.storage.getInstallationByAgent(PLATFORM, agentId);
+		return record ? this.#fromRecord(record) : null;
+	}
+	/** Look up an installation by the routing id in its messaging endpoint path. */
+	async getByWebhookId(webhookId) {
+		const record = await this.storage.getInstallationByWebhookId(webhookId);
+		return record && record.platform === "teams" ? this.#fromRecord(record) : null;
+	}
+	/** Insert or replace an installation. */
+	async save(installation) {
+		await this.storage.saveInstallation(this.#toRecord(installation));
+	}
+	/** All Teams installations (active and pending). */
+	async list() {
+		return (await this.storage.listInstallations(PLATFORM)).map((r) => this.#fromRecord(r));
+	}
+	/** Remove an agent's installation, if present. */
+	async deleteByAgent(agentId) {
+		const record = await this.storage.getInstallationByAgent(PLATFORM, agentId);
+		if (record) await this.storage.deleteInstallation(record.id);
+	}
+	#enc(value) {
+		if (value && !this.encryptionKey && !this.#warnedPlaintext) {
+			this.#warnedPlaintext = true;
+			console.warn("[Teams] Storing the bot client secret WITHOUT encryption — no encryption key is configured. Set `encryptionKey` on TeamsProvider or the MASTRA_ENCRYPTION_KEY environment variable to encrypt installation secrets at rest.");
+		}
+		return value && this.encryptionKey ? encrypt(value, this.encryptionKey) : value;
+	}
+	#dec(value) {
+		if (!value) return value;
+		if (!this.encryptionKey) {
+			if (isEncrypted(value)) throw new Error("Teams installation secrets are encrypted at rest, but no encryption key is configured. Set `encryptionKey` on TeamsProvider or MASTRA_ENCRYPTION_KEY.");
+			return value;
+		}
+		return decrypt(value, this.encryptionKey);
+	}
+	#toRecord(install) {
+		const data = {
+			appId: install.appId,
+			entraObjectId: install.entraObjectId,
+			appPassword: this.#enc(install.appPassword),
+			appTenantId: install.appTenantId,
+			appType: install.appType,
+			botName: install.botName,
+			messagingEndpoint: install.messagingEndpoint
+		};
+		return {
+			id: install.id,
+			platform: PLATFORM,
+			agentId: install.agentId,
+			status: install.status,
+			webhookId: install.webhookId,
+			data,
+			createdAt: install.installedAt,
+			updatedAt: /* @__PURE__ */ new Date()
+		};
+	}
+	#fromRecord(record) {
+		const data = record.data ?? {};
+		return {
+			id: record.id,
+			agentId: record.agentId,
+			webhookId: record.webhookId ?? "",
+			status: record.status === "active" ? "active" : "pending",
+			appId: data.appId,
+			entraObjectId: data.entraObjectId,
+			appPassword: this.#dec(data.appPassword),
+			appTenantId: data.appTenantId,
+			appType: data.appType,
+			botName: data.botName,
+			messagingEndpoint: data.messagingEndpoint,
+			installedAt: record.createdAt
+		};
+	}
+};
+/** Project an installation to its public, secret-free info for the editor UI. */
+function toInstallationInfo(install) {
+	return {
+		id: install.id,
+		platform: PLATFORM,
+		agentId: install.agentId,
+		status: install.status,
+		displayName: install.botName,
+		installedAt: install.installedAt
+	};
+}
+//#endregion
+//#region src/teams-provider.ts
+/**
+* Resolve the per-adapter streaming/typing config the provider applies to the
+* Teams entry in `AgentChannels.adapters` — both default on.
+*/
+function resolveTeamsAdapterConfig(config) {
+	return {
+		streaming: config.streaming ?? true,
+		typingStatus: config.typingStatus ?? true
+	};
+}
+/**
+* Microsoft Teams channel provider for Mastra — a {@link ChannelProvider} over
+* `@chat-adapter/teams`. The adapter handles the Bot Framework transport
+* (activity parse, JWT webhook verification, send/stream, typing, adaptive
+* cards); this provider adds the install/lifecycle layer.
+*
+* Credential modes (mutually exclusive, enforced at the type level):
+*
+* - **Self-managed** — bring your own Azure Bot registration: pass
+*   `appId`/`appPassword` (provider-level or per-`connect()`). Point the bot's
+*   messaging endpoint at `{baseUrl}/teams/events/{webhookId}`.
+* - **Delegated** — pass a scope-aware `tokenResolver` for a *manager*
+*   credential; `connect(agentId)` then provisions a bot per agent: an Entra
+*   application (Microsoft Graph), a fresh client secret, and a Teams
+*   Developer Portal bot registration pointing at this server. The per-agent
+*   secret is stored (encrypted) and used by the runtime — the manager
+*   credential is never needed on the message path.
+*
+* @example
+* ```ts
+* const teams = new TeamsProvider({ baseUrl: 'https://my-app.example.com', tokenResolver });
+* const mastra = new Mastra({ agents: { myAgent }, channels: { teams } });
+* await teams.connect('my-agent'); // → { type: 'deep_link', url: 'https://dev.teams.microsoft.com/bots' }
+* ```
+*/
+var TeamsProvider = class {
+	id = PLATFORM;
+	#config;
+	#mastra;
+	#store;
+	/** Live adapters, keyed by installation id. */
+	#adapters = /* @__PURE__ */ new Map();
+	/** Cached sync view of whether any active bot is registered (for {@link getInfo}). */
+	#configured = false;
+	#initPromise = null;
+	constructor(config = {}) {
+		this.#config = config;
+	}
+	/**
+	* Called by Mastra when this channel is registered.
+	* @internal
+	*/
+	__attach(mastra) {
+		if (this.#mastra && this.#mastra !== mastra) {
+			this.#initPromise = null;
+			this.#store = void 0;
+			this.#adapters.clear();
+			this.#configured = false;
+		}
+		this.#mastra = mastra;
+	}
+	/**
+	* Per-bot messaging endpoint. A single POST route keyed by an opaque
+	* `webhookId`; inbound requests are authenticated by Microsoft's JWT
+	* signature (verified by the adapter against the bot's `appId`), not by the
+	* path. Auto-initializes on first hit (mirrors `@mastra/slack`).
+	*/
+	getRoutes() {
+		const self = this;
+		const withInit = (handler) => {
+			return async ({ mastra }) => {
+				self.#mastra = mastra;
+				await self.#autoInitialize();
+				return handler.bind(self);
+			};
+		};
+		return [{
+			path: `/${PLATFORM}/events/:webhookId`,
+			method: "POST",
+			requiresAuth: false,
+			createHandler: withInit(this.#handleWebhook)
+		}];
+	}
+	/** Discovery metadata for the editor UI. */
+	getInfo() {
+		const hasCredentials = Boolean(this.#config.tokenResolver || this.#config.appId && this.#config.appPassword);
+		return {
+			id: this.id,
+			name: "Microsoft Teams",
+			isConfigured: this.#configured || hasCredentials,
+			connectOptionsSchema: {
+				type: "object",
+				properties: {
+					name: {
+						type: "string",
+						description: "Display name for the bot (defaults to the agent id)."
+					},
+					appId: {
+						type: "string",
+						description: "Microsoft App (client) ID of an existing bot registration (self-managed mode). Omit in delegated mode — a bot is provisioned per agent."
+					},
+					appPassword: {
+						type: "string",
+						description: "Client secret for the bot (self-managed mode)."
+					},
+					appTenantId: {
+						type: "string",
+						description: "Entra tenant ID for single-tenant bots."
+					}
+				}
+			}
+		};
+	}
+	/**
+	* Restore installations from storage: rebuild an adapter per active bot and
+	* inject `AgentChannels` so the agent can receive events immediately.
+	* Idempotent. Does not re-register messaging endpoints (they persist in the
+	* bot registration across restarts); reconnect an agent if its `baseUrl` changed.
+	*/
+	async initialize() {
+		if (this.#initPromise) return this.#initPromise;
+		this.#initPromise = this.#doInitialize();
+		try {
+			await this.#initPromise;
+		} catch (err) {
+			this.#initPromise = null;
+			throw err;
+		}
+	}
+	async #doInitialize() {
+		const active = (await (await this.#getStore()).list()).filter((i) => i.status === "active");
+		this.#configured = active.length > 0;
+		for (const installation of active) try {
+			await this.#activateInstallation(installation);
+		} catch (err) {
+			console.error(`[Teams] Failed to restore installation "${installation.id}":`, err);
+		}
+	}
+	/**
+	* Update runtime provider settings. Pass `appId`/`appPassword` to change the
+	* default bot credentials new {@link connect} calls fall back to; pass
+	* `baseUrl`/`apiUrl` to point the provider/adapter at a different host.
+	* `null` clears the default credentials only — per-bot installs are managed
+	* via {@link connect}/{@link disconnect}.
+	*/
+	async configure(credentials) {
+		if (this.#config.tokenResolver && (credentials?.appId !== void 0 || credentials?.appPassword !== void 0)) throw new Error("TeamsProvider was constructed with a tokenResolver — bot credentials are provisioned per agent. Remove the tokenResolver to manage credentials manually via configure().");
+		if (credentials === null) {
+			this.#config = {
+				...this.#config,
+				appId: void 0,
+				appPassword: void 0
+			};
+			return;
+		}
+		const apiUrlChanged = credentials.apiUrl !== void 0 && credentials.apiUrl !== this.#config.apiUrl;
+		this.#config = {
+			...this.#config,
+			...credentials
+		};
+		if (!apiUrlChanged) return;
+		const wasInitialized = this.#initPromise !== null;
+		this.#adapters.clear();
+		this.#initPromise = null;
+		if (wasInitialized) await this.initialize();
+	}
+	/**
+	* Connect an agent to Microsoft Teams.
+	*
+	* - **Delegated** (`tokenResolver`): provisions a per-agent bot — Entra
+	*   application + client secret via Microsoft Graph, then a Teams Developer
+	*   Portal bot registration whose messaging endpoint points at this server —
+	*   and returns `{ type: 'deep_link' }` to the Developer Portal where the
+	*   bot is packaged into a Teams app for install.
+	* - **Self-managed** with `appId`/`appPassword` (per-call or provider
+	*   default): validates the credentials via a Bot Framework token mint,
+	*   persists the installation, and returns `{ type: 'immediate' }`. Point
+	*   the bot registration's messaging endpoint at the installation's
+	*   `messagingEndpoint`.
+	* - Self-managed without credentials: persists a pending installation and
+	*   returns `{ type: 'deep_link' }` pointing at the Teams Developer Portal.
+	*/
+	async connect(agentId, options = {}) {
+		const existing = await (await this.#getStore()).getByAgent(agentId);
+		if (existing?.status === "active") throw new Error(`Agent "${agentId}" is already connected to Microsoft Teams. Disconnect first to reconnect.`);
+		if (this.#config.tokenResolver) {
+			if (options.appId !== void 0 || options.appPassword !== void 0) throw new Error("TeamsProvider was constructed with a tokenResolver — bots are provisioned per agent and credentials cannot be supplied per connect() call.");
+			return this.#connectDelegated(agentId, options, existing);
+		}
+		return this.#connectSelfManaged(agentId, options, existing);
+	}
+	async #connectSelfManaged(agentId, options, existing) {
+		const store = await this.#getStore();
+		const appId = options.appId ?? this.#config.appId;
+		const appPassword = options.appPassword ?? this.#config.appPassword;
+		if (!appId || !appPassword) {
+			const installationId = existing?.id ?? randomUUID();
+			await store.save({
+				id: installationId,
+				agentId,
+				webhookId: existing?.webhookId ?? randomUUID(),
+				status: "pending",
+				installedAt: existing?.installedAt ?? /* @__PURE__ */ new Date()
+			});
+			return {
+				type: "deep_link",
+				url: DEV_PORTAL_BOTS_URL,
+				installationId
+			};
+		}
+		const duplicate = (await store.list()).find((i) => i.status === "active" && i.agentId !== agentId && i.appId === appId);
+		if (duplicate) throw new Error(`This Teams bot is already connected to agent "${duplicate.agentId}". Disconnect it before connecting another agent.`);
+		const appTenantId = options.appTenantId ?? this.#config.appTenantId;
+		await validateBotCredentials({
+			appId,
+			appPassword,
+			appTenantId
+		}, this.#config.loginBaseUrl);
+		const installationId = existing?.id ?? randomUUID();
+		const webhookId = existing?.webhookId ?? randomUUID();
+		const baseUrl = this.#getBaseUrl();
+		const installation = {
+			id: installationId,
+			agentId,
+			webhookId,
+			status: "active",
+			appId,
+			appPassword,
+			appTenantId,
+			appType: this.#config.appType ?? (appTenantId ? "SingleTenant" : "MultiTenant"),
+			botName: options.name ?? agentId,
+			messagingEndpoint: baseUrl ? `${baseUrl}/${PLATFORM}/events/${webhookId}` : void 0,
+			installedAt: existing?.installedAt ?? /* @__PURE__ */ new Date()
+		};
+		await store.save(installation);
+		try {
+			await this.#activateInstallation(installation);
+		} catch (err) {
+			console.warn(`[Teams] Failed to activate installation for agent "${agentId}":`, err);
+		}
+		this.#configured = true;
+		try {
+			await this.#config.onInstall?.(installation);
+		} catch (err) {
+			console.warn(`[Teams] onInstall hook failed for agent "${agentId}":`, err);
+		}
+		return {
+			type: "immediate",
+			installationId
+		};
+	}
+	async #connectDelegated(agentId, options, existing) {
+		const tokenResolver = this.#config.tokenResolver;
+		const store = await this.#getStore();
+		if (!store.canEncrypt) throw new Error("Delegated Teams provisioning stores a Mastra-provisioned bot client secret and requires an encryption key. Set `encryptionKey` on TeamsProvider or the MASTRA_ENCRYPTION_KEY environment variable.");
+		const baseUrl = this.#getBaseUrl();
+		if (!baseUrl) throw new Error("TeamsProvider needs a baseUrl to register a bot messaging endpoint. Set `baseUrl` or configure the Mastra server.");
+		const botName = options.name ?? agentId;
+		const appType = this.#config.appType ?? "MultiTenant";
+		const appTenantId = options.appTenantId ?? this.#config.appTenantId;
+		if (appType === "SingleTenant" && !appTenantId) throw new Error("TeamsProvider is configured for SingleTenant bots but no appTenantId is available. Set `appTenantId` on the provider or pass it to connect().");
+		const webhookId = existing?.webhookId ?? randomUUID();
+		const messagingEndpoint = `${baseUrl}/${PLATFORM}/events/${webhookId}`;
+		const graphToken = await tokenResolver(TEAMS_GRAPH_SCOPE, appTenantId);
+		const application = await createApplication(graphToken, {
+			displayName: botName,
+			signInAudience: appType === "SingleTenant" ? "AzureADMyOrg" : "AzureADMultipleOrgs"
+		}, this.#config.graphBaseUrl);
+		let appPassword;
+		let devPortalToken;
+		let botRegistered = false;
+		let installation;
+		try {
+			appPassword = await addApplicationPassword(graphToken, application.id, "mastra-teams", this.#config.graphBaseUrl);
+			devPortalToken = await tokenResolver(TEAMS_DEV_PORTAL_SCOPE, appTenantId);
+			await createBotRegistration(devPortalToken, {
+				botId: application.appId,
+				name: botName,
+				description: `Mastra agent "${agentId}"`,
+				iconUrl: this.#config.botIconUrl ?? "",
+				messagingEndpoint,
+				callingEndpoint: ""
+			}, this.#config.devPortalBaseUrl);
+			botRegistered = true;
+			installation = {
+				id: existing?.id ?? randomUUID(),
+				agentId,
+				webhookId,
+				status: "active",
+				appId: application.appId,
+				entraObjectId: application.id,
+				appPassword,
+				appTenantId,
+				appType,
+				botName,
+				messagingEndpoint,
+				installedAt: existing?.installedAt ?? /* @__PURE__ */ new Date()
+			};
+			await store.save(installation);
+		} catch (err) {
+			if (botRegistered && devPortalToken) try {
+				await deleteBotRegistration(devPortalToken, application.appId, this.#config.devPortalBaseUrl);
+			} catch (cleanupErr) {
+				console.warn(`[Teams] Failed to roll back bot registration "${application.appId}":`, cleanupErr);
+			}
+			try {
+				await deleteApplication(graphToken, application.id, this.#config.graphBaseUrl);
+			} catch (cleanupErr) {
+				console.warn(`[Teams] Failed to roll back Entra application "${application.appId}":`, cleanupErr);
+			}
+			throw err;
+		}
+		try {
+			await this.#activateInstallation(installation);
+		} catch (err) {
+			console.warn(`[Teams] Failed to activate installation for agent "${agentId}":`, err);
+		}
+		this.#configured = true;
+		try {
+			await this.#config.onInstall?.(installation);
+		} catch (err) {
+			console.warn(`[Teams] onInstall hook failed for agent "${agentId}":`, err);
+		}
+		return {
+			type: "deep_link",
+			url: DEV_PORTAL_BOTS_URL,
+			installationId: installation.id
+		};
+	}
+	/**
+	* Disconnect an agent from Microsoft Teams. For bots this provider
+	* provisioned (delegated mode), the Developer Portal registration and the
+	* Entra application are deleted best-effort — a control-plane failure never
+	* blocks removal of the local installation.
+	*/
+	async disconnect(agentId) {
+		const store = await this.#getStore();
+		const existing = await store.getByAgent(agentId);
+		if (!existing) throw new Error(`No Teams installation found for agent "${agentId}"`);
+		if (existing.entraObjectId && this.#config.tokenResolver) {
+			if (existing.appId) try {
+				await deleteBotRegistration(await this.#config.tokenResolver(TEAMS_DEV_PORTAL_SCOPE, existing.appTenantId), existing.appId, this.#config.devPortalBaseUrl);
+			} catch (err) {
+				console.warn(`[Teams] Failed to delete bot registration for agent "${agentId}":`, err);
+			}
+			try {
+				await deleteApplication(await this.#config.tokenResolver(TEAMS_GRAPH_SCOPE, existing.appTenantId), existing.entraObjectId, this.#config.graphBaseUrl);
+			} catch (err) {
+				console.warn(`[Teams] Failed to delete Entra application for agent "${agentId}":`, err);
+			}
+		}
+		this.#adapters.delete(existing.id);
+		await store.deleteByAgent(agentId);
+		this.#configured = (await store.list()).some((i) => i.status === "active");
+	}
+	/** List installations (public info only — no secrets). */
+	async listInstallations() {
+		return (await (await this.#getStore()).list()).map(toInstallationInfo);
+	}
+	/**
+	* Get the full installation for an agent (includes the client secret).
+	* Returns `null` if the agent has no Teams installation. Mirrors
+	* `SlackProvider.getInstallation`.
+	*/
+	async getInstallation(agentId) {
+		return await (await this.#getStore()).getByAgent(agentId) ?? null;
+	}
+	/** Whether at least one bot is actively registered. */
+	isConfigured() {
+		return this.#configured;
+	}
+	/**
+	* Get the live `TeamsAdapter` for an installation id, if one is active.
+	* Used for message formatting/posting. Mirrors `SlackProvider.getAdapter`.
+	*/
+	getAdapter(installationId) {
+		return this.#adapters.get(installationId);
+	}
+	async #handleWebhook(c) {
+		const webhookId = c.req.param("webhookId");
+		if (!webhookId) return c.json({
+			ok: false,
+			error: "Missing webhookId"
+		}, 400);
+		const installation = await (await this.#getStore()).getByWebhookId(webhookId);
+		if (!installation || installation.status !== "active") return c.json({
+			ok: false,
+			error: "Unknown webhook"
+		}, 404);
+		const agent = this.#resolveAgent(installation.agentId);
+		if (!agent || !this.#mastra) return c.json({ ok: true });
+		const adapter = this.#getOrCreateAdapter(installation);
+		let channels = agent.getChannels();
+		if (!channels || channels.adapters["teams"] !== adapter) {
+			channels = this.#createAgentChannels(agent, adapter);
+			await channels.initialize(this.#mastra);
+		}
+		const waitUntil = this.#config.waitUntil ?? resolveWaitUntil(c);
+		try {
+			return await channels.handleWebhookEvent(PLATFORM, c.req.raw, waitUntil ? { waitUntil } : void 0);
+		} catch (err) {
+			console.error("[Teams] Error delegating to AgentChannels:", err);
+			return c.json({ ok: true });
+		}
+	}
+	#getOrCreateAdapter(installation) {
+		const existing = this.#adapters.get(installation.id);
+		if (existing) return existing;
+		const adapter = createTeamsAdapter$1({
+			appId: installation.appId,
+			appPassword: installation.appPassword,
+			...installation.appTenantId !== void 0 ? { appTenantId: installation.appTenantId } : {},
+			...installation.appType !== void 0 ? { appType: installation.appType } : {},
+			...installation.botName !== void 0 ? { userName: installation.botName } : {},
+			...this.#config.apiUrl !== void 0 ? { apiUrl: this.#config.apiUrl } : {},
+			...this.#config.logger !== void 0 ? { logger: this.#config.logger } : {}
+		});
+		this.#adapters.set(installation.id, adapter);
+		return adapter;
+	}
+	/** Rebuild the adapter and inject AgentChannels for an active installation. */
+	async #activateInstallation(installation) {
+		const agent = this.#resolveAgent(installation.agentId);
+		const adapter = this.#getOrCreateAdapter(installation);
+		if (agent && this.#mastra) await this.#createAgentChannels(agent, adapter).initialize(this.#mastra);
+	}
+	/**
+	* Create AgentChannels for an agent with the Teams adapter, preserving any
+	* adapters/config the agent author already configured (mirrors `@mastra/slack`).
+	*/
+	#createAgentChannels(agent, adapter) {
+		const existingConfig = agent.getChannels()?.channelConfig;
+		const cfg = this.#config;
+		const entry = {
+			adapter,
+			...resolveTeamsAdapterConfig(cfg),
+			...cfg.toolDisplay !== void 0 ? { toolDisplay: cfg.toolDisplay } : {},
+			...cfg.cors !== void 0 ? { cors: cfg.cors } : {},
+			...cfg.formatError !== void 0 ? { formatError: cfg.formatError } : {}
+		};
+		const channels = new AgentChannels({
+			...existingConfig,
+			adapters: {
+				...existingConfig?.adapters,
+				[PLATFORM]: entry
+			},
+			userName: agent.name,
+			handlers: cfg.handlers ?? existingConfig?.handlers,
+			inlineMedia: cfg.inlineMedia ?? existingConfig?.inlineMedia,
+			inlineLinks: cfg.inlineLinks ?? existingConfig?.inlineLinks,
+			state: cfg.state ?? existingConfig?.state,
+			threadContext: cfg.threadContext ?? existingConfig?.threadContext,
+			chatOptions: cfg.chatOptions ?? existingConfig?.chatOptions,
+			tools: cfg.tools ?? existingConfig?.tools,
+			resolveResourceId: cfg.resolveResourceId ?? existingConfig?.resolveResourceId,
+			waitUntil: cfg.waitUntil ?? existingConfig?.waitUntil,
+			resolveWaitUntil: cfg.resolveWaitUntil ?? existingConfig?.resolveWaitUntil
+		});
+		agent.setChannels(channels);
+		return channels;
+	}
+	async #autoInitialize() {
+		if (!this.#mastra) return;
+		await this.initialize();
+	}
+	#resolveAgent(agentId) {
+		try {
+			return this.#mastra?.getAgentById(agentId);
+		} catch {
+			return;
+		}
+	}
+	async #getStore() {
+		if (this.#store) return this.#store;
+		const encryptionKey = this.#config.encryptionKey ?? process.env.MASTRA_ENCRYPTION_KEY;
+		this.#store = new TeamsInstallStore(await this.#resolveStorage(), encryptionKey);
+		return this.#store;
+	}
+	async #resolveStorage() {
+		if (this.#config.storage) return this.#config.storage;
+		const mastraStore = this.#mastra?.getStorage();
+		if (mastraStore) {
+			await mastraStore.init();
+			const channels = await mastraStore.getStore("channels");
+			if (channels) return channels;
+		}
+		console.warn("[Teams] No persistent channels storage configured — installations are stored in memory and will be lost on restart.");
+		return new InMemoryChannelsStorage();
+	}
+	#getBaseUrl() {
+		if (this.#config.baseUrl) return stripTrailingSlash(this.#config.baseUrl);
+		const server = this.#mastra?.getServer();
+		if (!server) return void 0;
+		const protocol = server.studioProtocol ?? "http";
+		const host = server.studioHost ?? server.host ?? "localhost";
+		const port = server.studioPort ?? server.port ?? (Number(process.env.PORT) || 4111);
+		return !(protocol === "https" && port === 443 || protocol === "http" && port === 80) ? `${protocol}://${host}:${port}` : `${protocol}://${host}`;
+	}
+};
+function stripTrailingSlash(url) {
+	return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+//#endregion
+export { DEV_PORTAL_BASE_URL, DEV_PORTAL_BOTS_URL, GRAPH_API_BASE_URL, LOGIN_BASE_URL, PLATFORM, TEAMS_DEV_PORTAL_SCOPE, TEAMS_GRAPH_SCOPE, TeamsAdapter, TeamsInstallStore, TeamsProvider, addApplicationPassword, createApplication, createBotRegistration, createTeamsAdapter, deleteApplication, deleteBotRegistration, resolveTeamsAdapterConfig, toInstallationInfo, validateBotCredentials };
+
+//# sourceMappingURL=index.js.map