@nimbus-dev/connectors 0.1.0

package/connectors/stripe/src/server.ts

@@ -0,0 +1,65 @@
+import { z } from "zod";
+import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterStripeInvoices } from "./search-filter.ts";
+
+const BASE = "https://api.stripe.com";
+
+function apiKey(): string {
+  const t = process.env["STRIPE_API_KEY"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("STRIPE_API_KEY is not set");
+  }
+  return t;
+}
+
+function authHeader(): Record<string, string> {
+  return { Authorization: `Bearer ${apiKey()}`, Accept: "application/json" };
+}
+
+async function stripeGet(path: string): Promise<unknown> {
+  const res = await fetch(`${BASE}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Stripe ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+await runReadOnlyMcpConnector("nimbus-stripe", (reg) => {
+  reg(
+    "stripe_list",
+    "List recent Stripe invoices (`GET /v1/invoices`), most-recent-first, capped at `limit` (default 100). Returns the `{ object: 'list', data, has_more }` envelope.",
+    z.object({
+      limit: z.number().int().min(1).max(100).optional(),
+    }),
+    async (p) => {
+      const search = new URLSearchParams({ limit: String(p.limit ?? 100) });
+      return jsonResult(await stripeGet(`/v1/invoices?${search.toString()}`));
+    },
+  );
+
+  reg(
+    "stripe_get",
+    "Fetch one Stripe invoice by its id (`GET /v1/invoices/{id}`, e.g. `in_1A2b...`). Returns the invoice object directly. Throws when no match is found.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(await stripeGet(`/v1/invoices/${encodeURIComponent(p.id)}`));
+    },
+  );
+
+  reg(
+    "stripe_search",
+    "Substring search across recent Stripe invoices. Matches the query against id, number, status, customer id, customer name, customer email, and the description (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const search = new URLSearchParams({ limit: "100" });
+      const root = await stripeGet(`/v1/invoices?${search.toString()}`);
+      const data = (root as { data?: unknown[] } | null)?.data;
+      return matchesResult(data, filterStripeInvoices, p);
+    },
+  );
+});

package/connectors/superset/nimbus.extension.json

@@ -0,0 +1,16 @@
+{
+  "id": "com.nimbus.superset",
+  "displayName": "Superset",
+  "version": "0.1.0",
+  "description": "Apache Superset connector (read-only). Surfaces Superset dashboards — title, slug, published flag, status, owner count, last editor, changed timestamp — into the local index as `superset:dashboard` items. Superset has no static API key: the connector authenticates with username/password against `POST /api/v1/security/login` to obtain a short-lived JWT, then calls the dashboards API with `Authorization: Bearer <access_token>`. Superset has no universal SaaS host: the server host is supplied via the `superset.url` vault key and added to the sandbox network list at spawn time by `phase3AddSupersetMcp`, so the static manifest network list is intentionally empty. v1 indexes dashboards only — charts, datasets, saved queries, and write tools are a deferred follow-up. No write tools.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [],
+    "filesystem": { "read": [], "write": [] }
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/superset/src/search-filter.ts

@@ -0,0 +1,22 @@
+import {
+  asRecord,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type SupersetSearchMatchOptions = SearchMatchOptions;
+
+function stringAt(row: Record<string, unknown>, key: string): string {
+  const v = row[key];
+  return typeof v === "string" ? v : "";
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asRecord(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [stringAt(row, "dashboard_title"), stringAt(row, "slug")];
+}
+
+export const filterSupersetDashboards = makeQueryFilter(fieldsOf);

package/connectors/superset/src/server.ts

@@ -0,0 +1,119 @@
+import { z } from "zod";
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterSupersetDashboards } from "./search-filter.ts";
+
+function trimTrailingSlash(s: string): string {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+
+function apiBase(): string {
+  const v = process.env["SUPERSET_URL"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("SUPERSET_URL is not set");
+  }
+  return trimTrailingSlash(v);
+}
+
+function requiredEnv(name: string): string {
+  const v = process.env[name]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error(`${name} is not set`);
+  }
+  return v;
+}
+
+let cachedToken: string | null = null;
+
+async function login(): Promise<string> {
+  if (cachedToken !== null) {
+    return cachedToken;
+  }
+  const username = requiredEnv("SUPERSET_USERNAME");
+  const password = requiredEnv("SUPERSET_PASSWORD");
+  const res = await fetch(`${apiBase()}/api/v1/security/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ username, password, provider: "db", refresh: true }),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Superset login ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  let parsed: { access_token?: unknown };
+  try {
+    parsed = JSON.parse(text) as { access_token?: unknown };
+  } catch {
+    throw new Error("Superset login: invalid JSON response");
+  }
+  if (typeof parsed.access_token !== "string" || parsed.access_token === "") {
+    throw new Error("Superset login: no access_token in response");
+  }
+  cachedToken = parsed.access_token;
+  return cachedToken;
+}
+
+async function supersetGet(path: string): Promise<unknown> {
+  const token = await login();
+  const res = await fetch(`${apiBase()}${path}`, {
+    headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Superset ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+function dashboardsFrom(root: unknown): unknown[] {
+  const result = (root as { result?: unknown } | null)?.result;
+  if (Array.isArray(result)) {
+    return result;
+  }
+  return Array.isArray(root) ? root : [];
+}
+
+function dashboardListPath(page: number, pageSize: number): string {
+  const q = encodeURIComponent(`(page:${String(page)},page_size:${String(pageSize)})`);
+  return `/api/v1/dashboard/?q=${q}`;
+}
+
+await runReadOnlyMcpConnector("nimbus-superset", (reg) => {
+  reg(
+    "superset_list",
+    "List Apache Superset dashboards (`GET /api/v1/dashboard/`). `limit` (default 100) caps the page_size of the single first-page request. Returns the `.result` array from the Superset envelope.",
+    z.object({
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      const root = await supersetGet(dashboardListPath(0, p.limit ?? 100));
+      return jsonResult(dashboardsFrom(root));
+    },
+  );
+
+  reg(
+    "superset_get",
+    "Fetch one Apache Superset dashboard by numeric id (`/api/v1/dashboard/{id}`). Throws when no dashboard with that id exists.",
+    z.object({
+      id: z.number().int(),
+    }),
+    async (p) => {
+      return jsonResult(await supersetGet(`/api/v1/dashboard/${encodeURIComponent(String(p.id))}`));
+    },
+  );
+
+  reg(
+    "superset_search",
+    "Substring search across Apache Superset dashboards. Matches the query (case-insensitive) against dashboard title and slug. Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(200),
+    async (p) => {
+      const root = await supersetGet(dashboardListPath(0, 500));
+      const matches = filterSupersetDashboards(dashboardsFrom(root), {
+        query: p.query,
+        limit: p.limit,
+      });
+      return jsonResult({ matches });
+    },
+  );
+});

package/connectors/tableau/nimbus.extension.json

@@ -0,0 +1,16 @@
+{
+  "id": "com.nimbus.tableau",
+  "displayName": "Tableau",
+  "version": "0.1.0",
+  "description": "Tableau connector. Indexes Tableau dashboards and views as `tableau:dashboard` items in the local index and exposes three read-only tools (`tableau_list`, `tableau_get`, `tableau_search`) plus two HITL-gated write tools: `tableau_datasource_refresh` (trigger an extract refresh for a published datasource) and `tableau_workbook_refresh` (trigger an extract refresh for a workbook). Uses the Tableau REST API with Personal Access Token (PAT) auth. The per-tenant server URL is supplied via the `tableau.url` vault key and its hostname is added to the sandbox network list at spawn time by `phase3AddTableauMcp`, so the static manifest network list is intentionally empty.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [],
+    "filesystem": { "read": [], "write": [] }
+  },
+  "hitlRequired": ["write"],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.5.0"
+}

package/connectors/tableau/src/search-filter.ts

@@ -0,0 +1,22 @@
+import {
+  asRecord,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type TableauSearchMatchOptions = SearchMatchOptions;
+
+function stringAt(row: Record<string, unknown>, key: string): string {
+  const v = row[key];
+  return typeof v === "string" ? v : "";
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asRecord(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [stringAt(row, "name"), stringAt(row, "luid")];
+}
+
+export const filterTableauViews = makeQueryFilter(fieldsOf);

package/connectors/tableau/src/server.ts

@@ -0,0 +1,248 @@
+import { z } from "zod";
+import { type ConsentServer, createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { fetchWithTimeout, mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import {
+  runReadOnlyMcpConnector,
+  type ZodToolRegistrar,
+} from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterTableauViews } from "./search-filter.ts";
+
+function trimTrailingSlash(s: string): string {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+
+function apiBase(): string {
+  const v = process.env["TABLEAU_URL"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("TABLEAU_URL is not set");
+  }
+  return trimTrailingSlash(v);
+}
+
+function patName(): string {
+  const v = process.env["TABLEAU_PAT_NAME"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("TABLEAU_PAT_NAME is not set");
+  }
+  return v;
+}
+
+function patSecret(): string {
+  const v = process.env["TABLEAU_PAT_SECRET"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("TABLEAU_PAT_SECRET is not set");
+  }
+  return v;
+}
+
+interface SigninResult {
+  token: string;
+  siteId: string;
+}
+
+async function tableauSignin(): Promise<SigninResult> {
+  const base = apiBase();
+  const res = await fetchWithTimeout(`${base}/api/3.4/auth/signin`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
+      credentials: {
+        personalAccessTokenName: patName(),
+        personalAccessTokenSecret: patSecret(),
+        site: { contentUrl: "" },
+      },
+    }),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Tableau signin ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  const parsed = JSON.parse(text) as unknown;
+  const root =
+    parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null;
+  const creds = root?.["credentials"];
+  const credsObj =
+    creds !== null && typeof creds === "object" && !Array.isArray(creds)
+      ? (creds as Record<string, unknown>)
+      : null;
+  const token = typeof credsObj?.["token"] === "string" ? credsObj["token"] : null;
+  const site = credsObj?.["site"];
+  const siteObj =
+    site !== null && typeof site === "object" && !Array.isArray(site)
+      ? (site as Record<string, unknown>)
+      : null;
+  const siteId = typeof siteObj?.["id"] === "string" ? siteObj["id"] : null;
+  if (token === null || siteId === null) {
+    throw new Error("Tableau signin response missing credentials.token or credentials.site.id");
+  }
+  return { token, siteId };
+}
+
+/**
+ * List views for a site. With a `page`, requests Tableau's 1-based `pageSize`/`pageNumber` paging and
+ * returns `pagination.totalAvailable`; without it (used by `_get`/`_search`), returns the default page
+ * with `totalAvailable: 0`.
+ */
+async function listViews(
+  token: string,
+  siteId: string,
+  page?: { pageSize: number; pageNumber: number },
+): Promise<{ views: unknown[]; totalAvailable: number }> {
+  const base = apiBase();
+  const qs = page === undefined ? "" : `?pageSize=${page.pageSize}&pageNumber=${page.pageNumber}`;
+  const res = await fetchWithTimeout(
+    `${base}/api/3.4/sites/${encodeURIComponent(siteId)}/views${qs}`,
+    { headers: { "X-Tableau-Auth": token, Accept: "application/json" } },
+  );
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Tableau views ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  const parsed = JSON.parse(text) as unknown;
+  const root =
+    parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null;
+  const views = root?.["views"];
+  const viewsObj =
+    views !== null && typeof views === "object" && !Array.isArray(views)
+      ? (views as Record<string, unknown>)
+      : null;
+  const pagination = root?.["pagination"];
+  const paginationObj =
+    pagination !== null && typeof pagination === "object" && !Array.isArray(pagination)
+      ? (pagination as Record<string, unknown>)
+      : null;
+  return {
+    views: Array.isArray(viewsObj?.["view"]) ? (viewsObj["view"] as unknown[]) : [],
+    totalAvailable: Number(paginationObj?.["totalAvailable"]) || 0,
+  };
+}
+
+async function tableauRefresh(kind: "datasources" | "workbooks", id: string): Promise<string> {
+  const { token, siteId } = await tableauSignin();
+  const base = apiBase();
+  const res = await fetchWithTimeout(
+    `${base}/api/3.4/sites/${encodeURIComponent(siteId)}/${kind}/${encodeURIComponent(id)}/refresh`,
+    {
+      method: "POST",
+      headers: {
+        "X-Tableau-Auth": token,
+        Accept: "application/json",
+        "Content-Type": "application/json",
+      },
+      body: "{}",
+    },
+  );
+  const text = await res.text();
+  if (!res.ok)
+    throw new Error(`Tableau ${kind} refresh ${String(res.status)}: ${text.slice(0, 400)}`);
+  const root = JSON.parse(text) as { job?: { id?: string } };
+  const jobId = root.job?.id;
+  if (jobId === undefined || jobId === "") {
+    // Fail closed: a 2xx with no job id is a malformed response; do not report it as a queued
+    // refresh (which would make the agent treat a non-started refresh as success).
+    throw new Error(`Tableau ${kind} refresh: response missing job.id: ${text.slice(0, 400)}`);
+  }
+  return jobId;
+}
+
+export function registerTableauTools(reg: ZodToolRegistrar, server: unknown): void {
+  // Despite the read-only helper's name, this connector exposes write tools. The consent
+  // kit needs the real server, which the helper now passes through as its second argument.
+  const registerWriteTool = createWriteToolRegistrar(server as ConsentServer, {
+    connector: "tableau",
+    scopeEnv: "NIMBUS_MCP_TABLEAU_WRITE_SCOPE",
+    scopeKinds: ["resource"],
+  });
+
+  reg(
+    "tableau_list",
+    "List Tableau views/dashboards (`GET /api/3.4/sites/{siteId}/views`). Requires a PAT sign-in first. Paginated (1-based): `cursor` (page number) + `limit` (default 200, max 500) → `{ items, nextCursor }`.",
+    z.object({
+      cursor: z.string().nullable().optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      const pageSize = p.limit ?? 200;
+      // 1-based: null / "" / "0" / non-numeric / negative / fractional all resolve to page 1
+      // (never page 0 / a negative or out-of-bounds page).
+      const parsedPage = Math.trunc(Number(p.cursor));
+      const pageNumber = Number.isFinite(parsedPage) && parsedPage >= 1 ? parsedPage : 1;
+      const { token, siteId } = await tableauSignin();
+      const { views, totalAvailable } = await listViews(token, siteId, { pageSize, pageNumber });
+      const nextCursor = pageNumber * pageSize < totalAvailable ? String(pageNumber + 1) : null;
+      return jsonResult({ items: views, nextCursor });
+    },
+  );
+
+  reg(
+    "tableau_get",
+    "Fetch one Tableau view by its luid. Throws when no view with that id exists.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      const { token, siteId } = await tableauSignin();
+      const { views } = await listViews(token, siteId);
+      const found = views.find((v) => {
+        const obj =
+          v !== null && typeof v === "object" && !Array.isArray(v)
+            ? (v as Record<string, unknown>)
+            : null;
+        return obj?.["luid"] === p.id || obj?.["id"] === p.id;
+      });
+      if (found === undefined) {
+        throw new Error(`Tableau view not found: ${p.id}`);
+      }
+      return jsonResult(found);
+    },
+  );
+
+  reg(
+    "tableau_search",
+    "Substring search across Tableau views. Matches the query (case-insensitive) against view name and luid. Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(200),
+    async (p) => {
+      const { token, siteId } = await tableauSignin();
+      const { views } = await listViews(token, siteId);
+      const matches = filterTableauViews(views, { query: p.query, limit: p.limit });
+      return jsonResult({ matches });
+    },
+  );
+
+  registerWriteTool(
+    "tableau_datasource_refresh",
+    {
+      mutates: "tableau.datasource.refresh",
+      recoverable: true,
+      scopeTargetOf: (p) => ({ kind: "resource", value: p.id }),
+    },
+    "Trigger an extract refresh for a published datasource. Async — returns the job id.",
+    z.object({ id: z.string().min(1) }),
+    async (p) => jsonResult({ status: "queued", jobId: await tableauRefresh("datasources", p.id) }),
+  );
+
+  registerWriteTool(
+    "tableau_workbook_refresh",
+    {
+      mutates: "tableau.workbook.refresh",
+      recoverable: true,
+      scopeTargetOf: (p) => ({ kind: "resource", value: p.id }),
+    },
+    "Trigger an extract refresh for a workbook. Async — returns the job id.",
+    z.object({ id: z.string().min(1) }),
+    async (p) => jsonResult({ status: "queued", jobId: await tableauRefresh("workbooks", p.id) }),
+  );
+}
+
+// Exported so the bundled-connector registry can start this server explicitly: `import.meta.main`
+// is false under an import, and the module must stay importable by tests without connecting stdio.
+export async function startConnector(): Promise<void> {
+  await runReadOnlyMcpConnector("nimbus-tableau", registerTableauTools);
+}
+
+if (import.meta.main) await startConnector();

package/connectors/teams/nimbus.extension.json

@@ -0,0 +1,20 @@
+{
+  "id": "com.nimbus.teams",
+  "displayName": "Microsoft Teams",
+  "version": "0.1.0",
+  "description": "Microsoft Graph Teams connector (teams, channels, messages). Mutations require Gateway HITL.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [
+      "graph.microsoft.com",
+      "login.microsoftonline.com",
+      "smba.trafficmanager.net",
+      "api.botframework.com"
+    ]
+  },
+  "hitlRequired": ["write", "delete"],
+  "syncInterval": 300,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/teams/src/bot-send.ts

@@ -0,0 +1,72 @@
+import { fetchBearerAuthorizedJson } from "../../../shared/fetch-bearer-json.ts";
+import { requireProcessEnv } from "../../../shared/mcp-tool-kit.ts";
+
+/**
+ * Bot Framework outbound send-activity for the ChatOps operational reply surface (Slice 5).
+ *
+ * A Teams bot does not use the signed-in user's Graph token to reply; it authenticates with its own
+ * app credentials (`TEAMS_BOT_APP_ID` / `TEAMS_BOT_APP_PASSWORD`) to obtain an app-only token from the
+ * Bot Framework token endpoint, then POSTs an activity to the conversation's service URL. The service
+ * URL is region-specific and is provided by the inbound activity; we read it from
+ * `TEAMS_BOT_SERVICE_URL` (the adapter captures it from the activity and injects it), defaulting to
+ * the global Teams endpoint.
+ */
+
+const BOT_TOKEN_ENDPOINT = "https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token";
+const BOT_TOKEN_SCOPE = "https://api.botframework.com/.default";
+const DEFAULT_SERVICE_URL = "https://smba.trafficmanager.net/teams/";
+
+type GraphLikeResult = { ok: boolean; status: number; json: unknown; text: string };
+
+async function acquireBotToken(appId: string, appPassword: string): Promise<string> {
+  const res = await fetch(BOT_TOKEN_ENDPOINT, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: appId,
+      client_secret: appPassword,
+      scope: BOT_TOKEN_SCOPE,
+    }).toString(),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Bot Framework token: ${text.slice(0, 400)}`);
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text) as unknown;
+  } catch {
+    throw new Error("Bot Framework token: non-JSON response");
+  }
+  const access =
+    parsed !== null && typeof parsed === "object"
+      ? (parsed as Record<string, unknown>)["access_token"]
+      : undefined;
+  if (typeof access !== "string" || access === "") {
+    throw new Error("Bot Framework token: missing access_token");
+  }
+  return access;
+}
+
+function serviceUrlBase(): string {
+  const raw = process.env["TEAMS_BOT_SERVICE_URL"];
+  const base = raw !== undefined && raw !== "" ? raw : DEFAULT_SERVICE_URL;
+  return base.endsWith("/") ? base : `${base}/`;
+}
+
+/** Send a plain-text message activity to a Teams conversation via the Bot Framework. */
+export async function teamsBotSendActivity(
+  conversationId: string,
+  text: string,
+): Promise<GraphLikeResult> {
+  const appId = requireProcessEnv("TEAMS_BOT_APP_ID");
+  const appPassword = requireProcessEnv("TEAMS_BOT_APP_PASSWORD");
+  const token = await acquireBotToken(appId, appPassword);
+  const url = `${serviceUrlBase()}v3/conversations/${encodeURIComponent(conversationId)}/activities`;
+  return fetchBearerAuthorizedJson(url, token, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ type: "message", text }),
+  });
+}