@open-everywhere/provider-teams 0.0.0-stage → 0.1.0

package/agent/register.ts

@@ -0,0 +1,219 @@
+// registerTeamsProvider — the ONE boot entry of @open-everywhere/provider-teams. The app's
+// adapter-wiring module (agent/lib/register-adapters.ts) imports this STATICALLY and calls it once
+// at boot; every seam the teams bundle implements registers here and nowhere else. Static imports
+// only: eve bundles the agent definition and its whole import graph into one rolldown chunk — a
+// literal dynamic import() code-splits and trips eve's "expected one authored module" invariant.
+//
+// What teams registers (and what it deliberately does NOT):
+//   • identity mapper        — bindTeams (chat-surface plane; channels/teams-identity.ts)
+//   • capability manifest    — midTurnPost via the host-side Connector write seam
+//                              (channels/teams-connector.ts, OPE-1237); no reaction primitive
+//   • post arm               — teamsPostArm (mid-turn reply + unified reply + redrive helpers + the
+//                              1:1 DM delivery arm, OPE-887)
+//   • wake-origin codec      — the stored-data teams arm (channels/teams-origin-codec.ts, which also
+//                              owns the Bot-Connector serviceUrl allowlist isTrustedTeamsServiceUrl)
+//   • read adapter           — teamsReadAdapter (Microsoft Graph channel/thread history reads)
+//   • routine dispatch       — resolveTeamsTarget (proactive routine fires need the captured Bot
+//                              Framework conversation reference + the teams channel object, both of
+//                              which now live in this bundle, so its resolver moved here too)
+//   • teams BRIDGE           — the bundle→core seam for the routine fire-eligibility leg's Graph
+//                              checks (OPE-522, mirroring the slack provider's own bridge):
+//                              accountEnabled + channel-membership, keyed on the creator's Azure AD
+//                              object id (channels/teams-fire-eligibility.ts, core channels/
+//                              teams-bridge.ts)
+//   • bot display name       — a HANDLE line on a Teams-pinned session, not identity since OPE-610,
+//                              read from the app's OWN service principal via Graph (OPE-587;
+//                              channels/teams-bot-name.ts, core identity/bot-display-name.ts)
+//   • account directory      — the Bot Connector roster of the teams this deployment has seen, for
+//                              the identity-linking directory transport (OPE-887;
+//                              channels/teams-directory.ts). NOT Microsoft Graph — Graph has no `29:`
+//                              id and a link keys on one; the header of that file carries the whole
+//                              argument
+//   • surface message ops    — teamsMessageOps: postText/editMessage (OPE-899), the transport behind
+//                              the stop acknowledgement and the approval decision notice. Resolves
+//                              its own serviceUrl from the `conversation`-grain address store
+//                              (channels/teams-conversation-ref.ts), since the registry's callers
+//                              hand it only a bare conversation id.
+//   • reaction surface       — INBOUND ONLY (OPE-1502). Teams delivers `messageReaction` activities
+//                              and refuses an application identity the outbound WRITE, so the
+//                              feedback ingest is wired (channels/teams-reaction-feedback.ts) while
+//                              the capability manifest still reads `reactions: false`
+//   • NO attachment resolver — the Teams surface carries no attachment plane today
+
+import {
+  registerIdentityMapper,
+  registerCapabilityManifest,
+  registerSurfaceParity,
+  registerProviderEvents,
+  registerReactionSurface,
+  registerPostArm,
+  registerWakeOriginCodec,
+  registerReadAdapter,
+  registerSeatCatchUp,
+  registerRoutineDispatch,
+  registerTeamsBridge,
+  registerBotDisplayName,
+  registerAccountDirectory,
+  registerSurfaceMessageOps,
+  type DispatchTarget,
+  type Routine,
+  type UnifiedWakeOrigin,
+  registerProviderDocs,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import { PROVIDER_DOCS } from "./docs-generated.js";
+import { TEAMS_SURFACE_PARITY } from "./surface-parity.js";
+import { TEAMS_PROVIDER_EVENTS } from "./provider-events.js";
+import { registerTeamsOps } from "./ops.js";
+import { teamsMessageOps } from "./channels/teams-message-ops.js";
+import teamsChannel from "./channels/teams.js";
+import { bindTeams, teamsMode } from "./channels/teams-identity.js";
+import { teamsPostArm } from "./channels/teams-post-arm.js";
+import { teamsWakeOriginCodec } from "./channels/teams-origin-codec.js";
+import { teamsReadAdapter } from "./channels/teams-read.js";
+import { teamsSeatCatchUpFetch, TEAMS_TIMESTAMP_PRECISION_MS } from "./channels/teams-catch-up.js";
+import { liveTeamsRoomMembership, liveTeamsAccountActive } from "./channels/teams-fire-eligibility.js";
+import { teamsBotDisplayName } from "./channels/teams-bot-name.js";
+import { fetchTeamsDirectory } from "./channels/teams-directory.js";
+
+/** One stored-target field as a non-empty string, or undefined (never a coerced non-string — the
+ *  store row is data, validated on the way out, not trusted). Local copy of the core dispatcher's
+ *  private helper (a two-line structural read; not a barrel port). */
+function storedString(t: Routine["target"], key: string): string | undefined {
+  const v = t?.[key];
+  return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+
+/**
+ * Resolve a Teams routine to its proactive-fire DispatchTarget — MOVED VERBATIM out of core's
+ * schedules/dispatch.ts (OPE-114 stage 4). Proactive messaging on Teams REQUIRES a Bot Framework
+ * conversation reference (serviceUrl + conversation id) captured on a prior INBOUND turn — you
+ * cannot cold-send to a Teams user/channel the bot has never heard from. bindTeams captures exactly
+ * that off every inbound activity, and create_routine stores it on the routine, so by construction
+ * every Teams routine created in-thread carries its reference. A routine WITHOUT one (both fields
+ * are required by eve's teamsChannel().receive, which throws otherwise) fails closed to dry-run
+ * (null) here.
+ */
+export function resolveTeamsTarget(r: Routine): DispatchTarget | null {
+  const serviceUrl = storedString(r.target, "serviceUrl");
+  const conversationId = storedString(r.target, "conversationId");
+  if (!serviceUrl || !conversationId) return null;
+  const conversationType = storedString(r.target, "conversationType");
+  const channelId = storedString(r.target, "channelId");
+  const teamId = storedString(r.target, "teamId");
+  // The creator's Azure AD object id (OPE-522) — stamped by bindTeams onto the routine's STORED
+  // target at creation time (channels/teams-identity.ts). Read back here into ATTRIBUTES, never
+  // into the fresh `target` below: `target` is what actually rides into the Bot Connector send
+  // (routine-dispatch.ts's DispatchTarget doc — "stored-target extras... feed attributes instead,
+  // never the adapter call"), and this value has no business in a Connector payload. The
+  // dispatcher's fire-eligibility leg reads it off `attributes.aad_object_id`.
+  const aadObjectId = storedString(r.target, "aadObjectId");
+  // tenant: the stored raw fact, else the surfaceKey's workspace segment (a tenant GUID is seg()-safe,
+  // so it round-trips verbatim — unlike the conversation id, whose ":"/"@" get sanitized in the key
+  // and MUST come from the stored target).
+  const tenantId = storedString(r.target, "tenantId") ?? r.surfaceKey.split("/")[1] ?? "";
+  // teamsMode is the one tested scope→mode place (personal→dm, groupChat→mpim); an absent stored
+  // scope resolves to "channel" (capped — the conservative arm).
+  const mode = teamsMode(conversationType);
+  // OPE-486 — the fire's WAKE ORIGIN, parity with resolveSlackTarget (routine-dispatch.ts). Absent
+  // before this fix, so a Teams fire could never divert into the unified window (fire-window.ts's
+  // planFireWindow fails closed on a missing origin). serviceUrl/conversationId are already
+  // non-empty-checked above (isTrustedTeamsServiceUrl re-validates serviceUrl in the codec's
+  // validate arm); no replyToActivityId — a proactive fire has no reply chain to anchor to, matching
+  // teams-front.ts's own ambient-origin mint (`{ platform: "teams", serviceUrl, conversationId }`).
+  const origin: UnifiedWakeOrigin = { platform: "teams", serviceUrl, conversationId, ...(tenantId ? { tenantId } : {}) };
+  return {
+    channel: teamsChannel,
+    // Full TeamsReceiveTarget: conversationType lets eve anchor non-personal threads correctly;
+    // tenant/team/channel ids ride into the Connector's channelData.
+    target: {
+      serviceUrl,
+      conversationId,
+      ...(conversationType ? { conversationType } : {}),
+      ...(channelId ? { channelId } : {}),
+      ...(teamId ? { teamId } : {}),
+      ...(tenantId ? { tenantId } : {}),
+    },
+    mode,
+    // The facts bindTeams reads (workspace = tenant, surface = conversation). NO membership_type is
+    // stamped — it was never re-verified at fire time, so teamsTrust yields no verdict and bindFrom
+    // fails the fire closed to `external` (shared memory / domain skills stay off), matching what an
+    // inbound Teams activity without membershipType gets.
+    attributes: {
+      conversation_id: conversationId,
+      service_url: serviceUrl,
+      ...(tenantId ? { tenant_id: tenantId } : {}),
+      ...(channelId ? { channel_id: channelId } : {}),
+      ...(teamId ? { team_id: teamId } : {}),
+      ...(conversationType ? { scope: conversationType } : {}),
+      ...(aadObjectId ? { aad_object_id: aadObjectId } : {}),
+    },
+    origin,
+  };
+}
+
+/** Perform ALL of the teams bundle's registrations. Idempotent (each register call replaces);
+ *  cheap and side-effect-free beyond the registry writes. */
+export function registerTeamsProvider(): void {
+  registerIdentityMapper("teams", bindTeams);
+  // Bot-Connector proactive post wired via the host-side Connector write seam (channels/
+  // teams-connector.ts, OPE-1237 — the post arm sends a message activity into the captured
+  // conversation reference). No integration reaction primitive.
+  // closingProseDropped (OPE-2006): the Teams completion handler DROPS a turn's closing text and
+  // audits it. `reply` is the only route out.
+  registerCapabilityManifest("teams", { midTurnPost: true, reactions: false, closingProseDropped: true });
+  // The OPE-1499 parity ledger: every capability the chat-surface contract names, answered
+  // `supported` or `{ unsupported: "<reason>" }`. Gates nothing at runtime — `lint:surface-parity`
+  // reds on an unanswered row, and the contract's §7.1/§7.1.1/§7.2 tables are generated from it.
+  registerSurfaceParity("teams", TEAMS_SURFACE_PARITY);
+  // The OPE-1612 event inventory: every vendor event that could wake a routine, and how far the
+  // normalizer plane carries each one. Gates nothing at runtime — `lint:provider-events` reds a
+  // bundle that declares none or that promises a match key the normalizer does not declare, and
+  // the manual's inventory table is generated from it.
+  registerProviderEvents("teams", TEAMS_PROVIDER_EVENTS);
+  registerPostArm(teamsPostArm);
+  registerWakeOriginCodec("teams", teamsWakeOriginCodec);
+  // Teams channel/thread history reads ride Microsoft Graph (Bot Framework has no history API).
+  registerReadAdapter(teamsReadAdapter);
+  // THE SEAT CATCH-UP FETCH (OPE-1726): the channel (or reply chain) history since the seat's
+  // last wake, over Microsoft Graph — the same transport `read_channel` uses, and NOT the Bot
+  // Connector the wake arrives on. Core's shared path applies the bounds, the policy and the cap.
+  // The surface DECLARES the unit its own message stamps carry, and core widens both catch-up
+  // bounds by it (OPE-1847). A wrong or missing unit bounds the seat out of its own window.
+  registerSeatCatchUp("teams", teamsSeatCatchUpFetch, { timestampPrecisionMs: TEAMS_TIMESTAMP_PRECISION_MS });
+  // Proactive routine fires on the teams surface (needs the captured Bot Framework reference).
+  registerRoutineDispatch("teams", { resolveTarget: resolveTeamsTarget });
+  // The bundle→core bridge for the routine fire-eligibility leg's Graph checks (OPE-522) — core's
+  // routines/fire-eligibility.ts consumes these through channels/teams-bridge.ts, never Graph
+  // directly, mirroring the slack provider's own registerSlackBridge call.
+  registerTeamsBridge({ roomMembership: liveTeamsRoomMembership, accountActive: liveTeamsAccountActive });
+  // The bot's own display name (OPE-587) — core's per-surface registry arm, rendered as a HANDLE
+  // line, not identity, since OPE-610 settled the naming model. Reads the app's OWN service
+  // principal through the same Graph token the read adapter mints; needs no extra Azure consent
+  // (the app's implicit self-read, measured live). See channels/teams-bot-name.ts.
+  registerBotDisplayName("teams", teamsBotDisplayName);
+  // THE TEAMS ACCOUNT DIRECTORY (OPE-887) — the lookup the reverse-initiated link uses to NAME the
+  // other account instead of posting a bearer code where a room can read it. It walks the Bot
+  // Connector roster of the teams this deployment has captured a conversation reference for, so the
+  // ids it returns are the `29:` ids a Teams link actually keys on. The other half of the transport
+  // is the post arm's `deliverDirectMessage` — core requires BOTH before it offers the transport,
+  // and both rest on the same captured reference (channels/teams-conversation-ref.ts).
+  registerAccountDirectory("teams", (query) => fetchTeamsDirectory(query));
+  // THE STOP ACKNOWLEDGEMENT'S TRANSPORT (OPE-899) — postText/editMessage, so turn-anchor.ts's
+  // postSurfaceText resolves a real send instead of undefined on a Teams turn. No postFiles (no
+  // attachment plane) and no setReaction (no reaction primitive beyond the `angry` stop trigger).
+  registerSurfaceMessageOps(teamsMessageOps);
+  // REACTION-FEEDBACK INGEST (OPE-1502) — INBOUND only, and that is not a contradiction with the
+  // `reactions: false` manifest above. Teams refuses an application identity the outbound WRITE
+  // (§7.3's probe), while it delivers `messageReaction` activities inbound freely. The arm that
+  // records them is channels/teams-reaction-feedback.ts, reached from the stop arm's fan-out.
+  registerReactionSurface("teams");
+  // Shipped-manual plane (OPE-138): this bundle's own setup runbook (docs/deploy/surfaces/teams.md,
+  // compiled into ./docs-generated.ts because docs/ is not on disk at runtime). De-select the bundle
+  // and the module leaves the import graph; registerProviderDocs re-checks the selection gate anyway.
+  registerProviderDocs("teams", PROVIDER_DOCS);
+  // Ops plane (OPE-428): the live preflight probe that reports which Microsoft boundary governs
+  // channel reads. Split into ./ops.js so the STANDALONE ops MCP entry (repo-root
+  // scripts/ops-mcp.ts, which serves preflight with no agent boot) registers it without pulling
+  // the whole channel graph — the same split slack uses.
+  registerTeamsOps();
+}

package/agent/surface-parity.ts

@@ -0,0 +1,112 @@
+// TEAMS' surface-parity declaration (OPE-1499). See the core module's header
+// (packages/core/agent/identity/surface-parity.ts) for what the three cell shapes mean.
+//
+// Some of the gaps below are PERMANENT vendor limits and some are NOT BUILT YET. The distinction is
+// the whole point of writing a reason down: `react` and the ✋ glyph are things Microsoft does not
+// let an application identity do, so no ticket will ever close them. Reaction-feedback ingest was
+// the other kind — unwritten OE work — and OPE-1502 closed it, which is what the row now says.
+
+import type { SurfaceParityDeclaration } from "@open-everywhere/core/agent/adapter-api.js";
+
+export const TEAMS_SURFACE_PARITY: SurfaceParityDeclaration = {
+  // --- registration seams (§7.1) ---------------------------------------------------------------
+  "identity-mapper": "supported",
+  "capability-manifest": "supported",
+  "post-arm": "supported",
+  "wake-origin-codec": "supported",
+  "unified-action-plane": {
+    unsupported:
+      "the arm posts a plain message activity, and a button here needs an Adaptive Card PLUS an invoke route to receive the tap. `teams-front.ts` forwards every `invoke` to the native channel, whose HITL route resolves a tap against the TEAMS channel's own session — a unified seat's parked request lives on another session entirely, so an OE-minted card would render a button that settles nothing. Prose, which stands on its own, until that route exists",
+  },
+  "origin-placement-carry": {
+    unsupported:
+      "the placement is INSIDE the conversation identity: `threadRef` keys on `replyToActivityId`, the very activity a reply hangs under, so two origins that pass the conversation test already agree on placement and there is no gap to carry",
+  },
+  "read-adapter": "supported",
+  // INBOUND reaction ingest is wired (OPE-1502); the OUTBOUND write below is not, and the two are
+  // independent. The note is the honest half: Microsoft delivers `messageReaction` only for messages
+  // the agent itself sent, and delivers no author for the reacted message — so the "is this the
+  // agent's own reply" test on this surface is that vendor fence plus a present `replyToId`, not the
+  // author comparison Slack, Discord and Linear make.
+  "reaction-feedback-ingest": { supported: "the vendor fence is the guarantee — Teams delivers the event only for the agent's own messages, and carries no author to compare" },
+  "ancillary-ops": "supported",
+  // WIRED, AND TENANT-CONDITIONAL — the qualified form, because a bare ✅ over-claimed it against
+  // the support matrix's own 🔧 row (OPE-1527). The seam is built and armed on every channel and
+  // group chat; whether a PLAIN follow-up ever reaches it is the tenant's RSC consent, which no API
+  // can probe (channels/teams-engagement.ts). Without the grant only @mention activities arrive, so
+  // the seam wakes nothing and the surface answers once per mention exactly as before.
+  "ambient-engagement-seam": {
+    supported: "the seam is wired; plain follow-ups reach it only where the tenant consented to `ChannelMessage.Read.Group` / `ChatMessage.Read.Chat`, which no API can probe",
+  },
+  // The single-window divert writes `plan.window.addressing ?? "channel-watch"` (teams-front.ts), so
+  // an engaged follow-up and unowned room chatter leave the same row. No journey reds on it today —
+  // `J-ENGAGED-teams` does not gate a dispatch addressing — so the gap is declared here rather than
+  // carried as a silent one.
+  "engaged-row-promotion": {
+    unsupported: "not built yet — the single-window divert writes the plan's own `addressing`, which calls an engaged follow-up and room chatter alike",
+  },
+  // The reply chain IS the thread on Teams, so the router reads `replyToActivityId` the way it
+  // reads Slack's `threadTs`. A plain conversation send starts its own chain and stays top-level.
+  // The personal/group-chat DM leg keeps the raw divert — it mints no reply-chain origin.
+  "owned-thread-ingress": { supported: "the channel leg only — a reply chain is the thread; the DM leg mints no `replyToActivityId`, so it can own none" },
+
+  // --- wake legs and conversation shapes -------------------------------------------------------
+  "addressed-leg": "supported",
+  // Not the engagement seam: the wake is the single-window front's Leg A, a different mechanism.
+  // The registry does suppress it, though — the front drops a stood-down conversation above both
+  // legs, for a conversation an @mention enrolled (§7.6).
+  "ambient-leg": { supported: "the single-window front's Leg A, not the §2.5 engagement registry" },
+  // 🔴 OVER GRAPH, NOT THE BOT CONNECTOR. The transport a Teams activity arrives on carries no
+  // history API — which is why `teams-supervisor.ts` once said this surface could not catch up at all
+  // — but `teams-catch-up.ts` reads `/teams/{team}/channels/{channel}/messages`, the same Graph call
+  // `read_channel` uses. A personal or group chat carries no team id, so it takes no catch-up.
+  "seat-catch-up": { supported: "over Microsoft Graph (channel activities only — a personal/group chat carries no team id)" },
+  // The slot is EMPTY on this surface: `teams-front.ts` builds no `contextLines`, so there is no pour
+  // to police. The seat's room context here is the catch-up read above and the carried tail, both of
+  // which already pass the domain's policy in core.
+  "seat-context-admission": { unsupported: "the hydration fills no context-line slot — the seat's room context is the catch-up read, which core already admits" },
+  // The same missing invoke route the component-plane row above names: a card needs an Adaptive Card
+  // PLUS a tap that resolves against the UNIFIED seat's parked request, and `teams-front.ts` forwards
+  // every `invoke` to the native channel's own session, so nothing here can card in place. See the
+  // roster row for what that costs and where it does NOT cost anything.
+  "approval-card": { unsupported: "no invoke route resolves a tap against a unified seat's parked request. A governed act that takes the venue walk is redirected to a card-capable room in the SAME domain, or refused when the domain holds none. The paths OUTSIDE that walk do not: the spend checkpoint (spend/checkpoint.ts `requireSessionContinuation`) fails OPEN here and records the crossing in an audit row instead" },
+  // THE TRACE ARRIVES EVEN THOUGH THE BUTTON CANNOT (OPE-1854). A judge-lifted act posts its
+  // notice here as a plain message activity through the shared road (`postJudgeLiftNotice`), on this
+  // surface's own `SurfaceMessageOps` transport. It carries the overrule as an INSTRUCTION in
+  // words, with the action id a reviewer finds the act by, because no tap can land here.
+  // 🔴 BARE, NOT `{ supported: "…" }`. A noted cell is exempt from the overclaim arm, and the
+  // arm is the point: drop this bundle's text transport and the notice silently stops arriving.
+  "judge-lift-notice": "supported",
+  "name-drop-mention": { unsupported: "not built yet — Leg A wakes on an @mention or room chatter, never on a name-drop match" },
+  // 🔴 THE ACTIVITY TYPE IS THE FILTER. Teams sends an edit as a `messageUpdate` activity, and the
+  // inbound parser admits `message`, `invoke` and `conversationUpdate` only, so the edit resolves to
+  // null before `teams-front.ts` sees it. `teams-front.ts` forwards every non-`message` activity to
+  // the native channel for the same reason — there is nothing on this surface to gate.
+  "message-edit-wake": { unsupported: "an edit arrives as a `messageUpdate` activity, and the inbound parser admits `message`, `invoke` and `conversationUpdate` only" },
+  // The `;messageid=` reply chain (§4.6.1).
+  threads: "supported",
+  rooms: "supported",
+  dm: "supported",
+  mpim: "supported",
+
+  // --- core verbs (§7.2) -----------------------------------------------------------------------
+  reply: "supported",
+  edit_reply: "supported",
+  // PERMANENT. Microsoft Graph carries an outbound reaction route, but it refuses the
+  // application-only context OE runs in — there is no primitive an app identity can drive (§7.3).
+  react: { unsupported: "vendor limit — Graph's outbound reaction route refuses an application-only identity" },
+  no_reply: "supported",
+  read_channel: "supported",
+  read_thread: "supported",
+  search: { unsupported: "no work-search adapter — Teams is a chat surface, not a work corpus (§4.7)" },
+  post_message: "supported",
+  dm_person: "supported",
+  set_dm_delivery: "supported",
+  // Teams' six fixed reaction values carry no raised hand, so the stop trigger is `angry` — the one
+  // of the six people already use to mean "this is wrong" (§4.8).
+  stop: { supported: "the `angry` reaction — Teams' six fixed values carry no ✋" },
+  ack_stop_glyph: { unsupported: "vendor limit — Teams' fixed six-value reaction vocabulary has no raised hand" },
+  ack_cancel_note: "supported",
+  stand_down: { supported: "marks the conversation row; refuses on a 1:1 and when no row exists" },
+  post_file: { unsupported: "not built yet — no Teams attachment transport is wired (§7.3)" },
+};

package/dist/agent/channels/teams-bot-name.d.ts

@@ -0,0 +1,36 @@
+import type { BotDisplayNameArm } from "@open-everywhere/core/agent/adapter-api.js";
+import { type TeamsGraphRequester } from "./teams-read.js";
+/**
+ * The app's own display name from its service principal, or `undefined` when Graph cannot answer.
+ * Pure but for the injected `req` — exported (not just the live wrapper below) so the URL, the
+ * shape read and the fail-soft rules are unit-testable with a canned requester, no token mint and
+ * no network call. Same DI shape as teams-fire-eligibility.ts's probes.
+ *
+ * FAIL-SOFT on everything: an empty appId, a thrown request (`liveTeamsGraphRequest` throws on a
+ * missing token or a non-ok response), a response that is not an object, and a `displayName` that is
+ * absent, non-string or blank all read `undefined`.
+ */
+export declare function teamsBotDisplayNameViaGraph(appId: string, req: TeamsGraphRequester): Promise<string | undefined>;
+/**
+ * The Teams app-CATALOG display name (OPE-609) — what the Teams client renders beside a message —
+ * or `undefined` when Graph cannot answer. FAIL-SOFT identically to {@link teamsBotDisplayNameViaGraph}:
+ * a missing `AppCatalog.Read.All` consent throws a 403 inside `req`, caught here, so an unconsented
+ * or de-consented tenant reads `undefined` rather than blocking a turn. An empty `value` array (no
+ * catalog entry matches the app id) also reads `undefined`.
+ */
+export declare function teamsCatalogDisplayNameViaGraph(appId: string, req: TeamsGraphRequester): Promise<string | undefined>;
+/**
+ * The full resolution order (OPE-609): the catalog name first, the service-principal name second,
+ * `undefined` last. Pure but for the injected `req` — one requester serves both legs, so a test can
+ * assert exactly how many calls each leg made. Exported so the live arm and its tests share one
+ * definition of "what order do the two legs run in."
+ */
+export declare function resolveTeamsBotDisplayNameViaGraph(appId: string, req: TeamsGraphRequester): Promise<string | undefined>;
+/** Live arm: {@link resolveTeamsBotDisplayNameViaGraph} through the real app id + Graph transport,
+ *  resolved once per instance. `resolveTeamsAppId()` throws when MICROSOFT_APP_ID is unset, so it
+ *  is inside the try — an unconfigured deployment reads `undefined`, never an exception into
+ *  instruction assembly. */
+export declare const teamsBotDisplayName: BotDisplayNameArm;
+/** Test seam: drop the memoised name so one test cannot inherit another's. */
+export declare function _resetTeamsBotDisplayNameForTest(): void;
+//# sourceMappingURL=teams-bot-name.d.ts.map

package/dist/agent/channels/teams-bot-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-bot-name.d.ts","sourceRoot":"","sources":["../../../agent/channels/teams-bot-name.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AACpF,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AA8BlF;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQtH;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW1H;AAED;;;;;GAKG;AACH,wBAAsB,kCAAkC,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAI7H;AAKD;;;4BAG4B;AAC5B,eAAO,MAAM,mBAAmB,EAAE,iBAoBjC,CAAC;AAEF,8EAA8E;AAC9E,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD"}

package/dist/agent/channels/teams-bot-name.js

@@ -0,0 +1,141 @@
+// teams-bot-name — the bot's OWN display name on Teams, read from Microsoft Graph (OPE-587,
+// catalog leg OPE-609). The teams arm of core's per-surface bot-display-name registry
+// (identity/bot-display-name.ts), so a Teams-pinned session introduces the agent by a real name
+// instead of the generic identity line.
+//
+// ── TWO NAMES, TRIED IN ORDER ────────────────────────────────────────────────────────────────
+// 1. THE TEAMS APP-CATALOG NAME — `teamsApps.displayName` — is what the Teams client actually
+//    renders beside a message (the manifest's `name.short`). Reading it needs a tenant-admin-
+//    consented `AppCatalog.Read.All`; OPE-587 shipped without this leg because that call 403'd
+//    (`Missing role permissions`) on the only tenant available at the time. OPE-609 grants that
+//    consent, so this arm now tries the catalog first:
+//      GET /v1.0/appCatalogs/teamsApps?$filter=externalId eq '{MICROSOFT_APP_ID}'&$expand=appDefinitions
+//    NOT RE-MEASURED against a live 200 response as of this change — the consent was granted but a
+//    fresh probe of the catalog call itself was not run. The fail-soft path below means a wrong
+//    guess about the response shape degrades to the fallback below, never to a broken turn.
+// 2. THE SERVICE PRINCIPAL NAME — the ENTRA APP REGISTRATION display name — is the pre-OPE-609
+//    fallback and MEASURED LIVE against the e2e Teams tenant on 2026-08-15:
+//      GET /v1.0/servicePrincipals(appId='{MICROSOFT_APP_ID}')?$select=displayName
+//    The token carried exactly ONE application role (the RSC grant `Group.Selected`) and this call
+//    still returned HTTP 200 — an IMPLICIT self-read of the app's own directory object, needing no
+//    directory-read permission at all. `GET /users/{id}?$select=displayName` on the SAME token
+//    returned 403, confirming it is not a general directory-read grant. This is the name a
+//    deployment gets when `AppCatalog.Read.All` is unconsented, revoked, or the catalog call fails
+//    for any other reason — it can differ from the catalog name in case and spacing (measured in
+//    the e2e tenant: `open-everywhere` here versus `Open Everywhere` in the catalog / manifest).
+//
+// WHY THE SERVICE PRINCIPAL, NOT `/applications`, FOR LEG 2. `GET /v1.0/applications(appId='…')`
+// answered 200 with the same string in the same probe, so both work for a SINGLE-TENANT bot. They
+// stop being equivalent for a MULTI-TENANT one: the `application` object lives only in the app's
+// HOME tenant, while a `servicePrincipal` exists in EVERY tenant that consented to the app — and
+// the Graph token this arm rides is minted per tenant (`resolveTeamsTenantId`). The service
+// principal is therefore the object that exists wherever the token points. NOT VERIFIED: only one
+// tenant was available, so the foreign-tenant self-read is reasoned, not measured. Either leg fails
+// soft: an unresolvable name renders the generic identity line, which is what a Teams session got
+// before this arm existed.
+//
+// ── CACHING ──────────────────────────────────────────────────────────────────────────────────
+// One memoised promise per instance, matching the slack arm's `botDisplayName()` exactly: the
+// instruction assembler renders the identity line every turn, so an uncached arm would add a Graph
+// round trip per turn and could flip the standing block's bytes mid-session. A rename needs a cold
+// start to take effect. A FAILED resolution is cached too — the same posture — so a deployment
+// missing the token does not re-probe Graph on every turn. The 5s timeout bounds BOTH legs
+// together (one race around the whole two-call chain), not each leg separately — a hung catalog
+// call cannot silently double the turn's worst-case wait by handing the fallback leg its own budget.
+import { resolveTeamsAppId } from "eve/channels/teams";
+import { liveTeamsGraphRequest } from "./teams-read.js";
+const GRAPH_BASE = "https://graph.microsoft.com/v1.0";
+/** A Graph `displayName` field reduced to a usable string, or `undefined` for any other shape
+ *  (absent, non-string, blank) — shared by both name legs so "what counts as a name" is defined
+ *  exactly once. */
+function trimmedName(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/**
+ * The app's own display name from its service principal, or `undefined` when Graph cannot answer.
+ * Pure but for the injected `req` — exported (not just the live wrapper below) so the URL, the
+ * shape read and the fail-soft rules are unit-testable with a canned requester, no token mint and
+ * no network call. Same DI shape as teams-fire-eligibility.ts's probes.
+ *
+ * FAIL-SOFT on everything: an empty appId, a thrown request (`liveTeamsGraphRequest` throws on a
+ * missing token or a non-ok response), a response that is not an object, and a `displayName` that is
+ * absent, non-string or blank all read `undefined`.
+ */
+export async function teamsBotDisplayNameViaGraph(appId, req) {
+    if (appId.length === 0)
+        return undefined;
+    try {
+        const json = (await req(`${GRAPH_BASE}/servicePrincipals(appId='${encodeURIComponent(appId)}')?$select=displayName`));
+        return trimmedName(json?.displayName);
+    }
+    catch {
+        return undefined; // no token / 401 / 403 / 404 / transport failure ⇒ core renders the generic line
+    }
+}
+/**
+ * The Teams app-CATALOG display name (OPE-609) — what the Teams client renders beside a message —
+ * or `undefined` when Graph cannot answer. FAIL-SOFT identically to {@link teamsBotDisplayNameViaGraph}:
+ * a missing `AppCatalog.Read.All` consent throws a 403 inside `req`, caught here, so an unconsented
+ * or de-consented tenant reads `undefined` rather than blocking a turn. An empty `value` array (no
+ * catalog entry matches the app id) also reads `undefined`.
+ */
+export async function teamsCatalogDisplayNameViaGraph(appId, req) {
+    if (appId.length === 0)
+        return undefined;
+    try {
+        const json = (await req(`${GRAPH_BASE}/appCatalogs/teamsApps?$filter=externalId eq '${encodeURIComponent(appId)}'&$expand=appDefinitions`));
+        const entry = Array.isArray(json?.value) ? json.value[0] : undefined;
+        return trimmedName(entry?.displayName) ?? trimmedName(entry?.appDefinitions?.[0]?.displayName);
+    }
+    catch {
+        return undefined; // no consent / 401 / 403 / 404 / transport failure ⇒ fall back to the service principal
+    }
+}
+/**
+ * The full resolution order (OPE-609): the catalog name first, the service-principal name second,
+ * `undefined` last. Pure but for the injected `req` — one requester serves both legs, so a test can
+ * assert exactly how many calls each leg made. Exported so the live arm and its tests share one
+ * definition of "what order do the two legs run in."
+ */
+export async function resolveTeamsBotDisplayNameViaGraph(appId, req) {
+    const catalog = await teamsCatalogDisplayNameViaGraph(appId, req);
+    if (catalog !== undefined)
+        return catalog;
+    return teamsBotDisplayNameViaGraph(appId, req);
+}
+/** The memoised per-instance promise — see the CACHING note in the header. */
+let displayNamePromise;
+/** Live arm: {@link resolveTeamsBotDisplayNameViaGraph} through the real app id + Graph transport,
+ *  resolved once per instance. `resolveTeamsAppId()` throws when MICROSOFT_APP_ID is unset, so it
+ *  is inside the try — an unconfigured deployment reads `undefined`, never an exception into
+ *  instruction assembly. */
+export const teamsBotDisplayName = () => {
+    if (!displayNamePromise) {
+        displayNamePromise = (async () => {
+            try {
+                // The memoised value is a PROMISE and instruction assembly awaits it on every Teams turn,
+                // so a hung Graph call would block every turn on the instance, not one. The race bounds
+                // it: a stall settles the memo to `undefined` (the generic line), same as any other miss.
+                // The bound wraps BOTH legs (see the CACHING header note) — a slow catalog call eats into
+                // the same 5s budget the fallback leg would otherwise need.
+                const timeout = new Promise((resolve) => {
+                    const t = setTimeout(() => resolve(undefined), 5000);
+                    t.unref?.();
+                });
+                return await Promise.race([resolveTeamsBotDisplayNameViaGraph(await resolveTeamsAppId(), liveTeamsGraphRequest), timeout]);
+            }
+            catch {
+                return undefined;
+            }
+        })();
+    }
+    return displayNamePromise;
+};
+/** Test seam: drop the memoised name so one test cannot inherit another's. */
+export function _resetTeamsBotDisplayNameForTest() {
+    displayNamePromise = undefined;
+}
+//# sourceMappingURL=teams-bot-name.js.map

package/dist/agent/channels/teams-bot-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-bot-name.js","sourceRoot":"","sources":["../../../agent/channels/teams-bot-name.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sFAAsF;AACtF,gGAAgG;AAChG,wCAAwC;AACxC,EAAE;AACF,gGAAgG;AAChG,8FAA8F;AAC9F,8FAA8F;AAC9F,+FAA+F;AAC/F,gGAAgG;AAChG,uDAAuD;AACvD,yGAAyG;AACzG,mGAAmG;AACnG,gGAAgG;AAChG,4FAA4F;AAC5F,+FAA+F;AAC/F,4EAA4E;AAC5E,mFAAmF;AACnF,mGAAmG;AACnG,mGAAmG;AACnG,+FAA+F;AAC/F,2FAA2F;AAC3F,mGAAmG;AACnG,iGAAiG;AACjG,iGAAiG;AACjG,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,kGAAkG;AAClG,oGAAoG;AACpG,kGAAkG;AAClG,2BAA2B;AAC3B,EAAE;AACF,gGAAgG;AAChG,8FAA8F;AAC9F,mGAAmG;AACnG,mGAAmG;AACnG,+FAA+F;AAC/F,2FAA2F;AAC3F,gGAAgG;AAChG,qGAAqG;AAErG,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAA4B,MAAM,iBAAiB,CAAC;AAElF,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAmBtD;;oBAEoB;AACpB,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAa,EAAE,GAAwB;IACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,6BAA6B,kBAAkB,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAA4B,CAAC;QACjJ,OAAO,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,iFAAiF;IACrG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAAa,EAAE,GAAwB;IAC3F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,GAAG,UAAU,iDAAiD,kBAAkB,CAAC,KAAK,CAAC,0BAA0B,CAClH,CAA4B,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,WAAW,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,wFAAwF;IAC5G,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAAa,EAAE,GAAwB;IAC9F,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,2BAA2B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,IAAI,kBAA2D,CAAC;AAEhE;;;4BAG4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAsB,GAAG,EAAE;IACzD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,kBAAkB,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,CAAC;gBACH,0FAA0F;gBAC1F,wFAAwF;gBACxF,0FAA0F;gBAC1F,0FAA0F;gBAC1F,4DAA4D;gBAC5D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;oBACjD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;oBACrD,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,kCAAkC,CAAC,MAAM,iBAAiB,EAAE,EAAE,qBAAqB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7H,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,gCAAgC;IAC9C,kBAAkB,GAAG,SAAS,CAAC;AACjC,CAAC"}

package/dist/agent/channels/teams-catch-up.d.ts

@@ -0,0 +1,53 @@
+import { type TeamsGraphRequester } from "./teams-read.js";
+import { type AuditInput, type NormalizedMessage, type SeatCatchUpFetch } from "@open-everywhere/core/agent/adapter-api.js";
+/** Split the `<teamId>/<channelId>` container this surface's catch-up is addressed by. Returns
+ *  undefined for anything else rather than guessing a half — a partial address would read another
+ *  team's channel, the silent mis-address the wake-container design refuses. */
+export declare function parseTeamsCatchUpContainer(container: string): {
+    teamId: string;
+    channelId: string;
+} | undefined;
+/** Injected seam so the fetch drives offline in tests; defaults to the live Graph transport. */
+export interface TeamsCatchUpDeps {
+    readonly request: TeamsGraphRequester;
+    /** The deployment's own Entra object id, so its prior posts read as `self`. Absent ⇒ they arrive
+     *  tagged `bot` (an application author), which is visible and honest, never a crash. */
+    readonly selfActorId?: string;
+    /** The audit writer. Injected so the contract test reads the row this fetch emits instead of a
+     *  store; live callers get {@link appendAudit}, which never throws by its own contract. */
+    readonly audit?: (entry: AuditInput) => Promise<void>;
+}
+/** The audit action this read records under. One family, one spelling — a query for the next red
+ *  ship is `action = "teams.catch_up"` and nothing else. */
+export declare const TEAMS_CATCH_UP_ACTION = "teams.catch_up";
+/** The `<platform>/<workspace>/<surface>` domain-grain key the shared path hands down, split for the
+ *  audit row's own WHERE columns. Returns undefined for an absent key or a non-Teams one rather than
+ *  guessing a workspace — the row then says `unknown`, which is a fact, not a filled-in blank.
+ *  Pure; exported so the contract test pins the parse rather than re-deriving it. */
+export declare function teamsCatchUpScopeFromChannelKey(channelKey: string | undefined): {
+    workspace: string;
+    surface: string;
+} | undefined;
+/** The fetch, with its seams exposed so the contract test drives it with no network. */
+export declare function fetchTeamsCatchUpWindow(req: {
+    container: string;
+    threadRoot?: string;
+    sinceMs: number;
+    channelKey?: string;
+}, deps?: TeamsCatchUpDeps): Promise<readonly NormalizedMessage[]>;
+/**
+ * A Graph message's `createdDateTime` carries MILLISECOND grain (OPE-1847,
+ * `core/agent/channels/seat-catch-up.ts` {@link SeatCatchUpDeclaration.timestampPrecisionMs}).
+ * 🔴 ONE MILLISECOND IS NOT ZERO WIDENING. The road widens the LOWER bound by nothing here and the
+ * UPPER bound by exactly one millisecond, so a message stamped at the trigger's own instant is
+ * INSIDE the window and `excludeId` is the only thing that removes the trigger. A rendered Teams
+ * line carries the Graph message id in its `ts` slot, which is the value the wake path passes as
+ * `excludeId`.
+ * 🔴 IT IS STILL DECLARED, and the parity test requires it. The declaration is what makes "this
+ * surface needs the finest unit" a CHECKED claim rather than an omission, and an omission is
+ * indistinguishable from the GitHub and Notion defect this whole mechanism exists to close.
+ */
+export declare const TEAMS_TIMESTAMP_PRECISION_MS = 1;
+/** Teams' registered {@link SeatCatchUpFetch} — the one thing this surface contributes to the shared path. */
+export declare const teamsSeatCatchUpFetch: SeatCatchUpFetch;
+//# sourceMappingURL=teams-catch-up.d.ts.map

package/dist/agent/channels/teams-catch-up.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-catch-up.d.ts","sourceRoot":"","sources":["../../../agent/channels/teams-catch-up.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAwG,KAAK,mBAAmB,EAA0B,MAAM,iBAAiB,CAAC;AACzL,OAAO,EAA6C,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAMvK;;gFAEgF;AAChF,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO/G;AA0CD,gGAAgG;AAChG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC;4FACwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;+FAC2F;IAC3F,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAID;4DAC4D;AAC5D,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD;;;qFAGqF;AACrF,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAKlI;AAmBD,wFAAwF;AACxF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EACrF,IAAI,GAAE,gBAA2B,GAChC,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAqEvC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,8GAA8G;AAC9G,eAAO,MAAM,qBAAqB,EAAE,gBAQhC,CAAC"}