@open-everywhere/provider-teams 0.0.0-stage → 0.1.0

package/dist/agent/channels/teams-identity.d.ts

@@ -0,0 +1,148 @@
+import type { SessionMode, IdentityMapper } from "@open-everywhere/core/agent/adapter-api.js";
+/** Structural match for eve's SessionAuthContext (attributes + principal). */
+export interface OpenEverywhereTeamsAuth {
+    readonly authenticator: string;
+    readonly principalId: string;
+    readonly principalType: string;
+    readonly attributes: Record<string, string>;
+}
+export interface TeamsIdentityInput {
+    /** The Teams user (from.id) — the OpenEverywhere principal. */
+    readonly userId: string;
+    /** Azure AD object id of the actor, when carried — a stable cross-tenant user key. */
+    readonly aadObjectId?: string;
+    readonly userName?: string;
+    /** The tenant (org) — becomes the OpenEverywhere `workspace`, the org boundary. */
+    readonly tenantId?: string;
+    /** The conversation — becomes the OpenEverywhere `surface`. */
+    readonly conversationId: string;
+    /** Teams team/channel id (channel conversations only). */
+    readonly channelId?: string;
+    /** Teams team id (channel conversations only). */
+    readonly teamId?: string;
+    /** Bot Connector base URL for proactive post-back. */
+    readonly serviceUrl?: string;
+    /** Normalized conversation scope: "personal" | "groupChat" | "channel" | "unknown". */
+    readonly scope?: string;
+    /** Channel membership type ("standard" | "private" | "shared"), when positively known. */
+    readonly membershipType?: string;
+    /**
+     * The acting user's tenant membership type ("guest" | "member"), positively resolved via the
+     * cached Bot Connector roster probe (teams-roster.ts — the analog of Slack's users.info). A GUEST
+     * is a cross-org / B2B-collaboration account inside the tenant, so it demotes the surface's
+     * trust to `external` exactly as a restricted Slack DM partner does. `undefined` = never
+     * determined (no lookup / lookup failed / field absent) → teamsTrust leaves the existing
+     * channel/vouch verdict intact (fail-closed unless the operator vouches), mirroring Slack.
+     */
+    readonly userType?: string;
+}
+/**
+ * Fold a resolved tenant membership type into an ALREADY-BUILT auth capture (OPE-493).
+ *
+ * The front resolves the roster verdict AFTER it has built the capture, because the probe is a
+ * network call and the capture is built synchronously. This is the seam that carries the answer in,
+ * so the attribute name still has exactly one spelling.
+ *
+ * 🔴 NO VERDICT RETURNS THE SAME OBJECT, by reference. That is the fail-open guarantee stated as
+ * code: when the probe cannot answer, nothing downstream can tell the probe ran.
+ */
+export declare function withTeamsUserType<A extends OpenEverywhereTeamsAuth>(auth: A, userType: string | undefined): A;
+/** Build the auth context OpenEverywhere dispatches with — raw facts as string attributes. */
+export declare function buildTeamsAuth(input: TeamsIdentityInput): OpenEverywhereTeamsAuth;
+/**
+ * Pull the channel membershipType out of a Bot Framework activity's `channelData`,
+ * which (for channel conversations) may carry `{ channel: { membershipType } }`.
+ * Defensive: channelData is raw JSON, so everything is probed, never assumed. Note
+ * that inbound message activities frequently OMIT membershipType (it's a Graph/Teams
+ * API property, not a guaranteed Activity field) — absence is the common case, and
+ * teamsVisibility fails closed to private on it.
+ */
+export declare function teamsMembershipType(channelData: Record<string, unknown> | undefined): string | undefined;
+/**
+ * The acting user's tenant membership type from a Bot Connector roster member record (or a
+ * Microsoft Graph `/users/{id}` object) — the authoritative "is this a GUEST?" signal, the
+ * Teams analog of Slack's `partnerFactsFromInfo`. Probes `userType` (Graph: "Guest"/"Member")
+ * then `userRole` (Bot roster: "guest" for a guest, else a member role), case-insensitively.
+ * Pure + defensive (raw JSON): a missing/failed lookup, an empty role, or an unrecognised value
+ * all yield `undefined` (no verdict → the existing channel/vouch trust stands, fail-closed
+ * unless vouched). Only a positive "guest" flag → "guest" (→ external demotion); a positively
+ * recognised member/owner/admin role → "member".
+ *
+ * What it PROVES: the tenant classifies this account as a guest (external B2B collaborator) —
+ * demote. What it does NOT prove: that a "member" is inside YOUR org boundary if the deployment
+ * spans multiple tenants; org-internal trust still requires the channel verdict or an operator
+ * vouch. It is a demotion-only signal, never an upgrade.
+ */
+export declare function teamsUserTypeFromMember(info: unknown): "guest" | "member" | undefined;
+/**
+ * Teams conversation scope → session mode, or UNDEFINED when the scope classifies nothing.
+ *
+ * 🔴 THE UNDEFINED IS THE POINT (OPE-1867). An inbound activity that carries no `conversationType`
+ * — or one Teams spells in a way this mapper does not know — tells us nothing about whether the
+ * conversation is a room or a 1:1 chat with one person. Answering "channel" there is a DEFAULT, not
+ * a reading, and a reader that publishes the surface must be able to tell the two apart: a personal
+ * chat reported as a room names that individual's conversation id in a report posted into a room.
+ * {@link teamsMode} applies the default for every reader that needs a usable value; this function
+ * is what the identity mapper hands the binding, so the provenance survives.
+ */
+export declare function teamsResolvedMode(scope: string | undefined): SessionMode | undefined;
+/** Teams conversation scope → session mode, GAP-FILLED to `channel` when nothing classifies it.
+ *  Visibility, trust and the seat-grain stamps all need a definite value and all fail closed on
+ *  their own terms, so the default is right for them. A reader that PUBLISHES the surface wants
+ *  {@link teamsResolvedMode} instead. */
+export declare function teamsMode(scope: string | undefined): SessionMode;
+/**
+ * Teams facts → visibility. FAIL CLOSED, mirroring slackVisibility: anything we
+ * can't positively confirm as a team-wide (standard) channel is treated as
+ * `private`, so a surface's learnings never leak up to shared memory on an
+ * under-specified event. Personal/group chats are never public surfaces. For a team
+ * channel, only `membershipType === "standard"` (the org/team-wide channel everyone
+ * on the team can see) yields `public`; `private`/`shared`/unknown → `private`.
+ * (Inbound activities usually DON'T carry membershipType, so the fail-closed branch
+ * is the normal case for channels — private is the safe default.)
+ */
+export declare function teamsVisibility(scope: string | undefined, membershipType: string | undefined, mode: SessionMode): Visibility;
+/**
+ * Teams membership → trust (memory gate). FAIL CLOSED — only POSITIVE facts yield a
+ * verdict. A `shared` channel is a Teams Shared Channel — it can include people from
+ * OTHER tenants/orgs (the Teams analog of Slack Connect) — so it's `external` and gets
+ * no shared memory. A channel positively identified as `standard`/`private` AND carrying
+ * its tenant id is in-tenant → `internal`. Personal/group chats are personal silos
+ * (gate N/A → internal; bindFrom's DM-partner gate still fails an unverified DM partner
+ * closed). ANYTHING ELSE — absent membershipType (the common case: inbound activities
+ * routinely omit it), an unrecognised value, or a missing tenant id — returns
+ * `undefined`, so bindFrom FAILS CLOSED to `external` (shared/org memory gated off)
+ * unless the operator vouches for the deployment with OE_TRUST=internal — the same
+ * layer Discord/Linear use. An ambiguous Teams event must never reach the
+ * shared org brain.
+ *
+ * GUEST DETECTION (OPE-60): a `userType` positively resolved to "guest" (a cross-org / B2B
+ * collaboration account inside the tenant, via the cached roster lookup) DEMOTES to `external`
+ * FIRST — ahead of every other branch, including the personal-silo and standard-channel
+ * `internal` verdicts and the operator vouch (bindFrom's precedence gives a mapper's own
+ * `external` verdict priority over the vouch). This is exactly how Slack demotes a restricted
+ * DM partner. An absent/unknown `userType` (the common case — no lookup, or a lookup that
+ * couldn't confirm) leaves the existing verdict intact, so behaviour is unchanged unless a
+ * guest is positively detected.
+ */
+export declare function teamsTrust(scope: string | undefined, membershipType: string | undefined, mode: SessionMode, tenantId?: string, userType?: string): Trust | undefined;
+/** Local copies of the binding's unions (kept eve-free + import-cycle-free). */
+type Visibility = "public" | "private";
+type Trust = "internal" | "external";
+/**
+ * The trust-registry GROUP rung for a Teams TEAM (OPE-490), or `undefined` when this activity has
+ * no team (a personal or group chat) or the id is not a safe key segment.
+ *
+ * FAIL-CLOSED and REFUSING, never repairing: an id that would need sanitising contributes no rung
+ * at all. Repairing it would risk composing a segment that collides with a real key, and a missing
+ * rung is simply the pre-OPE-490 behaviour.
+ *
+ * Exported for the identity test, which pins the marker spelling — the spelling is a config
+ * contract an operator types into `agent/identity/surfaces.ts`, so it must not drift silently.
+ */
+export declare function teamsTrustGroup(teamId: string | undefined): {
+    readonly trustGroup: string;
+} | undefined;
+export declare const bindTeams: IdentityMapper;
+export {};
+//# sourceMappingURL=teams-identity.d.ts.map

package/dist/agent/channels/teams-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-identity.d.ts","sourceRoot":"","sources":["../../../agent/channels/teams-identity.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAmB,cAAc,EAAe,MAAM,4CAA4C,CAAC;AAG5H,8EAA8E;AAC9E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,uBAAuB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,CAAC,CAG7G;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,KAAK,EAAE,kBAAkB,GAAG,uBAAuB,CAqBjF;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAKxG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CASrF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAKpF;AAED;;;yCAGyC;AACzC,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAEhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,WAAW,GAChB,UAAU,CAMZ;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,WAAW,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,GAChB,KAAK,GAAG,SAAS,CASnB;AAED,gFAAgF;AAChF,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AACvC,KAAK,KAAK,GAAG,UAAU,GAAG,UAAU,CAAC;AAwCrC;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAGvG;AAED,eAAO,MAAM,SAAS,EAAE,cA6GvB,CAAC"}

package/dist/agent/channels/teams-identity.js

@@ -0,0 +1,336 @@
+// Pure Microsoft Teams→OpenEverywhere identity capture. The Teams channel (teams.ts) calls
+// these to stow RAW Teams facts (tenant/conversation/channel/team ids + scope +
+// membershipType + actor) into the session auth context's `attributes`. The
+// INTERPRETATION of those facts into mode/visibility lives here too (teamsMode/
+// teamsVisibility) — kept beside the capture so the mapper in
+// agent/identity/binding.ts (bindTeams) just calls them, exactly as Slack splits
+// capture (slack-identity.ts) from interpretation (binding.ts). This file imports no
+// eve types — only OpenEverywhere's `SessionMode` string-union — so it's trivially
+// unit-testable. The security-critical decisions are ONE tested place each and both
+// fail closed: teamsVisibility ("is this a team-wide (public) channel?") and
+// teamsTrust ("is this surface positively in-tenant?" — unknown → no verdict, so
+// bindFrom binds it external).
+import { rootDmGrainAttrs } from "@open-everywhere/core/agent/adapter-api.js";
+/** The attribute the roster verdict is stowed under — ONE spelling, read by `bindTeams` and by the
+ *  front's `teamsAuthorRefuted`. */
+const TEAMS_USER_TYPE_ATTR = "user_type";
+/**
+ * Fold a resolved tenant membership type into an ALREADY-BUILT auth capture (OPE-493).
+ *
+ * The front resolves the roster verdict AFTER it has built the capture, because the probe is a
+ * network call and the capture is built synchronously. This is the seam that carries the answer in,
+ * so the attribute name still has exactly one spelling.
+ *
+ * 🔴 NO VERDICT RETURNS THE SAME OBJECT, by reference. That is the fail-open guarantee stated as
+ * code: when the probe cannot answer, nothing downstream can tell the probe ran.
+ */
+export function withTeamsUserType(auth, userType) {
+    if (!userType)
+        return auth;
+    return { ...auth, attributes: { ...auth.attributes, [TEAMS_USER_TYPE_ATTR]: userType } };
+}
+/** Build the auth context OpenEverywhere dispatches with — raw facts as string attributes. */
+export function buildTeamsAuth(input) {
+    const attributes = {
+        conversation_id: input.conversationId,
+        user_id: input.userId,
+    };
+    if (input.aadObjectId)
+        attributes.aad_object_id = input.aadObjectId;
+    if (input.userName)
+        attributes.user_name = input.userName;
+    if (input.tenantId)
+        attributes.tenant_id = input.tenantId;
+    if (input.channelId)
+        attributes.channel_id = input.channelId;
+    if (input.teamId)
+        attributes.team_id = input.teamId;
+    if (input.serviceUrl)
+        attributes.service_url = input.serviceUrl;
+    if (input.scope)
+        attributes.scope = input.scope;
+    if (input.membershipType)
+        attributes.membership_type = input.membershipType;
+    if (input.userType)
+        attributes[TEAMS_USER_TYPE_ATTR] = input.userType;
+    // Root-DM grain stamp (window-tool-gating §D-DM, widened to group DMs): a 1:1 (scope "personal")
+    // chat OR a groupChat (⇒ "mpim") is a STANDING seat ⇒ narrowed hands — both are closed multi-party
+    // conversations with no channel identity. teamsMode's "channel" branch (scope "channel"/unknown) is
+    // unambiguously excluded, so a real team channel is never over-narrowed.
+    const teamsScopeMode = teamsMode(input.scope);
+    Object.assign(attributes, rootDmGrainAttrs(teamsScopeMode === "dm" || teamsScopeMode === "mpim"));
+    return { authenticator: "teams", principalId: input.userId, principalType: "teams-user", attributes };
+}
+/**
+ * Pull the channel membershipType out of a Bot Framework activity's `channelData`,
+ * which (for channel conversations) may carry `{ channel: { membershipType } }`.
+ * Defensive: channelData is raw JSON, so everything is probed, never assumed. Note
+ * that inbound message activities frequently OMIT membershipType (it's a Graph/Teams
+ * API property, not a guaranteed Activity field) — absence is the common case, and
+ * teamsVisibility fails closed to private on it.
+ */
+export function teamsMembershipType(channelData) {
+    const ch = channelData?.channel;
+    if (!ch || typeof ch !== "object")
+        return undefined;
+    const mt = ch["membershipType"];
+    return typeof mt === "string" && mt.length > 0 ? mt : undefined;
+}
+/**
+ * The acting user's tenant membership type from a Bot Connector roster member record (or a
+ * Microsoft Graph `/users/{id}` object) — the authoritative "is this a GUEST?" signal, the
+ * Teams analog of Slack's `partnerFactsFromInfo`. Probes `userType` (Graph: "Guest"/"Member")
+ * then `userRole` (Bot roster: "guest" for a guest, else a member role), case-insensitively.
+ * Pure + defensive (raw JSON): a missing/failed lookup, an empty role, or an unrecognised value
+ * all yield `undefined` (no verdict → the existing channel/vouch trust stands, fail-closed
+ * unless vouched). Only a positive "guest" flag → "guest" (→ external demotion); a positively
+ * recognised member/owner/admin role → "member".
+ *
+ * What it PROVES: the tenant classifies this account as a guest (external B2B collaborator) —
+ * demote. What it does NOT prove: that a "member" is inside YOUR org boundary if the deployment
+ * spans multiple tenants; org-internal trust still requires the channel verdict or an operator
+ * vouch. It is a demotion-only signal, never an upgrade.
+ */
+export function teamsUserTypeFromMember(info) {
+    if (!info || typeof info !== "object")
+        return undefined; // lookup failed / absent → no verdict
+    const o = info;
+    const raw = o["userType"] ?? o["userRole"]; // Graph userType | Bot Connector roster userRole
+    if (typeof raw !== "string" || raw.length === 0)
+        return undefined; // field absent → no verdict
+    const v = raw.toLowerCase();
+    if (v === "guest")
+        return "guest";
+    if (v === "member" || v === "user" || v === "owner" || v === "admin" || v === "organizer")
+        return "member";
+    return undefined; // unrecognised value → no verdict (fail toward the existing lower/fail-closed tier)
+}
+/**
+ * Teams conversation scope → session mode, or UNDEFINED when the scope classifies nothing.
+ *
+ * 🔴 THE UNDEFINED IS THE POINT (OPE-1867). An inbound activity that carries no `conversationType`
+ * — or one Teams spells in a way this mapper does not know — tells us nothing about whether the
+ * conversation is a room or a 1:1 chat with one person. Answering "channel" there is a DEFAULT, not
+ * a reading, and a reader that publishes the surface must be able to tell the two apart: a personal
+ * chat reported as a room names that individual's conversation id in a report posted into a room.
+ * {@link teamsMode} applies the default for every reader that needs a usable value; this function
+ * is what the identity mapper hands the binding, so the provenance survives.
+ */
+export function teamsResolvedMode(scope) {
+    if (scope === "personal")
+        return "dm"; // a 1:1 chat with the bot
+    if (scope === "groupChat")
+        return "mpim"; // an ad-hoc group chat
+    if (scope === "channel")
+        return "channel"; // a team channel
+    return undefined; // "unknown" / unrecognised → nothing classified this conversation
+}
+/** Teams conversation scope → session mode, GAP-FILLED to `channel` when nothing classifies it.
+ *  Visibility, trust and the seat-grain stamps all need a definite value and all fail closed on
+ *  their own terms, so the default is right for them. A reader that PUBLISHES the surface wants
+ *  {@link teamsResolvedMode} instead. */
+export function teamsMode(scope) {
+    return teamsResolvedMode(scope) ?? "channel";
+}
+/**
+ * Teams facts → visibility. FAIL CLOSED, mirroring slackVisibility: anything we
+ * can't positively confirm as a team-wide (standard) channel is treated as
+ * `private`, so a surface's learnings never leak up to shared memory on an
+ * under-specified event. Personal/group chats are never public surfaces. For a team
+ * channel, only `membershipType === "standard"` (the org/team-wide channel everyone
+ * on the team can see) yields `public`; `private`/`shared`/unknown → `private`.
+ * (Inbound activities usually DON'T carry membershipType, so the fail-closed branch
+ * is the normal case for channels — private is the safe default.)
+ */
+export function teamsVisibility(scope, membershipType, mode) {
+    // 1:1 and group chats are never "public" surfaces.
+    if (mode === "dm" || mode === "mpim")
+        return "private";
+    if (scope === "personal" || scope === "groupChat")
+        return "private";
+    if (membershipType === "standard")
+        return "public"; // an explicit team-wide channel
+    return "private"; // private/shared/unknown channel → fail closed
+}
+/**
+ * Teams membership → trust (memory gate). FAIL CLOSED — only POSITIVE facts yield a
+ * verdict. A `shared` channel is a Teams Shared Channel — it can include people from
+ * OTHER tenants/orgs (the Teams analog of Slack Connect) — so it's `external` and gets
+ * no shared memory. A channel positively identified as `standard`/`private` AND carrying
+ * its tenant id is in-tenant → `internal`. Personal/group chats are personal silos
+ * (gate N/A → internal; bindFrom's DM-partner gate still fails an unverified DM partner
+ * closed). ANYTHING ELSE — absent membershipType (the common case: inbound activities
+ * routinely omit it), an unrecognised value, or a missing tenant id — returns
+ * `undefined`, so bindFrom FAILS CLOSED to `external` (shared/org memory gated off)
+ * unless the operator vouches for the deployment with OE_TRUST=internal — the same
+ * layer Discord/Linear use. An ambiguous Teams event must never reach the
+ * shared org brain.
+ *
+ * GUEST DETECTION (OPE-60): a `userType` positively resolved to "guest" (a cross-org / B2B
+ * collaboration account inside the tenant, via the cached roster lookup) DEMOTES to `external`
+ * FIRST — ahead of every other branch, including the personal-silo and standard-channel
+ * `internal` verdicts and the operator vouch (bindFrom's precedence gives a mapper's own
+ * `external` verdict priority over the vouch). This is exactly how Slack demotes a restricted
+ * DM partner. An absent/unknown `userType` (the common case — no lookup, or a lookup that
+ * couldn't confirm) leaves the existing verdict intact, so behaviour is unchanged unless a
+ * guest is positively detected.
+ */
+export function teamsTrust(scope, membershipType, mode, tenantId, userType) {
+    if (userType === "guest")
+        return "external"; // positively-detected guest → demote (wins over vouch)
+    if (mode === "dm" || mode === "mpim")
+        return "internal"; // personal silo; gate N/A
+    if (scope === "personal" || scope === "groupChat")
+        return "internal";
+    if (membershipType === "shared")
+        return "external"; // cross-tenant Shared Channel
+    if (tenantId && (membershipType === "standard" || membershipType === "private")) {
+        return "internal"; // positively-identified in-tenant channel
+    }
+    return undefined; // unverifiable membership/tenant → bindFrom fails closed to external
+}
+function teamsAuthOf(ctx) {
+    return ctx.session?.auth?.current ?? ctx.session?.auth?.initiator ?? null;
+}
+function teamsAttr(a, keys) {
+    if (!a)
+        return undefined;
+    for (const k of keys) {
+        const v = a[k];
+        if (typeof v === "string" && v.length > 0)
+            return v;
+        if (Array.isArray(v) && typeof v[0] === "string" && v[0].length > 0)
+            return v[0];
+    }
+    return undefined;
+}
+function teamsAuthPrincipalId(ctx) {
+    const pid = teamsAuthOf(ctx)?.principalId;
+    return pid && pid.length > 0 ? pid : undefined;
+}
+/**
+ * The trust-registry GROUP rung for a Teams TEAM (OPE-490), or `undefined` when this activity has
+ * no team (a personal or group chat) or the id is not a safe key segment.
+ *
+ * FAIL-CLOSED and REFUSING, never repairing: an id that would need sanitising contributes no rung
+ * at all. Repairing it would risk composing a segment that collides with a real key, and a missing
+ * rung is simply the pre-OPE-490 behaviour.
+ *
+ * Exported for the identity test, which pins the marker spelling — the spelling is a config
+ * contract an operator types into `agent/identity/surfaces.ts`, so it must not drift silently.
+ */
+export function teamsTrustGroup(teamId) {
+    if (teamId === undefined || !/^[a-zA-Z0-9._-]+$/.test(teamId))
+        return undefined;
+    return { trustGroup: `team:${teamId}` };
+}
+export const bindTeams = (ctx) => {
+    const a = teamsAuthOf(ctx)?.attributes;
+    const scope = teamsAttr(a, ["scope"]);
+    const membershipType = teamsAttr(a, ["membership_type", "membershipType"]);
+    const userType = teamsAttr(a, ["user_type", "userType"]); // "guest" | "member" — cached roster probe (teams-roster.ts)
+    const mode = teamsMode(scope);
+    const conversationId = teamsAttr(a, ["conversation_id", "conversationId"]);
+    const serviceUrl = teamsAttr(a, ["service_url", "serviceUrl"]);
+    const tenantId = teamsAttr(a, ["tenant_id", "tenantId"]);
+    return {
+        workspace: tenantId,
+        surface: conversationId,
+        // A channel-scoped Teams CONVERSATION names one reply chain (the conversation id carries
+        // `;messageid=<root>`), so the listable/vouchable/spend-cappable container is the Teams
+        // CHANNEL — domain membership resolves at the channel grain, mirroring the Discord
+        // thread→parent-channel precedent (bindDiscord.domainSurface). Absent (personal/groupChat,
+        // or an activity with no channel id) → fall back to the conversation grain, today's exact
+        // behaviour (bindFrom only surfaces domainSurface when it differs from surface).
+        domainSurface: teamsAttr(a, ["channel_id", "channelId"]),
+        // 🔴 THE RESOLVED mode, not the gap-filled one (OPE-1867). An activity with no recognised
+        // `conversationType` contributes NO mode here; bindFrom still gap-fills `channel`, so every
+        // reader below and downstream is unchanged — but the binding now says the value was a default,
+        // and the one reader that publishes a surface refuses it. `visibility` and `trust` keep taking
+        // the gap-filled `mode` local above, which is what their own fail-closed rules are written for.
+        mode: teamsResolvedMode(scope),
+        // 🔴 THE TEAM RUNG (OPE-490). A Teams channel keys as `teams/<tenant>/<conversationId>` and the
+        // TEAM is nowhere in that key, so an operator could not declare a whole team internal or public
+        // — only enumerate its channels. This contributes the team as a MARKED group segment, which the
+        // trust registry matches as a rung BETWEEN the tenant and the surface
+        // (identity/surface-key-grammar.ts). An operator then writes:
+        //
+        //     defineSurface({ key: "teams/<tenantId>/team:<teamId>", trust: "internal" })
+        //
+        // The vendor word "team" lives HERE, in the Teams bundle, never in core — core composes
+        // `<platform>/<tenant>/<segment>` and validates only the `<marker>:<id>` shape.
+        //
+        // It changes NO domain semantics: the surface key, the domain key and every memory/spend/audit
+        // grain are byte-identical. `teamId` is present only on a CHANNEL activity, so a personal or
+        // group chat contributes no rung and resolves exactly as before.
+        ...(teamsTrustGroup(teamsAttr(a, ["team_id", "teamId"])) ?? {}),
+        visibility: teamsVisibility(scope, membershipType, mode),
+        trust: teamsTrust(scope, membershipType, mode, tenantId, userType),
+        principalId: teamsAuthPrincipalId(ctx) ?? teamsAttr(a, ["user_id", "userId"]),
+        // 🔴 THE ENGAGEMENT-REGISTRY KEY (OPE-1500), the Discord precedent (`bindDiscord.engagementKey`)
+        // in Teams' own vocabulary. It is the CONVERSATION id, which names the REPLY CHAIN in a team
+        // channel (the id carries `;messageid=<root>`) and the CHAT in a group chat — the two containers
+        // an engagement can be kept per on this surface. The same id is this binding's `surface`, so
+        // `teams/<tenant>/<conversationId>` + `<conversationId>` addresses the exact row the seam's wake
+        // gate reads back (channels/teams-engagement.ts). Publishing it here is what lets `stand_down`
+        // mark that row; without it the verb found no anchor and refused on every Teams turn.
+        //
+        // NEVER ON A 1:1 CHAT, and the omission is the honest half — Discord's DM reasoning exactly. A
+        // personal chat is answered unconditionally (the front's DM divert bypasses the engagement gate
+        // by design), so a mark on it would suppress nothing, and `stand_down` says it could not stop
+        // rather than writing a row that changes nothing.
+        ...(teamsMode(scope) !== "dm" && conversationId ? { engagementKey: conversationId } : {}),
+        // 🔴 THE ROOM-GRAIN STOP ANCHOR (OPE-1511), and Teams is the only surface that has one. The
+        // single-window front's Leg A wakes on ANY message in a vouched CHANNEL, including a reply chain
+        // no @mention ever engaged — a room-grain wake, which the conversation-grain key above cannot
+        // address. Publishing the CHANNEL id here is what lets `stand_down` reach the room row that wake
+        // stores (channels/teams-engagement.ts), instead of refusing on a wake the person can plainly
+        // see. The verb marks it only when the conversation grain held no row, so an ordinary
+        // thread-grain stop is unchanged.
+        //
+        // CHANNEL SCOPE ONLY. A personal or group chat has no Leg A — the front diverts both into their
+        // own DM window above `planFor` — so there is no room wake to stop and a mark here would be a
+        // write nobody reads. The value is the raw channel id, for the audit trail; the row's address is
+        // derived from the partition on both sides, so no spelling can drift.
+        ...(mode === "channel" && teamsAttr(a, ["channel_id", "channelId"])
+            ? { roomEngagementKey: teamsAttr(a, ["channel_id", "channelId"]) }
+            : {}),
+        // THE STOP REGISTRY'S ADDRESS FOR THIS TURN (OPE-898) — the CONVERSATION, which on a Teams
+        // channel means the REPLY CHAIN, not the channel. A `messageReaction` activity carries
+        // `conversation.id`, so the reply chain is the only container a stop trigger can name.
+        //
+        // 🔴 IT IS NOT `target.channelId`, even though this binding has one. That field holds the Teams
+        // CHANNEL id, which is a coarser room than the turn ran in and is absent on a personal chat —
+        // so keying the registry on it would both over-reach and leave every DM turn unstoppable.
+        // `anchorChannelId` wins over `target.channelId` in hooks/turn-anchor.ts for exactly this case.
+        ...(conversationId ? { anchorChannelId: conversationId } : {}),
+        // Proactive post-back needs the Bot Connector CONVERSATION REFERENCE (serviceUrl +
+        // conversation id), not a thread anchor — Teams can't cold-address a chat by AAD
+        // user id (Bot Framework requires a reference captured on a prior inbound turn,
+        // which is exactly what this is: every field comes off THIS inbound activity).
+        // `conversationType` (the activity's scope: personal/groupChat/channel) rides along
+        // so a routine FIRE can re-derive mode without guessing from id shapes — the
+        // dispatcher (@open-everywhere/provider-teams register.ts resolveTeamsTarget) stamps it
+        // back as the `scope` attribute this very mapper reads.
+        target: conversationId && serviceUrl
+            ? {
+                serviceUrl,
+                conversationId,
+                tenantId,
+                channelId: teamsAttr(a, ["channel_id", "channelId"]),
+                teamId: teamsAttr(a, ["team_id", "teamId"]),
+                conversationType: scope,
+                // The creator's Azure AD object id (OPE-522) — carried on the STORED target so a routine
+                // created from this turn can be re-checked at fire time (routines/fire-eligibility.ts's
+                // Teams leg): Graph's `/users/{id}` and a channel roster's `userId` are both keyed on
+                // this value, a DIFFERENT identifier from the Bot Framework `from.id` this mapper's own
+                // `principalId` carries (see buildTeamsAuth's `aad_object_id` attribute, captured above).
+                // Absent when the inbound activity didn't carry one (e.g. no Teams AAD linkage) — a
+                // routine created from such a turn simply has no Teams eligibility leg to run, matching
+                // every other "cannot check" case in this module family.
+                aadObjectId: teamsAttr(a, ["aad_object_id", "aadObjectId"]),
+            }
+            : undefined,
+    };
+};
+//# sourceMappingURL=teams-identity.js.map

package/dist/agent/channels/teams-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-identity.js","sourceRoot":"","sources":["../../../agent/channels/teams-identity.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,iFAAiF;AACjF,qFAAqF;AACrF,mFAAmF;AACnF,oFAAoF;AACpF,6EAA6E;AAC7E,iFAAiF;AACjF,+BAA+B;AAG/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAyC9E;oCACoC;AACpC,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAoC,IAAO,EAAE,QAA4B;IACxG,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC3F,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,MAAM,UAAU,GAA2B;QACzC,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,OAAO,EAAE,KAAK,CAAC,MAAM;KACtB,CAAC;IACF,IAAI,KAAK,CAAC,WAAW;QAAE,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC,WAAW,CAAC;IACpE,IAAI,KAAK,CAAC,QAAQ;QAAE,UAAU,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC1D,IAAI,KAAK,CAAC,QAAQ;QAAE,UAAU,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC1D,IAAI,KAAK,CAAC,SAAS;QAAE,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM;QAAE,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;IACpD,IAAI,KAAK,CAAC,UAAU;QAAE,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;IAChE,IAAI,KAAK,CAAC,KAAK;QAAE,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAChD,IAAI,KAAK,CAAC,cAAc;QAAE,UAAU,CAAC,eAAe,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5E,IAAI,KAAK,CAAC,QAAQ;QAAE,UAAU,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;IACtE,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,yEAAyE;IACzE,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC;IAClG,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACxG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAgD;IAClF,MAAM,EAAE,GAAI,WAAiE,EAAE,OAAO,CAAC;IACvF,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAChC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,CAAC,sCAAsC;IAC/F,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iDAAiD;IAC7F,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,4BAA4B;IAC/F,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC3G,OAAO,SAAS,CAAC,CAAC,oFAAoF;AACxG,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;IACjE,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,CAAC,uBAAuB;IACjE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,iBAAiB;IAC5D,OAAO,SAAS,CAAC,CAAC,kEAAkE;AACtF,CAAC;AAED;;;yCAGyC;AACzC,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAyB,EACzB,cAAkC,EAClC,IAAiB;IAEjB,mDAAmD;IACnD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,cAAc,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC,CAAC,gCAAgC;IACpF,OAAO,SAAS,CAAC,CAAC,+CAA+C;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,UAAU,CACxB,KAAyB,EACzB,cAAkC,EAClC,IAAiB,EACjB,QAAiB,EACjB,QAAiB;IAEjB,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,CAAC,uDAAuD;IACpG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,CAAC,0BAA0B;IACnF,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IACrE,IAAI,cAAc,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,CAAC,8BAA8B;IAClF,IAAI,QAAQ,IAAI,CAAC,cAAc,KAAK,UAAU,IAAI,cAAc,KAAK,SAAS,CAAC,EAAE,CAAC;QAChF,OAAO,UAAU,CAAC,CAAC,0CAA0C;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC,CAAC,qEAAqE;AACzF,CAAC;AAyBD,SAAS,WAAW,CAAC,GAAoB;IACvC,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,CAAY,EAAE,IAAuB;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAoB;IAChD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;IAC1C,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,OAAO,EAAE,UAAU,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAmB,CAAC,GAAG,EAAe,EAAE;IAC5D,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IACvC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,6DAA6D;IACvH,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,cAAc;QACvB,yFAAyF;QACzF,wFAAwF;QACxF,mFAAmF;QACnF,2FAA2F;QAC3F,0FAA0F;QAC1F,iFAAiF;QACjF,aAAa,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACxD,0FAA0F;QAC1F,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,gGAAgG;QAChG,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC;QAC9B,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,sEAAsE;QACtE,8DAA8D;QAC9D,EAAE;QACF,kFAAkF;QAClF,EAAE;QACF,wFAAwF;QACxF,gFAAgF;QAChF,EAAE;QACF,+FAA+F;QAC/F,6FAA6F;QAC7F,iEAAiE;QACjE,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,UAAU,EAAE,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC;QACxD,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAClE,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7E,iGAAiG;QACjG,6FAA6F;QAC7F,iGAAiG;QACjG,6FAA6F;QAC7F,iGAAiG;QACjG,+FAA+F;QAC/F,sFAAsF;QACtF,EAAE;QACF,+FAA+F;QAC/F,gGAAgG;QAChG,8FAA8F;QAC9F,kDAAkD;QAClD,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,4FAA4F;QAC5F,iGAAiG;QACjG,8FAA8F;QAC9F,iGAAiG;QACjG,8FAA8F;QAC9F,sFAAsF;QACtF,kCAAkC;QAClC,EAAE;QACF,gGAAgG;QAChG,8FAA8F;QAC9F,iGAAiG;QACjG,sEAAsE;QACtE,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACjE,CAAC,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,2FAA2F;QAC3F,uFAAuF;QACvF,uFAAuF;QACvF,EAAE;QACF,gGAAgG;QAChG,8FAA8F;QAC9F,0FAA0F;QAC1F,gGAAgG;QAChG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,mFAAmF;QACnF,iFAAiF;QACjF,gFAAgF;QAChF,+EAA+E;QAC/E,oFAAoF;QACpF,6EAA6E;QAC7E,wFAAwF;QACxF,wDAAwD;QACxD,MAAM,EACJ,cAAc,IAAI,UAAU;YAC1B,CAAC,CAAC;gBACE,UAAU;gBACV,cAAc;gBACd,QAAQ;gBACR,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBACpD,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAC3C,gBAAgB,EAAE,KAAK;gBACvB,yFAAyF;gBACzF,wFAAwF;gBACxF,sFAAsF;gBACtF,wFAAwF;gBACxF,0FAA0F;gBAC1F,oFAAoF;gBACpF,wFAAwF;gBACxF,yDAAyD;gBACzD,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;aAC5D;YACH,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC,CAAC"}

package/dist/agent/channels/teams-input-response.d.ts

@@ -0,0 +1,23 @@
+import type { TeamsContext, TeamsInputResponseResult, TeamsInvokeActivity, TeamsMessageActivity } from "eve/channels/teams";
+import { type IngressSpendGateInput, type InputResponseAdmission, type InputResponseScope, type SpendGateDecision } from "@open-everywhere/core/agent/adapter-api.js";
+export interface TeamsInputResponseDeps {
+    /** The core admission. Injected in tests; the live default is the shared decision. */
+    readonly admit?: (scope: InputResponseScope) => Promise<InputResponseAdmission>;
+    /** Positive per-member verdict for leg B. Live default is the Bot Connector member probe. */
+    readonly userType?: (activity: TeamsInvokeActivity | TeamsMessageActivity) => Promise<"guest" | "member" | undefined>;
+    /** Render the refusal. Teams has no ephemeral primitive on this handle, so it is a thread post. */
+    readonly notify?: (text: string) => Promise<void>;
+    /** The shared spend-admission decision (OPE-588). Injected in tests; the live default is
+     *  `ingressSpendGate` (spend/ingress-gate.ts) — the SAME function every ordinary ingress door
+     *  consults. */
+    readonly spendGate?: (input: IngressSpendGateInput) => Promise<SpendGateDecision>;
+}
+/**
+ * Admit or refuse one eve-owned HITL answer submitted through Teams.
+ *
+ * Returns `{ auth }` on an allow — the same auth shape `onMessage` builds, so an admitted answer
+ * resumes the parked turn under OE's real Teams identity rather than eve's thinner default.
+ * Returns `null` on a refusal, which leaves the request PENDING (eve has no cancel on this seam).
+ */
+export declare function admitTeamsInputResponse(ctx: TeamsContext, activity: TeamsInvokeActivity | TeamsMessageActivity, deps?: TeamsInputResponseDeps): Promise<TeamsInputResponseResult>;
+//# sourceMappingURL=teams-input-response.d.ts.map

package/dist/agent/channels/teams-input-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-input-response.d.ts","sourceRoot":"","sources":["../../../agent/channels/teams-input-response.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,4CAA4C,CAAC;AAIpD,MAAM,WAAW,sBAAsB;IACrC,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAChF,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,GAAG,oBAAoB,KAAK,OAAO,CAAC,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;IACtH,mGAAmG;IACnG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD;;oBAEgB;IAChB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACnF;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,mBAAmB,GAAG,oBAAoB,EACpD,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CA4DnC"}

package/dist/agent/channels/teams-input-response.js

@@ -0,0 +1,102 @@
+// THE TEAMS ARM OF THE HITL-ANSWER ADMISSION (OPE-574).
+//
+// 🔴 THE TEAMS PREMISE IS THE OPPOSITE OF SLACK'S, AND THE TICKET SAID OTHERWISE. eve's Teams
+// channel resolves the hook as `onInputResponse ?? (onMessage === undefined ? defaultOnInputResponse
+// : rejectInput)` and `rejectInput` returns `null` for every submission. OE authors `onMessage`
+// (channels/teams.ts), so on Teams NOBODY could answer a HITL card — every Adaptive-Card submit and
+// every card-valued message was dropped, with no post, no row and no log line. The Slack hole
+// (anyone may answer) does not exist here; a silent dead end did. Authoring this hook closes both
+// at once: it opens the path AND governs it. The two eve behaviours are pinned against the
+// installed dist by `packages/core/scripts/eve-install-integrity-test.ts`.
+//
+// LEG B HAS TEETH HERE. `resolveTeamsUserType` reads the Bot Connector's conversation-member
+// record and returns a POSITIVE `guest`/`member` verdict per person — the same probe the inbound
+// message path already runs on every activity — so a guest answering from an ordinary internal
+// channel is refused. That was the residual approvals/clicker-floor.ts named before OPE-589; Slack
+// closed the same gap with its own probe (`slackClickerIsGuest`), so this is no longer a
+// Teams-only capability. An unresolvable probe returns `undefined` and the leg is INERT: "we could
+// not ask" never becomes a refusal.
+//
+// 🔴 FAIL-OPEN ON A THROW. eve logs a thrown hook and drops the answer, which would put Teams back
+// where it started. Anything unexpected therefore returns the default auth and says so in the log.
+//
+// 🔴 SPEND GATE (OPE-588), ahead of the room/guest admission below. This card action RESUMES a
+// parked turn: a decision to spend more, taken through a button, on a scope nobody asked whether it
+// could afford. Every ordinary ingress door consults the ONE shared spend gate before it dispatches
+// a turn (spend/ingress-gate.ts); eve's own Teams invoke route calls `onInputResponse` and then
+// `.respond()` directly, with no call site of that gate anywhere on the seam — verified against the
+// installed eve/dist. A decline returns `null`, the same reject-the-answer outcome a room/guest
+// refusal already leaves — the request stays PENDING.
+import { admitInputResponse, ingressSpendGate, resolvePartition, } from "@open-everywhere/core/agent/adapter-api.js";
+import { buildTeamsAuth, teamsMembershipType } from "./teams-identity.js";
+import { resolveTeamsUserType, teamsHandleRosterProbe } from "./teams-roster.js";
+/**
+ * Admit or refuse one eve-owned HITL answer submitted through Teams.
+ *
+ * Returns `{ auth }` on an allow — the same auth shape `onMessage` builds, so an admitted answer
+ * resumes the parked turn under OE's real Teams identity rather than eve's thinner default.
+ * Returns `null` on a refusal, which leaves the request PENDING (eve has no cancel on this seam).
+ */
+export async function admitTeamsInputResponse(ctx, activity, deps = {}) {
+    const probe = deps.userType ?? ((a) => resolveTeamsUserType(teamsHandleRosterProbe(ctx.teams), a.conversation.id, a.from.id));
+    let auth;
+    try {
+        const userType = await probe(activity);
+        auth = buildTeamsAuth({
+            userId: activity.from.id,
+            aadObjectId: activity.from.aadObjectId,
+            userName: activity.from.name,
+            tenantId: activity.tenantId ?? activity.conversation.tenantId,
+            conversationId: activity.conversation.id,
+            channelId: activity.teamsChannelId,
+            teamId: activity.teamId,
+            serviceUrl: activity.serviceUrl,
+            scope: activity.scope,
+            membershipType: teamsMembershipType(activity.channelData),
+            userType,
+        });
+        const bindable = {
+            channel: { kind: "teams" },
+            session: { auth: { current: auth } },
+        };
+        const p = resolvePartition(bindable);
+        // SPEND GATE (OPE-588) — ahead of the room/guest admission below (see the header note). A
+        // decline returns `null` immediately, before the room/guest floor runs: over budget outranks
+        // identity, the same ordering `channels/unified.ts`'s `windowSpendGate` takes ahead of its own
+        // `resolveInboundAnswer`.
+        const spendGate = deps.spendGate ?? ingressSpendGate;
+        const spendVerdict = await spendGate({
+            bindable,
+            door: "answer",
+            principalId: activity.from.id,
+            post: async (text) => { await ctx.thread.post(text); },
+        });
+        if (spendVerdict === "declined")
+            return null;
+        const verdict = await (deps.admit ?? admitInputResponse)({
+            org: p.org,
+            platform: p.platform,
+            workspace: p.workspace,
+            surface: p.surface,
+            surfaceKey: p.surfaceKey,
+            principalId: activity.from.id,
+            // `responses` is deliberately ABSENT: eve decodes the submission AFTER this hook returns, so
+            // Teams cannot know the count. A zero here would read as a measured value in the audit row.
+            ...(userType === undefined ? {} : { answererIsGuest: userType === "guest" }),
+        });
+        if (verdict.ok)
+            return { auth };
+        const notify = deps.notify ?? (async (text) => { await ctx.thread.post(text); });
+        await notify(verdict.notice).catch((err) => {
+            console.error(`[open-everywhere:teams] HITL refusal notice failed to post: ${String(err)}`);
+        });
+        return null;
+    }
+    catch (err) {
+        console.error(`[open-everywhere:teams] HITL answer admission failed softly — accepting the answer: ${String(err)}`);
+        // FAIL-OPEN with whatever auth we managed to build. `null` here would restore eve's silent
+        // `rejectInput`, which is the bug this module exists to close.
+        return { auth: auth ?? null };
+    }
+}
+//# sourceMappingURL=teams-input-response.js.map