@open-everywhere/provider-teams 0.0.0-stage → 0.1.0

package/dist/agent/channels/teams-read.js

@@ -0,0 +1,424 @@
+// Microsoft Teams channel/thread READ adapter for the generic read verbs (channel-read.ts) — the
+// third wired surface after Slack (slack-read.ts, reused verbatim) and Discord (inline in
+// channel-read.ts). Teams was DECLARED UNSUPPORTED at the read core's introduction because eve
+// exposes no Teams message-history API; this module closes that gap via Microsoft GRAPH, the API
+// that actually carries Teams channel/thread history (Bot Framework does not).
+//
+// WHY A SEPARATE GRAPH TOKEN (not eve's own Teams token): eve's `resolveTeamsAccessToken`
+// (eve/channels/teams, used by reply-post.ts's sendTeamsActivity/replyToTeamsActivity) mints a
+// token scoped to `https://api.botframework.com/.default` — the Bot Framework CONNECTOR audience,
+// which can POST activities but exposes no history-read endpoint. Reading channel messages / thread
+// replies instead needs `https://graph.microsoft.com/.default` — a DIFFERENT audience, so it needs
+// its OWN token. We reuse the EXACT SAME client-credential FLOW + env resolution eve's mint uses —
+// same `MICROSOFT_APP_ID`/`MICROSOFT_APP_PASSWORD`/`MICROSOFT_TENANT_ID` (with the `TEAMS_APP_*`
+// fallbacks), same `login.microsoftonline.com/{tenant}/oauth2/v2.0/token` endpoint, same
+// `grant_type=client_credentials` — by calling eve's OWN public `resolveTeamsAppId` /
+// `resolveTeamsAppPassword` / `resolveTeamsTenantId` for id/password/tenant resolution (never
+// re-implemented), and only requesting Graph's scope instead of the Connector's. The app
+// registration must ALSO hold a Graph permission that can read channel messages
+// (`ChannelMessage.Read.All`, admin-consented) OR already have the per-team RSC grant
+// `ChannelMessage.Read.Group` this deployment's own Teams app manifest already requests for
+// ambient watching (teams-app/manifest.json, docs/deploy/surfaces/teams.md) — when a team already
+// has that grant, THIS adapter needs no extra Azure configuration at all. Undocumented/absent
+// either way surfaces as a Graph 401/403, fail-loud (see below), never a silent empty read.
+//
+// SCOPE — TEAM CHANNELS ONLY. The manifest also carries the CHAT RSC grant `ChatMessage.Read.Chat`,
+// whose Graph analogue is `/chats/{chat-id}/messages`: a different id shape (a chat has no team, so
+// the TWO-LEVEL ID note below doesn't apply) and a different allowlist grain. Reading a group
+// chat's history is therefore NOT wired here — that grant exists for the delivery side
+// (teams-front.ts). A chat-read adapter would be its own arm, not a parameter of these calls.
+//
+// TWO-LEVEL ID: unlike Slack/Discord's single channel id, a Graph channel read needs BOTH a team id
+// AND a channel id (`/teams/{team}/channels/{channel}/…`). The domain allowlist (like every other
+// platform) lists only the CHANNEL id — the same stable per-channel grain memory resolution already
+// keys on (teams-identity.ts's `domainSurface`; see memory/resolve.ts's domainKeyOf comment) — so
+// the team id is resolved from the LIVE turn's OWN binding (always known on an engaged Teams
+// session; see identity/binding.ts's bindTeams `target.teamId`), never tracked per allowed channel.
+// 🔴 AND IT IS RESOLVED AGAIN BEFORE IT REACHES A URL. The binding carries the BOT CONNECTOR's team
+// id (`19:…@thread.tacv2`); Graph's `/teams/{id}` segment takes the team's Microsoft 365 GROUP id and
+// nothing else. `channels/teams-graph-team-id.ts` maps the one to the other over the Connector and
+// caches it (OPE-1808) — `currentGraphTeamId` below is the only place these reads take a team id from.
+// Reading a channel OTHER than the current one therefore assumes it lives in the SAME team as the
+// turn (the common case — a domain's Teams channels are one team's channels, exactly like a Slack
+// domain's channels being one workspace's); a genuine cross-team domain surfaces a clear Graph
+// 404/403 rather than silently reading the wrong team.
+//
+// GRAPH QUIRKS (verified against Microsoft's own docs, 2026-07):
+//   - Channel messages (`GET .../channels/{id}/messages`) and thread replies (`GET
+//     .../messages/{id}/replies`) support `$top` (max 50) but NOT `$orderby`/`$filter` — so unlike
+//     Slack/Discord's guaranteed history order, we sort explicitly by `createdDateTime` before
+//     rendering "oldest first" rather than trusting the API's order.
+//   - Both endpoints observably return NEWEST-first (root messages by the whole reply chain's last-
+//     modified time; replies by their own createdDateTime) — the OPPOSITE of Slack's
+//     conversations.replies (oldest-first). Our explicit sort makes this a non-issue either way.
+//   - Pagination is `@odata.nextLink` (an absolute follow-up URL), bounded here at
+//     {@link TEAMS_GRAPH_MAX_PAGES} pages so a busy channel can't fan out unboundedly (mirrors
+//     discord-backscroll.ts's DISCORD_RAW_FETCH_MAX_PAGES).
+//   - Message bodies are always `body.contentType:"html"`; `stripHtml` below strips tags (mention
+//     `<at>` spans included) and decodes the common entities — a self-contained copy of the Teams
+//     e2e driver's tag-strip (scripts/e2e/teams-driver.ts), kept LOCAL rather than imported (agent/
+//     code must not depend on scripts/, the same DAG discipline discord-backscroll.ts's
+//     isDiscordBackscrollVisible note documents for Slack-vs-Discord).
+//   - A `deletedDateTime` message or a non-"message" `messageType` (systemEventMessage, chatEvent,
+//     …) is dropped — the Graph analogue of Slack's `subtype` filter / Discord's `isConversationType`.
+//
+// FAIL LOUD (unlike Discord backscroll's fail-soft posture): a read must surface its error, never
+// silently return an empty page — matching discordReadAdapter's posture in channel-read.ts.
+import { resolveTeamsAppId, resolveTeamsAppPassword, resolveTeamsTenantId } from "eve/channels/teams";
+import { auditChannelReadRefusal, bindFrom, resolvePartition, domainKeyOf, domainForChannel, getConfig, refutedReadAuthorIds, ChannelScopeError, warmCredential, domainRoster, } from "@open-everywhere/core/agent/adapter-api.js";
+import { noteTeamsReadBoundary, teamsReadBoundary, _resetTeamsReadBoundaryForTest } from "./teams-graph-boundary.js";
+import { teamsGraphTeamId } from "./teams-graph-team-id.js";
+// OPE-929 — the reply-chain half of a channel conversation id; the suffix is spelled once, there.
+import { teamsReplyChainRoot } from "./teams-conversation-ref.js";
+const GRAPH_BASE = "https://graph.microsoft.com/v1.0";
+const GRAPH_TOKEN_SCOPE = "https://graph.microsoft.com/.default";
+const TOKEN_LOGIN_BASE = "https://login.microsoftonline.com";
+/** Refresh the cached Graph token this long before its stated expiry, so a call never races it. */
+const TOKEN_SKEW_MS = 60_000;
+/** Microsoft's documented app-only token lifetime — used only when a token response omits
+ *  `expires_in` (every real one carries it). */
+const GRAPH_TOKEN_FALLBACK_TTL_SEC = 3600;
+const TEAMS_CHANNEL_DEFAULT_LIMIT = 50;
+const TEAMS_THREAD_DEFAULT_LIMIT = 100;
+/** Graph's own hard cap on `$top` for both the channel-messages and thread-replies endpoints. */
+const TEAMS_GRAPH_PAGE_SIZE = 50;
+/** Bounds a busy channel's fetch at ≤5 pages (≤250 messages) — mirrors Discord's page bound. */
+const TEAMS_GRAPH_MAX_PAGES = 5;
+// --- Graph app-only token (client-credentials, Graph scope) --------------------------------
+/**
+ * Mint an app-only Microsoft Graph access token via the client-credentials flow — see the file
+ * header for why this can't reuse eve's `resolveTeamsAccessToken` (wrong audience). Fails LOUD
+ * (throws) on a missing tenant id or a failed token exchange; `resolveTeamsAppId` /
+ * `resolveTeamsAppPassword` already throw their own actionable "MICROSOFT_APP_ID is required" etc.
+ * errors when unset, so this only adds the tenant-id check (eve's Connector flow tolerates an absent
+ * tenant by falling back to the `botframework.com` placeholder tenant; Graph's client-credentials
+ * flow has no such fallback — it is genuinely tenant-scoped). Never echoes the app password or the
+ * minted token: this message is written to an audit row.
+ */
+async function mintTeamsGraphTokenOnce() {
+    const [appId, appPassword, tenantId] = await Promise.all([resolveTeamsAppId(), resolveTeamsAppPassword(), resolveTeamsTenantId()]);
+    if (!tenantId) {
+        throw new Error("read: Teams channel reads need MICROSOFT_TENANT_ID (or TEAMS_TENANT_ID) set — Graph's " +
+            "client-credential token is tenant-scoped (unlike the Bot Connector token, which tolerates an absent tenant).");
+    }
+    const body = new URLSearchParams({ client_id: appId, client_secret: appPassword, grant_type: "client_credentials", scope: GRAPH_TOKEN_SCOPE });
+    const res = await fetch(`${TOKEN_LOGIN_BASE}/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok || !json.access_token) {
+        throw new Error(`read: Teams Graph token request failed — ${json.error_description ?? json.error ?? `HTTP ${res.status}`}.`);
+    }
+    // WHICH BOUNDARY GOVERNS THIS DEPLOYMENT'S READS (OPE-428). The mint is the ONE place the answer
+    // is knowable without an extra Graph call — the token's own `roles` claim says whether a
+    // TENANT-WIDE application permission is consented, which is what removes Microsoft's per-team
+    // check. teams-graph-boundary.ts holds the determination for the refusal rows and audits it when
+    // it changes. Best-effort by construction: it never throws, so a read can't fail over a marker.
+    await noteTeamsReadBoundary(json.access_token);
+    return { value: json.access_token, expiresAtMs: Date.now() + (json.expires_in ?? GRAPH_TOKEN_FALLBACK_TTL_SEC) * 1000 };
+}
+/**
+ * The Graph app-only token, held warm by the SHARED seam (core credentials/warm.ts, OPE-134).
+ *
+ * ⚠️ THE NO-REFRESH RHYTHM IS EXACTLY THE `"re-mint"` POSTURE. An app-only token lives ~1h and
+ * carries NO refresh token — the only renewal is another client-credentials exchange from the app
+ * registration's own secret, which is what `"re-mint"` means (contrast `"refresh-token"`, the OAuth
+ * dance the seam deliberately refuses). "No refresh" describes the absent refresh TOKEN, not an
+ * absent renewal: nothing about this credential needs a rhythm the seam doesn't already have.
+ *
+ * Keyed by nothing — one deployment = one app registration = one tenant. The 60s margin is kept
+ * from the pre-unification code rather than taking the seam's 5-minute default: this credential's
+ * behaviour must not change under a refactor, and 60s is a defensible margin for a 1h token.
+ *
+ * WHAT UNIFYING BOUGHT THIS SURFACE: single-flight (concurrent reads in one turn used to each
+ * kick off their own token exchange) and, far more importantly, a LOUD failure — a broken app
+ * password now leaves a durable, queryable `teams.token_mint_failed` audit row instead of only an
+ * exception inside whichever read happened to trip over it.
+ */
+const teamsGraphToken = warmCredential({
+    name: "teams.graph-app-only",
+    platform: "teams",
+    auditAction: "teams.token_mint_failed",
+    refresh: "re-mint",
+    refreshMarginMs: TOKEN_SKEW_MS,
+    fallbackTtlSeconds: GRAPH_TOKEN_FALLBACK_TTL_SEC,
+    mint: mintTeamsGraphTokenOnce,
+});
+/** Test-only reset — drops the held Graph token AND the boundary determination it produced (the
+ *  two are minted together; leaving the boundary behind would let one test's token decide the next
+ *  test's audit marker). */
+export function _resetTeamsGraphTokenCache() {
+    teamsGraphToken.reset();
+    _resetTeamsReadBoundaryForTest();
+}
+/** Exported (OPE-522) so channels/teams-fire-eligibility.ts's Graph probes reuse the SAME token
+ *  mint + GET plumbing rather than standing up a second one — the routine fire-eligibility leg's
+ *  requests are ordinary Graph reads, no different in shape from a channel-history read. Callers
+ *  that need "unresolvable" rather than a thrown error (fire-eligibility's fail-open posture) catch
+ *  around it themselves — this function's own fail-LOUD contract is unchanged. */
+export const liveTeamsGraphRequest = async (url) => {
+    const token = await teamsGraphToken.get();
+    const res = await fetch(url, { headers: { authorization: `Bearer ${token}` } });
+    if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        throw new Error(`read: Teams Graph GET failed (HTTP ${res.status}) for ${url}${text ? ` — ${text.slice(0, 200)}` : ""}`);
+    }
+    return res.json();
+};
+/** HTML message body → plain text: drop tags (mention `<at>…</at>` spans included), decode the
+ *  five common entities, collapse whitespace. Pure — a self-contained copy of the Teams e2e
+ *  driver's stripHtml (scripts/e2e/teams-driver.ts); see the file header for why it's not shared. */
+export function stripHtml(html) {
+    return html
+        .replace(/<[^>]*>/g, " ")
+        .replace(/&amp;/g, "&")
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&quot;/g, '"')
+        .replace(/&#39;/g, "'")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+function authorOf(m) {
+    return m.from?.user?.displayName ?? m.from?.user?.id ?? m.from?.application?.displayName ?? m.from?.application?.id ?? "(unknown)";
+}
+/** A message kept as ordinary conversation content: not deleted, and either no `messageType` or
+ *  exactly "message" (system events — teamDescriptionUpdated, chatEvent, etc. — carry other
+ *  values and are dropped, the Graph analogue of Slack's `subtype` filter). */
+function isConversationMessage(m) {
+    if (m.deletedDateTime)
+        return false;
+    return m.messageType === undefined || m.messageType === "message";
+}
+function toIntermediate(m) {
+    if (!isConversationMessage(m))
+        return undefined;
+    const text = stripHtml(m.body?.content ?? "");
+    if (!text)
+        return undefined;
+    const parsed = m.createdDateTime ? Date.parse(m.createdDateTime) : Number.NaN;
+    // OPE-474 grading fields, additive: `author` (the display string) is untouched. A `from.user.id`
+    // is the person; a `from.application` with no user is a machine; neither present is unattributable.
+    const userId = m.from?.user?.id;
+    const isApp = m.from?.user === undefined && m.from?.application !== undefined;
+    return {
+        author: authorOf(m),
+        ts: m.id ?? "",
+        text,
+        createdMs: Number.isFinite(parsed) ? parsed : 0,
+        ...(isApp ? { bot: true } : typeof userId === "string" && userId.length > 0 ? { authorId: userId } : {}),
+    };
+}
+/**
+ * Normalize a raw Graph messages array (either endpoint's `value`) into oldest-first
+ * {@link TeamsRenderedLine}[] — dropping deleted/system messages and empty bodies, HTML-stripped.
+ * Graph guarantees neither endpoint's order (no `$orderby` support, and both are observed
+ * newest-first in practice — see the file header), so this ALWAYS sorts by `createdDateTime`
+ * rather than trusting API order. Pure; exported for the render test (mirrors discordLinesFromRaw).
+ */
+export function teamsLinesFromRaw(raw) {
+    // `createdMs` is the sort key and stops here; the OPE-474 grading fields ride on.
+    return teamsTimedLinesFromRaw(raw).map(({ createdMs: _createdMs, ...line }) => line);
+}
+/**
+ * The same normalization, with each line's CREATE TIME kept (epoch ms). The read verbs do not need it
+ * — a rendered line carries the message id in `ts`, not a timestamp — but the seat catch-up does: it
+ * bounds its window by time and core orders the whole window by it (channels/seat-catch-up.ts).
+ * Exported so `teams-catch-up.ts` shares this one normalization rather than re-deriving the sender
+ * kind and the system-message filter, which is the whole way those two could disagree about a
+ * message. `createdMs` is 0 when Graph sent no readable `createdDateTime`; the caller drops it.
+ */
+export function teamsTimedLinesFromRaw(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const lines = raw.map(toIntermediate).filter((l) => l !== undefined);
+    lines.sort((a, b) => a.createdMs - b.createdMs);
+    return lines;
+}
+/** Follow `@odata.nextLink` until `limit` messages are in hand or {@link TEAMS_GRAPH_MAX_PAGES}
+ *  pages are exhausted — a hard bound so a busy channel/thread can't fan out unboundedly (mirrors
+ *  discord-backscroll.ts's DISCORD_RAW_FETCH_MAX_PAGES). Returns the raw messages, unsorted
+ *  (teamsLinesFromRaw sorts). Propagates any requester error (fail-loud). */
+export async function fetchGraphPages(req, initialUrl, limit) {
+    const all = [];
+    let url = initialUrl;
+    for (let page = 0; page < TEAMS_GRAPH_MAX_PAGES && url && all.length < limit; page++) {
+        const json = (await req(url));
+        all.push(...(Array.isArray(json.value) ? json.value : []));
+        url = typeof json["@odata.nextLink"] === "string" ? json["@odata.nextLink"] : undefined;
+    }
+    return all;
+}
+export function channelMessagesUrl(teamId, channelId) {
+    return `${GRAPH_BASE}/teams/${encodeURIComponent(teamId)}/channels/${encodeURIComponent(channelId)}/messages?$top=${TEAMS_GRAPH_PAGE_SIZE}`;
+}
+export function threadRepliesUrl(teamId, channelId, rootMessageId) {
+    return `${GRAPH_BASE}/teams/${encodeURIComponent(teamId)}/channels/${encodeURIComponent(channelId)}/messages/${encodeURIComponent(rootMessageId)}/replies?$top=${TEAMS_GRAPH_PAGE_SIZE}`;
+}
+// --- the Teams-specific channel allowlist (channel grain, not the ephemeral conversation grain) --
+//
+// channel-read.ts's shared allowedSurfaceIdsFrom keys "own" off the raw surfaceKey — correct for
+// Slack/Discord (whose surfaceKey IS the readable unit) but wrong for Teams, whose surfaceKey is a
+// per-reply-chain CONVERSATION id (bindTeams's `surface`), not the stable CHANNEL grain a Graph read
+// actually operates on. domainKeyOf resolves that stable grain already (teams-identity.ts's
+// `domainSurface`; see memory/resolve.ts's own domainKeyOf comment) — this reuses THAT, not the raw
+// surfaceKey. Kept local rather than importing channel-read.ts's helper: channel-read.ts registers
+// this adapter, so importing back would cycle the module graph (the same DAG discipline
+// discord-backscroll.ts's isDiscordBackscrollVisible note documents).
+//
+// SANITIZATION QUIRK (Teams-only): a Teams channel id looks like `19:abc…@thread.tacv2` — binding.ts's
+// `bindFrom` runs every surface/domainSurface segment through its filesystem-safe `seg()` sanitizer
+// (`[^a-zA-Z0-9._-]+` → "-"), so the value domainKeyOf and a domain's exact `reach` entries actually carry is the SANITIZED
+// form (e.g. `19-abc-thread.tacv2`), not the raw Graph id. Slack/Discord ids are already safe (no
+// sanitization visible), so this is invisible there; Teams is the first surface where it bites. The
+// GRAPH CALL needs the RAW id verbatim (Graph literally requires the colons/`@`), so `readChannel`/
+// `readThread` pass the caller's raw `channel` straight into the URL — but the ALLOWLIST check below
+// sanitizes it first (mirroring binding.ts's `seg()`, kept local — same DAG-avoidance rationale as
+// above) so it compares like-for-like against the already-sanitized grain. Consequence for deployers:
+// a Teams domain's `reach` entries must list the SANITIZED channel id (what domainKeyOf actually
+// produces), not the raw `19:…@thread.tacv2` string — documented in docs/deploy/surfaces/teams.md.
+const UNSAFE_SEGMENT_CHARS = /[^a-zA-Z0-9._-]+/g;
+/** Mirrors binding.ts's private `seg()` sanitizer exactly (same regex, same trim, same 100-char
+ *  cap) so a raw Teams channel id compares correctly against the already-sanitized domain grain.
+ *  Pure; exported for the allowlist test. */
+export function sanitizeTeamsChannelId(value) {
+    return value.trim().replace(UNSAFE_SEGMENT_CHARS, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 100);
+}
+/** The Teams CHANNEL ids this session may read (SANITIZED — see the header note): the current
+ *  channel (its channel grain) plus every Teams channel this session's explicit domain lists. Pure
+ *  but for the injected `domains` — mirrors channel-read.ts's allowedSurfaceIdsFrom shape so it is
+ *  unit-testable the same way. */
+export function allowedTeamsChannelIds(channelGrainKey, domains) {
+    const ids = new Set();
+    const own = channelGrainKey.split("/")[2];
+    if (own)
+        ids.add(own);
+    const domain = domainForChannel(channelGrainKey, domains);
+    if (domain) {
+        for (const key of domainRoster(domain)) {
+            const parts = key.split("/");
+            if (parts.length === 3 && parts[0] === "teams" && parts[2])
+                ids.add(parts[2]);
+        }
+    }
+    return { ids, domain: domain?.name };
+}
+/** Assert a requested (raw) Teams channel id is readable by this session — else AUDIT the refusal
+ *  and throw (fail closed), the same ChannelScopeError shape slack-read/channel-read raise.
+ *  Sanitizes `channelId` before comparing (see the header note) — the RAW value is what the Graph
+ *  call itself uses, and the SANITIZED one is what the row records, so a row compares like-for-like
+ *  against the domain's `reach`. The decision is unchanged; only the row is new. */
+export async function assertTeamsChannelAllowed(ctx, channelId, deps) {
+    const p = resolvePartition(ctx);
+    const domains = getConfig().loadDomains();
+    const callerKey = domainKeyOf(p);
+    const { ids, domain } = allowedTeamsChannelIds(callerKey, domains);
+    const wanted = sanitizeTeamsChannelId(channelId);
+    if (ids.has(wanted))
+        return;
+    // The refused read never reached Graph, so no Microsoft boundary governed THIS call — OE's own
+    // fence did. The marker still belongs on the row: it says which boundary governs the reads this
+    // deployment DOES let through, which is the fact a defender reading a refusal wants next
+    // (OPE-428). `"unknown"` when no Graph token has been minted in this process yet — the fence must
+    // not make a network call to answer.
+    await auditChannelReadRefusal(ctx, { platform: "teams", surfaceId: wanted, callerKey, callerDomain: domain, domains, boundary: teamsReadBoundary() }, deps);
+    const scope = domain ? `domain "${domain}"` : "this channel's (no multi-channel domain)";
+    throw new ChannelScopeError(`channel "${channelId}" is not in ${scope} teams read scope. The agent may only read channels in its ` +
+        `memory domain (memory/config/domains.ts). Add the channel to the domain's \`channels\` to grant it.`);
+}
+/**
+ * The current turn's team id IN GRAPH'S SPELLING — the Microsoft 365 group id every `/teams/{id}/…`
+ * URL below takes.
+ *
+ * 🔴 THE BINDING CARRIES THE OTHER ONE. `bindTeams`'s `target.teamId` is the inbound activity's
+ * `channelData.team.id`, which is the BOT CONNECTOR's team id (`19:…@thread.tacv2`) — Graph keeps
+ * that spelling as a team's `internalId` and addresses nothing by it. So the binding's id is
+ * RESOLVED through the Connector before it reaches a Graph URL (channels/teams-graph-team-id.ts,
+ * OPE-1808); the resolution is cached per team, so a read pays at most one extra round trip per
+ * process. See the file header for why a DIFFERENT channel in the domain is assumed to share this
+ * team (Graph needs both team + channel; the domain allowlist tracks only the latter).
+ */
+async function currentGraphTeamId(ctx) {
+    const t = bindFrom(ctx).target;
+    const botTeamId = typeof t?.teamId === "string" && t.teamId.length > 0 ? t.teamId : undefined;
+    const serviceUrl = typeof t?.serviceUrl === "string" && t.serviceUrl.length > 0 ? t.serviceUrl : undefined;
+    return await teamsGraphTeamId(botTeamId, serviceUrl);
+}
+function noTeamIdError(what) {
+    return new Error(`read: couldn't resolve this Teams channel's team id from the live session — Teams ${what} need an engaged team-channel turn, ` +
+        `and the team's Microsoft 365 group id must be resolvable from the Bot Connector.`);
+}
+// --- the OPE-474 non-member author leg ---------------------------------------------------------
+//
+// 🔴 THE REGISTER IS THE WHOLE LEG HERE, AND THAT IS A LIMIT WORTH STATING RATHER THAN PAPERING
+// OVER. Teams CAN refute an author in principle — Entra reports `userType: "guest"` — and the WAKE
+// path already reads it (channels/teams.ts `resolveTeamsUserType`). That probe is not reachable from
+// a read, for two reasons that are both structural:
+//   • it is keyed by CONVERSATION (`/v3/conversations/{id}/members/{userId}`) and needs the Bot
+//     Connector handle off the inbound activity, which a read tool does not hold;
+//   • a read may target a DIFFERENT channel from the turn's own conversation, so the current
+//     conversation's roster is not the right question to ask about that page's authors anyway.
+// Adding a Graph `/users/{id}` call would be a NEW privileged permission (`User.Read.All`) for one
+// taint bit, so it is deliberately not invented here. A Teams deployment that wants the author leg
+// on reads arms the author-trust register, exactly as Discord and Notion do.
+//
+// The consequence, stated plainly: on an UNARMED Teams tenant a channel read never marks the turn,
+// even over a guest's message. The fence still rides every read, and the wake leg still refutes the
+// same guest when they SPEAK. Under-marking is the direction this whole plane fails in.
+// --- the adapter ------------------------------------------------------------------------------
+export const teamsReadAdapter = {
+    platform: "teams",
+    /**
+     * OPE-929 — Teams' own spelling of "which room and which thread is this turn in", and the one of
+     * the three that no core-side guess could have got right.
+     *
+     * 🔴 THE BINDING'S CONVERSATION IS NOT THE READ CONTAINER. A Teams CHANNEL activity binds the
+     * REPLY CHAIN as its `surface` / `anchorChannelId` (the conversation id carries
+     * `;messageid=<root>`), while both Graph read URLs below take the CHANNEL id
+     * (`/teams/{team}/channels/{channel}/messages[/{root}/replies]`). So the container is
+     * `target.channelId` and the thread root is the `;messageid=` half of the conversation id — the
+     * two halves of one value, pulled apart here rather than anywhere else.
+     *
+     * A personal or group chat carries no channel id and no reply-chain suffix, so it reports no
+     * address at all: Graph's chat-message read is delegated-only, and this adapter reads channels.
+     * The read then refuses loudly, which is the honest answer for a surface it cannot serve.
+     */
+    wakeAddress(ctx) {
+        const b = bindFrom(ctx);
+        const container = typeof b.target?.["channelId"] === "string" ? b.target["channelId"] : undefined;
+        if (!container)
+            return undefined;
+        const conversation = typeof b.target?.["conversationId"] === "string" ? b.target["conversationId"] : undefined;
+        const root = conversation ? teamsReplyChainRoot(conversation) : undefined;
+        return { container, ...(root ? { threadRoot: root } : {}) };
+    },
+    async readChannel(ctx, channel, limit, req = liveTeamsGraphRequest) {
+        await assertTeamsChannelAllowed(ctx, channel);
+        const teamId = await currentGraphTeamId(ctx);
+        if (!teamId)
+            throw noTeamIdError("channel reads");
+        const n = limit ?? TEAMS_CHANNEL_DEFAULT_LIMIT;
+        const raw = await fetchGraphPages(req, channelMessagesUrl(teamId, channel), n);
+        return teamsLinesFromRaw(raw).slice(-n); // most recent n, oldest-first (matches Slack/Discord)
+    },
+    async readThread(ctx, channel, threadTs, limit, req = liveTeamsGraphRequest) {
+        await assertTeamsChannelAllowed(ctx, channel);
+        const teamId = await currentGraphTeamId(ctx);
+        if (!teamId)
+            throw noTeamIdError("thread reads");
+        const n = limit ?? TEAMS_THREAD_DEFAULT_LIMIT;
+        const raw = await fetchGraphPages(req, threadRepliesUrl(teamId, channel, threadTs), n);
+        return teamsLinesFromRaw(raw).slice(-n);
+    },
+    /** OPE-474 / OPE-534 — the author-trust register only; see the note above for why the Entra probe
+     *  is not reachable from a read. No `memberships` leg: an armed Teams tenant matches on principal
+     *  keys (`teams/<entraObjectId>`), which is what a Teams declaration lists. It answers with the
+     *  refuted AUTHOR IDS, because core reads the one answer twice: the turn mark and the `withhold`
+     *  body replacement. */
+    async refutedAuthorIds(ctx, lines) {
+        return await refutedReadAuthorIds(lines, resolvePartition(ctx).workspaceKey);
+    },
+};
+//# sourceMappingURL=teams-read.js.map

package/dist/agent/channels/teams-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-read.js","sourceRoot":"","sources":["../../../agent/channels/teams-read.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,0FAA0F;AAC1F,+FAA+F;AAC/F,iGAAiG;AACjG,+EAA+E;AAC/E,EAAE;AACF,0FAA0F;AAC1F,+FAA+F;AAC/F,kGAAkG;AAClG,oGAAoG;AACpG,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,yFAAyF;AACzF,sFAAsF;AACtF,8FAA8F;AAC9F,yFAAyF;AACzF,gFAAgF;AAChF,sFAAsF;AACtF,4FAA4F;AAC5F,kGAAkG;AAClG,8FAA8F;AAC9F,4FAA4F;AAC5F,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,8FAA8F;AAC9F,uFAAuF;AACvF,8FAA8F;AAC9F,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,oGAAoG;AACpG,kGAAkG;AAClG,6FAA6F;AAC7F,oGAAoG;AACpG,oGAAoG;AACpG,sGAAsG;AACtG,mGAAmG;AACnG,uGAAuG;AACvG,kGAAkG;AAClG,kGAAkG;AAClG,+FAA+F;AAC/F,uDAAuD;AACvD,EAAE;AACF,iEAAiE;AACjE,mFAAmF;AACnF,mGAAmG;AACnG,+FAA+F;AAC/F,qEAAqE;AACrE,oGAAoG;AACpG,qFAAqF;AACrF,iGAAiG;AACjG,mFAAmF;AACnF,+FAA+F;AAC/F,4DAA4D;AAC5D,kGAAkG;AAClG,kGAAkG;AAClG,oGAAoG;AACpG,wFAAwF;AACxF,uEAAuE;AACvE,mGAAmG;AACnG,uGAAuG;AACvG,EAAE;AACF,kGAAkG;AAClG,4FAA4F;AAE5F,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACtG,OAAO,EACL,uBAAuB,EACvB,QAAQ,EACR,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EAMd,YAAY,GACb,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AACrH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,kGAAkG;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,MAAM,UAAU,GAAG,kCAAkC,CAAC;AACtD,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AACjE,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAC7D,mGAAmG;AACnG,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B;gDACgD;AAChD,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAE1C,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,iGAAiG;AACjG,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,gGAAgG;AAChG,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,8FAA8F;AAE9F;;;;;;;;;GASG;AACH,KAAK,UAAU,uBAAuB;IACpC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,iBAAiB,EAAE,EAAE,uBAAuB,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;IACnI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,wFAAwF;YACtF,8GAA8G,CACjH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/I,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,gBAAgB,IAAI,kBAAkB,CAAC,QAAQ,CAAC,oBAAoB,EAAE;QAC/F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA+F,CAAC;IAChJ,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/H,CAAC;IACD,iGAAiG;IACjG,yFAAyF;IACzF,8FAA8F;IAC9F,iGAAiG;IACjG,gGAAgG;IAChG,MAAM,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,GAAG,IAAI,EAAE,CAAC;AAC1H,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,eAAe,GAAG,cAAc,CAAC;IACrC,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,OAAO;IACjB,WAAW,EAAE,yBAAyB;IACtC,OAAO,EAAE,SAAS;IAClB,eAAe,EAAE,aAAa;IAC9B,kBAAkB,EAAE,4BAA4B;IAChD,IAAI,EAAE,uBAAuB;CAC9B,CAAC,CAAC;AAEH;;4BAE4B;AAC5B,MAAM,UAAU,0BAA0B;IACxC,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,8BAA8B,EAAE,CAAC;AACnC,CAAC;AASD;;;;kFAIkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAwB,KAAK,EAAE,GAAG,EAAE,EAAE;IACtE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC,CAAC;AAgCF;;qGAEqG;AACrG,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI;SACR,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAmB;IACnC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,WAAW,CAAC;AACrI,CAAC;AAED;;+EAE+E;AAC/E,SAAS,qBAAqB,CAAC,CAAmB;IAChD,IAAI,CAAC,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC;AACpE,CAAC;AAMD,SAAS,cAAc,CAAC,CAAmB;IACzC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC9E,iGAAiG;IACjG,oGAAoG;IACpG,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC;IAC9E,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;QACd,IAAI;QACJ,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,kFAAkF;IAClF,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAI,GAA0B,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAChH,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAwB,EAAE,UAAkB,EAAE,KAAa;IAC/F,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,IAAI,GAAG,GAAuB,UAAU,CAAC;IACzC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,qBAAqB,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAc,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,GAAG,GAAG,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,SAAiB;IAClE,OAAO,GAAG,UAAU,UAAU,kBAAkB,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,qBAAqB,EAAE,CAAC;AAC9I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB,EAAE,aAAqB;IACvF,OAAO,GAAG,UAAU,UAAU,kBAAkB,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,SAAS,CAAC,aAAa,kBAAkB,CAAC,aAAa,CAAC,iBAAiB,qBAAqB,EAAE,CAAC;AAC3L,CAAC;AAED,oGAAoG;AACpG,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,qGAAqG;AACrG,4FAA4F;AAC5F,oGAAoG;AACpG,mGAAmG;AACnG,wFAAwF;AACxF,sEAAsE;AACtE,EAAE;AACF,uGAAuG;AACvG,oGAAoG;AACpG,4HAA4H;AAC5H,kGAAkG;AAClG,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,mGAAmG;AACnG,sGAAsG;AACtG,iGAAiG;AACjG,mGAAmG;AAEnG,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD;;6CAE6C;AAC7C,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrG,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,sBAAsB,CAAC,eAAuB,EAAE,OAA0B;IACxF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAG;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;oFAIoF;AACpF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAoB,EAAE,SAAiB,EAAE,IAAyB;IAChH,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IAC5B,+FAA+F;IAC/F,gGAAgG;IAChG,yFAAyF;IACzF,kGAAkG;IAClG,qCAAqC;IACrC,MAAM,uBAAuB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5J,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAC,CAAC,0CAA0C,CAAC;IACzF,MAAM,IAAI,iBAAiB,CACzB,YAAY,SAAS,eAAe,KAAK,6DAA6D;QACpG,qGAAqG,CACxG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,kBAAkB,CAAC,GAAoB;IACpD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,OAAO,MAAM,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,CACd,qFAAqF,IAAI,sCAAsC;QAC7H,kFAAkF,CACrF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,EAAE;AACF,gGAAgG;AAChG,mGAAmG;AACnG,qGAAqG;AACrG,oDAAoD;AACpD,gGAAgG;AAChG,kFAAkF;AAClF,6FAA6F;AAC7F,+FAA+F;AAC/F,mGAAmG;AACnG,mGAAmG;AACnG,6EAA6E;AAC7E,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,wFAAwF;AAExF,iGAAiG;AAEjG,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,OAAgB;IAC1B;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,GAAoB;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3H,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,GAAoB,EAAE,OAAe,EAAE,KAAc,EAAE,GAAG,GAAwB,qBAAqB;QACvH,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,MAAM,aAAa,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,KAAK,IAAI,2BAA2B,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sDAAsD;IACjG,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAoB,EAAE,OAAe,EAAE,QAAgB,EAAE,KAAc,EAAE,GAAG,GAAwB,qBAAqB;QACxI,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,KAAK,IAAI,0BAA0B,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD;;;;4BAIwB;IACxB,KAAK,CAAC,gBAAgB,CAAC,GAAoB,EAAE,KAAmC;QAC9E,OAAO,MAAM,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/E,CAAC;CACF,CAAC"}

package/dist/agent/channels/teams-roster.d.ts

@@ -0,0 +1,54 @@
+import { type TeamsHandle } from "eve/channels/teams";
+/** The subset of eve's `TeamsApiResponse` the probe reads. */
+export interface TeamsRosterResponse {
+    readonly ok: boolean;
+    readonly body: unknown;
+}
+/** One GET against the Bot Connector, addressed at an already-resolved serviceUrl. Injected so the
+ *  probe's caching, its fail-open branches and its path are testable with no network. */
+export type TeamsRosterProbe = (path: string) => Promise<TeamsRosterResponse>;
+/** The roster member path for one (conversation, user) — the ONE place it is built. */
+export declare function teamsRosterMemberPath(conversationId: string, userId: string): string;
+/**
+ * The probe a NATIVE turn has: `teamsChannel` hands the handler a handle that already holds both the
+ * credential and the conversation address, so its `request` escape hatch is the whole transport.
+ */
+export declare function teamsHandleRosterProbe(teams: Pick<TeamsHandle, "request">): TeamsRosterProbe;
+/**
+ * The probe the FRONT has. The front route is a plain HTTP handler with no channel handle, so it
+ * addresses the connector by the activity's own `serviceUrl` and mints the token through eve's
+ * `callTeamsConnectorApi` — the SAME client-credentials mint the native handle uses, not a second
+ * bespoke credential path.
+ *
+ * 🔴 THE MINT MUST BE TENANT-SCOPED. eve's `resolveTeamsAccessToken` reads `MICROSOFT_TENANT_ID` /
+ * `TEAMS_TENANT_ID` and falls back to the `botframework.com` placeholder tenant only when neither is
+ * set. A single-tenant app registration refuses the placeholder with AADSTS700016, so a deployment
+ * whose bot app is single-tenant must set the tenant id. The tenant is never hardcoded here.
+ *
+ * `undefined` when the activity carries no serviceUrl — there is nothing to address, so there is no
+ * verdict to resolve.
+ */
+export declare function teamsServiceUrlRosterProbe(serviceUrl: string | undefined): TeamsRosterProbe | undefined;
+/**
+ * The acting user's tenant membership type, cached and fail-open. `undefined` means NEVER DETERMINED —
+ * the caller then leaves `userType` unset, and every downstream verdict is byte-identical to a
+ * deployment with no probe at all.
+ *
+ * 🔴 OPE-572 — THE CACHE KEY AND THE WIRE CALL USE DIFFERENT IDS, ON PURPOSE.
+ *   - THE KEY strips the reply-chain suffix. On a CHANNEL activity `conversation.id` is the
+ *     REPLY-CHAIN id, so keying on it verbatim made a busy channel pay one connector call per
+ *     (THREAD, user) per TTL instead of per (CHANNEL, user). The verdict is a property of the
+ *     TENANT — a user is a guest of the tenant, never of one reply chain — so the coarser key
+ *     answers the same question with fewer calls. Two reply chains collapsing onto one channel key
+ *     is the POINT, not a collision.
+ *   - THE WIRE CALL keeps the id EXACTLY as the caller passed it. That is the shape the 2026-08-15
+ *     live-tenant probe measured. Whether the connector ALSO accepts a thread-qualified id on
+ *     `/v3/conversations/{id}/members/{userId}` is NOT established, and one live GET against a real
+ *     threaded channel reply is what settles it. Until then, changing the wire shape would trade a
+ *     measured behaviour for an unmeasured one. A refusal fails open like any other non-2xx.
+ * scripts/teams-roster-probe-test.ts pins BOTH halves — the shared key and the unstripped path.
+ */
+export declare function resolveTeamsUserType(probe: TeamsRosterProbe | undefined, conversationId: string | undefined, userId: string | undefined): Promise<"guest" | "member" | undefined>;
+/** Test seam: drop the cached roster verdicts (a fresh test must not inherit another's). */
+export declare function _resetTeamsUserTypeCacheForTest(): void;
+//# sourceMappingURL=teams-roster.d.ts.map

package/dist/agent/channels/teams-roster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-roster.d.ts","sourceRoot":"","sources":["../../../agent/channels/teams-roster.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAK7E,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;yFACyF;AACzF,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE9E,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAM5F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS,CAGvG;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,gBAAgB,GAAG,SAAS,EACnC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,OAAO,CAAC,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC,CAczC;AAED,4FAA4F;AAC5F,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}

package/dist/agent/channels/teams-roster.js

@@ -0,0 +1,121 @@
+// THE TEAMS ROSTER PROBE (OPE-60 mechanism, OPE-493 reach) — "is the acting user a tenant GUEST?".
+//
+// The inbound Bot Framework activity carries NO guest bit (`from.role` is only "user"/"bot"), so the
+// answer comes from the Bot Connector ROSTER: `GET {serviceUrl}/v3/conversations/{id}/members/{userId}`
+// returns a member record whose `userRole` is "guest" for a B2B guest and "user" for a tenant member.
+// MEASURED against a live tenant on 2026-08-15, so this is a real discriminator, not a documented one.
+// It needs no Microsoft Graph app registration and no new privileged permission — the bot's own
+// client-credentials token already carries it.
+//
+// WHY THIS IS ITS OWN MODULE. Two live paths need the probe and neither can host it:
+//   - `teams-identity.ts` imports no eve types on purpose (its header states it), which keeps the
+//     security-critical mapping trivially unit-testable. The probe needs eve's connector client, so
+//     putting it there would take that property away.
+//   - `teams.ts` (the native channel) already imports `teams-front.ts` for `frontTeamsChannel`, so
+//     the front cannot import back from `teams.ts` without a cycle.
+// This module imports `teams-identity.ts` and eve, and both call sites import this module. One
+// direction, no cycle, and `teamsUserTypeFromMember` stays the ONE reader of Teams' guest vocabulary.
+//
+// 🔴 THE PATH NEEDS ITS LEADING SLASH. eve composes the connector URL as
+// `trimTrailingSlash(serviceUrl) + path` (node_modules/eve/dist/src/public/channels/teams/api.js), and
+// eve's own callers pass "/v3/…". A path written without the slash composes
+// `https://smba.trafficmanager.net/emeav3/conversations/…` — a malformed URL that answers non-2xx, so
+// the probe fails open and reports NO verdict on every call. `teamsRosterMemberPath` is the ONE place
+// the path is built, and its leading slash is pinned by a test.
+//
+// FAIL-OPEN EVERYWHERE. No serviceUrl, no conversation, no user, an HTTP error, a transport throw or
+// an unrecognised body all yield `undefined` — "never determined". `teamsTrust` then leaves the
+// existing channel/vouch verdict intact, which is the pre-probe behaviour. The probe only ever
+// DEMOTES; it can never raise trust.
+import { callTeamsConnectorApi } from "eve/channels/teams";
+import { dmTrustTtlMs } from "@open-everywhere/core/agent/adapter-api.js";
+import { teamsUserTypeFromMember } from "./teams-identity.js";
+import { teamsChannelGrainConversationId } from "./teams-conversation-ref.js";
+/** The roster member path for one (conversation, user) — the ONE place it is built. */
+export function teamsRosterMemberPath(conversationId, userId) {
+    return `/v3/conversations/${encodeURIComponent(conversationId)}/members/${encodeURIComponent(userId)}`;
+}
+/**
+ * The probe a NATIVE turn has: `teamsChannel` hands the handler a handle that already holds both the
+ * credential and the conversation address, so its `request` escape hatch is the whole transport.
+ */
+export function teamsHandleRosterProbe(teams) {
+    // The body MUST be absent, not `{}`: eve's request forwards any defined body into the fetch init
+    // (`body: "{}"`), and fetch throws `Request with GET/HEAD method cannot have body` — a throw the
+    // resolver's fail-open catch then swallows, leaving this probe permanently inert. The handle type
+    // requires a body argument, so the absence is spelled as a cast.
+    return (path) => teams.request(path, undefined, { method: "GET" });
+}
+/**
+ * The probe the FRONT has. The front route is a plain HTTP handler with no channel handle, so it
+ * addresses the connector by the activity's own `serviceUrl` and mints the token through eve's
+ * `callTeamsConnectorApi` — the SAME client-credentials mint the native handle uses, not a second
+ * bespoke credential path.
+ *
+ * 🔴 THE MINT MUST BE TENANT-SCOPED. eve's `resolveTeamsAccessToken` reads `MICROSOFT_TENANT_ID` /
+ * `TEAMS_TENANT_ID` and falls back to the `botframework.com` placeholder tenant only when neither is
+ * set. A single-tenant app registration refuses the placeholder with AADSTS700016, so a deployment
+ * whose bot app is single-tenant must set the tenant id. The tenant is never hardcoded here.
+ *
+ * `undefined` when the activity carries no serviceUrl — there is nothing to address, so there is no
+ * verdict to resolve.
+ */
+export function teamsServiceUrlRosterProbe(serviceUrl) {
+    if (!serviceUrl)
+        return undefined;
+    return (path) => callTeamsConnectorApi({ serviceUrl, path, method: "GET" });
+}
+// Cached per (CHANNEL, user) because tenant membership changes rarely, on the SAME TTL knob the
+// Slack DM-partner cache uses (`identity.dmTrustTtlMs`). Only a POSITIVE verdict is cached: caching
+// "no verdict" would pin a transport blip for the whole TTL.
+const teamsUserTypeCache = new Map();
+// The channel-grain strip lives in channels/teams-conversation-ref.ts, the module whose subject is
+// Teams conversation addressing, and that header states why it is spelled in this repo at all
+// (eve does not re-export its own copy).
+//
+// 🔴 IN THIS FILE IT IS A CACHE KEY AND NOTHING ELSE. It must never reach the connector — see
+// {@link resolveTeamsUserType}.
+/**
+ * The acting user's tenant membership type, cached and fail-open. `undefined` means NEVER DETERMINED —
+ * the caller then leaves `userType` unset, and every downstream verdict is byte-identical to a
+ * deployment with no probe at all.
+ *
+ * 🔴 OPE-572 — THE CACHE KEY AND THE WIRE CALL USE DIFFERENT IDS, ON PURPOSE.
+ *   - THE KEY strips the reply-chain suffix. On a CHANNEL activity `conversation.id` is the
+ *     REPLY-CHAIN id, so keying on it verbatim made a busy channel pay one connector call per
+ *     (THREAD, user) per TTL instead of per (CHANNEL, user). The verdict is a property of the
+ *     TENANT — a user is a guest of the tenant, never of one reply chain — so the coarser key
+ *     answers the same question with fewer calls. Two reply chains collapsing onto one channel key
+ *     is the POINT, not a collision.
+ *   - THE WIRE CALL keeps the id EXACTLY as the caller passed it. That is the shape the 2026-08-15
+ *     live-tenant probe measured. Whether the connector ALSO accepts a thread-qualified id on
+ *     `/v3/conversations/{id}/members/{userId}` is NOT established, and one live GET against a real
+ *     threaded channel reply is what settles it. Until then, changing the wire shape would trade a
+ *     measured behaviour for an unmeasured one. A refusal fails open like any other non-2xx.
+ * scripts/teams-roster-probe-test.ts pins BOTH halves — the shared key and the unstripped path.
+ */
+export async function resolveTeamsUserType(probe, conversationId, userId) {
+    if (!probe || !conversationId || !userId)
+        return undefined; // nothing to address / to key on → no verdict
+    const key = `${teamsChannelGrainConversationId(conversationId)}:${userId}`;
+    const hit = teamsUserTypeCache.get(key);
+    if (hit && Date.now() - hit.at < dmTrustTtlMs())
+        return hit.userType;
+    try {
+        const res = await probe(teamsRosterMemberPath(conversationId, userId));
+        if (!res.ok)
+            return undefined; // 4xx/5xx (e.g. member not resolvable) → no verdict
+        const userType = teamsUserTypeFromMember(res.body);
+        if (userType)
+            teamsUserTypeCache.set(key, { userType, at: Date.now() });
+        return userType;
+    }
+    catch {
+        return undefined; // transport error → no verdict (mirrors the Slack users.info catch)
+    }
+}
+/** Test seam: drop the cached roster verdicts (a fresh test must not inherit another's). */
+export function _resetTeamsUserTypeCacheForTest() {
+    teamsUserTypeCache.clear();
+}
+//# sourceMappingURL=teams-roster.js.map