@open-everywhere/provider-teams 0.0.0-stage → 0.1.0

package/dist/agent/provider-events.d.ts

@@ -0,0 +1,3 @@
+import type { ProviderEventDeclaration } from "@open-everywhere/core/agent/adapter-api.js";
+export declare const TEAMS_PROVIDER_EVENTS: ProviderEventDeclaration;
+//# sourceMappingURL=provider-events.d.ts.map

package/dist/agent/provider-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-events.d.ts","sourceRoot":"","sources":["../../agent/provider-events.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAE3F,eAAO,MAAM,qBAAqB,EAAE,wBA+CnC,CAAC"}

package/dist/agent/provider-events.js

@@ -0,0 +1,67 @@
+// TEAMS's event inventory (OPE-1612). See the core module's header
+// (packages/core/agent/routines/provider-events.ts) for what the three routing states mean.
+//
+// 🔴 TEAMS REGISTERS NO EVENT NORMALIZER, so every row is `routing: "none"` and the declaration
+// names no `source`.
+//
+// TEAMS HAS NO "EVENT NAME", AND THE ROWS SAY SO RATHER THAN INVENTING ONE. Microsoft Graph
+// subscribes to a RESOURCE PATH, and one subscription declares which changes it wants through a
+// separate `changeType` (`created`, `updated`, `deleted`). There is no `workflow_run`-shaped string
+// to quote, so each row's `event` is the resource path verbatim and its note carries the change
+// types that path accepts. Spelling a composite like `chatMessage.created` would be a name the
+// vendor does not use, which is the invention this seam exists to forbid.
+//
+// TWO THINGS WOULD HAVE TO BE DECIDED BEFORE ANY OF THIS ROUTES, and neither is a normalizer.
+// Graph proves a delivery with a validation token rather than a body signature, so the "declared
+// door with a declared verifier" rule needs an answer for that shape. And a resource-data
+// notification arrives ENCRYPTED under a certificate the deployment holds, so the payload a
+// normalizer would read does not exist until something decrypts it.
+export const TEAMS_PROVIDER_EVENTS = {
+    // `source` is ABSENT, not empty — the bundle registers no normalizer, so there is no key to name.
+    doc: "https://learn.microsoft.com/en-us/graph/teams-changenotifications-chatmessage",
+    events: [
+        {
+            event: "/teams/{team-id}/channels/{channel-id}/messages",
+            routing: "none",
+            match: [],
+            scope: [],
+            note: "messages and replies in ONE channel; changeType `created,updated`. The narrowest Teams subscription there is, and the one a per-channel routine would want",
+        },
+        {
+            event: "/chats/{chat-id}/messages",
+            routing: "none",
+            match: [],
+            scope: [],
+            note: "messages in ONE chat; changeType `created,updated`",
+        },
+        {
+            event: "/teams/getAllMessages",
+            routing: "none",
+            match: [],
+            scope: [],
+            note: "every channel message in the TENANT; changeType `created,updated`. Tenant-wide, so it needs the `ChannelMessage.Read.All` application permission",
+        },
+        {
+            event: "/chats/getAllMessages",
+            routing: "none",
+            match: [],
+            scope: [],
+            note: "every chat message in the TENANT; changeType `created,updated,deleted`. Needs `Chat.Read.All`",
+        },
+        {
+            event: "/users/{user-id}/chats/getAllMessages",
+            routing: "none",
+            match: [],
+            scope: [],
+            note: "every chat message one user takes part in; changeType `created,updated,deleted`",
+        },
+        {
+            event: "/appCatalogs/teamsApps/{teams-app-id}/installedToChats/getAllMessages",
+            routing: "none",
+            match: [],
+            scope: [],
+            note: "every chat message where a named Teams app is installed; changeType `created,updated`. The narrowest tenant-wide shape — it follows the app rather than the tenant",
+        },
+    ],
+};
+//# sourceMappingURL=provider-events.js.map

package/dist/agent/provider-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-events.js","sourceRoot":"","sources":["../../agent/provider-events.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,4FAA4F;AAC5F,EAAE;AACF,gGAAgG;AAChG,qBAAqB;AACrB,EAAE;AACF,4FAA4F;AAC5F,gGAAgG;AAChG,oGAAoG;AACpG,gGAAgG;AAChG,+FAA+F;AAC/F,0EAA0E;AAC1E,EAAE;AACF,8FAA8F;AAC9F,iGAAiG;AACjG,0FAA0F;AAC1F,4FAA4F;AAC5F,oEAAoE;AAIpE,MAAM,CAAC,MAAM,qBAAqB,GAA6B;IAC7D,kGAAkG;IAClG,GAAG,EAAE,+EAA+E;IACpF,MAAM,EAAE;QACN;YACE,KAAK,EAAE,iDAAiD;YACxD,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,4JAA4J;SACnK;QACD;YACE,KAAK,EAAE,2BAA2B;YAClC,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,oDAAoD;SAC3D;QACD;YACE,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,kJAAkJ;SACzJ;QACD;YACE,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,+FAA+F;SACtG;QACD;YACE,KAAK,EAAE,uCAAuC;YAC9C,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,iFAAiF;SACxF;QACD;YACE,KAAK,EAAE,uEAAuE;YAC9E,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,oKAAoK;SAC3K;KACF;CACF,CAAC"}

package/dist/agent/register.d.ts

@@ -0,0 +1,16 @@
+import { type DispatchTarget, type Routine } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * Resolve a Teams routine to its proactive-fire DispatchTarget — MOVED VERBATIM out of core's
+ * schedules/dispatch.ts (OPE-114 stage 4). Proactive messaging on Teams REQUIRES a Bot Framework
+ * conversation reference (serviceUrl + conversation id) captured on a prior INBOUND turn — you
+ * cannot cold-send to a Teams user/channel the bot has never heard from. bindTeams captures exactly
+ * that off every inbound activity, and create_routine stores it on the routine, so by construction
+ * every Teams routine created in-thread carries its reference. A routine WITHOUT one (both fields
+ * are required by eve's teamsChannel().receive, which throws otherwise) fails closed to dry-run
+ * (null) here.
+ */
+export declare function resolveTeamsTarget(r: Routine): DispatchTarget | null;
+/** Perform ALL of the teams bundle's registrations. Idempotent (each register call replaces);
+ *  cheap and side-effect-free beyond the registry writes. */
+export declare function registerTeamsProvider(): void;
+//# sourceMappingURL=register.d.ts.map

package/dist/agent/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../agent/register.ts"],"names":[],"mappings":"AA0CA,OAAO,EAeL,KAAK,cAAc,EACnB,KAAK,OAAO,EAGb,MAAM,4CAA4C,CAAC;AAwBpD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAwDpE;AAED;6DAC6D;AAC7D,wBAAgB,qBAAqB,IAAI,IAAI,CA+D5C"}

package/dist/agent/register.js

@@ -0,0 +1,198 @@
+// registerTeamsProvider — the ONE boot entry of @open-everywhere/provider-teams. The app's
+// adapter-wiring module (agent/lib/register-adapters.ts) imports this STATICALLY and calls it once
+// at boot; every seam the teams bundle implements registers here and nowhere else. Static imports
+// only: eve bundles the agent definition and its whole import graph into one rolldown chunk — a
+// literal dynamic import() code-splits and trips eve's "expected one authored module" invariant.
+//
+// What teams registers (and what it deliberately does NOT):
+//   • identity mapper        — bindTeams (chat-surface plane; channels/teams-identity.ts)
+//   • capability manifest    — midTurnPost via the host-side Connector write seam
+//                              (channels/teams-connector.ts, OPE-1237); no reaction primitive
+//   • post arm               — teamsPostArm (mid-turn reply + unified reply + redrive helpers + the
+//                              1:1 DM delivery arm, OPE-887)
+//   • wake-origin codec      — the stored-data teams arm (channels/teams-origin-codec.ts, which also
+//                              owns the Bot-Connector serviceUrl allowlist isTrustedTeamsServiceUrl)
+//   • read adapter           — teamsReadAdapter (Microsoft Graph channel/thread history reads)
+//   • routine dispatch       — resolveTeamsTarget (proactive routine fires need the captured Bot
+//                              Framework conversation reference + the teams channel object, both of
+//                              which now live in this bundle, so its resolver moved here too)
+//   • teams BRIDGE           — the bundle→core seam for the routine fire-eligibility leg's Graph
+//                              checks (OPE-522, mirroring the slack provider's own bridge):
+//                              accountEnabled + channel-membership, keyed on the creator's Azure AD
+//                              object id (channels/teams-fire-eligibility.ts, core channels/
+//                              teams-bridge.ts)
+//   • bot display name       — a HANDLE line on a Teams-pinned session, not identity since OPE-610,
+//                              read from the app's OWN service principal via Graph (OPE-587;
+//                              channels/teams-bot-name.ts, core identity/bot-display-name.ts)
+//   • account directory      — the Bot Connector roster of the teams this deployment has seen, for
+//                              the identity-linking directory transport (OPE-887;
+//                              channels/teams-directory.ts). NOT Microsoft Graph — Graph has no `29:`
+//                              id and a link keys on one; the header of that file carries the whole
+//                              argument
+//   • surface message ops    — teamsMessageOps: postText/editMessage (OPE-899), the transport behind
+//                              the stop acknowledgement and the approval decision notice. Resolves
+//                              its own serviceUrl from the `conversation`-grain address store
+//                              (channels/teams-conversation-ref.ts), since the registry's callers
+//                              hand it only a bare conversation id.
+//   • reaction surface       — INBOUND ONLY (OPE-1502). Teams delivers `messageReaction` activities
+//                              and refuses an application identity the outbound WRITE, so the
+//                              feedback ingest is wired (channels/teams-reaction-feedback.ts) while
+//                              the capability manifest still reads `reactions: false`
+//   • NO attachment resolver — the Teams surface carries no attachment plane today
+import { registerIdentityMapper, registerCapabilityManifest, registerSurfaceParity, registerProviderEvents, registerReactionSurface, registerPostArm, registerWakeOriginCodec, registerReadAdapter, registerSeatCatchUp, registerRoutineDispatch, registerTeamsBridge, registerBotDisplayName, registerAccountDirectory, registerSurfaceMessageOps, registerProviderDocs, } from "@open-everywhere/core/agent/adapter-api.js";
+import { PROVIDER_DOCS } from "./docs-generated.js";
+import { TEAMS_SURFACE_PARITY } from "./surface-parity.js";
+import { TEAMS_PROVIDER_EVENTS } from "./provider-events.js";
+import { registerTeamsOps } from "./ops.js";
+import { teamsMessageOps } from "./channels/teams-message-ops.js";
+import teamsChannel from "./channels/teams.js";
+import { bindTeams, teamsMode } from "./channels/teams-identity.js";
+import { teamsPostArm } from "./channels/teams-post-arm.js";
+import { teamsWakeOriginCodec } from "./channels/teams-origin-codec.js";
+import { teamsReadAdapter } from "./channels/teams-read.js";
+import { teamsSeatCatchUpFetch, TEAMS_TIMESTAMP_PRECISION_MS } from "./channels/teams-catch-up.js";
+import { liveTeamsRoomMembership, liveTeamsAccountActive } from "./channels/teams-fire-eligibility.js";
+import { teamsBotDisplayName } from "./channels/teams-bot-name.js";
+import { fetchTeamsDirectory } from "./channels/teams-directory.js";
+/** One stored-target field as a non-empty string, or undefined (never a coerced non-string — the
+ *  store row is data, validated on the way out, not trusted). Local copy of the core dispatcher's
+ *  private helper (a two-line structural read; not a barrel port). */
+function storedString(t, key) {
+    const v = t?.[key];
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+/**
+ * Resolve a Teams routine to its proactive-fire DispatchTarget — MOVED VERBATIM out of core's
+ * schedules/dispatch.ts (OPE-114 stage 4). Proactive messaging on Teams REQUIRES a Bot Framework
+ * conversation reference (serviceUrl + conversation id) captured on a prior INBOUND turn — you
+ * cannot cold-send to a Teams user/channel the bot has never heard from. bindTeams captures exactly
+ * that off every inbound activity, and create_routine stores it on the routine, so by construction
+ * every Teams routine created in-thread carries its reference. A routine WITHOUT one (both fields
+ * are required by eve's teamsChannel().receive, which throws otherwise) fails closed to dry-run
+ * (null) here.
+ */
+export function resolveTeamsTarget(r) {
+    const serviceUrl = storedString(r.target, "serviceUrl");
+    const conversationId = storedString(r.target, "conversationId");
+    if (!serviceUrl || !conversationId)
+        return null;
+    const conversationType = storedString(r.target, "conversationType");
+    const channelId = storedString(r.target, "channelId");
+    const teamId = storedString(r.target, "teamId");
+    // The creator's Azure AD object id (OPE-522) — stamped by bindTeams onto the routine's STORED
+    // target at creation time (channels/teams-identity.ts). Read back here into ATTRIBUTES, never
+    // into the fresh `target` below: `target` is what actually rides into the Bot Connector send
+    // (routine-dispatch.ts's DispatchTarget doc — "stored-target extras... feed attributes instead,
+    // never the adapter call"), and this value has no business in a Connector payload. The
+    // dispatcher's fire-eligibility leg reads it off `attributes.aad_object_id`.
+    const aadObjectId = storedString(r.target, "aadObjectId");
+    // tenant: the stored raw fact, else the surfaceKey's workspace segment (a tenant GUID is seg()-safe,
+    // so it round-trips verbatim — unlike the conversation id, whose ":"/"@" get sanitized in the key
+    // and MUST come from the stored target).
+    const tenantId = storedString(r.target, "tenantId") ?? r.surfaceKey.split("/")[1] ?? "";
+    // teamsMode is the one tested scope→mode place (personal→dm, groupChat→mpim); an absent stored
+    // scope resolves to "channel" (capped — the conservative arm).
+    const mode = teamsMode(conversationType);
+    // OPE-486 — the fire's WAKE ORIGIN, parity with resolveSlackTarget (routine-dispatch.ts). Absent
+    // before this fix, so a Teams fire could never divert into the unified window (fire-window.ts's
+    // planFireWindow fails closed on a missing origin). serviceUrl/conversationId are already
+    // non-empty-checked above (isTrustedTeamsServiceUrl re-validates serviceUrl in the codec's
+    // validate arm); no replyToActivityId — a proactive fire has no reply chain to anchor to, matching
+    // teams-front.ts's own ambient-origin mint (`{ platform: "teams", serviceUrl, conversationId }`).
+    const origin = { platform: "teams", serviceUrl, conversationId, ...(tenantId ? { tenantId } : {}) };
+    return {
+        channel: teamsChannel,
+        // Full TeamsReceiveTarget: conversationType lets eve anchor non-personal threads correctly;
+        // tenant/team/channel ids ride into the Connector's channelData.
+        target: {
+            serviceUrl,
+            conversationId,
+            ...(conversationType ? { conversationType } : {}),
+            ...(channelId ? { channelId } : {}),
+            ...(teamId ? { teamId } : {}),
+            ...(tenantId ? { tenantId } : {}),
+        },
+        mode,
+        // The facts bindTeams reads (workspace = tenant, surface = conversation). NO membership_type is
+        // stamped — it was never re-verified at fire time, so teamsTrust yields no verdict and bindFrom
+        // fails the fire closed to `external` (shared memory / domain skills stay off), matching what an
+        // inbound Teams activity without membershipType gets.
+        attributes: {
+            conversation_id: conversationId,
+            service_url: serviceUrl,
+            ...(tenantId ? { tenant_id: tenantId } : {}),
+            ...(channelId ? { channel_id: channelId } : {}),
+            ...(teamId ? { team_id: teamId } : {}),
+            ...(conversationType ? { scope: conversationType } : {}),
+            ...(aadObjectId ? { aad_object_id: aadObjectId } : {}),
+        },
+        origin,
+    };
+}
+/** Perform ALL of the teams bundle's registrations. Idempotent (each register call replaces);
+ *  cheap and side-effect-free beyond the registry writes. */
+export function registerTeamsProvider() {
+    registerIdentityMapper("teams", bindTeams);
+    // Bot-Connector proactive post wired via the host-side Connector write seam (channels/
+    // teams-connector.ts, OPE-1237 — the post arm sends a message activity into the captured
+    // conversation reference). No integration reaction primitive.
+    // closingProseDropped (OPE-2006): the Teams completion handler DROPS a turn's closing text and
+    // audits it. `reply` is the only route out.
+    registerCapabilityManifest("teams", { midTurnPost: true, reactions: false, closingProseDropped: true });
+    // The OPE-1499 parity ledger: every capability the chat-surface contract names, answered
+    // `supported` or `{ unsupported: "<reason>" }`. Gates nothing at runtime — `lint:surface-parity`
+    // reds on an unanswered row, and the contract's §7.1/§7.1.1/§7.2 tables are generated from it.
+    registerSurfaceParity("teams", TEAMS_SURFACE_PARITY);
+    // The OPE-1612 event inventory: every vendor event that could wake a routine, and how far the
+    // normalizer plane carries each one. Gates nothing at runtime — `lint:provider-events` reds a
+    // bundle that declares none or that promises a match key the normalizer does not declare, and
+    // the manual's inventory table is generated from it.
+    registerProviderEvents("teams", TEAMS_PROVIDER_EVENTS);
+    registerPostArm(teamsPostArm);
+    registerWakeOriginCodec("teams", teamsWakeOriginCodec);
+    // Teams channel/thread history reads ride Microsoft Graph (Bot Framework has no history API).
+    registerReadAdapter(teamsReadAdapter);
+    // THE SEAT CATCH-UP FETCH (OPE-1726): the channel (or reply chain) history since the seat's
+    // last wake, over Microsoft Graph — the same transport `read_channel` uses, and NOT the Bot
+    // Connector the wake arrives on. Core's shared path applies the bounds, the policy and the cap.
+    // The surface DECLARES the unit its own message stamps carry, and core widens both catch-up
+    // bounds by it (OPE-1847). A wrong or missing unit bounds the seat out of its own window.
+    registerSeatCatchUp("teams", teamsSeatCatchUpFetch, { timestampPrecisionMs: TEAMS_TIMESTAMP_PRECISION_MS });
+    // Proactive routine fires on the teams surface (needs the captured Bot Framework reference).
+    registerRoutineDispatch("teams", { resolveTarget: resolveTeamsTarget });
+    // The bundle→core bridge for the routine fire-eligibility leg's Graph checks (OPE-522) — core's
+    // routines/fire-eligibility.ts consumes these through channels/teams-bridge.ts, never Graph
+    // directly, mirroring the slack provider's own registerSlackBridge call.
+    registerTeamsBridge({ roomMembership: liveTeamsRoomMembership, accountActive: liveTeamsAccountActive });
+    // The bot's own display name (OPE-587) — core's per-surface registry arm, rendered as a HANDLE
+    // line, not identity, since OPE-610 settled the naming model. Reads the app's OWN service
+    // principal through the same Graph token the read adapter mints; needs no extra Azure consent
+    // (the app's implicit self-read, measured live). See channels/teams-bot-name.ts.
+    registerBotDisplayName("teams", teamsBotDisplayName);
+    // THE TEAMS ACCOUNT DIRECTORY (OPE-887) — the lookup the reverse-initiated link uses to NAME the
+    // other account instead of posting a bearer code where a room can read it. It walks the Bot
+    // Connector roster of the teams this deployment has captured a conversation reference for, so the
+    // ids it returns are the `29:` ids a Teams link actually keys on. The other half of the transport
+    // is the post arm's `deliverDirectMessage` — core requires BOTH before it offers the transport,
+    // and both rest on the same captured reference (channels/teams-conversation-ref.ts).
+    registerAccountDirectory("teams", (query) => fetchTeamsDirectory(query));
+    // THE STOP ACKNOWLEDGEMENT'S TRANSPORT (OPE-899) — postText/editMessage, so turn-anchor.ts's
+    // postSurfaceText resolves a real send instead of undefined on a Teams turn. No postFiles (no
+    // attachment plane) and no setReaction (no reaction primitive beyond the `angry` stop trigger).
+    registerSurfaceMessageOps(teamsMessageOps);
+    // REACTION-FEEDBACK INGEST (OPE-1502) — INBOUND only, and that is not a contradiction with the
+    // `reactions: false` manifest above. Teams refuses an application identity the outbound WRITE
+    // (§7.3's probe), while it delivers `messageReaction` activities inbound freely. The arm that
+    // records them is channels/teams-reaction-feedback.ts, reached from the stop arm's fan-out.
+    registerReactionSurface("teams");
+    // Shipped-manual plane (OPE-138): this bundle's own setup runbook (docs/deploy/surfaces/teams.md,
+    // compiled into ./docs-generated.ts because docs/ is not on disk at runtime). De-select the bundle
+    // and the module leaves the import graph; registerProviderDocs re-checks the selection gate anyway.
+    registerProviderDocs("teams", PROVIDER_DOCS);
+    // Ops plane (OPE-428): the live preflight probe that reports which Microsoft boundary governs
+    // channel reads. Split into ./ops.js so the STANDALONE ops MCP entry (repo-root
+    // scripts/ops-mcp.ts, which serves preflight with no agent boot) registers it without pulling
+    // the whole channel graph — the same split slack uses.
+    registerTeamsOps();
+}
+//# sourceMappingURL=register.js.map

package/dist/agent/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../agent/register.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,mGAAmG;AACnG,kGAAkG;AAClG,gGAAgG;AAChG,iGAAiG;AACjG,EAAE;AACF,4DAA4D;AAC5D,0FAA0F;AAC1F,kFAAkF;AAClF,8FAA8F;AAC9F,oGAAoG;AACpG,6DAA6D;AAC7D,qGAAqG;AACrG,qGAAqG;AACrG,+FAA+F;AAC/F,iGAAiG;AACjG,oGAAoG;AACpG,8FAA8F;AAC9F,iGAAiG;AACjG,4FAA4F;AAC5F,oGAAoG;AACpG,6FAA6F;AAC7F,gDAAgD;AAChD,oGAAoG;AACpG,6FAA6F;AAC7F,8FAA8F;AAC9F,mGAAmG;AACnG,kFAAkF;AAClF,sGAAsG;AACtG,oGAAoG;AACpG,wCAAwC;AACxC,qGAAqG;AACrG,mGAAmG;AACnG,8FAA8F;AAC9F,kGAAkG;AAClG,oEAAoE;AACpE,oGAAoG;AACpG,8FAA8F;AAC9F,oGAAoG;AACpG,sFAAsF;AACtF,mFAAmF;AAEnF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EAIzB,oBAAoB,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,YAAY,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACvG,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE;;sEAEsE;AACtE,SAAS,YAAY,CAAC,CAAoB,EAAE,GAAW;IACrD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,8FAA8F;IAC9F,8FAA8F;IAC9F,6FAA6F;IAC7F,gGAAgG;IAChG,uFAAuF;IACvF,6EAA6E;IAC7E,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1D,qGAAqG;IACrG,kGAAkG;IAClG,yCAAyC;IACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxF,+FAA+F;IAC/F,+DAA+D;IAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACzC,iGAAiG;IACjG,gGAAgG;IAChG,0FAA0F;IAC1F,2FAA2F;IAC3F,mGAAmG;IACnG,kGAAkG;IAClG,MAAM,MAAM,GAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvH,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,4FAA4F;QAC5F,iEAAiE;QACjE,MAAM,EAAE;YACN,UAAU;YACV,cAAc;YACd,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC;QACD,IAAI;QACJ,gGAAgG;QAChG,gGAAgG;QAChG,iGAAiG;QACjG,sDAAsD;QACtD,UAAU,EAAE;YACV,eAAe,EAAE,cAAc;YAC/B,WAAW,EAAE,UAAU;YACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD;QACD,MAAM;KACP,CAAC;AACJ,CAAC;AAED;6DAC6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3C,uFAAuF;IACvF,yFAAyF;IACzF,8DAA8D;IAC9D,+FAA+F;IAC/F,4CAA4C;IAC5C,0BAA0B,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,yFAAyF;IACzF,iGAAiG;IACjG,+FAA+F;IAC/F,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACrD,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,qDAAqD;IACrD,sBAAsB,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACvD,eAAe,CAAC,YAAY,CAAC,CAAC;IAC9B,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACvD,8FAA8F;IAC9F,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IACtC,4FAA4F;IAC5F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,0FAA0F;IAC1F,mBAAmB,CAAC,OAAO,EAAE,qBAAqB,EAAE,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC5G,6FAA6F;IAC7F,uBAAuB,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACxE,gGAAgG;IAChG,4FAA4F;IAC5F,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,cAAc,EAAE,uBAAuB,EAAE,aAAa,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACxG,+FAA+F;IAC/F,0FAA0F;IAC1F,8FAA8F;IAC9F,iFAAiF;IACjF,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACrD,iGAAiG;IACjG,4FAA4F;IAC5F,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,qFAAqF;IACrF,wBAAwB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,6FAA6F;IAC7F,8FAA8F;IAC9F,gGAAgG;IAChG,yBAAyB,CAAC,eAAe,CAAC,CAAC;IAC3C,+FAA+F;IAC/F,8FAA8F;IAC9F,8FAA8F;IAC9F,4FAA4F;IAC5F,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,kGAAkG;IAClG,mGAAmG;IACnG,oGAAoG;IACpG,oBAAoB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7C,8FAA8F;IAC9F,gFAAgF;IAChF,8FAA8F;IAC9F,uDAAuD;IACvD,gBAAgB,EAAE,CAAC;AACrB,CAAC"}

package/dist/agent/surface-parity.d.ts

@@ -0,0 +1,3 @@
+import type { SurfaceParityDeclaration } from "@open-everywhere/core/agent/adapter-api.js";
+export declare const TEAMS_SURFACE_PARITY: SurfaceParityDeclaration;
+//# sourceMappingURL=surface-parity.d.ts.map

package/dist/agent/surface-parity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-parity.d.ts","sourceRoot":"","sources":["../../agent/surface-parity.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAE3F,eAAO,MAAM,oBAAoB,EAAE,wBAqGlC,CAAC"}

package/dist/agent/surface-parity.js

@@ -0,0 +1,106 @@
+// TEAMS' surface-parity declaration (OPE-1499). See the core module's header
+// (packages/core/agent/identity/surface-parity.ts) for what the three cell shapes mean.
+//
+// Some of the gaps below are PERMANENT vendor limits and some are NOT BUILT YET. The distinction is
+// the whole point of writing a reason down: `react` and the ✋ glyph are things Microsoft does not
+// let an application identity do, so no ticket will ever close them. Reaction-feedback ingest was
+// the other kind — unwritten OE work — and OPE-1502 closed it, which is what the row now says.
+export const TEAMS_SURFACE_PARITY = {
+    // --- registration seams (§7.1) ---------------------------------------------------------------
+    "identity-mapper": "supported",
+    "capability-manifest": "supported",
+    "post-arm": "supported",
+    "wake-origin-codec": "supported",
+    "unified-action-plane": {
+        unsupported: "the arm posts a plain message activity, and a button here needs an Adaptive Card PLUS an invoke route to receive the tap. `teams-front.ts` forwards every `invoke` to the native channel, whose HITL route resolves a tap against the TEAMS channel's own session — a unified seat's parked request lives on another session entirely, so an OE-minted card would render a button that settles nothing. Prose, which stands on its own, until that route exists",
+    },
+    "origin-placement-carry": {
+        unsupported: "the placement is INSIDE the conversation identity: `threadRef` keys on `replyToActivityId`, the very activity a reply hangs under, so two origins that pass the conversation test already agree on placement and there is no gap to carry",
+    },
+    "read-adapter": "supported",
+    // INBOUND reaction ingest is wired (OPE-1502); the OUTBOUND write below is not, and the two are
+    // independent. The note is the honest half: Microsoft delivers `messageReaction` only for messages
+    // the agent itself sent, and delivers no author for the reacted message — so the "is this the
+    // agent's own reply" test on this surface is that vendor fence plus a present `replyToId`, not the
+    // author comparison Slack, Discord and Linear make.
+    "reaction-feedback-ingest": { supported: "the vendor fence is the guarantee — Teams delivers the event only for the agent's own messages, and carries no author to compare" },
+    "ancillary-ops": "supported",
+    // WIRED, AND TENANT-CONDITIONAL — the qualified form, because a bare ✅ over-claimed it against
+    // the support matrix's own 🔧 row (OPE-1527). The seam is built and armed on every channel and
+    // group chat; whether a PLAIN follow-up ever reaches it is the tenant's RSC consent, which no API
+    // can probe (channels/teams-engagement.ts). Without the grant only @mention activities arrive, so
+    // the seam wakes nothing and the surface answers once per mention exactly as before.
+    "ambient-engagement-seam": {
+        supported: "the seam is wired; plain follow-ups reach it only where the tenant consented to `ChannelMessage.Read.Group` / `ChatMessage.Read.Chat`, which no API can probe",
+    },
+    // The single-window divert writes `plan.window.addressing ?? "channel-watch"` (teams-front.ts), so
+    // an engaged follow-up and unowned room chatter leave the same row. No journey reds on it today —
+    // `J-ENGAGED-teams` does not gate a dispatch addressing — so the gap is declared here rather than
+    // carried as a silent one.
+    "engaged-row-promotion": {
+        unsupported: "not built yet — the single-window divert writes the plan's own `addressing`, which calls an engaged follow-up and room chatter alike",
+    },
+    // The reply chain IS the thread on Teams, so the router reads `replyToActivityId` the way it
+    // reads Slack's `threadTs`. A plain conversation send starts its own chain and stays top-level.
+    // The personal/group-chat DM leg keeps the raw divert — it mints no reply-chain origin.
+    "owned-thread-ingress": { supported: "the channel leg only — a reply chain is the thread; the DM leg mints no `replyToActivityId`, so it can own none" },
+    // --- wake legs and conversation shapes -------------------------------------------------------
+    "addressed-leg": "supported",
+    // Not the engagement seam: the wake is the single-window front's Leg A, a different mechanism.
+    // The registry does suppress it, though — the front drops a stood-down conversation above both
+    // legs, for a conversation an @mention enrolled (§7.6).
+    "ambient-leg": { supported: "the single-window front's Leg A, not the §2.5 engagement registry" },
+    // 🔴 OVER GRAPH, NOT THE BOT CONNECTOR. The transport a Teams activity arrives on carries no
+    // history API — which is why `teams-supervisor.ts` once said this surface could not catch up at all
+    // — but `teams-catch-up.ts` reads `/teams/{team}/channels/{channel}/messages`, the same Graph call
+    // `read_channel` uses. A personal or group chat carries no team id, so it takes no catch-up.
+    "seat-catch-up": { supported: "over Microsoft Graph (channel activities only — a personal/group chat carries no team id)" },
+    // The slot is EMPTY on this surface: `teams-front.ts` builds no `contextLines`, so there is no pour
+    // to police. The seat's room context here is the catch-up read above and the carried tail, both of
+    // which already pass the domain's policy in core.
+    "seat-context-admission": { unsupported: "the hydration fills no context-line slot — the seat's room context is the catch-up read, which core already admits" },
+    // The same missing invoke route the component-plane row above names: a card needs an Adaptive Card
+    // PLUS a tap that resolves against the UNIFIED seat's parked request, and `teams-front.ts` forwards
+    // every `invoke` to the native channel's own session, so nothing here can card in place. See the
+    // roster row for what that costs and where it does NOT cost anything.
+    "approval-card": { unsupported: "no invoke route resolves a tap against a unified seat's parked request. A governed act that takes the venue walk is redirected to a card-capable room in the SAME domain, or refused when the domain holds none. The paths OUTSIDE that walk do not: the spend checkpoint (spend/checkpoint.ts `requireSessionContinuation`) fails OPEN here and records the crossing in an audit row instead" },
+    // THE TRACE ARRIVES EVEN THOUGH THE BUTTON CANNOT (OPE-1854). A judge-lifted act posts its
+    // notice here as a plain message activity through the shared road (`postJudgeLiftNotice`), on this
+    // surface's own `SurfaceMessageOps` transport. It carries the overrule as an INSTRUCTION in
+    // words, with the action id a reviewer finds the act by, because no tap can land here.
+    // 🔴 BARE, NOT `{ supported: "…" }`. A noted cell is exempt from the overclaim arm, and the
+    // arm is the point: drop this bundle's text transport and the notice silently stops arriving.
+    "judge-lift-notice": "supported",
+    "name-drop-mention": { unsupported: "not built yet — Leg A wakes on an @mention or room chatter, never on a name-drop match" },
+    // 🔴 THE ACTIVITY TYPE IS THE FILTER. Teams sends an edit as a `messageUpdate` activity, and the
+    // inbound parser admits `message`, `invoke` and `conversationUpdate` only, so the edit resolves to
+    // null before `teams-front.ts` sees it. `teams-front.ts` forwards every non-`message` activity to
+    // the native channel for the same reason — there is nothing on this surface to gate.
+    "message-edit-wake": { unsupported: "an edit arrives as a `messageUpdate` activity, and the inbound parser admits `message`, `invoke` and `conversationUpdate` only" },
+    // The `;messageid=` reply chain (§4.6.1).
+    threads: "supported",
+    rooms: "supported",
+    dm: "supported",
+    mpim: "supported",
+    // --- core verbs (§7.2) -----------------------------------------------------------------------
+    reply: "supported",
+    edit_reply: "supported",
+    // PERMANENT. Microsoft Graph carries an outbound reaction route, but it refuses the
+    // application-only context OE runs in — there is no primitive an app identity can drive (§7.3).
+    react: { unsupported: "vendor limit — Graph's outbound reaction route refuses an application-only identity" },
+    no_reply: "supported",
+    read_channel: "supported",
+    read_thread: "supported",
+    search: { unsupported: "no work-search adapter — Teams is a chat surface, not a work corpus (§4.7)" },
+    post_message: "supported",
+    dm_person: "supported",
+    set_dm_delivery: "supported",
+    // Teams' six fixed reaction values carry no raised hand, so the stop trigger is `angry` — the one
+    // of the six people already use to mean "this is wrong" (§4.8).
+    stop: { supported: "the `angry` reaction — Teams' six fixed values carry no ✋" },
+    ack_stop_glyph: { unsupported: "vendor limit — Teams' fixed six-value reaction vocabulary has no raised hand" },
+    ack_cancel_note: "supported",
+    stand_down: { supported: "marks the conversation row; refuses on a 1:1 and when no row exists" },
+    post_file: { unsupported: "not built yet — no Teams attachment transport is wired (§7.3)" },
+};
+//# sourceMappingURL=surface-parity.js.map

package/dist/agent/surface-parity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-parity.js","sourceRoot":"","sources":["../../agent/surface-parity.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,wFAAwF;AACxF,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,kGAAkG;AAClG,+FAA+F;AAI/F,MAAM,CAAC,MAAM,oBAAoB,GAA6B;IAC5D,gGAAgG;IAChG,iBAAiB,EAAE,WAAW;IAC9B,qBAAqB,EAAE,WAAW;IAClC,UAAU,EAAE,WAAW;IACvB,mBAAmB,EAAE,WAAW;IAChC,sBAAsB,EAAE;QACtB,WAAW,EACT,icAAic;KACpc;IACD,wBAAwB,EAAE;QACxB,WAAW,EACT,2OAA2O;KAC9O;IACD,cAAc,EAAE,WAAW;IAC3B,gGAAgG;IAChG,mGAAmG;IACnG,8FAA8F;IAC9F,mGAAmG;IACnG,oDAAoD;IACpD,0BAA0B,EAAE,EAAE,SAAS,EAAE,kIAAkI,EAAE;IAC7K,eAAe,EAAE,WAAW;IAC5B,+FAA+F;IAC/F,+FAA+F;IAC/F,kGAAkG;IAClG,kGAAkG;IAClG,qFAAqF;IACrF,yBAAyB,EAAE;QACzB,SAAS,EAAE,+JAA+J;KAC3K;IACD,mGAAmG;IACnG,kGAAkG;IAClG,kGAAkG;IAClG,2BAA2B;IAC3B,uBAAuB,EAAE;QACvB,WAAW,EAAE,sIAAsI;KACpJ;IACD,6FAA6F;IAC7F,gGAAgG;IAChG,wFAAwF;IACxF,sBAAsB,EAAE,EAAE,SAAS,EAAE,iHAAiH,EAAE;IAExJ,gGAAgG;IAChG,eAAe,EAAE,WAAW;IAC5B,+FAA+F;IAC/F,+FAA+F;IAC/F,wDAAwD;IACxD,aAAa,EAAE,EAAE,SAAS,EAAE,mEAAmE,EAAE;IACjG,6FAA6F;IAC7F,oGAAoG;IACpG,mGAAmG;IACnG,6FAA6F;IAC7F,eAAe,EAAE,EAAE,SAAS,EAAE,2FAA2F,EAAE;IAC3H,oGAAoG;IACpG,mGAAmG;IACnG,kDAAkD;IAClD,wBAAwB,EAAE,EAAE,WAAW,EAAE,oHAAoH,EAAE;IAC/J,mGAAmG;IACnG,oGAAoG;IACpG,iGAAiG;IACjG,sEAAsE;IACtE,eAAe,EAAE,EAAE,WAAW,EAAE,+XAA+X,EAAE;IACja,2FAA2F;IAC3F,mGAAmG;IACnG,4FAA4F;IAC5F,uFAAuF;IACvF,4FAA4F;IAC5F,8FAA8F;IAC9F,mBAAmB,EAAE,WAAW;IAChC,mBAAmB,EAAE,EAAE,WAAW,EAAE,wFAAwF,EAAE;IAC9H,iGAAiG;IACjG,mGAAmG;IACnG,kGAAkG;IAClG,qFAAqF;IACrF,mBAAmB,EAAE,EAAE,WAAW,EAAE,gIAAgI,EAAE;IACtK,0CAA0C;IAC1C,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,WAAW;IAClB,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,WAAW;IAEjB,gGAAgG;IAChG,KAAK,EAAE,WAAW;IAClB,UAAU,EAAE,WAAW;IACvB,oFAAoF;IACpF,gGAAgG;IAChG,KAAK,EAAE,EAAE,WAAW,EAAE,qFAAqF,EAAE;IAC7G,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,WAAW;IACzB,WAAW,EAAE,WAAW;IACxB,MAAM,EAAE,EAAE,WAAW,EAAE,4EAA4E,EAAE;IACrG,YAAY,EAAE,WAAW;IACzB,SAAS,EAAE,WAAW;IACtB,eAAe,EAAE,WAAW;IAC5B,kGAAkG;IAClG,gEAAgE;IAChE,IAAI,EAAE,EAAE,SAAS,EAAE,2DAA2D,EAAE;IAChF,cAAc,EAAE,EAAE,WAAW,EAAE,8EAA8E,EAAE;IAC/G,eAAe,EAAE,WAAW;IAC5B,UAAU,EAAE,EAAE,SAAS,EAAE,qEAAqE,EAAE;IAChG,SAAS,EAAE,EAAE,WAAW,EAAE,+DAA+D,EAAE;CAC5F,CAAC"}