@open-everywhere/provider-teams 0.0.0-stage → 0.1.1

package/dist/agent/channels/teams-conversation-ref.js

@@ -0,0 +1,368 @@
+// THE TEAMS CONVERSATION REFERENCE (OPE-887) — the durable answer to "where may this deployment
+// reach a Teams person or a Teams team when no turn is running?".
+//
+// WHY TEAMS NEEDS THIS AND NO OTHER SURFACE DOES. Slack and Discord cold-address a direct message
+// from a bare person id under the bot token: `conversations.open`, `POST /users/@me/channels`. The
+// Bot Framework has no equivalent. Every write goes to `{serviceUrl}/v3/...`, `serviceUrl` is
+// REGIONAL (`.../emea/`, `.../amer/`, `.../uk/`) and appears nowhere but on an inbound activity, and
+// the conversation id is minted by Microsoft. So an address that is never captured is an address
+// this deployment can never hold: without this module a proactive Teams delivery is not "not wired",
+// it is impossible.
+//
+// THREE SPECIES, AND CONFUSING THEM WOULD BE THE WORST BUG IN THIS FILE:
+//
+//   • `personal` — keyed on the Bot Framework user id (`from.id`, a `29:` string), and its
+//     conversation id is a 1:1 chat between that person and the bot. It is written ONLY from an
+//     activity whose scope IS `personal`. 🔴 A CHANNEL CONVERSATION ID MUST NEVER LAND IN A
+//     PERSONAL ROW: the one caller of the personal address is the DM arm, which delivers private
+//     things — an identity-link consent ask, a governance pane read — and a channel id there would
+//     post them into a room where everybody can read them.
+//   • `team` — keyed on the Teams team id, and its conversation id is the CHANNEL-grain conversation.
+//     Its reader is the account directory (`teams-directory.ts`), which needs a conversation to read
+//     a roster from.
+//   • `conversation` (OPE-899) — keyed on the EXACT conversation id an activity arrived on, at
+//     WHATEVER grain that id is (a channel's reply chain included, `;messageid=<root>` suffix and
+//     all). Written for every scope, personal/group/channel alike — unlike the two rows above, this
+//     one is never selective. Its reader is `teams-message-ops.ts`'s SurfaceMessageOps: the stop
+//     acknowledgement (turn-anchor.ts's `postSurfaceText`) is handed only a bare conversation id
+//     (core's `channelId`), never a `serviceUrl`, so posting the cancel note into that EXACT id needs
+//     a lookup this row is the only thing that can answer. The `personal`/`team` rows cannot stand in
+//     for it: `personal` requires a principal id the caller does not have, and `team` stores the
+//     CHANNEL grain, not the reply-chain grain a channel turn actually anchors on.
+//     A CHANNEL activity writes this species TWICE (OPE-1093): once at the reply-chain grain it
+//     arrived on, and once at the CHANNEL grain, which is the grain every roster entry, surface key
+//     and resource-grant address names. Without the second row those two sets are disjoint and no
+//     Teams container grant can deliver — see the CHANNEL-GRAIN TWIN block in `teamsAddressRowsFor`.
+//
+// IT ALSO WRITES THE ID-RESTORATION INDEX ROWS (`teams-id-restore.ts`), because this is the one
+// point where a raw Teams id enters the deployment. Those rows are a SPELLING and not an address:
+// they carry no `serviceUrl`, they name no reachable place, and they exist only so a resource-grant
+// address — which can spell a Teams id one way and only one way — can be turned back into something
+// the Bot Framework accepts. Read that module's header before changing anything here.
+//
+// A GROUP CHAT WRITES NO `personal`/`team` ROW — it is neither a 1:1 nor a team, its members are an
+// ad-hoc set, and neither reader has a use for it — but it DOES write a `conversation` row, same as
+// every other scope. "Unsupported, never faked" still holds: a group chat has no DM-arm or directory
+// use, but it is exactly as stoppable-and-acknowledgeable as a channel or a personal chat, so the one
+// row that stop acknowledgement depends on is written unconditionally.
+//
+// EVERY ROW IS RE-STAMPED, NEVER WRITTEN ONCE. Microsoft makes no promise that a tenant keeps its
+// `serviceUrl` region, so the newest inbound activity always wins. That is also why there is no TTL:
+// an address is corrected by traffic, and expiring one would trade a stale address for none at all.
+//
+// 🔴 THE HOST ALLOWLIST IS APPLIED TWICE, ON PURPOSE. A stored `serviceUrl` becomes the target of a
+// `client_credentials` Connector bearer token, and it arrived in an activity BODY that eve's JWT
+// verifier does not bind (see `isTrustedTeamsServiceUrl`'s own comment). So an untrusted host is
+// refused at WRITE time — it never reaches the table — and every read re-checks, because a row
+// written by an older, weaker build must not become a token exfiltration route after an upgrade.
+import { getOperationalStore, deploymentOrg } from "@open-everywhere/core/agent/adapter-api.js";
+import { isTrustedTeamsServiceUrl } from "./teams-origin-codec.js";
+import { teamsIdIndexRow, TEAMS_CONVERSATION_KEY_KIND, TEAMS_PERSON_KEY_KIND } from "./teams-id-restore.js";
+/** The platform key both row species are stored under. */
+export const TEAMS_ADDRESS_PLATFORM = "teams";
+/** The `kind` of a 1:1 chat reference — keyed on the Bot Framework `29:` user id. */
+export const TEAMS_PERSONAL_ADDRESS_KIND = "personal";
+/** The `kind` of a team reference — keyed on the Teams team id. */
+export const TEAMS_TEAM_ADDRESS_KIND = "team";
+/** The `kind` of a bare conversation reference (OPE-899) — keyed on the EXACT conversation id, at
+ *  whatever grain it arrived on. See the header's third species. */
+const TEAMS_CONVERSATION_ADDRESS_KIND = "conversation";
+/** How many team references one directory search may read. A deployment serving more teams than this
+ *  is not a shape we have; the bound exists so a growing table can never turn a human-paced lookup
+ *  into an unbounded fan-out of live calls inside one turn. */
+export const TEAMS_TEAM_ADDRESS_READ_LIMIT = 8;
+/** The `;messageid=<root>` suffix Teams appends to a CHANNEL conversation id. It names one REPLY
+ *  CHAIN inside the channel, never the channel itself. */
+const TEAMS_REPLY_CHAIN_SUFFIX = ";messageid=";
+/**
+ * The CHANNEL-grain conversation id — the same id with any reply-chain suffix removed. A personal or
+ * group chat id carries no suffix and comes back unchanged.
+ *
+ * WHY THIS IS SPELLED HERE RATHER THAN BORROWED. eve strips the SAME suffix at the SAME (last)
+ * occurrence in `normalizeTeamsContinuationAddress`, but eve does not re-export that function from
+ * `eve/channels/teams`: it lives behind eve's private `#public/channels/teams/api.js` specifier and
+ * eve's package `exports` map admits no deep import. Measured against eve 0.38.3 on 2026-08-15 — the
+ * barrel re-exports eleven names from `api.js` and this is not one of them. Re-check on an eve bump;
+ * if eve exports it, delete this and call eve's.
+ *
+ * TWO READERS, TWO DIFFERENT USES, both deliberate:
+ *   • the roster probe (`teams-roster.ts`) uses it as a CACHE KEY ONLY. The id it sends on the wire
+ *     stays exactly as the caller passed it, because that is the shape the 2026-08-15 live-tenant
+ *     probe measured.
+ *   • this module stores it as the TEAM address, because a team's roster is a property of the
+ *     channel and not of one reply chain.
+ */
+export function teamsChannelGrainConversationId(conversationId) {
+    const i = conversationId.lastIndexOf(TEAMS_REPLY_CHAIN_SUFFIX);
+    return i < 0 ? conversationId : conversationId.slice(0, i);
+}
+/**
+ * The REPLY-CHAIN ROOT message id inside a channel conversation id, or undefined when the id names
+ * no reply chain (a personal or group chat, or a channel id already at channel grain).
+ *
+ * The twin of {@link teamsChannelGrainConversationId}: one splits the id at the suffix and keeps the
+ * left half, this one keeps the right. They live together so the suffix is spelled ONCE — a second
+ * spelling elsewhere is how the two halves drift apart. `channels/teams-read.ts` reads this to give
+ * `read_thread` its Graph `.../messages/{root}/replies` id (OPE-929).
+ */
+export function teamsReplyChainRoot(conversationId) {
+    const i = conversationId.lastIndexOf(TEAMS_REPLY_CHAIN_SUFFIX);
+    if (i < 0)
+        return undefined;
+    const root = conversationId.slice(i + TEAMS_REPLY_CHAIN_SUFFIX.length);
+    return root.length > 0 ? root : undefined;
+}
+function nonEmpty(v) {
+    return typeof v === "string" && v.trim().length > 0 ? v.trim() : undefined;
+}
+/**
+ * PURE: the rows one inbound activity should write — zero, one or two. Separated from the write so
+ * the whole decision (which species, which key, which conversation id, and every refusal) is
+ * unit-testable without a store, a network or an eve activity.
+ *
+ * REFUSES, NEVER REPAIRS on the shared preconditions: a missing tenant, a missing conversation, or an
+ * untrusted `serviceUrl` yields NO row of ANY species. Past that gate, the `conversation` row
+ * (OPE-899) is scope-agnostic and always included; the `personal`/`team` rows stay scope-selective —
+ * a blank author on a personal activity or a channel activity with no team id costs only ITS OWN row,
+ * never the conversation one. A half-written `personal`/`team` address is worse than none (the DM arm
+ * would treat it as "I can reach this person" and then fail at the transport); the `conversation` row
+ * carries no such risk — its one reader (`teams-message-ops.ts`) already holds the exact id it asks
+ * for, so there is nothing for a wrong key to misdirect.
+ */
+export function teamsAddressRowsFor(input, at = new Date()) {
+    const serviceUrl = nonEmpty(input.serviceUrl);
+    const tenantId = nonEmpty(input.tenantId);
+    const conversationId = nonEmpty(input.conversationId);
+    if (!serviceUrl || !tenantId || !conversationId)
+        return [];
+    // WRITE-TIME half of the double allowlist — see this file's header.
+    if (!isTrustedTeamsServiceUrl(serviceUrl))
+        return [];
+    const updatedAt = at.toISOString();
+    const rows = [
+        // The `conversation` row (OPE-899) — EVERY scope, at the EXACT id the activity arrived on. This
+        // is what lets a stop acknowledgement resolve a `serviceUrl` from the bare conversation id
+        // `postSurfaceText` is handed (see the header's third species).
+        {
+            platform: TEAMS_ADDRESS_PLATFORM,
+            kind: TEAMS_CONVERSATION_ADDRESS_KIND,
+            refKey: conversationId,
+            tenant: tenantId,
+            address: { serviceUrl, conversationId },
+            updatedAt,
+        },
+    ];
+    // ─── THE CHANNEL-GRAIN TWIN (OPE-1093) ────────────────────────────────────────────────────────
+    //
+    // WHY THIS EXISTS. Every live Teams CHANNEL activity carries a `;messageid=<root>` suffix, so the
+    // `conversation` row above and the `conversation-key` index row below only ever hold the REPLY-CHAIN
+    // grain. The domain roster, the surface key and a resource-grant address all name the CHANNEL grain.
+    // The two sets were disjoint: the only container address the fence admits was the one the transport
+    // could never restore, so EVERY Teams container grant refused. Measured on the live fixture tenant,
+    // deploy #128, 2026-08-24. This pair closes the join — the address row makes the channel itself
+    // postable, and the index row makes the roster spelling restore to it.
+    //
+    // A POST AT THIS GRAIN STARTS A NEW THREAD in the channel, which is what a container grant means:
+    // the grant names the channel, never whichever reply chain the deployment last saw traffic in.
+    //
+    // IT REACHES NO FURTHER THAN THE CHANNEL THE ACTIVITY CAME FROM. The channel grain is DERIVED from
+    // an id this deployment already holds as a `conversation` address, and it is stored under the same
+    // `serviceUrl`, from the same activity, past the same trusted-host gate. On a channel activity that
+    // names a team, the `team` row below already stores this exact conversation id; this pair makes the
+    // same place reachable by conversation id rather than by team id.
+    //
+    // THE TEST IS THE IDS, NOT THE SCOPE. A personal or group chat id carries no reply-chain suffix, so
+    // the channel grain equals the exact id and this block writes nothing — the rows above already are
+    // the channel-grain rows. The same holds for a channel activity that ever arrives at channel grain.
+    const channelGrain = teamsChannelGrainConversationId(conversationId);
+    if (channelGrain.length > 0 && channelGrain !== conversationId) {
+        rows.push({
+            platform: TEAMS_ADDRESS_PLATFORM,
+            kind: TEAMS_CONVERSATION_ADDRESS_KIND,
+            refKey: channelGrain,
+            tenant: tenantId,
+            address: { serviceUrl, conversationId: channelGrain },
+            updatedAt,
+        });
+    }
+    if (input.scope === "personal") {
+        const userId = nonEmpty(input.userId);
+        if (userId) {
+            rows.push({
+                platform: TEAMS_ADDRESS_PLATFORM,
+                kind: TEAMS_PERSONAL_ADDRESS_KIND,
+                refKey: userId,
+                tenant: tenantId,
+                address: { serviceUrl, conversationId },
+                updatedAt,
+            });
+        }
+    }
+    else if (input.scope === "channel") {
+        const teamId = nonEmpty(input.teamId);
+        if (teamId) {
+            rows.push({
+                platform: TEAMS_ADDRESS_PLATFORM,
+                kind: TEAMS_TEAM_ADDRESS_KIND,
+                refKey: teamId,
+                tenant: tenantId,
+                // The CHANNEL grain, never the reply chain the activity arrived on.
+                address: { serviceUrl, conversationId: teamsChannelGrainConversationId(conversationId) },
+                updatedAt,
+            });
+        }
+    }
+    // groupChat, "unknown", anything unrecognised — no `personal`/`team` row, but the `conversation`
+    // row above still stands. See the header.
+    // THE ID-RESTORATION INDEX (OPE-1078, `teams-id-restore.ts`) — the spelling→raw rows that let a
+    // resource-grant address reach these transports at all. Two properties are deliberate:
+    //   • they sit BELOW the shared gate, so an untrusted `serviceUrl` still records NOTHING of ANY
+    //     species. One gate, not two.
+    //   • the PERSON row is scope-agnostic, unlike the `personal` address row above. An index row
+    //     claims no reachability — it is a spelling, not an address — so the "a half address is worse
+    //     than none" rule that makes `personal` selective does not apply to it.
+    // `teamsIdIndexRow` answers undefined when there is nothing to index (see its own doc).
+    const conversationKey = teamsIdIndexRow(TEAMS_CONVERSATION_KEY_KIND, conversationId, tenantId, updatedAt);
+    if (conversationKey)
+        rows.push(conversationKey);
+    // The CHANNEL-GRAIN index row — the half of the OPE-1093 twin that a granted address actually
+    // reads. `restoreTeamsConversationId` turns the roster spelling into this raw id, and the
+    // channel-grain ADDRESS row above is what that raw id then resolves to.
+    if (channelGrain.length > 0 && channelGrain !== conversationId) {
+        const channelKey = teamsIdIndexRow(TEAMS_CONVERSATION_KEY_KIND, channelGrain, tenantId, updatedAt);
+        if (channelKey)
+            rows.push(channelKey);
+    }
+    const authorId = nonEmpty(input.userId);
+    if (authorId) {
+        const personKey = teamsIdIndexRow(TEAMS_PERSON_KEY_KIND, authorId, tenantId, updatedAt);
+        if (personKey)
+            rows.push(personKey);
+    }
+    return rows;
+}
+function log(msg) {
+    console.log(`[open-everywhere:teams-address] ${msg}`);
+}
+/**
+ * Record what one inbound activity says about where we can reach its author or its team.
+ *
+ * FAIL-SOFT, TOTALLY. A store outage, a refused write, a malformed activity — every one of them is a
+ * logged line and nothing else. This runs on the ingest path behind the Bot Framework's 200 ack, and
+ * a proactive address that was not captured is a future delivery that does not happen; it is never a
+ * reason to take a live wake off the air.
+ */
+export async function recordTeamsConversationReference(input) {
+    try {
+        const rows = teamsAddressRowsFor(input);
+        if (rows.length === 0)
+            return;
+        const org = deploymentOrg();
+        const store = getOperationalStore();
+        for (const row of rows)
+            await store.recordProactiveAddress(org, row);
+    }
+    catch (err) {
+        log(`could not record the conversation reference: ${err?.message ?? String(err)}`);
+    }
+}
+/** One stored row as a usable reference, or undefined. The READ half of the double allowlist, plus
+ *  the non-empty checks that keep a partial row from reaching a caller as an address. */
+function refFrom(row) {
+    if (!row)
+        return undefined;
+    const serviceUrl = nonEmpty(row.address["serviceUrl"]);
+    const conversationId = nonEmpty(row.address["conversationId"]);
+    const tenantId = nonEmpty(row.tenant);
+    if (!serviceUrl || !conversationId || !tenantId)
+        return undefined;
+    if (!isTrustedTeamsServiceUrl(serviceUrl))
+        return undefined;
+    return { serviceUrl, conversationId, tenantId };
+}
+/**
+ * The 1:1 chat reference for one Bot Framework user id, or undefined when this deployment has never
+ * had a personal chat with them. Undefined is a REAL answer — the DM arm's honest "I have no way to
+ * reach this person" — never a reason to fall back to some other conversation.
+ */
+export async function teamsPersonalConversationRef(principalId) {
+    const id = nonEmpty(principalId);
+    if (!id)
+        return undefined;
+    try {
+        const row = await getOperationalStore().proactiveAddress(deploymentOrg(), TEAMS_ADDRESS_PLATFORM, TEAMS_PERSONAL_ADDRESS_KIND, id);
+        return refFrom(row);
+    }
+    catch (err) {
+        log(`could not read the personal conversation reference: ${err?.message ?? String(err)}`);
+        return undefined;
+    }
+}
+/**
+ * The reference for one EXACT conversation id (OPE-899) — the reply chain a channel turn anchored
+ * on, a group chat, or a 1:1, at whatever grain the caller's id already is. Undefined when this
+ * deployment has never seen an inbound activity on that id. This is the ONE lookup
+ * `teams-message-ops.ts` uses to turn a bare `channelId` (core's SurfaceMessageOps contract, which
+ * carries no `serviceUrl`) back into something postable.
+ */
+export async function teamsConversationRef(conversationId) {
+    const id = nonEmpty(conversationId);
+    if (!id)
+        return undefined;
+    try {
+        const row = await getOperationalStore().proactiveAddress(deploymentOrg(), TEAMS_ADDRESS_PLATFORM, TEAMS_CONVERSATION_ADDRESS_KIND, id);
+        return refFrom(row);
+    }
+    catch (err) {
+        log(`could not read the conversation reference: ${err?.message ?? String(err)}`);
+        return undefined;
+    }
+}
+/** Persist a 1:1 chat reference the DM arm has just created, so the next delivery to that person is
+ *  one call instead of two. Fail-soft: a failed write costs a repeated create, never a failed send. */
+export async function rememberTeamsPersonalConversation(principalId, ref) {
+    await recordTeamsConversationReference({
+        scope: "personal",
+        userId: principalId,
+        tenantId: ref.tenantId,
+        conversationId: ref.conversationId,
+        serviceUrl: ref.serviceUrl,
+    });
+}
+/** Every team reference this deployment holds, most recently seen first and bounded by
+ *  {@link TEAMS_TEAM_ADDRESS_READ_LIMIT}. Rows that fail the read-time checks are dropped. */
+export async function teamsTeamConversationRefs() {
+    try {
+        const rows = await getOperationalStore().proactiveAddresses(deploymentOrg(), TEAMS_ADDRESS_PLATFORM, TEAMS_TEAM_ADDRESS_KIND, TEAMS_TEAM_ADDRESS_READ_LIMIT);
+        return rows.map(refFrom).filter((r) => r !== undefined);
+    }
+    catch (err) {
+        log(`could not read the team conversation references: ${err?.message ?? String(err)}`);
+        return [];
+    }
+}
+/**
+ * The (region, tenant) this deployment can open a NEW 1:1 chat in, when it has no personal reference
+ * for somebody yet — read off the team references it does hold.
+ *
+ * 🔴 ONE TENANT OR NOTHING. Opening a conversation names a tenant in `channelData`, and picking one
+ * of several would be a guess about which organisation a bare `29:` id belongs to. A wrong guess is
+ * not a failed send — Microsoft would refuse it, or worse, resolve a different person. So two
+ * disagreeing tenants yield `undefined` and the arm refuses out loud, which is the same posture
+ * `soleAdmittedTenantFromConfig` takes in core.
+ *
+ * `conversationId` on the returned reference is the TEAM's conversation and must never be posted
+ * into — the caller uses only `serviceUrl` and `tenantId`. That is why this returns the narrow pair
+ * rather than a {@link TeamsConversationRef}.
+ */
+export async function teamsSoleTenantRegion() {
+    const refs = await teamsTeamConversationRefs();
+    if (refs.length === 0)
+        return undefined;
+    const tenants = new Set(refs.map((r) => r.tenantId));
+    if (tenants.size !== 1)
+        return undefined;
+    const newest = refs[0]; // proactiveAddresses orders newest first
+    return { serviceUrl: newest.serviceUrl, tenantId: newest.tenantId };
+}
+//# sourceMappingURL=teams-conversation-ref.js.map

package/dist/agent/channels/teams-conversation-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-conversation-ref.js","sourceRoot":"","sources":["../../../agent/channels/teams-conversation-ref.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,kEAAkE;AAClE,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,8FAA8F;AAC9F,qGAAqG;AACrG,iGAAiG;AACjG,qGAAqG;AACrG,oBAAoB;AACpB,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,2FAA2F;AAC3F,gGAAgG;AAChG,4FAA4F;AAC5F,iGAAiG;AACjG,mGAAmG;AACnG,2DAA2D;AAC3D,sGAAsG;AACtG,qGAAqG;AACrG,qBAAqB;AACrB,+FAA+F;AAC/F,kGAAkG;AAClG,oGAAoG;AACpG,iGAAiG;AACjG,iGAAiG;AACjG,sGAAsG;AACtG,sGAAsG;AACtG,iGAAiG;AACjG,mFAAmF;AACnF,gGAAgG;AAChG,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,oGAAoG;AACpG,oGAAoG;AACpG,sFAAsF;AACtF,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,uEAAuE;AACvE,EAAE;AACF,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,iGAAiG;AACjG,+FAA+F;AAC/F,iGAAiG;AAEjG,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAyB,MAAM,4CAA4C,CAAC;AACvH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE5G,0DAA0D;AAC1D,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE9C,qFAAqF;AACrF,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC;AAEtD,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C;oEACoE;AACpE,MAAM,+BAA+B,GAAG,cAAc,CAAC;AAEvD;;+DAE+D;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C;0DAC0D;AAC1D,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAE/C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,+BAA+B,CAAC,cAAsB;IACpE,MAAM,CAAC,GAAG,cAAc,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,cAAsB;IACxD,MAAM,CAAC,GAAG,cAAc,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAwBD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA4B,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE;IACrF,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,CAAC;IAC3D,oEAAoE;IACpE,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAEnC,MAAM,IAAI,GAAuB;QAC/B,gGAAgG;QAChG,2FAA2F;QAC3F,gEAAgE;QAChE;YACE,QAAQ,EAAE,sBAAsB;YAChC,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;YACvC,SAAS;SACV;KACF,CAAC;IAEF,iGAAiG;IACjG,EAAE;IACF,kGAAkG;IAClG,qGAAqG;IACrG,qGAAqG;IACrG,oGAAoG;IACpG,oGAAoG;IACpG,gGAAgG;IAChG,uEAAuE;IACvE,EAAE;IACF,kGAAkG;IAClG,+FAA+F;IAC/F,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,oGAAoG;IACpG,oGAAoG;IACpG,kEAAkE;IAClE,EAAE;IACF,oGAAoG;IACpG,mGAAmG;IACnG,oGAAoG;IACpG,MAAM,YAAY,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAC;IACrE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,sBAAsB;YAChC,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE;YACrD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC;gBACR,QAAQ,EAAE,sBAAsB;gBAChC,IAAI,EAAE,2BAA2B;gBACjC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;gBACvC,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC;gBACR,QAAQ,EAAE,sBAAsB;gBAChC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,QAAQ;gBAChB,oEAAoE;gBACpE,OAAO,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,+BAA+B,CAAC,cAAc,CAAC,EAAE;gBACxF,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,iGAAiG;IACjG,0CAA0C;IAE1C,gGAAgG;IAChG,uFAAuF;IACvF,gGAAgG;IAChG,kCAAkC;IAClC,8FAA8F;IAC9F,kGAAkG;IAClG,4EAA4E;IAC5E,wFAAwF;IACxF,MAAM,eAAe,GAAG,eAAe,CAAC,2BAA2B,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1G,IAAI,eAAe;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,8FAA8F;IAC9F,0FAA0F;IAC1F,wEAAwE;IACxE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;QAC/D,MAAM,UAAU,GAAG,eAAe,CAAC,2BAA2B,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACnG,IAAI,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,eAAe,CAAC,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxF,IAAI,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,GAAG,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAA4B;IACjF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,gDAAiD,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED;yFACyF;AACzF,SAAS,OAAO,CAAC,GAAiC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,WAAmB;IACpE,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAC;QACnI,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,uDAAwD,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,cAAsB;IAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,EAAE,CAAC,CAAC;QACvI,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,8CAA+C,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;uGACuG;AACvG,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,WAAmB,EAAE,GAAyB;IACpG,MAAM,gCAAgC,CAAC;QACrC,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;8FAC8F;AAC9F,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,mBAAmB,EAAE,CAAC,kBAAkB,CACzD,aAAa,EAAE,EACf,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,CAC9B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAA6B,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,oDAAqD,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,IAAI,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,yCAAyC;IAClE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACtE,CAAC"}

package/dist/agent/channels/teams-directory.d.ts

@@ -0,0 +1,11 @@
+import { type DirectoryCandidate } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * Every account in the teams this deployment has seen whose name, UPN, email or id matches `query`,
+ * as `{nativeId, name, handle}`. Fail-soft to `[]`; never throws.
+ *
+ * `tenant` is deliberately unused: Teams is not a tenant-scoped platform in core's principal-key
+ * sense, so core never passes one. The population comes from the stored team references instead —
+ * see the header.
+ */
+export declare function fetchTeamsDirectory(query: string): Promise<readonly DirectoryCandidate[]>;
+//# sourceMappingURL=teams-directory.d.ts.map

package/dist/agent/channels/teams-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-directory.d.ts","sourceRoot":"","sources":["../../../agent/channels/teams-directory.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAsCrF;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAuB/F"}

package/dist/agent/channels/teams-directory.js

@@ -0,0 +1,179 @@
+// THE TEAMS ACCOUNT DIRECTORY — "who, in the teams this deployment has seen, is called that?"
+// (OPE-887). The Teams arm of core's identity/account-directory.ts registry, and the third one
+// written; the Slack arm (`fetchWorkspaceRoster`) and the Discord arm (`fetchGuildDirectory`) are the
+// shapes this follows.
+//
+// WHAT IT IS FOR. The reverse-initiated identity link (core identity/link-flow.ts) lets a person NAME
+// the other account instead of carrying a bearer code between two surfaces. Naming needs a lookup,
+// and this is Teams'. Core owns the matching, the ranking and the cap (`rankDirectoryCandidates`,
+// pure), so this arm may over-return.
+//
+// 🔴 IT IS THE BOT CONNECTOR ROSTER, NOT MICROSOFT GRAPH, AND THE REASON IS THE ID SHAPE. A Teams
+// identity link keys on `nativeId` = the Bot Framework user id (`from.id`, a `29:` string —
+// teams-identity.ts's `bindTeams` sets `principalId` from it). Graph's `/users` answers with the AAD
+// object id and the UPN and has NO `29:` id at all, so a Graph-backed arm would hand back candidates
+// that no link can key on and no DM can address — worse than no arm, because the code-transport
+// fallback would stop firing. `GET {serviceUrl}/v3/conversations/{id}/pagedmembers` returns the `29:`
+// id alongside the name and the UPN, which is the right shape by construction.
+//
+// 🔴 A DIRECTORY HIT IS NOT EVIDENCE OF ANYTHING. It says an account with that name is in one of these
+// teams — nothing about whose it is. The proof in this flow is the CONSENT the named account gives in
+// its own DM, which is why this arm is useless without `teamsPostArm.deliverDirectMessage` and why
+// core requires both before it offers the transport.
+//
+// THREE DIVERGENCES FROM THE DISCORD ARM, all forced by the platform:
+//
+//   1. THERE IS NO SERVER-SIDE SEARCH. Discord has `GET /guilds/{id}/members/search`; the Bot
+//      Connector has only a paged roster. So this arm WALKS pages and matches locally, the way the
+//      Slack arm does, and both bounds below exist to keep that walk inside core's 8-second arm
+//      timeout.
+//   2. THE POPULATION COMES FROM CAPTURED STATE, NOT CONFIG. Discord fences on
+//      `admittedTenantsFromConfig` because a Discord bot is in every guild it was ever invited to,
+//      including unrelated servers. A Teams team reference exists ONLY because a JWT-verified activity
+//      from that team reached this deployment's own front and was accepted, so the capture IS the
+//      admission and a second config fence would only make the arm dead on a deployment that declares
+//      no Teams domains.
+//   3. IT NEEDS NO PRIVILEGED PERMISSION. Discord's member endpoints need the SERVER MEMBERS INTENT;
+//      the Connector roster rides the bot's own client-credentials token, exactly as the guest probe
+//      in teams-roster.ts does.
+//
+// FAIL-SOFT PER TEAM. A refused, failed, hung or unreadable team contributes nothing and the other
+// teams still answer. Nothing here throws: core's resolver catches, but an arm that leaned on that
+// would lose every OTHER team's rows to one team's 403.
+//
+// BOTS ARE DROPPED, by ID SHAPE rather than by a flag. A Teams user id begins `29:` and a bot id
+// begins `28:`; a link is a statement about a HUMAN, and the consent step would DM a bot that can
+// never answer.
+import { callTeamsConnectorApi } from "eve/channels/teams";
+import { teamsTeamConversationRefs } from "./teams-conversation-ref.js";
+/** How many roster pages one team may be walked for. Four pages of {@link TEAMS_ROSTER_PAGE_SIZE}
+ *  cover a 2000-person team; past that a person narrows their query or uses the code transport. The
+ *  bound is about core's 8-second arm timeout, not about correctness. */
+const TEAMS_DIRECTORY_MAX_PAGES = 4;
+/** Members per roster page. The Connector's own documented ceiling for `pagedmembers`. */
+const TEAMS_ROSTER_PAGE_SIZE = 500;
+/** How many matches one TEAM may contribute. Core caps the ANSWER at `DIRECTORY_MAX_CANDIDATES` (8)
+ *  after ranking across every team, so this is deliberately larger: a first name that matches twelve
+ *  people in one team must not lose the right person to an arbitrary truncation before core ranks. */
+const TEAMS_DIRECTORY_MAX_PER_TEAM = 25;
+function log(msg) {
+    console.log(`[open-everywhere:teams-directory] ${msg}`);
+}
+/** The same normalization core's matcher applies, so a local page filter and core's final rank agree
+ *  about what "matches" means (`@tommy` and `tommy` are one query to a person). */
+function normalize(raw) {
+    return raw.trim().replace(/^@/u, "").replace(/\s+/gu, " ").toLowerCase();
+}
+/**
+ * Every account in the teams this deployment has seen whose name, UPN, email or id matches `query`,
+ * as `{nativeId, name, handle}`. Fail-soft to `[]`; never throws.
+ *
+ * `tenant` is deliberately unused: Teams is not a tenant-scoped platform in core's principal-key
+ * sense, so core never passes one. The population comes from the stored team references instead —
+ * see the header.
+ */
+export async function fetchTeamsDirectory(query) {
+    const q = normalize(query);
+    if (q.length === 0)
+        return [];
+    const teams = await teamsTeamConversationRefs();
+    if (teams.length === 0)
+        return [];
+    // 🔴 THE TEAMS ARE WALKED CONCURRENTLY, and that is about the ARM TIMEOUT rather than speed. Core
+    // gives an arm 8 seconds and answers `[]` when it overruns, so several teams walked one after
+    // another could turn a working directory into an empty one on a slow day — and the person would see
+    // the code fallback with no way to tell why. The fan-out is bounded by the read limit the reference
+    // store applies (TEAMS_TEAM_ADDRESS_READ_LIMIT), so "concurrent" here means at most eight walks.
+    const perTeam = await Promise.all(teams.map((team) => teamMembersMatching(team, q)));
+    // Deduped across teams: one person in three teams is ONE account, and three identical rows would
+    // crowd the other candidates out of core's cap. `perTeam` keeps the stored order (newest reference
+    // first), so which team's row wins is deterministic rather than a race.
+    const byId = new Map();
+    for (const members of perTeam) {
+        for (const member of members) {
+            if (!byId.has(member.nativeId))
+                byId.set(member.nativeId, member);
+        }
+    }
+    return [...byId.values()];
+}
+/** One team's matches for `q`, walked page by page. Never throws: a team that refuses contributes
+ *  nothing and the caller moves on. */
+async function teamMembersMatching(team, q) {
+    const out = [];
+    let continuationToken;
+    for (let page = 0; page < TEAMS_DIRECTORY_MAX_PAGES; page++) {
+        const body = await rosterPage(team, continuationToken);
+        if (!body)
+            return out; // a refused/failed page ends this team, keeping what it already found
+        for (const raw of body.members) {
+            const candidate = candidateFromMember(raw, q);
+            if (candidate)
+                out.push(candidate);
+            if (out.length >= TEAMS_DIRECTORY_MAX_PER_TEAM)
+                return out;
+        }
+        continuationToken = body.continuationToken;
+        if (!continuationToken)
+            return out; // the roster ended
+    }
+    return out;
+}
+/** One `pagedmembers` GET under the bot's own Connector credential, or undefined. The token is a
+ *  SECRET — eve mints and holds it; nothing here logs a URL that could carry one. */
+async function rosterPage(team, continuationToken) {
+    // 🔴 THE PATH NEEDS ITS LEADING SLASH — eve composes `trimTrailingSlash(serviceUrl) + path`, and a
+    // path written without it makes a malformed URL that answers non-2xx forever (the same trap
+    // teams-roster.ts's header states).
+    const params = new URLSearchParams({ pageSize: String(TEAMS_ROSTER_PAGE_SIZE) });
+    if (continuationToken)
+        params.set("continuationToken", continuationToken);
+    const path = `/v3/conversations/${encodeURIComponent(team.conversationId)}/pagedmembers?${params.toString()}`;
+    try {
+        const res = await callTeamsConnectorApi({ serviceUrl: team.serviceUrl, path, method: "GET" });
+        if (!res.ok) {
+            // A refusal is the one failure an operator can act on, and a silent empty answer reads as
+            // "nobody matched" — a different and misleading fact.
+            log(`the roster read did not answer (${res.status}) for conversation ${team.conversationId} — the account directory is unavailable there; linking falls back to the code flow.`);
+            return undefined;
+        }
+        const b = res.body;
+        if (!b || typeof b !== "object" || !Array.isArray(b.members))
+            return undefined;
+        return {
+            members: b.members,
+            ...(typeof b.continuationToken === "string" && b.continuationToken.length > 0 ? { continuationToken: b.continuationToken } : {}),
+        };
+    }
+    catch (err) {
+        log(`the roster read failed for conversation ${team.conversationId}: ${err?.message ?? String(err)}`);
+        return undefined;
+    }
+}
+/**
+ * One roster row as a candidate when it matches `q`, or undefined.
+ *
+ * `handle` is the UPN (or the email when Teams gave no UPN) — the unique, typeable string a person
+ * knows themselves by; `name` is the display name Teams shows in the room. Both are directory strings
+ * this arm does not trust: core sanitizes them and the tool fences them before a model reads either.
+ *
+ * The match is local and deliberately GENEROUS (substring over name, handle and id), because core
+ * re-ranks EXACT before PREFIX before contains. Over-returning costs a row in a capped list;
+ * under-returning loses the right person with no way to tell.
+ */
+function candidateFromMember(member, q) {
+    const nativeId = typeof member.id === "string" ? member.id.trim() : "";
+    // A person's Bot Framework id begins `29:`. A `28:` id is a bot (this one included) and every other
+    // shape is something this arm does not understand — both are dropped rather than guessed at.
+    if (!nativeId.startsWith("29:"))
+        return undefined;
+    const name = typeof member.name === "string" ? member.name.trim() : "";
+    const upn = typeof member.userPrincipalName === "string" ? member.userPrincipalName.trim() : "";
+    const email = typeof member.email === "string" ? member.email.trim() : "";
+    const handle = upn || email;
+    const matched = normalize(nativeId) === q || [name, handle].some((f) => f.length > 0 && normalize(f).includes(q));
+    if (!matched)
+        return undefined;
+    return { nativeId, ...(name ? { name } : {}), ...(handle ? { handle } : {}) };
+}
+//# sourceMappingURL=teams-directory.js.map

package/dist/agent/channels/teams-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-directory.js","sourceRoot":"","sources":["../../../agent/channels/teams-directory.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,+FAA+F;AAC/F,sGAAsG;AACtG,uBAAuB;AACvB,EAAE;AACF,sGAAsG;AACtG,mGAAmG;AACnG,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,kGAAkG;AAClG,4FAA4F;AAC5F,qGAAqG;AACrG,qGAAqG;AACrG,gGAAgG;AAChG,sGAAsG;AACtG,+EAA+E;AAC/E,EAAE;AACF,uGAAuG;AACvG,sGAAsG;AACtG,mGAAmG;AACnG,qDAAqD;AACrD,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,8FAA8F;AAC9F,mGAAmG;AACnG,gGAAgG;AAChG,gBAAgB;AAChB,+EAA+E;AAC/E,mGAAmG;AACnG,uGAAuG;AACvG,kGAAkG;AAClG,sGAAsG;AACtG,yBAAyB;AACzB,qGAAqG;AACrG,qGAAqG;AACrG,gCAAgC;AAChC,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,wDAAwD;AACxD,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,gBAAgB;AAGhB,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAA6B,MAAM,6BAA6B,CAAC;AAEnG;;yEAEyE;AACzE,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC,0FAA0F;AAC1F,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;sGAEsG;AACtG,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAExC,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,GAAG,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;AAC1D,CAAC;AAaD;mFACmF;AACnF,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,kGAAkG;IAClG,8FAA8F;IAC9F,oGAAoG;IACpG,oGAAoG;IACpG,iGAAiG;IACjG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAErF,iGAAiG;IACjG,mGAAmG;IACnG,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;uCACuC;AACvC,KAAK,UAAU,mBAAmB,CAAC,IAA0B,EAAE,CAAS;IACtE,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,IAAI,iBAAqC,CAAC;IAC1C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,yBAAyB,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,CAAC,sEAAsE;QAC7F,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,GAAG,CAAC,MAAM,IAAI,4BAA4B;gBAAE,OAAO,GAAG,CAAC;QAC7D,CAAC;QACD,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC3C,IAAI,CAAC,iBAAiB;YAAE,OAAO,GAAG,CAAC,CAAC,mBAAmB;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;qFACqF;AACrF,KAAK,UAAU,UAAU,CACvB,IAA0B,EAC1B,iBAAqC;IAErC,mGAAmG;IACnG,4FAA4F;IAC5F,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACjF,IAAI,iBAAiB;QAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,qBAAqB,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC9G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,0FAA0F;YAC1F,sDAAsD;YACtD,GAAG,CAAC,mCAAmC,GAAG,CAAC,MAAM,sBAAsB,IAAI,CAAC,cAAc,qFAAqF,CAAC,CAAC;YACjL,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAiE,CAAC;QAChF,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/E,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,OAAuC;YAClD,GAAG,CAAC,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjI,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,2CAA2C,IAAI,CAAC,cAAc,KAAM,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,MAAyB,EAAE,CAAS;IAC/D,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,oGAAoG;IACpG,6FAA6F;IAC7F,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC"}