comisai 1.0.44 → 1.0.46

package/node_modules/@comis/channels/dist/msteams/msteams-reaction-binder.js

@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Microsoft Teams reaction binder — the pure inbound-reaction mapper.
+ *
+ * Teams has no live SDK reaction callback: reactions arrive as
+ * `messageReaction` activities pushed through the same webhook the message path
+ * uses. So this file carries only the PURE transform — a `messageReaction`
+ * activity to a {@link NormalizedReaction} — while the fan-out loop over the
+ * registered handlers lives in the adapter alongside the message fan-out.
+ *
+ * The reactor id is UNTRUSTED inbound data; no trust is assigned here. The
+ * reaction is minted through {@link parseReaction} so its `z.strictObject`
+ * rejects any smuggled field (e.g. a trust/authority claim) before it leaves
+ * the adapter.
+ *
+ * @module
+ */
+import { parseReaction } from "@comis/core";
+/**
+ * The closed set of Teams reaction types mapped to their Unicode emoji. A type
+ * outside this set is skipped (no reaction is surfaced).
+ */
+const REACTION_EMOJI = {
+    like: "👍",
+    heart: "❤️",
+    laugh: "😆",
+    surprised: "😮",
+    sad: "😢",
+    angry: "😡",
+};
+/** Resolve a reaction type to its emoji via the closed map, or undefined. */
+function reactionEmoji(type) {
+    // eslint-disable-next-line security/detect-object-injection -- gated by Object.hasOwn against a literal closed record
+    return Object.hasOwn(REACTION_EMOJI, type) ? REACTION_EMOJI[type] : undefined;
+}
+/**
+ * Strip a trailing ";messageid=…" reply suffix from a conversation id so the
+ * reaction's channelId matches the id the message mapper produces.
+ */
+function stripMessageIdSuffix(conversationId) {
+    const idx = conversationId.indexOf(";messageid=");
+    return idx >= 0 ? conversationId.slice(0, idx) : conversationId;
+}
+/**
+ * Map a Bot Framework `messageReaction` activity to a NormalizedReaction.
+ *
+ * Returns null for a non-reaction activity, an empty/unknown reaction type, or
+ * an activity missing a reaction target or reactor — the adapter skips those.
+ *
+ * @param activity - A Bot Framework inbound activity
+ * @returns A validated NormalizedReaction, or null to skip
+ */
+export function mapMsTeamsReaction(activity) {
+    if (activity.type !== "messageReaction")
+        return null;
+    const reactionType = activity.reactionsAdded?.[0]?.type;
+    if (reactionType === undefined)
+        return null;
+    const emoji = reactionEmoji(reactionType);
+    if (emoji === undefined)
+        return null;
+    const messageId = activity.replyToId ?? activity.id;
+    if (messageId === undefined)
+        return null;
+    const reactorId = activity.from?.aadObjectId ?? activity.from?.id;
+    if (reactorId === undefined)
+        return null;
+    const parsed = parseReaction({
+        messageId,
+        reactorId,
+        emoji,
+        channelType: "msteams",
+        channelId: stripMessageIdSuffix(activity.conversation.id),
+    });
+    return parsed.ok ? parsed.value : null;
+}

package/node_modules/@comis/channels/dist/msteams/msteams-resolver.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Microsoft Teams MediaResolverPort adapter.
+ *
+ * Resolves `msteams-file://<encodeURIComponent(realUrl)>` attachments (emitted by
+ * the message mapper) to downloaded media buffers. The scheme is decoded back to
+ * the real https URL, the Bot Framework Connector Bearer is minted once, and the
+ * bytes are fetched through the INJECTED auth-capable SSRF-guarded fetcher — never
+ * a bare `fetch`. The fetcher DNS-pins each hop and decides per-hop whether to
+ * attach the Bearer against the allowlist this resolver supplies, so the token is
+ * transmitted only to a Connector/attachment host and dropped on a cross-host
+ * redirect.
+ *
+ * Dependency-clean by construction: this file pulls in neither the SSRF-fetcher's
+ * home package nor its underlying HTTP-transport dependency. The fetcher is received
+ * as a local structural interface, so the DNS-pinning + redirect machinery stays in
+ * the package that owns the transport.
+ *
+ * The returned MIME is sniffed (the port contract mandates a verified type; Teams
+ * can mislabel bytes and the model vision API rejects a declared/actual mismatch).
+ * Raw bytes are returned — the pipeline applies the external-content fence on the
+ * DERIVED text (transcription/vision/doc-extract), not this resolver.
+ *
+ * @module
+ */
+import type { MediaResolverPort } from "@comis/core";
+import type { Result } from "@comis/shared";
+/**
+ * Structural interface for the auth-capable SSRF-guarded fetcher (avoids a
+ * circular dep on the package that owns the HTTP transport). It is the auth superset of the
+ * plain `fetch(url)` seam: `opts` carries the Authorization header value and the
+ * host allowlist the header may ride, and the fetcher enforces the per-hop
+ * attach/drop decision.
+ */
+interface SsrfFetcher {
+    fetch(url: string, opts?: {
+        authHeader?: string;
+        authAllowHosts?: readonly string[];
+    }): Promise<Result<{
+        buffer: Buffer;
+        mimeType: string;
+        sizeBytes: number;
+    }, Error>>;
+}
+/** Minimal logger interface for resolver logging. */
+interface ResolverLogger {
+    debug(obj: Record<string, unknown>, msg: string): void;
+    warn(obj: Record<string, unknown>, msg: string): void;
+}
+export interface MsTeamsResolverDeps {
+    /** Auth-capable SSRF-guarded fetcher; the only path media bytes are fetched through. */
+    ssrfFetcher: SsrfFetcher;
+    /**
+     * Mint the Connector client-credentials Bearer. A mint failure is non-fatal —
+     * the fetch proceeds with no header, since a pre-authed downloadUrl needs none.
+     */
+    getToken: () => Promise<Result<string, Error>>;
+    /** Config passthrough of the token-attach host allowlist; empty → {@link DEFAULT_MEDIA_AUTH_ALLOW_HOSTS}. */
+    mediaAuthAllowHosts: readonly string[];
+    /** Reject a fetched body whose reported size exceeds this many bytes. */
+    maxBytes: number;
+    logger: ResolverLogger;
+}
+/**
+ * Bot Framework Connector/attachment hosts that may receive the Connector Bearer
+ * on an inbound media fetch. A pre-authed SharePoint downloadUrl needs no token and
+ * its storage redirect must not carry one, so `*.sharepoint.com` is excluded; the
+ * inbound path mints the Connector token only (no Graph token), so
+ * `graph.microsoft.com` is excluded too. A leading-dot entry matches that domain
+ * and any subdomain; the fetcher drops the Bearer for any host outside this list
+ * and on a cross-host redirect.
+ */
+export declare const DEFAULT_MEDIA_AUTH_ALLOW_HOSTS: readonly ["smba.trafficmanager.net", ".botframework.com"];
+/**
+ * Teams attachment hosts an inbound media fetch may target at HOP 0 (the initial,
+ * pre-redirect attachment URL). BROADER than {@link DEFAULT_MEDIA_AUTH_ALLOW_HOSTS}
+ * (the token-attach set): a SharePoint or Graph download host receives NO Connector
+ * bearer but IS a legitimate initial attachment host, so it is fetch-allowed here
+ * while staying token-excluded there.
+ *
+ * The gate is HOP-0 ONLY. The injected fetcher re-validates every hop against the
+ * SSRF firewall (private/loopback/link-local/cloud-metadata IPs) but does NOT
+ * restrict arbitrary PUBLIC hosts — so without this list an attacker-influenced
+ * `contentUrl` could drive a blind GET to any public host (egress-IP disclosure,
+ * attacker-log ping, a fetch-proxy) and hand the response bytes to the
+ * vision/STT/doc-extract pipeline. A REDIRECT target is deliberately NOT re-checked
+ * against this list: a pre-authed SharePoint `downloadUrl` 302-redirects to blob
+ * storage, and that hop must still be followed (token-free, re-validated for SSRF by
+ * the fetcher). Only the INITIAL host is gated here.
+ *
+ * A leading-dot entry matches that apex domain and any subdomain (anchored on the
+ * dot, so `evilbotframework.com` never matches `.botframework.com`); a dotless entry
+ * is an exact host match.
+ */
+export declare const DEFAULT_MEDIA_FETCH_ALLOW_HOSTS: readonly ["smba.trafficmanager.net", ".botframework.com", ".sharepoint.com", "graph.microsoft.com"];
+/**
+ * Create a Microsoft Teams media resolver implementing MediaResolverPort.
+ *
+ * Decodes `msteams-file://` attachments, mints the Connector Bearer, and drives the
+ * injected auth-capable SSRF-guarded fetcher with the config-or-DEFAULT host
+ * allowlist. Returns raw bytes with a sniffed MIME type.
+ */
+export declare function createMsTeamsResolver(deps: MsTeamsResolverDeps): MediaResolverPort;
+export {};

package/node_modules/@comis/channels/dist/msteams/msteams-resolver.js

@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Microsoft Teams MediaResolverPort adapter.
+ *
+ * Resolves `msteams-file://<encodeURIComponent(realUrl)>` attachments (emitted by
+ * the message mapper) to downloaded media buffers. The scheme is decoded back to
+ * the real https URL, the Bot Framework Connector Bearer is minted once, and the
+ * bytes are fetched through the INJECTED auth-capable SSRF-guarded fetcher — never
+ * a bare `fetch`. The fetcher DNS-pins each hop and decides per-hop whether to
+ * attach the Bearer against the allowlist this resolver supplies, so the token is
+ * transmitted only to a Connector/attachment host and dropped on a cross-host
+ * redirect.
+ *
+ * Dependency-clean by construction: this file pulls in neither the SSRF-fetcher's
+ * home package nor its underlying HTTP-transport dependency. The fetcher is received
+ * as a local structural interface, so the DNS-pinning + redirect machinery stays in
+ * the package that owns the transport.
+ *
+ * The returned MIME is sniffed (the port contract mandates a verified type; Teams
+ * can mislabel bytes and the model vision API rejects a declared/actual mismatch).
+ * Raw bytes are returned — the pipeline applies the external-content fence on the
+ * DERIVED text (transcription/vision/doc-extract), not this resolver.
+ *
+ * @module
+ */
+import { sanitizeLogString, systemNowMs } from "@comis/core";
+import { ok, err, tryCatch } from "@comis/shared";
+import { fileTypeFromBuffer } from "file-type";
+/**
+ * Bot Framework Connector/attachment hosts that may receive the Connector Bearer
+ * on an inbound media fetch. A pre-authed SharePoint downloadUrl needs no token and
+ * its storage redirect must not carry one, so `*.sharepoint.com` is excluded; the
+ * inbound path mints the Connector token only (no Graph token), so
+ * `graph.microsoft.com` is excluded too. A leading-dot entry matches that domain
+ * and any subdomain; the fetcher drops the Bearer for any host outside this list
+ * and on a cross-host redirect.
+ */
+export const DEFAULT_MEDIA_AUTH_ALLOW_HOSTS = [
+    "smba.trafficmanager.net",
+    ".botframework.com",
+];
+/**
+ * Teams attachment hosts an inbound media fetch may target at HOP 0 (the initial,
+ * pre-redirect attachment URL). BROADER than {@link DEFAULT_MEDIA_AUTH_ALLOW_HOSTS}
+ * (the token-attach set): a SharePoint or Graph download host receives NO Connector
+ * bearer but IS a legitimate initial attachment host, so it is fetch-allowed here
+ * while staying token-excluded there.
+ *
+ * The gate is HOP-0 ONLY. The injected fetcher re-validates every hop against the
+ * SSRF firewall (private/loopback/link-local/cloud-metadata IPs) but does NOT
+ * restrict arbitrary PUBLIC hosts — so without this list an attacker-influenced
+ * `contentUrl` could drive a blind GET to any public host (egress-IP disclosure,
+ * attacker-log ping, a fetch-proxy) and hand the response bytes to the
+ * vision/STT/doc-extract pipeline. A REDIRECT target is deliberately NOT re-checked
+ * against this list: a pre-authed SharePoint `downloadUrl` 302-redirects to blob
+ * storage, and that hop must still be followed (token-free, re-validated for SSRF by
+ * the fetcher). Only the INITIAL host is gated here.
+ *
+ * A leading-dot entry matches that apex domain and any subdomain (anchored on the
+ * dot, so `evilbotframework.com` never matches `.botframework.com`); a dotless entry
+ * is an exact host match.
+ */
+export const DEFAULT_MEDIA_FETCH_ALLOW_HOSTS = [
+    "smba.trafficmanager.net",
+    ".botframework.com",
+    ".sharepoint.com",
+    "graph.microsoft.com",
+];
+const MSTEAMS_FILE_SCHEME = /^msteams-file:\/\//;
+/**
+ * Case-insensitive host match against an allowlist. A leading-dot entry matches
+ * that apex domain OR any subdomain of it — anchored on the dot, so a look-alike
+ * host (e.g. `evilbotframework.com`) never matches `.botframework.com`; any other
+ * entry is an exact host match. Mirrors the fetcher's auth-host suffix semantics.
+ */
+function matchesHostSuffix(host, list) {
+    const h = host.toLowerCase();
+    return list.some((entry) => {
+        const e = entry.toLowerCase();
+        return e.startsWith(".") ? h === e.slice(1) || h.endsWith(e) : h === e;
+    });
+}
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a Microsoft Teams media resolver implementing MediaResolverPort.
+ *
+ * Decodes `msteams-file://` attachments, mints the Connector Bearer, and drives the
+ * injected auth-capable SSRF-guarded fetcher with the config-or-DEFAULT host
+ * allowlist. Returns raw bytes with a sniffed MIME type.
+ */
+export function createMsTeamsResolver(deps) {
+    /** Strip the decoded URL and the Connector token from an error message, then sanitize free-text. */
+    function sanitizeError(message, realUrl, token) {
+        let stripped = message;
+        if (realUrl.length > 0)
+            stripped = stripped.replaceAll(realUrl, "[REDACTED_URL]");
+        if (token && token.length > 0)
+            stripped = stripped.replaceAll(token, "[REDACTED_TOKEN]");
+        return sanitizeLogString(stripped);
+    }
+    return {
+        schemes: ["msteams-file"],
+        async resolve(attachment) {
+            // Decode msteams-file://<encodeURIComponent(realUrl)> — the exact inverse of the
+            // mapper's encode. decodeURIComponent throws on malformed percent-encoding, and the
+            // URL is attacker-influenced, so the decode is guarded rather than trusted.
+            const decoded = tryCatch(() => decodeURIComponent(attachment.url.replace(MSTEAMS_FILE_SCHEME, "")));
+            if (!decoded.ok) {
+                deps.logger.warn({
+                    platform: "msteams",
+                    errorKind: "validation",
+                    hint: "Drop the attachment: its msteams-file:// payload is not valid percent-encoding",
+                }, "Teams media resolve failed: malformed attachment URL");
+                return err(new Error("Invalid msteams-file:// URL: malformed percent-encoding"));
+            }
+            const realUrl = decoded.value;
+            const allowHosts = deps.mediaAuthAllowHosts.length > 0
+                ? deps.mediaAuthAllowHosts
+                : DEFAULT_MEDIA_AUTH_ALLOW_HOSTS;
+            // Hop-0 fetch-host allowlist: the INITIAL attachment host must be a known
+            // Teams/SharePoint/Bot-Framework/Graph attachment host before any GET. The
+            // fetcher re-validates every hop for SSRF (private/metadata IPs) but does NOT
+            // restrict arbitrary PUBLIC hosts, so an attacker-influenced contentUrl pointing
+            // at a non-Teams host is dropped here — closing the blind-public-SSRF residual.
+            // REDIRECTS are not gated (the fetcher follows a SharePoint 302 → blob-storage
+            // hop token-free); only hop 0 is checked. Any operator-configured Connector host
+            // in the auth allowlist is fetch-trusted too (a host trusted to receive the
+            // bearer is trusted to fetch from), so it is unioned in.
+            const fetchHost = tryCatch(() => new URL(realUrl).hostname);
+            if (!fetchHost.ok ||
+                !matchesHostSuffix(fetchHost.value, [
+                    ...DEFAULT_MEDIA_FETCH_ALLOW_HOSTS,
+                    ...allowHosts,
+                ])) {
+                deps.logger.warn({
+                    platform: "msteams",
+                    errorKind: "validation",
+                    hint: "Drop the attachment: its URL host is not a Teams/SharePoint/Bot-Framework/Graph attachment host",
+                }, "Teams media resolve blocked: off-allowlist fetch host");
+                return err(new Error("attachment host not permitted"));
+            }
+            // Mint the Bearer once; the fetcher decides per-hop whether to attach it. A mint
+            // failure is non-fatal — a pre-authed downloadUrl fetches with no Authorization header.
+            const tok = await deps.getToken();
+            const token = tok.ok ? tok.value : undefined;
+            const authHeader = token !== undefined ? `Bearer ${token}` : undefined;
+            const startMs = systemNowMs();
+            const fetched = await deps.ssrfFetcher.fetch(realUrl, { authHeader, authAllowHosts: allowHosts });
+            const durationMs = systemNowMs() - startMs;
+            if (!fetched.ok) {
+                deps.logger.warn({
+                    platform: "msteams",
+                    durationMs,
+                    errorKind: "platform",
+                    hint: "Teams media fetch failed — verify the attachment URL is reachable and the Connector app has access",
+                }, "Teams media fetch failed");
+                // The decoded URL / Bearer must never surface in the returned error.
+                const msg = fetched.error instanceof Error ? fetched.error.message : String(fetched.error);
+                return err(new Error(sanitizeError(msg, realUrl, token)));
+            }
+            const { buffer, mimeType: fetchedMime, sizeBytes } = fetched.value;
+            // Secondary size cap at the resolver (defense-in-depth over the fetcher's own cap).
+            if (sizeBytes > deps.maxBytes) {
+                deps.logger.warn({
+                    platform: "msteams",
+                    sizeBytes,
+                    maxBytes: deps.maxBytes,
+                    durationMs,
+                    errorKind: "precondition",
+                    hint: "Raise the Teams media size limit or ask the sender to shrink the file",
+                }, "Teams media rejected: body exceeds the configured size cap");
+                return err(new Error(`Teams media size ${sizeBytes} exceeds limit of ${deps.maxBytes} bytes`));
+            }
+            // The port contract mandates a VERIFIED (sniffed) MIME. Teams/Bot Framework can
+            // mislabel bytes (e.g. an image/jpeg header on PNG bytes) and the model vision API
+            // rejects a declared type that mismatches the actual bytes — sniff the downloaded
+            // bytes; the recognized type is authoritative, else fall back to the fetched header.
+            const sniffed = await fileTypeFromBuffer(buffer);
+            const mimeType = sniffed?.mime ?? fetchedMime;
+            if (sniffed && sniffed.mime !== fetchedMime) {
+                deps.logger.debug({ platform: "msteams", declaredMime: fetchedMime, sniffedMime: sniffed.mime }, "Teams media MIME corrected from sniffed bytes (declared type mismatched)");
+            }
+            deps.logger.debug({ platform: "msteams", sizeBytes, durationMs }, "Teams media resolved");
+            // Raw bytes only — the pipeline fences the DERIVED text, not the media bytes here.
+            return ok({ buffer, mimeType, sizeBytes });
+        },
+    };
+}

package/node_modules/@comis/channels/dist/msteams/msteams-rich-renderer.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Microsoft Teams rich renderer: pure functions mapping domain rich types to
+ * Adaptive Card v1.4 JSON.
+ *
+ * Converts `RichCard[]` + `RichButton[][]` into a single Adaptive Card
+ * attachment for the Teams connector. Interactive buttons (`callback_data`)
+ * become `Action.Execute` carrying the shared approval verb + the signed
+ * callback; `url` buttons become `Action.OpenUrl`; the rest become
+ * `Action.Submit`. `RichEffect` ("spoiler"/"silent") has no Adaptive Card
+ * equivalent and is not an input here — it is dropped upstream.
+ *
+ * Pure functions, no side effects, no I/O — fully testable without network.
+ * The card is a hand-built typed object (no Adaptive Cards SDK dependency).
+ *
+ * Adaptive Card enums are case-SENSITIVE: a lowercase value (e.g. "bolder")
+ * silently renders unstyled in the host and the bug is invisible in CI. Every
+ * enum this module emits is therefore a PascalCase literal, and any unmapped
+ * style falls back to "Default" — never a lowercase passthrough.
+ *
+ * @module
+ */
+import type { RichButton, RichCard } from "@comis/core";
+/**
+ * Render `RichCard[]` + `RichButton[][]` into one Adaptive Card v1.4 attachment.
+ *
+ * The button rows are flattened into `content.actions`. A styled button also
+ * contributes a companion colored marker TextBlock (a glyph, not its label) to
+ * `content.body`, since `Action.Execute` has no color in the 1.4 core schema.
+ *
+ * @param cards - Card bodies (title/description/image/fields); any nested
+ *   `buttons` rows are folded into the card actions too
+ * @param buttons - Button rows; flattened into the card actions
+ * @returns One Adaptive Card attachment object (hand-built typed JSON)
+ */
+export declare function renderMSTeamsCardAttachment(cards: RichCard[], buttons: RichButton[][]): Record<string, unknown>;

package/node_modules/@comis/channels/dist/msteams/msteams-rich-renderer.js

@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Microsoft Teams rich renderer: pure functions mapping domain rich types to
+ * Adaptive Card v1.4 JSON.
+ *
+ * Converts `RichCard[]` + `RichButton[][]` into a single Adaptive Card
+ * attachment for the Teams connector. Interactive buttons (`callback_data`)
+ * become `Action.Execute` carrying the shared approval verb + the signed
+ * callback; `url` buttons become `Action.OpenUrl`; the rest become
+ * `Action.Submit`. `RichEffect` ("spoiler"/"silent") has no Adaptive Card
+ * equivalent and is not an input here — it is dropped upstream.
+ *
+ * Pure functions, no side effects, no I/O — fully testable without network.
+ * The card is a hand-built typed object (no Adaptive Cards SDK dependency).
+ *
+ * Adaptive Card enums are case-SENSITIVE: a lowercase value (e.g. "bolder")
+ * silently renders unstyled in the host and the bug is invisible in CI. Every
+ * enum this module emits is therefore a PascalCase literal, and any unmapped
+ * style falls back to "Default" — never a lowercase passthrough.
+ *
+ * @module
+ */
+import { MSTEAMS_APPROVAL_VERB } from "./msteams-actions.js";
+/**
+ * Map a domain button style to a PascalCase Adaptive Card TextBlock color.
+ *
+ * `Action.Execute` carries no color in the 1.4 core schema, so a styled
+ * button's emphasis rides on a companion TextBlock color. Closed lookup: any
+ * style outside the mapped set (including "secondary"/"link" and `undefined`)
+ * falls back to "Default" — a lowercase literal must never reach the wire.
+ */
+function styleToColor(style) {
+    switch (style) {
+        case "primary":
+            return "Good";
+        case "danger":
+            return "Attention";
+        default:
+            return "Default";
+    }
+}
+/**
+ * The glyph a styled button's companion TextBlock carries. `Action.Execute` has
+ * no color in the AC 1.4 core schema, so a styled button's emphasis rides on a
+ * companion colored TextBlock — but that companion carries only this marker, not
+ * the button's label, so the label is never rendered twice (once in the body and
+ * again as the action title).
+ */
+const EMPHASIS_MARKER = "●"; // ● BLACK CIRCLE
+/**
+ * Map one domain button to its Adaptive Card action by discriminant:
+ *   - `callback_data` present → `Action.Execute` (interactive; stamps the shared
+ *     verb the inbound normalizer validates, so the rendered and validated verb
+ *     sets cannot drift, plus the opaque signed callback as `data.cb`)
+ *   - `url` present → `Action.OpenUrl`
+ *   - otherwise → `Action.Submit`
+ */
+function buttonToAction(btn) {
+    if (btn.callback_data !== undefined) {
+        return {
+            type: "Action.Execute",
+            title: btn.text,
+            verb: MSTEAMS_APPROVAL_VERB,
+            data: { cb: btn.callback_data },
+        };
+    }
+    if (btn.url !== undefined) {
+        return { type: "Action.OpenUrl", title: btn.text, url: btn.url };
+    }
+    return { type: "Action.Submit", title: btn.text };
+}
+/**
+ * Build the Adaptive Card body elements for one card: a Bolder/Medium title
+ * TextBlock, a plain description TextBlock, an Image, and a FactSet of fields —
+ * each emitted only when the corresponding field is present. The domain
+ * `color` integer accent has no Adaptive Card enum equivalent and is dropped.
+ */
+function cardToBody(card) {
+    const body = [];
+    if (card.title !== undefined) {
+        body.push({
+            type: "TextBlock",
+            text: card.title,
+            weight: "Bolder",
+            size: "Medium",
+            wrap: true,
+        });
+    }
+    if (card.description !== undefined) {
+        body.push({ type: "TextBlock", text: card.description, wrap: true });
+    }
+    if (card.image_url !== undefined) {
+        body.push({ type: "Image", url: card.image_url });
+    }
+    if (card.fields !== undefined && card.fields.length > 0) {
+        body.push({
+            type: "FactSet",
+            facts: card.fields.map((f) => ({ title: f.name, value: f.value })),
+        });
+    }
+    return body;
+}
+/**
+ * Render `RichCard[]` + `RichButton[][]` into one Adaptive Card v1.4 attachment.
+ *
+ * The button rows are flattened into `content.actions`. A styled button also
+ * contributes a companion colored marker TextBlock (a glyph, not its label) to
+ * `content.body`, since `Action.Execute` has no color in the 1.4 core schema.
+ *
+ * @param cards - Card bodies (title/description/image/fields); any nested
+ *   `buttons` rows are folded into the card actions too
+ * @param buttons - Button rows; flattened into the card actions
+ * @returns One Adaptive Card attachment object (hand-built typed JSON)
+ */
+export function renderMSTeamsCardAttachment(cards, buttons) {
+    const body = [];
+    for (const card of cards) {
+        body.push(...cardToBody(card));
+    }
+    // Card-level button rows (RichCard.buttons) render as card actions too, folded
+    // ahead of the top-level button rows into the same flattened action set —
+    // otherwise a rich card's own buttons would be silently dropped.
+    const flat = [
+        ...cards.flatMap((card) => card.buttons ?? []),
+        ...buttons,
+    ].flat();
+    // A styled button's emphasis is carried by a companion colored TextBlock
+    // because Action.Execute has no color in the 1.4 core schema. The companion
+    // carries a colored marker glyph, NOT the button's label — echoing the label
+    // would render it twice (here and again as the action title). The spacing enum
+    // here is a PascalCase literal for the same case-sensitivity reason.
+    for (const btn of flat) {
+        if (btn.style !== undefined) {
+            body.push({
+                type: "TextBlock",
+                text: EMPHASIS_MARKER,
+                color: styleToColor(btn.style),
+                spacing: "Small",
+                wrap: true,
+            });
+        }
+    }
+    const actions = flat.map(buttonToAction);
+    return {
+        contentType: "application/vnd.microsoft.card.adaptive",
+        content: {
+            $schema: "http://adaptivecards.io/schemas/adaptive-card.json",
+            type: "AdaptiveCard",
+            version: "1.4",
+            body,
+            actions,
+        },
+    };
+}

package/node_modules/@comis/channels/dist/shared/channel-health-monitor.d.ts

@@ -8,9 +8,9 @@
  * Follows the createProcessMonitor() factory pattern: closure state,
  * setInterval + unref(), typed event bus emission.
  *
- * Note: recordRunStart/recordRunEnd are infrastructure-ready. They are fully
- * implemented but not wired to EventBus agent execution events in this plan.
- * activeRuns will be 0 in production until a follow-up phase wires them.
+ * Note: recordRunStart/recordRunEnd are fully implemented but nothing wires
+ * them to EventBus agent execution events yet, so activeRuns is always 0 in
+ * production until a caller invokes them.
  *
  * @module
  */
@@ -29,6 +29,13 @@ export interface ChannelHealthEntry {
     readonly state: ChannelHealthState;
     readonly lastCheckedAt: number;
     readonly lastMessageAt: number | null;
+    /**
+     * Timestamp of the last INBOUND message, distinct from lastMessageAt (which
+     * an outbound send also bumps). A send-only bot leaves this null while
+     * lastMessageAt advances, so a dead ingress cannot report healthy — the
+     * doctor recent-inbound probe keys on this, never lastMessageAt.
+     */
+    readonly lastInboundAt: number | null;
     readonly error: string | null;
     readonly consecutiveFailures: number;
     readonly stateChangedAt: number;

package/node_modules/@comis/channels/dist/shared/channel-health-monitor.js

@@ -9,9 +9,9 @@
  * Follows the createProcessMonitor() factory pattern: closure state,
  * setInterval + unref(), typed event bus emission.
  *
- * Note: recordRunStart/recordRunEnd are infrastructure-ready. They are fully
- * implemented but not wired to EventBus agent execution events in this plan.
- * activeRuns will be 0 in production until a follow-up phase wires them.
+ * Note: recordRunStart/recordRunEnd are fully implemented but nothing wires
+ * them to EventBus agent execution events yet, so activeRuns is always 0 in
+ * production until a caller invokes them.
  *
  * @module
  */
@@ -90,6 +90,7 @@ export function createChannelHealthMonitor(config) {
             state: "startup-grace",
             lastCheckedAt: now,
             lastMessageAt: null,
+            lastInboundAt: null,
             error: null,
             consecutiveFailures: 0,
             stateChangedAt: now,
@@ -185,6 +186,9 @@ export function createChannelHealthMonitor(config) {
             else {
                 entry.consecutiveFailures = 0; // reset on successful getStatus
                 entry.lastMessageAt = status.lastMessageAt ?? entry.lastMessageAt;
+                // Inbound-only signal, captured beside last-activity but never conflated
+                // with it (an outbound send bumps lastMessageAt, not this).
+                entry.lastInboundAt = status.lastInboundAt ?? entry.lastInboundAt;
                 entry.error = status.error ?? null;
                 if (!status.connected) {
                     newState = "disconnected";

package/node_modules/@comis/channels/dist/shared/delivery-timing.js

@@ -43,7 +43,7 @@ function customDelay(config) {
  *   Capped at 2.0x for blocks >= 500 chars.
  * - Position signal: earlier blocks delivered faster (0.5x at start),
  *   later blocks slower (1.0x at end).
- * - Conversation pace: stubbed as 1.0 (deferred TIMING-D01).
+ * - Conversation pace: stubbed as 1.0 (not yet implemented).
  *
  * Signals are multiplied and scaled between minMs-maxMs.
  */

package/node_modules/@comis/channels/dist/shared/lifecycle-reactor.js

@@ -51,10 +51,11 @@ export function createLifecycleReactor(deps) {
     const { eventBus, adapter, channelType, replyToMetaKey, config, logger } = deps;
     // Construction-time invariant: the reactor is created only for
     // adapters whose capability gate says `features.reactions: true` (see
-    // setup-channels-runtime.ts ~L500). After ChannelPort.reactToMessage/removeReaction
-    // were made optional, narrow the adapter shape locally so the body can call the
-    // methods directly. If a caller bypasses the gate the constructor surfaces it
-    // loudly here instead of `TypeError` later inside the fire-and-forget path.
+    // setup-channels-runtime.ts). ChannelPort.reactToMessage/removeReaction are
+    // optional on the port, so narrow the adapter shape locally so the body can
+    // call the methods directly. If a caller bypasses the gate the constructor
+    // surfaces it loudly here instead of `TypeError` later inside the
+    // fire-and-forget path.
     // @allow-throw: Construction-time invariant — capability-gate misconfiguration
     // is a developer/composition-root bug that must surface loudly at startup, not
     // be swallowed into Result.err. The caller (setup-channels-runtime.ts) creates

package/node_modules/@comis/channels/dist/shared/plan-renderer.d.ts

@@ -1,8 +1,8 @@
 /**
- * plan-renderer — pure checkbox rendering of SEP plan state (§8.3).
+ * plan-renderer — pure checkbox rendering of SEP plan state.
  *
  * Maps a `PlanSnapshot` (sourced from the Silent Execution Planner via
- * `ExecutionPlanPort`, §16.7) to deterministic plain-text checkbox lines. Rich
+ * `ExecutionPlanPort`) to deterministic plain-text checkbox lines. Rich
  * surfaces can re-skin per status; this is the canonical ASCII form for
  * plain-text channels (IRC, Email, Echo).
  *