comisai 1.0.45 → 1.0.46

package/node_modules/@comis/channels/dist/email/email-activity.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Email DigestOnly activity renderer (§7.2 / §18.3 row
- * "DigestOnly"). Email is the largest-cap, send-only channel — it wires the
+ * Email DigestOnly activity renderer.
+ * Email is the largest-cap, send-only channel — it wires the
  * `createDigestOnlyRenderer`: buffer the trail in `apply`, send NOTHING
  * mid-turn, send NOTHING on success (the assistant reply IS the activity, so a
  * separate "done" email would be noise), and on failure emit exactly ONE
@@ -20,7 +20,7 @@
  *      adapter's OWN log call, not on the value handed back. There is no reliable
  *      structural signal to disambiguate a richer variant on the returned error,
  *      so the classifier DEFAULTS to `{kind:"internal", cause:e}` (KISS —
- *      Pitfall 4; no invented rich classifier). §19.3: the SMTP error body
+ *      no invented rich classifier). The SMTP error body
  *      is read for NOTHING user-facing — it selects the variant only and is NEVER
  *      rendered or logged as activity text. The S4 fixture proves the digest body
  *      is the `FAILED {errorKind}` header + the redacted bullet trail, not the
@@ -39,7 +39,7 @@
  *   3. `createEmailActivityRenderer` — wires the
  *      {@link createDigestOnlyRenderer}. DigestOnly is purely end-of-turn (it
  *      schedules nothing), so its deps are `{ actions }` ONLY — there is NO
- *      TimerPort / ClockPort (Pitfall 5). It does NOT re-implement the digest body:
+ *      TimerPort / ClockPort. It does NOT re-implement the digest body:
  *      the `FAILED {errorKind}` header + bullet-trail assembly lives in
  *      `digest-only.ts`. This is the signature the daemon wiring constructs.
  *
@@ -63,7 +63,7 @@
  * injected (pre-wiring) or the trail has no approval event, the digest stays the
  * byte-stable `[FAILED] {errorKind}` + bullet trail, so the 5 golden
  * fixtures are unaffected. The renderer reaches NO orchestrator/router code — it
- * only invokes the injected accessor (Pitfall 5).
+ * only invokes the injected accessor.
  *
  * The channels package depends on core + shared only (no observability substrate),
  * so no diagnostics primitive is reachable here.
@@ -76,7 +76,7 @@ import { createDigestOnlyRenderer } from "../shared/strategies/digest-only.js";
  * failure with no structured numeric code on the returned value, so this DEFAULTS
  * to `internal` carrying the cause. The error is consulted for NOTHING that
  * reaches the user — it selects the variant only and is never rendered or logged
- * as activity text (§19.3).
+ * as activity text.
  */
 export function classifyEmailError(e) {
     // The SMTP send path offers no structured code on the returned Error; there is
@@ -135,8 +135,8 @@ function buildApprovalLinkTrailer(trail, mintApprovalLink) {
 /**
  * Create the Email DigestOnly activity renderer — wires the
  * {@link createDigestOnlyRenderer} with the per-channel render-actions adapter.
- * DigestOnly is purely end-of-turn, so it takes NO TimerPort / ClockPort (Pitfall
- * 5). The daemon composition root constructs this with the recipient id
+ * DigestOnly is purely end-of-turn, so it takes NO TimerPort / ClockPort.
+ * The daemon composition root constructs this with the recipient id
  * and the optional `mintApprovalLink` accessor: when present, a `[FAILED]`
  * digest whose trail carries a `kind:"approval"` event appends the minted
  * single-use link. When absent, the digest is the byte-stable failure body.

package/node_modules/@comis/channels/dist/email/email-adapter.js

@@ -26,7 +26,7 @@ import { randomUUID } from "node:crypto";
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
-// Phase 216 ONCE-03: reconcileSend is intentionally NOT implemented — this transport cannot reliably query 'did the bot send X?' (AppleScript/fire-and-forget/SMTP). Recovery treats the absence as 'unresolved' → park+escalate (the honest fallback, never a blind replay).
+// reconcileSend is intentionally NOT implemented — this transport cannot reliably query 'did the bot send X?' (AppleScript/fire-and-forget/SMTP). Recovery treats the absence as 'unresolved' → park+escalate (the honest fallback, never a blind replay).
 /**
  * Create an email channel adapter implementing ChannelPort.
  *

package/node_modules/@comis/channels/dist/email/email-plugin.js

@@ -20,7 +20,7 @@ const EMAIL_CAPABILITIES = {
         deleteMessages: false,
         fetchHistory: false,
         attachments: true,
-        // §17.2: Email DigestOnly — no typing, no threads, no buttons.
+        // Email is DigestOnly — no typing, no threads, no buttons.
         typing: false,
         threads: false,
         buttons: "none",

package/node_modules/@comis/channels/dist/imessage/imessage-activity.d.ts

@@ -5,7 +5,7 @@ import type { ActivityRenderActions } from "../shared/strategies/actions.js";
  * union. The live adapter wraps send/not-started failures in a bare `Error` with
  * no structured numeric code to read, so this DEFAULTS to `internal` carrying the
  * cause. The error is consulted for NOTHING that reaches the user — it selects the
- * variant only and is never rendered or logged as activity text (§19.3).
+ * variant only and is never rendered or logged as activity text.
  */
 export declare function classifyIMessageError(e: unknown): ActivityRenderError;
 /**
@@ -19,9 +19,9 @@ export declare function makeIMessageRenderActions(adapter: ChannelPort, channelI
  * Create the iMessage AppendOnly activity renderer — wires the
  * {@link createAppendOnlyRenderer} with the per-channel render-actions adapter.
  *
- * AppendOnly has no delete to sequence — NO TimerPort. Pitfall 5 was about
- * the delete-sequencing TimerPort, NOT a read-only clock for elapsed display.
- * The optional `deps.clock` (§8.5) is forwarded into
+ * AppendOnly has no delete to sequence — NO TimerPort (a scheduling
+ * TimerPort is a different concern from a read-only clock for elapsed display).
+ * The optional `deps.clock` is forwarded into
  * the strategy so the "(running N s)" fallback lights up when no SEP plan is
  * active; `clock.now()` is read-only display arithmetic (no scheduling, no
  * I/O). The optional `deps.markers` is forwarded to the strategy's

package/node_modules/@comis/channels/dist/imessage/imessage-activity.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * iMessage AppendOnly activity renderer (§7.2 / §18.3 row "AppendOnly").
+ * iMessage AppendOnly activity renderer.
  * iMessage is send-only — no in-place edit, no delete — so it wires the
  * `createAppendOnlyRenderer`: ONE opening status (the first non-trivial frame),
  * later frames are no-ops, the closing follow-up is SUPPRESSED on success (the
@@ -17,8 +17,8 @@
  *      not started")`), with NO structured numeric code to read. There is no
  *      reliable structural signal to disambiguate a retryable/permission case on
  *      this send-only channel, so the classifier DEFAULTS to
- *      `{kind:"internal", cause:e}` (KISS — Pitfall 4; no invented rich
- *      classifier). Per §19.3, the wrapped "Failed to send …" message is read
+ *      `{kind:"internal", cause:e}` (KISS — no invented rich
+ *      classifier). The wrapped "Failed to send …" message is read
  *      for NOTHING user-facing — it selects the variant only and is NEVER rendered
  *      or logged as activity text. The S4 fixture proves the failure text is
  *      `❌ {errorKind}` (from `failureLabel`), not the bridge error body.
@@ -36,7 +36,7 @@
  *   3. `createIMessageActivityRenderer` — wires the
  *      {@link createAppendOnlyRenderer}. AppendOnly has no delete to sequence, so
  *      its deps are `{ actions }` ONLY — there is NO TimerPort / ClockPort (the
- *      strategy schedules nothing; Pitfall 5). It does NOT re-implement any
+ *      strategy schedules nothing). It does NOT re-implement any
  *      sequencing — the strategy owns the opening-once + suppress-on-success +
  *      one-closing-on-failure finalize table. This is the signature the daemon
  *      wiring constructs.
@@ -52,7 +52,7 @@ import { buildApprovalPrompt } from "../shared/strategies/approval-render.js";
  * union. The live adapter wraps send/not-started failures in a bare `Error` with
  * no structured numeric code to read, so this DEFAULTS to `internal` carrying the
  * cause. The error is consulted for NOTHING that reaches the user — it selects the
- * variant only and is never rendered or logged as activity text (§19.3).
+ * variant only and is never rendered or logged as activity text.
  */
 export function classifyIMessageError(e) {
     // The iMessage bridge offers no structured code for send failures; there is no
@@ -92,9 +92,9 @@ export function makeIMessageRenderActions(adapter, channelId) {
  * Create the iMessage AppendOnly activity renderer — wires the
  * {@link createAppendOnlyRenderer} with the per-channel render-actions adapter.
  *
- * AppendOnly has no delete to sequence — NO TimerPort. Pitfall 5 was about
- * the delete-sequencing TimerPort, NOT a read-only clock for elapsed display.
- * The optional `deps.clock` (§8.5) is forwarded into
+ * AppendOnly has no delete to sequence — NO TimerPort (a scheduling
+ * TimerPort is a different concern from a read-only clock for elapsed display).
+ * The optional `deps.clock` is forwarded into
  * the strategy so the "(running N s)" fallback lights up when no SEP plan is
  * active; `clock.now()` is read-only display arithmetic (no scheduling, no
  * I/O). The optional `deps.markers` is forwarded to the strategy's
@@ -105,15 +105,15 @@ export function makeIMessageRenderActions(adapter, channelId) {
 export function createIMessageActivityRenderer(adapter, channelId, deps = {}) {
     return createAppendOnlyRenderer({
         actions: makeIMessageRenderActions(adapter, channelId),
-        // §8.5 wiring: forward the
-        // daemon-injected ClockPort so AppendOnly's first-apply startedAtMs
-        // capture + elapsedMs feeds renderFrameText's "(running N s)" fallback.
-        // Without this forward, §8.5 would be silently inert in iMessage.
+        // Forward the daemon-injected ClockPort so AppendOnly's first-apply
+        // startedAtMs capture + elapsedMs feeds renderFrameText's "(running N s)"
+        // fallback. Without this forward, the elapsed fallback would be silently
+        // inert in iMessage.
         clock: deps.clock,
         markers: deps.markers,
         // iMessage has no button surface, so an approval frame appends the plain-text
         // prompt ("Reply approve or deny …", with shortIds when >1 pending) to the
-        // opening status (§6.4.6). A non-approval frame yields "" (no append).
+        // opening status. A non-approval frame yields "" (no append).
         buildPrompt: buildApprovalPrompt,
     });
 }

package/node_modules/@comis/channels/dist/imessage/imessage-adapter.js

@@ -22,7 +22,7 @@ import { randomUUID } from "node:crypto";
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
-// Phase 216 ONCE-03: reconcileSend is intentionally NOT implemented — this transport cannot reliably query 'did the bot send X?' (AppleScript/fire-and-forget/SMTP). Recovery treats the absence as 'unresolved' → park+escalate (the honest fallback, never a blind replay).
+// reconcileSend is intentionally NOT implemented — this transport cannot reliably query 'did the bot send X?' (AppleScript/fire-and-forget/SMTP). Recovery treats the absence as 'unresolved' → park+escalate (the honest fallback, never a blind replay).
 /**
  * Create an iMessage adapter implementing the ChannelPort interface.
  *

package/node_modules/@comis/channels/dist/imessage/imessage-client.d.ts

@@ -2,8 +2,8 @@
  * iMessage JSON-RPC Client: Spawns `imsg rpc` as a child process and
  * communicates via JSON-RPC 2.0 over stdin/stdout.
  *
- * Adapted from Comis's IMessageRpcClient for Comis's hexagonal
- * architecture with Result-based error handling.
+ * Fits Comis's hexagonal architecture: all fallible operations return
+ * Result values instead of throwing across the port boundary.
  *
  * Lifecycle:
  * 1. `start()` spawns `imsg rpc` child process

package/node_modules/@comis/channels/dist/imessage/imessage-client.js

@@ -3,8 +3,8 @@
  * iMessage JSON-RPC Client: Spawns `imsg rpc` as a child process and
  * communicates via JSON-RPC 2.0 over stdin/stdout.
  *
- * Adapted from Comis's IMessageRpcClient for Comis's hexagonal
- * architecture with Result-based error handling.
+ * Fits Comis's hexagonal architecture: all fallible operations return
+ * Result values instead of throwing across the port boundary.
  *
  * Lifecycle:
  * 1. `start()` spawns `imsg rpc` child process

package/node_modules/@comis/channels/dist/imessage/imessage-plugin.js

@@ -20,7 +20,7 @@ const CAPABILITIES = {
         deleteMessages: false,
         fetchHistory: true,
         attachments: true,
-        // §17.2: iMessage AppendOnly — no typing, no threads, no buttons.
+        // iMessage is AppendOnly — no typing, no threads, no buttons.
         typing: false,
         threads: false,
         buttons: "none",

package/node_modules/@comis/channels/dist/index.d.ts

@@ -79,6 +79,16 @@ export { mapEmailToNormalized } from "./email/message-mapper.js";
 export { createImapLifecycle } from "./email/imap-lifecycle.js";
 export type { ImapLifecycleOpts, ImapLifecycleHandle } from "./email/imap-lifecycle.js";
 export { buildThreadingHeaders, extractThreadId } from "./email/threading.js";
+export { createMsTeamsAdapter } from "./msteams/msteams-adapter.js";
+export type { MsTeamsAdapterDeps, MsTeamsAdapterHandle } from "./msteams/msteams-adapter.js";
+export { createMsTeamsPlugin } from "./msteams/msteams-plugin.js";
+export type { MsTeamsPluginHandle } from "./msteams/msteams-plugin.js";
+export { mapMsTeamsActivityToNormalized } from "./msteams/message-mapper.js";
+export type { TeamsActivity } from "./msteams/message-mapper.js";
+export { validateActivityJwt, createActivityJwtValidator, createLocalActivityJwtValidator, createConnectorTokenProvider, createConnectorTokenProviderFor, } from "./msteams/msteams-auth.js";
+export type { ConnectorAuthMode, ConnectorTokenDeps, ConnectorTokenProvider, } from "./msteams/msteams-auth.js";
+export { validateMsTeamsCredentials } from "./msteams/credential-validator.js";
+export { classifyMsTeamsError } from "./msteams/errors.js";
 export { EchoChannelAdapter } from "./echo/echo-adapter.js";
 export type { EchoAdapterOptions } from "./echo/echo-adapter.js";
 export { createTelegramPlugin } from "./telegram/telegram-plugin.js";
@@ -140,6 +150,7 @@ export type { EditPlaceDeps } from "./shared/strategies/edit-place.js";
 export { createTelegramActivityRenderer, classifyTelegramError } from "./telegram/telegram-activity.js";
 export { createDiscordActivityRenderer } from "./discord/discord-activity.js";
 export { createSlackActivityRenderer } from "./slack/slack-activity.js";
+export { createMSTeamsActivityRenderer } from "./msteams/msteams-activity.js";
 export { createWhatsAppActivityRenderer } from "./whatsapp/whatsapp-activity.js";
 export { createEchoActivityRenderer } from "./echo/echo-activity.js";
 export { createSignalActivityRenderer } from "./signal/signal-activity.js";

package/node_modules/@comis/channels/dist/index.js

@@ -76,6 +76,14 @@ export { isAllowedSender, isAutomatedSender } from "./email/sender-filter.js";
 export { mapEmailToNormalized } from "./email/message-mapper.js";
 export { createImapLifecycle } from "./email/imap-lifecycle.js";
 export { buildThreadingHeaders, extractThreadId } from "./email/threading.js";
+// Microsoft Teams adapter (route-driven, text round-trip)
+export { createMsTeamsAdapter } from "./msteams/msteams-adapter.js";
+export { createMsTeamsPlugin } from "./msteams/msteams-plugin.js";
+// Microsoft Teams utilities
+export { mapMsTeamsActivityToNormalized } from "./msteams/message-mapper.js";
+export { validateActivityJwt, createActivityJwtValidator, createLocalActivityJwtValidator, createConnectorTokenProvider, createConnectorTokenProviderFor, } from "./msteams/msteams-auth.js";
+export { validateMsTeamsCredentials } from "./msteams/credential-validator.js";
+export { classifyMsTeamsError } from "./msteams/errors.js";
 // Echo adapter (testing)
 export { EchoChannelAdapter } from "./echo/echo-adapter.js";
 // Channel plugin factories
@@ -154,8 +162,8 @@ export { coalesceBlocks } from "./shared/block-coalescer.js";
 // Abort summary builder (consumed by orchestrator execution-filter.ts)
 export { buildAbortSummary } from "./shared/abort-summary.js";
 // Send policy primitives (consumed by orchestrator execution-policy.ts +
-// type-only by execution-pipeline / inbound-pipeline / inbound-gate / inbound-route +
-// commit 4: createSendOverrideStore needed by orchestrator channel-manager.ts)
+// type-only by execution-pipeline / inbound-pipeline / inbound-gate / inbound-route;
+// createSendOverrideStore is needed by orchestrator channel-manager.ts)
 export { evaluateSendPolicy, applySessionOverride, createSendOverrideStore, } from "./shared/send-policy.js";
 // Telegram thread propagation metadata keys (consumed by orchestrator
 // execution-pipeline.test.ts for cross-set equivalence assertion)
@@ -166,7 +174,7 @@ export { TELEGRAM_THREAD_META_KEYS } from "./telegram/thread-context.js";
 // Surfaced on the public barrel so this info-disclosure-relevant routing (never
 // leak the General topic id onto a reply) is assertable from the public API.
 export { buildSendThreadParams, buildTypingThreadParams, resolveTelegramThreadContext, } from "./telegram/thread-context.js";
-// Activity rendering strategies (§7.2). The daemon composition root
+// Activity rendering strategies. The daemon composition root
 // (setup-channels-runtime.ts) selects a per-channel ChannelActivityRenderer via
 // `selectStrategy(caps, channelType)` from @comis/core, then constructs the
 // matching strategy here via buildActivityRenderers. Echo→TestSink is
@@ -176,7 +184,7 @@ export { buildSendThreadParams, buildTypingThreadParams, resolveTelegramThreadCo
 // DeleteAndRepost (Signal), AppendOnly (iMessage/LINE), LinePerEvent (IRC), and
 // DigestOnly (Email) factories wire their per-channel render-actions adapters
 // here too; buildActivityRenderers dispatches each from this
-// barrel, completing the §18.3 coverage matrix. Deps differ per
+// barrel, so every channel type has a matching strategy. Deps differ per
 // strategy: DeleteAndRepost takes {timer, clock}, LinePerEvent takes {clock},
 // and AppendOnly/DigestOnly take none. The EditPlace + Echo factories + the
 // createEditPlaceRenderer machine are re-exported here so the daemon's
@@ -186,6 +194,7 @@ export { createEditPlaceRenderer } from "./shared/strategies/edit-place.js";
 export { createTelegramActivityRenderer, classifyTelegramError } from "./telegram/telegram-activity.js";
 export { createDiscordActivityRenderer } from "./discord/discord-activity.js";
 export { createSlackActivityRenderer } from "./slack/slack-activity.js";
+export { createMSTeamsActivityRenderer } from "./msteams/msteams-activity.js";
 export { createWhatsAppActivityRenderer } from "./whatsapp/whatsapp-activity.js";
 export { createEchoActivityRenderer } from "./echo/echo-activity.js";
 // Non-EditPlace strategy factories — wired by

package/node_modules/@comis/channels/dist/irc/irc-activity.d.ts

@@ -6,7 +6,7 @@ import type { ActivityRenderActions } from "../shared/strategies/actions.js";
  * `new Error("Failed to send IRC message: …")` with no structured numeric code to
  * read, so this DEFAULTS to `internal` carrying the cause. The error is consulted
  * for NOTHING that reaches the user — it selects the variant only and is never
- * rendered or logged as activity text (§19.3).
+ * rendered or logged as activity text.
  */
 export declare function classifyIrcError(e: unknown): ActivityRenderError;
 /**
@@ -18,14 +18,14 @@ export declare function classifyIrcError(e: unknown): ActivityRenderError;
 export declare function makeIrcRenderActions(adapter: ChannelPort, channelId: string): ActivityRenderActions;
 /**
  * Build one IRC line for an event, the {@link createLinePerEventRenderer} `lineFor`
- * override (§6.4.6 / §18.3). IRC has no button surface, so a
+ * override. IRC has no button surface, so a
  * `kind:"approval"` event renders the plain-text prompt
  * `buildApprovalText(event, { includeShortId })` — the shortId form only when MORE
  * THAN ONE approval is pending in the same frame (so the user's reply, parsed by
  * the router's plain-text branch, is unambiguous). A
  * `kind:"subagent"` event renders with a `↳ ` depth prefix via `subagentLine`.
  * Everything else keeps the redacted `eventLabel`. No signing — HMAC is skipped for
- * plaintext (§6.4.6); the router scopes replies to `pendingForSession`.
+ * plaintext prompts; the router scopes replies to `pendingForSession`.
  */
 export declare function ircLineFor(event: ActivityEvent, visibleEvents: readonly ActivityEvent[]): string;
 /**

package/node_modules/@comis/channels/dist/irc/irc-activity.js

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * IRC LinePerEvent activity renderer (§7.2 / §18.3 row "LinePerEvent").
- * IRC is text-only — no in-place edit, no delete, a hard per-line character cap
- * (§7.1). Three parts, copying the non-EditPlace
+ * IRC LinePerEvent activity renderer.
+ * IRC is text-only — no in-place edit, no delete, a hard per-line character
+ * cap. Three parts, copying the non-EditPlace
  * `make<Ch>RenderActions` / `classify<Ch>Error` / `create<Ch>ActivityRenderer`
  * shape (signal-activity.ts / whatsapp-activity.ts are the structural analogs —
  * `buttons:"none"`, no rich effect, thin wiring):
@@ -11,8 +11,8 @@
  *      adapter wraps send failures in `new Error("Failed to send IRC message: …")`
  *      with NO structured numeric code, so there is no reliable structural signal
  *      to disambiguate a richer variant; the classifier DEFAULTS to
- *      `{kind:"internal", cause:e}` (KISS — Pitfall 4; no invented rich
- *      classifier). Per §19.3, the wrapped error is read for NOTHING
+ *      `{kind:"internal", cause:e}` (KISS — no invented rich
+ *      classifier). The wrapped error is read for NOTHING
  *      user-facing — it selects the variant only and is NEVER rendered or logged
  *      as activity text. The S4 fixture proves the failure line is
  *      `[ERR] {errorKind}` (from the strategy), not the platform error body.
@@ -38,7 +38,7 @@
  *      painted verbatim by `eventLabel` — the renderer adds no prefix.
  *
  * NOTE the factory signature is `(adapter, channelId, { clock })` — clock ONLY,
- * NO timer (Pitfall 5). LinePerEvent needs the clock for the elapsed-time suffix
+ * NO timer. LinePerEvent needs the clock for the elapsed-time suffix
  * but schedules nothing, so it takes `{ actions, clock? }`. The channels package
  * depends on core + shared only (no diagnostics substrate is reachable here).
  */
@@ -52,7 +52,7 @@ import { buildApprovalText, countPendingApprovals, } from "../shared/strategies/
  * `new Error("Failed to send IRC message: …")` with no structured numeric code to
  * read, so this DEFAULTS to `internal` carrying the cause. The error is consulted
  * for NOTHING that reaches the user — it selects the variant only and is never
- * rendered or logged as activity text (§19.3).
+ * rendered or logged as activity text.
  */
 export function classifyIrcError(e) {
     // IRC offers no structured code for send failures; there is no reliable
@@ -88,21 +88,21 @@ export function makeIrcRenderActions(adapter, channelId) {
     };
 }
 /**
- * The IRC subagent depth prefix (§18.3). IRC has no thread primitive, so a
+ * The IRC subagent depth prefix. IRC has no thread primitive, so a
  * `kind:"subagent"` event renders INLINE with this prefix; the `🤖`/agentId portion
  * rides on the projection's `defaultLabel` and is painted verbatim after it.
  */
 const SUBAGENT_DEPTH_PREFIX = "↳ ";
 /**
  * Build one IRC line for an event, the {@link createLinePerEventRenderer} `lineFor`
- * override (§6.4.6 / §18.3). IRC has no button surface, so a
+ * override. IRC has no button surface, so a
  * `kind:"approval"` event renders the plain-text prompt
  * `buildApprovalText(event, { includeShortId })` — the shortId form only when MORE
  * THAN ONE approval is pending in the same frame (so the user's reply, parsed by
  * the router's plain-text branch, is unambiguous). A
  * `kind:"subagent"` event renders with a `↳ ` depth prefix via `subagentLine`.
  * Everything else keeps the redacted `eventLabel`. No signing — HMAC is skipped for
- * plaintext (§6.4.6); the router scopes replies to `pendingForSession`.
+ * plaintext prompts; the router scopes replies to `pendingForSession`.
  */
 export function ircLineFor(event, visibleEvents) {
     if (event.kind === "approval") {

package/node_modules/@comis/channels/dist/irc/irc-adapter.js

@@ -64,7 +64,7 @@ function delay(ms) {
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
-// Phase 216 ONCE-03: reconcileSend is intentionally NOT implemented — this transport cannot reliably query 'did the bot send X?' (AppleScript/fire-and-forget/SMTP). Recovery treats the absence as 'unresolved' → park+escalate (the honest fallback, never a blind replay).
+// reconcileSend is intentionally NOT implemented — this transport cannot reliably query 'did the bot send X?' (AppleScript/fire-and-forget/SMTP). Recovery treats the absence as 'unresolved' → park+escalate (the honest fallback, never a blind replay).
 /**
  * Create an IRC adapter implementing the ChannelPort interface.
  *

package/node_modules/@comis/channels/dist/irc/irc-plugin.js

@@ -21,7 +21,7 @@ const CAPABILITIES = {
         deleteMessages: false,
         fetchHistory: false,
         attachments: false,
-        // §17.2: IRC LinePerEvent — text-only; no typing, no threads, no buttons.
+        // IRC is LinePerEvent — text-only; no typing, no threads, no buttons.
         typing: false,
         threads: false,
         buttons: "none",

package/node_modules/@comis/channels/dist/line/line-activity.d.ts

@@ -6,7 +6,7 @@ import { type SignCallbackData } from "../shared/strategies/approval-render.js";
  * union. The live adapter wraps send failures in a bare `Error` with no structured
  * numeric code preserved, so this DEFAULTS to `internal` carrying the cause. The
  * error is consulted for NOTHING that reaches the user — it selects the variant
- * only and is never rendered or logged as activity text (§19.3).
+ * only and is never rendered or logged as activity text.
  */
 export declare function classifyLineError(e: unknown): ActivityRenderError;
 /**
@@ -21,21 +21,19 @@ export declare function makeLineRenderActions(adapter: ChannelPort, channelId: s
  * Create the LINE AppendOnly activity renderer — wires the
  * {@link createAppendOnlyRenderer} with the per-channel render-actions adapter.
  *
- * AppendOnly has no delete to sequence, so there is NO TimerPort — Pitfall 5
- * was originally about the delete-sequencing TimerPort, NOT a read-only clock
- * for elapsed display. The optional `deps.clock` (now FORWARDED per §8.5;
- * previously it was destructured-but-unused) feeds the strategy's elapsed-time
+ * AppendOnly has no delete to sequence, so there is NO TimerPort — the no-timer
+ * rule bans scheduling, NOT a read-only clock for elapsed display. The optional
+ * `deps.clock` is forwarded into the strategy and feeds its elapsed-time
  * fallback "(running N s)" when no SEP plan is active; `clock.now()` is
  * consulted ONLY for read-only display arithmetic (no scheduling, no I/O).
- * `timer` is still accepted-but-unused to stay structurally assignable to the
+ * `timer` is accepted-but-unused to stay structurally assignable to the
  * daemon's uniform `RendererFactory` deps.
  *
  * The daemon composition root constructs this with the chat id and the optional
  * `signCallbackData`. `signCallbackData` is the secret-bound signer: the
  * renderer CONSUMES it to build the signed Quick-Reply approval chips and never
- * imports the orchestrator package (Pitfall 5). When omitted, an approval frame
- * degrades to a send-only status (the signer is wired in a later plan; the rest
- * of the renderer is unaffected).
+ * imports the orchestrator package. When omitted, an approval frame
+ * degrades to a send-only status; the rest of the renderer is unaffected.
  */
 export declare function createLineActivityRenderer(adapter: ChannelPort, channelId: string, deps?: {
     timer?: TimerPort;

package/node_modules/@comis/channels/dist/line/line-activity.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * LINE AppendOnly activity renderer (§7.2 / §18.3 row "AppendOnly").
+ * LINE AppendOnly activity renderer.
  * LINE is send-only for the activity renderer — no in-place edit, no delete — so
  * it wires the `createAppendOnlyRenderer` IDENTICALLY to iMessage: ONE
  * opening status (the first non-trivial frame), later frames are no-ops, the
@@ -15,11 +15,11 @@
  *      …")` (catch-wrapped around the LINE SDK throw), with NO structured numeric
  *      code preserved on the wrapper. There is no reliable structural signal to
  *      disambiguate a retryable/permission/quota case on this send-only renderer,
- *      so the classifier DEFAULTS to `{kind:"internal", cause:e}` (KISS —
- *      Pitfall 4; no invented rich classifier). Per §19.3, the wrapped "Failed
- *      to send …" message is read for NOTHING user-facing — it selects the variant
- *      only and is NEVER rendered or logged as activity text. The S4 fixture proves
- *      the failure text is `❌ {errorKind}` (from `failureLabel`), not the SDK body.
+ *      so the classifier DEFAULTS to `{kind:"internal", cause:e}` (KISS — no
+ *      invented rich classifier). The wrapped "Failed to send …" message is read
+ *      for NOTHING user-facing — it selects the variant only and is NEVER
+ *      rendered or logged as activity text. The S4 fixture proves the failure
+ *      text is `❌ {errorKind}` (from `failureLabel`), not the SDK body.
  *
  *   2. `makeLineRenderActions` — the `ActivityRenderActions` adapter. `send` posts
  *      a plain opening status via `adapter.sendMessage` (NO silent effect — LINE
@@ -32,18 +32,18 @@
  *
  *   3. `createLineActivityRenderer` — wires the
  *      {@link createAppendOnlyRenderer}. AppendOnly has no delete to sequence, so
- *      it takes NO TimerPort / ClockPort (the strategy schedules nothing;
- *      Pitfall 5). It does NOT re-implement any sequencing — the strategy owns the
- *      finalize table. This is the signature the daemon wiring constructs (plus
- *      the optional `signCallbackData` injected later).
+ *      it takes NO TimerPort (the strategy schedules nothing). It does NOT
+ *      re-implement any sequencing — the strategy owns the finalize table. This is
+ *      the signature the daemon wiring constructs (plus the optional
+ *      `signCallbackData` injected later).
  *
- * Quick-Reply approval chips (§7.7): a `kind:"approval"` frame's opening
+ * Quick-Reply approval chips: a `kind:"approval"` frame's opening
  * `send` carries the signed Quick-Reply chips (the `buttons` rows from
  * `buildApprovalButtons` over the renderer-injected `SignCallbackData`); each
- * chip's callback data is the §6.4.2 wire string `v1.<choice>.<shortId>.<hmac>`
+ * chip's callback data is the signed wire string `v1.<choice>.<shortId>.<hmac>`
  * (LINE Quick-Reply postback carries it back). The renderer reaches the core HMAC
- * primitive through the injected signer and never imports `@comis/orchestrator`
- * (Pitfall 5). When the signer is absent, an approval frame degrades to a
+ * primitive through the injected signer and never imports `@comis/orchestrator`.
+ * When the signer is absent, an approval frame degrades to a
  * send-only status; a non-approval frame is always send-only.
  *
  * The channels package depends on core + shared only (no observability substrate),
@@ -57,7 +57,7 @@ import { buildApprovalButtons, } from "../shared/strategies/approval-render.js";
  * union. The live adapter wraps send failures in a bare `Error` with no structured
  * numeric code preserved, so this DEFAULTS to `internal` carrying the cause. The
  * error is consulted for NOTHING that reaches the user — it selects the variant
- * only and is never rendered or logged as activity text (§19.3).
+ * only and is never rendered or logged as activity text.
  */
 export function classifyLineError(e) {
     // The LINE SDK throw is catch-wrapped into a bare Error with no structured code
@@ -101,31 +101,29 @@ export function makeLineRenderActions(adapter, channelId) {
  * Create the LINE AppendOnly activity renderer — wires the
  * {@link createAppendOnlyRenderer} with the per-channel render-actions adapter.
  *
- * AppendOnly has no delete to sequence, so there is NO TimerPort — Pitfall 5
- * was originally about the delete-sequencing TimerPort, NOT a read-only clock
- * for elapsed display. The optional `deps.clock` (now FORWARDED per §8.5;
- * previously it was destructured-but-unused) feeds the strategy's elapsed-time
+ * AppendOnly has no delete to sequence, so there is NO TimerPort — the no-timer
+ * rule bans scheduling, NOT a read-only clock for elapsed display. The optional
+ * `deps.clock` is forwarded into the strategy and feeds its elapsed-time
  * fallback "(running N s)" when no SEP plan is active; `clock.now()` is
  * consulted ONLY for read-only display arithmetic (no scheduling, no I/O).
- * `timer` is still accepted-but-unused to stay structurally assignable to the
+ * `timer` is accepted-but-unused to stay structurally assignable to the
  * daemon's uniform `RendererFactory` deps.
  *
  * The daemon composition root constructs this with the chat id and the optional
  * `signCallbackData`. `signCallbackData` is the secret-bound signer: the
  * renderer CONSUMES it to build the signed Quick-Reply approval chips and never
- * imports the orchestrator package (Pitfall 5). When omitted, an approval frame
- * degrades to a send-only status (the signer is wired in a later plan; the rest
- * of the renderer is unaffected).
+ * imports the orchestrator package. When omitted, an approval frame
+ * degrades to a send-only status; the rest of the renderer is unaffected.
  */
 export function createLineActivityRenderer(adapter, channelId, deps = {}) {
     const { signCallbackData, clock } = deps;
     return createAppendOnlyRenderer({
         actions: makeLineRenderActions(adapter, channelId),
-        // Elapsed-fallback wiring (§8.5): forward the daemon-injected ClockPort into
+        // Elapsed-fallback wiring: forward the daemon-injected ClockPort into
         // AppendOnly so the strategy can capture startedAtMs on the first apply() and
-        // compute elapsedMs for renderFrameText's "(running N s)" fallback. Previously
-        // this `clock` was declared on the deps shape but destructured-but-unused —
-        // silent inert.
+        // compute elapsedMs for renderFrameText's "(running N s)" fallback. Merely
+        // declaring `clock` on the deps shape is not enough — without this forward it
+        // is silently inert.
         clock,
         markers: deps.markers,
         // Approval frame → signed Quick-Reply chips. The signer is the only path to

package/node_modules/@comis/channels/dist/line/line-adapter.js

@@ -35,7 +35,7 @@ import { randomUUID } from "node:crypto";
 export function createLineAdapter(deps) {
     // E2E seam: when deps.apiRoot is set, point both LINE SDK clients at the
     // override base URL instead of api.line.me. Production omits the field
-    // entirely (byte-identical to the prior single-key shape).
+    // entirely, so the client config carries only the token key.
     const baseUrlOverride = deps.apiRoot ? { baseURL: deps.apiRoot } : {};
     const client = new messagingApi.MessagingApiClient({
         channelAccessToken: deps.channelAccessToken,

package/node_modules/@comis/channels/dist/line/line-plugin.js

@@ -18,7 +18,7 @@ const CAPABILITIES = {
         deleteMessages: false,
         fetchHistory: false,
         attachments: true,
-        // §17.2: LINE AppendOnly + Quick Reply — typing, no threads, quick-reply buttons.
+        // LINE renders activity via AppendOnly + Quick Reply: typing, no threads, quick-reply buttons.
         typing: true,
         threads: false,
         buttons: "quickreply",

package/node_modules/@comis/channels/dist/msteams/credential-validator.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Microsoft Teams Credential Validator: fail-fast guard that the bot
+ * credentials required to authenticate the adapter are present.
+ *
+ * Synchronous, transport-free, and secret-safe — it verifies appId and tenantId
+ * are non-empty plus the per-mode credential the configured authMode requires
+ * (secret → appPassword, certificate → certPath, managedIdentity →
+ * managedIdentityClientId), naming any missing field in the error, never the
+ * secret value itself. Live token-mint reachability is a separate operational
+ * probe and is intentionally out of scope here.
+ *
+ * @module
+ */
+import type { Result } from "@comis/shared";
+/** Credentials required to authenticate the Microsoft Teams adapter. */
+export interface MsTeamsValidateOpts {
+    /**
+     * Credential mode. Selects which per-mode credential is required alongside the
+     * always-required appId + tenantId: `secret` → appPassword, `certificate` →
+     * certPath, `managedIdentity` → managedIdentityClientId. Absent defaults to
+     * `secret`.
+     */
+    authMode?: "secret" | "certificate" | "managedIdentity";
+    /** Bot application (client) id. */
+    appId?: string;
+    /** Bot application secret — never echoed into errors or logs. Required in secret mode. */
+    appPassword?: string;
+    /** Single-tenant directory id. */
+    tenantId?: string;
+    /** Client certificate path — required in certificate mode. */
+    certPath?: string;
+    /** Managed-identity client id — required in managed-identity mode. */
+    managedIdentityClientId?: string;
+}
+/**
+ * Verify the Microsoft Teams bot credentials required for the configured mode
+ * are present. appId + tenantId are always required; the third credential is
+ * authMode-branched (secret → appPassword, certificate → certPath,
+ * managedIdentity → managedIdentityClientId).
+ *
+ * @param opts.authMode - Credential mode (default "secret")
+ * @param opts.appId - Bot application (client) id
+ * @param opts.appPassword - Bot application secret (never named by value; secret mode)
+ * @param opts.tenantId - Single-tenant directory id
+ * @param opts.certPath - Certificate path (certificate mode)
+ * @param opts.managedIdentityClientId - Managed-identity client id (managed-identity mode)
+ * @returns ok when all required fields are non-empty; err naming the first missing field
+ */
+export declare function validateMsTeamsCredentials(opts: MsTeamsValidateOpts): Result<void, Error>;