@kodelyth/msteams 2026.5.39 → 2026.5.42

package/dist/runtime-api-BL4DOWXD.js

@@ -0,0 +1,28 @@
+import { mergeAllowlist, resolveAllowlistMatchSimple, summarizeMapping } from "klaw/plugin-sdk/allow-from";
+import { createChannelMessageReplyPipeline } from "klaw/plugin-sdk/channel-message";
+import { createChannelPairingController } from "klaw/plugin-sdk/channel-pairing";
+import { resolveToolsBySender } from "klaw/plugin-sdk/channel-policy";
+import { DEFAULT_ACCOUNT_ID } from "klaw/plugin-sdk/account-id";
+import { logTypingFailure } from "klaw/plugin-sdk/channel-logging";
+import { PAIRING_APPROVED_MESSAGE, buildProbeChannelStatusSummary, createDefaultChannelRuntimeState } from "klaw/plugin-sdk/channel-status";
+import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback, resolveNestedAllowlistDecision } from "klaw/plugin-sdk/channel-targets";
+import { isDangerousNameMatchingEnabled } from "klaw/plugin-sdk/dangerous-name-runtime";
+import { resolveDefaultGroupPolicy } from "klaw/plugin-sdk/runtime-group-policy";
+import { withFileLock as withFileLock$1 } from "klaw/plugin-sdk/file-lock";
+import { keepHttpServerTaskAlive } from "klaw/plugin-sdk/channel-lifecycle";
+import { detectMime, extensionForMime, extractOriginalFilename, getFileExtension, resolveChannelMediaMaxBytes } from "klaw/plugin-sdk/media-runtime";
+import { dispatchReplyFromConfigWithSettledDispatcher as dispatchReplyFromConfigWithSettledDispatcher$1 } from "klaw/plugin-sdk/inbound-reply-dispatch";
+import { loadOutboundMediaFromUrl } from "klaw/plugin-sdk/outbound-media";
+import { buildMediaPayload } from "klaw/plugin-sdk/reply-payload";
+import { fetchWithSsrFGuard as fetchWithSsrFGuard$1 } from "klaw/plugin-sdk/ssrf-runtime";
+import { normalizeStringEntries } from "klaw/plugin-sdk/string-normalization-runtime";
+import { chunkTextForOutbound } from "klaw/plugin-sdk/text-chunking";
+import { DEFAULT_WEBHOOK_MAX_BODY_BYTES } from "klaw/plugin-sdk/webhook-ingress";
+import { createPluginRuntimeStore } from "klaw/plugin-sdk/runtime-store";
+//#region extensions/msteams/src/runtime.ts
+const { setRuntime: setMSTeamsRuntime, getRuntime: getMSTeamsRuntime, tryGetRuntime: getOptionalMSTeamsRuntime } = createPluginRuntimeStore({
+	pluginId: "msteams",
+	errorMessage: "MSTeams runtime not initialized"
+});
+//#endregion
+export { summarizeMapping as A, normalizeStringEntries as C, resolveDefaultGroupPolicy as D, resolveChannelMediaMaxBytes as E, getMSTeamsRuntime as M, getOptionalMSTeamsRuntime as N, resolveNestedAllowlistDecision as O, setMSTeamsRuntime as P, normalizeChannelSlug as S, resolveChannelEntryMatchWithFallback as T, isDangerousNameMatchingEnabled as _, buildMediaPayload as a, logTypingFailure as b, createChannelMessageReplyPipeline as c, detectMime as d, dispatchReplyFromConfigWithSettledDispatcher$1 as f, getFileExtension as g, fetchWithSsrFGuard$1 as h, buildChannelKeyCandidates as i, withFileLock$1 as j, resolveToolsBySender as k, createChannelPairingController as l, extractOriginalFilename as m, DEFAULT_WEBHOOK_MAX_BODY_BYTES as n, buildProbeChannelStatusSummary as o, extensionForMime as p, PAIRING_APPROVED_MESSAGE as r, chunkTextForOutbound as s, DEFAULT_ACCOUNT_ID as t, createDefaultChannelRuntimeState as u, keepHttpServerTaskAlive as v, resolveAllowlistMatchSimple as w, mergeAllowlist as x, loadOutboundMediaFromUrl as y };

package/dist/runtime-api.js

@@ -0,0 +1,2 @@
+import { A as summarizeMapping, C as normalizeStringEntries, D as resolveDefaultGroupPolicy, E as resolveChannelMediaMaxBytes, O as resolveNestedAllowlistDecision, P as setMSTeamsRuntime, S as normalizeChannelSlug, T as resolveChannelEntryMatchWithFallback, _ as isDangerousNameMatchingEnabled, a as buildMediaPayload, b as logTypingFailure, c as createChannelMessageReplyPipeline, d as detectMime, f as dispatchReplyFromConfigWithSettledDispatcher, g as getFileExtension, h as fetchWithSsrFGuard, i as buildChannelKeyCandidates, j as withFileLock, k as resolveToolsBySender, l as createChannelPairingController, m as extractOriginalFilename, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, o as buildProbeChannelStatusSummary, p as extensionForMime, r as PAIRING_APPROVED_MESSAGE, s as chunkTextForOutbound, t as DEFAULT_ACCOUNT_ID, u as createDefaultChannelRuntimeState, v as keepHttpServerTaskAlive, w as resolveAllowlistMatchSimple, x as mergeAllowlist, y as loadOutboundMediaFromUrl } from "./runtime-api-BL4DOWXD.js";
+export { DEFAULT_ACCOUNT_ID, DEFAULT_WEBHOOK_MAX_BODY_BYTES, PAIRING_APPROVED_MESSAGE, buildChannelKeyCandidates, buildMediaPayload, buildProbeChannelStatusSummary, chunkTextForOutbound, createChannelMessageReplyPipeline, createChannelPairingController, createDefaultChannelRuntimeState, detectMime, dispatchReplyFromConfigWithSettledDispatcher, extensionForMime, extractOriginalFilename, fetchWithSsrFGuard, getFileExtension, isDangerousNameMatchingEnabled, keepHttpServerTaskAlive, loadOutboundMediaFromUrl, logTypingFailure, mergeAllowlist, normalizeChannelSlug, normalizeStringEntries, resolveAllowlistMatchSimple, resolveChannelEntryMatchWithFallback, resolveChannelMediaMaxBytes, resolveDefaultGroupPolicy, resolveNestedAllowlistDecision, resolveToolsBySender, setMSTeamsRuntime, summarizeMapping, withFileLock };

package/dist/secret-contract-Bo7kdUrT.js

@@ -0,0 +1,35 @@
+import { collectSecretInputAssignment, getChannelRecord } from "klaw/plugin-sdk/channel-secret-basic-runtime";
+//#region extensions/msteams/src/secret-contract.ts
+const secretTargetRegistryEntries = [{
+	id: "channels.msteams.appPassword",
+	targetType: "channels.msteams.appPassword",
+	configFile: "klaw.json",
+	pathPattern: "channels.msteams.appPassword",
+	secretShape: "secret_input",
+	expectedResolvedValue: "string",
+	includeInPlan: true,
+	includeInConfigure: true,
+	includeInAudit: true
+}];
+function collectRuntimeConfigAssignments(params) {
+	const msteams = getChannelRecord(params.config, "msteams");
+	if (!msteams) return;
+	collectSecretInputAssignment({
+		value: msteams.appPassword,
+		path: "channels.msteams.appPassword",
+		expected: "string",
+		defaults: params.defaults,
+		context: params.context,
+		active: msteams.enabled !== false,
+		inactiveReason: "Microsoft Teams channel is disabled.",
+		apply: (value) => {
+			msteams.appPassword = value;
+		}
+	});
+}
+const channelSecrets = {
+	secretTargetRegistryEntries,
+	collectRuntimeConfigAssignments
+};
+//#endregion
+export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };

package/dist/secret-contract-api.js

@@ -0,0 +1,2 @@
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-Bo7kdUrT.js";
+export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/setup-entry.js

@@ -0,0 +1,15 @@
+import { defineBundledChannelSetupEntry } from "klaw/plugin-sdk/channel-entry-contract";
+//#region extensions/msteams/setup-entry.ts
+var setup_entry_default = defineBundledChannelSetupEntry({
+	importMetaUrl: import.meta.url,
+	plugin: {
+		specifier: "./setup-plugin-api.js",
+		exportName: "msteamsSetupPlugin"
+	},
+	secrets: {
+		specifier: "./secret-contract-api.js",
+		exportName: "channelSecrets"
+	}
+});
+//#endregion
+export { setup_entry_default as default };

package/dist/setup-plugin-api.js

@@ -0,0 +1,64 @@
+import { h as resolveMSTeamsCredentials } from "./graph-users-D-gKCguI.js";
+import { i as msteamsSetupAdapter, t as msteamsSetupWizard } from "./setup-surface-COTQDcTQ.js";
+import { t as MSTeamsChannelConfigSchema } from "./config-schema-Btk-XCOd.js";
+import { describeAccountSnapshot } from "klaw/plugin-sdk/account-helpers";
+import { formatAllowFromLowercase } from "klaw/plugin-sdk/allow-from";
+import { createTopLevelChannelConfigAdapter } from "klaw/plugin-sdk/channel-config-helpers";
+//#region extensions/msteams/src/channel.setup.ts
+const meta = {
+	id: "msteams",
+	label: "Microsoft Teams",
+	selectionLabel: "Microsoft Teams (Bot Framework)",
+	docsPath: "/channels/msteams",
+	docsLabel: "msteams",
+	blurb: "Teams SDK; enterprise support.",
+	aliases: ["teams"],
+	order: 60
+};
+const resolveMSTeamsChannelConfig = (cfg) => ({
+	allowFrom: cfg.channels?.msteams?.allowFrom,
+	defaultTo: cfg.channels?.msteams?.defaultTo
+});
+const msteamsConfigAdapter = createTopLevelChannelConfigAdapter({
+	sectionKey: "msteams",
+	resolveAccount: (cfg) => ({
+		accountId: "default",
+		enabled: cfg.channels?.msteams?.enabled !== false,
+		configured: Boolean(resolveMSTeamsCredentials(cfg.channels?.msteams))
+	}),
+	resolveAccessorAccount: ({ cfg }) => resolveMSTeamsChannelConfig(cfg),
+	resolveAllowFrom: (account) => account.allowFrom,
+	formatAllowFrom: (allowFrom) => formatAllowFromLowercase({ allowFrom }),
+	resolveDefaultTo: (account) => account.defaultTo
+});
+const msteamsSetupPlugin = {
+	id: "msteams",
+	meta: {
+		...meta,
+		aliases: [...meta.aliases]
+	},
+	capabilities: {
+		chatTypes: [
+			"direct",
+			"channel",
+			"thread"
+		],
+		polls: true,
+		threads: true,
+		media: true
+	},
+	reload: { configPrefixes: ["channels.msteams"] },
+	configSchema: MSTeamsChannelConfigSchema,
+	config: {
+		...msteamsConfigAdapter,
+		isConfigured: (_account, cfg) => Boolean(resolveMSTeamsCredentials(cfg.channels?.msteams)),
+		describeAccount: (account) => describeAccountSnapshot({
+			account,
+			configured: account.configured
+		})
+	},
+	setupWizard: msteamsSetupWizard,
+	setup: msteamsSetupAdapter
+};
+//#endregion
+export { msteamsSetupPlugin };

package/dist/setup-surface-COTQDcTQ.js

@@ -0,0 +1,531 @@
+import { O as formatUnknownError, c as normalizeQuery, f as resolveGraphToken, g as saveDelegatedTokens, h as resolveMSTeamsCredentials, o as listChannelsForTeam, p as hasConfiguredMSTeamsCredentials, s as listTeamsByName, t as searchGraphUsers, v as normalizeSecretInputString } from "./graph-users-D-gKCguI.js";
+import { mapAllowlistResolutionInputs } from "klaw/plugin-sdk/allow-from";
+import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString } from "klaw/plugin-sdk/string-coerce-runtime";
+import { DEFAULT_ACCOUNT_ID, createSetupTranslator, createStandardChannelSetupStatus, createTopLevelChannelAllowFromSetter, createTopLevelChannelDmPolicy, createTopLevelChannelGroupPolicySetter, mergeAllowFromEntries, splitSetupEntries } from "klaw/plugin-sdk/setup";
+import { formatDocsLink } from "klaw/plugin-sdk/setup-tools";
+//#region extensions/msteams/src/resolve-allowlist.ts
+function stripProviderPrefix(raw) {
+	return raw.replace(/^(msteams|teams):/i, "");
+}
+function normalizeMSTeamsMessagingTarget(raw) {
+	let trimmed = raw.trim();
+	if (!trimmed) return;
+	trimmed = stripProviderPrefix(trimmed).trim();
+	if (/^conversation:/i.test(trimmed)) {
+		const id = trimmed.slice(13).trim();
+		return id ? `conversation:${id}` : void 0;
+	}
+	if (/^user:/i.test(trimmed)) {
+		const id = trimmed.slice(5).trim();
+		return id ? `user:${id}` : void 0;
+	}
+	return trimmed || void 0;
+}
+function normalizeMSTeamsUserInput(raw) {
+	return stripProviderPrefix(raw).replace(/^(user|conversation):/i, "").trim();
+}
+function parseMSTeamsConversationId(raw) {
+	const trimmed = stripProviderPrefix(raw).trim();
+	if (!/^conversation:/i.test(trimmed)) return null;
+	return trimmed.slice(13).trim();
+}
+/**
+* Detect whether a raw target string looks like a Microsoft Teams conversation
+* or user id that cron announce delivery and other explicit-target paths can
+* forward verbatim to the channel adapter.
+*
+* Accepts both prefixed and bare formats:
+* - `conversation:<id>` — explicit conversation prefix
+* - `user:<aad-guid>`   — user id (16+ hex chars, UUID-like)
+* - `19:abc@thread.tacv2` / `19:abc@thread.skype` — channel / legacy group
+* - `19:{userId}_{appId}@unq.gbl.spaces` — Graph 1:1 chat thread format
+* - `a:1xxx` — Bot Framework personal (1:1) chat id
+* - `8:orgid:xxx` — Bot Framework org-scoped personal chat id
+* - `29:xxx` — Bot Framework user id
+*
+* Display-name user targets such as `user:John Smith` intentionally return
+* false so that the Graph API directory lookup still runs for them.
+*/
+function looksLikeMSTeamsTargetId(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return false;
+	if (/^conversation:/i.test(trimmed)) return true;
+	if (/^user:/i.test(trimmed)) {
+		const id = trimmed.slice(5).trim();
+		return /^[0-9a-fA-F-]{16,}$/.test(id);
+	}
+	if (/^19:.+@thread\.(tacv2|skype)$/i.test(trimmed)) return true;
+	if (/^19:.+@unq\.gbl\.spaces$/i.test(trimmed)) return true;
+	if (/^a:1[A-Za-z0-9_-]+$/i.test(trimmed)) return true;
+	if (/^8:orgid:[A-Za-z0-9-]+$/i.test(trimmed)) return true;
+	if (/^29:[A-Za-z0-9_-]+$/i.test(trimmed)) return true;
+	return /@thread\b/i.test(trimmed);
+}
+function normalizeMSTeamsTeamKey(raw) {
+	return stripProviderPrefix(raw).replace(/^team:/i, "").trim() || void 0;
+}
+function normalizeMSTeamsChannelKey(raw) {
+	return (raw?.trim().replace(/^#/, "").trim() ?? "") || void 0;
+}
+function normalizeMSTeamsConversationTargetId(raw) {
+	const trimmed = stripProviderPrefix(raw).trim();
+	return parseMSTeamsConversationId(trimmed) ?? trimmed;
+}
+function looksLikeMSTeamsThreadConversationId(raw) {
+	const normalized = normalizeMSTeamsConversationTargetId(raw);
+	return /^19:.+@thread\./i.test(normalized);
+}
+function parseMSTeamsTeamChannelInput(raw) {
+	const trimmed = stripProviderPrefix(raw).trim();
+	if (!trimmed) return {};
+	const parts = trimmed.split("/");
+	const team = normalizeMSTeamsTeamKey(parts[0] ?? "");
+	const channel = parts.length > 1 ? normalizeMSTeamsChannelKey(parts.slice(1).join("/")) : void 0;
+	return {
+		...team ? { team } : {},
+		...channel ? { channel } : {}
+	};
+}
+function parseMSTeamsTeamEntry(raw) {
+	const { team, channel } = parseMSTeamsTeamChannelInput(raw);
+	if (!team) return null;
+	return {
+		teamKey: team,
+		...channel ? { channelKey: channel } : {}
+	};
+}
+async function resolveMSTeamsChannelAllowlist(params) {
+	let tokenPromise;
+	const getToken = () => {
+		tokenPromise ??= resolveGraphToken(params.cfg);
+		return tokenPromise;
+	};
+	return await mapAllowlistResolutionInputs({
+		inputs: params.entries,
+		mapInput: async (input) => {
+			const { team, channel } = parseMSTeamsTeamChannelInput(input);
+			if (!team) return {
+				input,
+				resolved: false
+			};
+			if (looksLikeMSTeamsThreadConversationId(team)) {
+				const teamId = normalizeMSTeamsConversationTargetId(team);
+				if (!channel) return {
+					input,
+					resolved: true,
+					teamId,
+					teamName: teamId
+				};
+				if (!looksLikeMSTeamsThreadConversationId(channel)) return {
+					input,
+					resolved: false,
+					teamId,
+					teamName: teamId,
+					note: "channel id required for conversation-id team"
+				};
+				const channelId = normalizeMSTeamsConversationTargetId(channel);
+				return {
+					input,
+					resolved: true,
+					teamId,
+					teamName: teamId,
+					channelId,
+					channelName: channelId
+				};
+			}
+			const token = await getToken();
+			const teams = /^[0-9a-fA-F-]{16,}$/.test(team) ? [{
+				id: team,
+				displayName: team
+			}] : await listTeamsByName(token, team);
+			if (teams.length === 0) return {
+				input,
+				resolved: false,
+				note: "team not found"
+			};
+			const teamMatch = teams[0];
+			const graphTeamId = teamMatch.id?.trim();
+			const teamName = teamMatch.displayName?.trim() || team;
+			if (!graphTeamId) return {
+				input,
+				resolved: false,
+				note: "team id missing"
+			};
+			let teamChannels = [];
+			try {
+				teamChannels = await listChannelsForTeam(token, graphTeamId);
+			} catch {}
+			const teamId = teamChannels.find((ch) => normalizeOptionalLowercaseString(ch.displayName) === "general")?.id?.trim() || graphTeamId;
+			if (!channel) return {
+				input,
+				resolved: true,
+				teamId,
+				teamName,
+				note: teams.length > 1 ? "multiple teams; chose first" : void 0
+			};
+			const normalizedChannel = normalizeOptionalLowercaseString(channel);
+			const channelMatch = teamChannels.find((item) => item.id === channel) ?? teamChannels.find((item) => normalizeOptionalLowercaseString(item.displayName) === normalizedChannel) ?? teamChannels.find((item) => normalizeLowercaseStringOrEmpty(item.displayName ?? "").includes(normalizedChannel ?? ""));
+			if (!channelMatch?.id) return {
+				input,
+				resolved: false,
+				note: "channel not found"
+			};
+			return {
+				input,
+				resolved: true,
+				teamId,
+				teamName,
+				channelId: channelMatch.id,
+				channelName: channelMatch.displayName ?? channel,
+				note: teamChannels.length > 1 ? "multiple channels; chose first" : void 0
+			};
+		}
+	});
+}
+async function resolveMSTeamsUserAllowlist(params) {
+	const token = await resolveGraphToken(params.cfg);
+	return await mapAllowlistResolutionInputs({
+		inputs: params.entries,
+		mapInput: async (input) => {
+			const query = normalizeQuery(normalizeMSTeamsUserInput(input));
+			if (!query) return {
+				input,
+				resolved: false
+			};
+			if (/^[0-9a-fA-F-]{16,}$/.test(query)) return {
+				input,
+				resolved: true,
+				id: query
+			};
+			const users = await searchGraphUsers({
+				token,
+				query,
+				top: 10
+			});
+			const match = users[0];
+			if (!match?.id) return {
+				input,
+				resolved: false
+			};
+			return {
+				input,
+				resolved: true,
+				id: match.id,
+				name: match.displayName ?? void 0,
+				note: users.length > 1 ? "multiple matches; chose first" : void 0
+			};
+		}
+	});
+}
+//#endregion
+//#region extensions/msteams/src/setup-core.ts
+const t$1 = createSetupTranslator();
+const msteamsSetupAdapter = {
+	resolveAccountId: () => DEFAULT_ACCOUNT_ID,
+	applyAccountConfig: ({ cfg }) => ({
+		...cfg,
+		channels: {
+			...cfg.channels,
+			msteams: {
+				...cfg.channels?.msteams,
+				enabled: true
+			}
+		}
+	})
+};
+const channel$1 = "msteams";
+async function promptMSTeamsCredentials(prompter) {
+	return {
+		appId: (await prompter.text({
+			message: t$1("wizard.msteams.appIdPrompt"),
+			validate: (value) => value?.trim() ? void 0 : t$1("common.required")
+		})).trim(),
+		appPassword: (await prompter.text({
+			message: t$1("wizard.msteams.appPasswordPrompt"),
+			validate: (value) => value?.trim() ? void 0 : t$1("common.required")
+		})).trim(),
+		tenantId: (await prompter.text({
+			message: t$1("wizard.msteams.tenantIdPrompt"),
+			validate: (value) => value?.trim() ? void 0 : t$1("common.required")
+		})).trim()
+	};
+}
+async function noteMSTeamsCredentialHelp(prompter) {
+	await prompter.note([
+		t$1("wizard.msteams.helpAzureBot"),
+		t$1("wizard.msteams.helpClientSecret"),
+		t$1("wizard.msteams.helpWebhook"),
+		t$1("wizard.msteams.helpEnvTip"),
+		t$1("wizard.channels.docs", { link: formatDocsLink("/channels/msteams", "msteams") })
+	].join("\n"), t$1("wizard.msteams.credentialsTitle"));
+}
+function createMSTeamsSetupWizardBase() {
+	return {
+		channel: channel$1,
+		resolveAccountIdForConfigure: () => DEFAULT_ACCOUNT_ID,
+		resolveShouldPromptAccountIds: () => false,
+		status: createStandardChannelSetupStatus({
+			channelLabel: "MS Teams",
+			configuredLabel: t$1("wizard.channels.statusConfigured"),
+			unconfiguredLabel: t$1("wizard.channels.statusNeedsAppCredentials"),
+			configuredHint: t$1("wizard.channels.statusConfigured"),
+			unconfiguredHint: t$1("wizard.channels.statusNeedsAppCreds"),
+			configuredScore: 2,
+			unconfiguredScore: 0,
+			includeStatusLine: true,
+			resolveConfigured: ({ cfg }) => Boolean(resolveMSTeamsCredentials(cfg.channels?.msteams)) || hasConfiguredMSTeamsCredentials(cfg.channels?.msteams)
+		}),
+		credentials: [],
+		finalize: async ({ cfg, prompter }) => {
+			const resolved = resolveMSTeamsCredentials(cfg.channels?.msteams);
+			const hasConfigCreds = hasConfiguredMSTeamsCredentials(cfg.channels?.msteams);
+			const canUseEnv = Boolean(!hasConfigCreds && normalizeSecretInputString(process.env.MSTEAMS_APP_ID) && normalizeSecretInputString(process.env.MSTEAMS_APP_PASSWORD) && normalizeSecretInputString(process.env.MSTEAMS_TENANT_ID));
+			let next = cfg;
+			let appId = null;
+			let appPassword = null;
+			let tenantId = null;
+			if (!resolved && !hasConfigCreds) await noteMSTeamsCredentialHelp(prompter);
+			if (canUseEnv) if (await prompter.confirm({
+				message: t$1("wizard.msteams.envPrompt"),
+				initialValue: true
+			})) next = msteamsSetupAdapter.applyAccountConfig({
+				cfg: next,
+				accountId: DEFAULT_ACCOUNT_ID,
+				input: {}
+			});
+			else ({appId, appPassword, tenantId} = await promptMSTeamsCredentials(prompter));
+			else if (hasConfigCreds) {
+				if (!await prompter.confirm({
+					message: t$1("wizard.msteams.credentialsKeep"),
+					initialValue: true
+				})) ({appId, appPassword, tenantId} = await promptMSTeamsCredentials(prompter));
+			} else ({appId, appPassword, tenantId} = await promptMSTeamsCredentials(prompter));
+			if (appId && appPassword && tenantId) next = {
+				...next,
+				channels: {
+					...next.channels,
+					msteams: {
+						...next.channels?.msteams,
+						enabled: true,
+						appId,
+						appPassword,
+						tenantId
+					}
+				}
+			};
+			return {
+				cfg: next,
+				accountId: DEFAULT_ACCOUNT_ID
+			};
+		}
+	};
+}
+//#endregion
+//#region extensions/msteams/src/setup-surface.ts
+const t = createSetupTranslator();
+const channel = "msteams";
+const setMSTeamsAllowFrom = createTopLevelChannelAllowFromSetter({ channel });
+const setMSTeamsGroupPolicy = createTopLevelChannelGroupPolicySetter({
+	channel,
+	enabled: true
+});
+function openDelegatedOAuthUrl(url) {
+	return Promise.reject(/* @__PURE__ */ new Error(`Automatic browser launch is not available. Open this URL manually: ${url}`));
+}
+function looksLikeGuid(value) {
+	return /^[0-9a-fA-F-]{16,}$/.test(value);
+}
+async function promptMSTeamsAllowFrom(params) {
+	const existing = params.cfg.channels?.msteams?.allowFrom ?? [];
+	await params.prompter.note([
+		t("wizard.msteams.allowlistIntro"),
+		t("wizard.msteams.allowlistResolve"),
+		t("wizard.msteams.examples"),
+		"- alex@example.com",
+		"- Alex Johnson",
+		"- 00000000-0000-0000-0000-000000000000"
+	].join("\n"), t("wizard.msteams.allowlistTitle"));
+	while (true) {
+		const parts = splitSetupEntries(await params.prompter.text({
+			message: t("wizard.msteams.allowFromPrompt"),
+			placeholder: "alex@example.com, Alex Johnson",
+			initialValue: existing[0] ? existing[0] : void 0,
+			validate: (value) => value.trim() ? void 0 : t("common.required")
+		}));
+		if (parts.length === 0) {
+			await params.prompter.note(t("wizard.msteams.enterAtLeastOneUser"), t("wizard.msteams.allowlistTitle"));
+			continue;
+		}
+		const resolved = await resolveMSTeamsUserAllowlist({
+			cfg: params.cfg,
+			entries: parts
+		}).catch(() => null);
+		if (!resolved) {
+			const ids = parts.filter((part) => looksLikeGuid(part));
+			if (ids.length !== parts.length) {
+				await params.prompter.note(t("wizard.msteams.graphLookupUnavailable"), t("wizard.msteams.allowlistTitle"));
+				continue;
+			}
+			const unique = mergeAllowFromEntries(existing, ids);
+			return setMSTeamsAllowFrom(params.cfg, unique);
+		}
+		const unresolved = resolved.filter((item) => !item.resolved || !item.id);
+		if (unresolved.length > 0) {
+			await params.prompter.note(t("wizard.msteams.couldNotResolve", { entries: unresolved.map((item) => item.input).join(", ") }), t("wizard.msteams.allowlistTitle"));
+			continue;
+		}
+		const unique = mergeAllowFromEntries(existing, resolved.map((item) => item.id));
+		return setMSTeamsAllowFrom(params.cfg, unique);
+	}
+}
+function setMSTeamsTeamsAllowlist(cfg, entries) {
+	const teams = { ...cfg.channels?.msteams?.teams ?? {} };
+	for (const entry of entries) {
+		const teamKey = entry.teamKey;
+		if (!teamKey) continue;
+		const existing = teams[teamKey] ?? {};
+		if (entry.channelKey) {
+			const channels = { ...existing.channels };
+			channels[entry.channelKey] = channels[entry.channelKey] ?? {};
+			teams[teamKey] = {
+				...existing,
+				channels
+			};
+		} else teams[teamKey] = existing;
+	}
+	return {
+		...cfg,
+		channels: {
+			...cfg.channels,
+			msteams: {
+				...cfg.channels?.msteams,
+				enabled: true,
+				teams
+			}
+		}
+	};
+}
+function listMSTeamsGroupEntries(cfg) {
+	return Object.entries(cfg.channels?.msteams?.teams ?? {}).flatMap(([teamKey, value]) => {
+		const channels = value?.channels ?? {};
+		const channelKeys = Object.keys(channels);
+		if (channelKeys.length === 0) return [teamKey];
+		return channelKeys.map((channelKey) => `${teamKey}/${channelKey}`);
+	});
+}
+async function resolveMSTeamsGroupAllowlist(params) {
+	let resolvedEntries = params.entries.map((entry) => parseMSTeamsTeamEntry(entry)).filter(Boolean);
+	if (params.entries.length === 0 || !resolveMSTeamsCredentials(params.cfg.channels?.msteams)) return resolvedEntries;
+	try {
+		const lookups = await resolveMSTeamsChannelAllowlist({
+			cfg: params.cfg,
+			entries: params.entries
+		});
+		const resolvedChannels = lookups.filter((entry) => entry.resolved && entry.teamId && entry.channelId);
+		const resolvedTeams = lookups.filter((entry) => entry.resolved && entry.teamId && !entry.channelId);
+		const unresolved = lookups.filter((entry) => !entry.resolved).map((entry) => entry.input);
+		resolvedEntries = [
+			...resolvedChannels.map((entry) => ({
+				teamKey: entry.teamId,
+				channelKey: entry.channelId
+			})),
+			...resolvedTeams.map((entry) => ({ teamKey: entry.teamId })),
+			...unresolved.map((entry) => parseMSTeamsTeamEntry(entry)).filter(Boolean)
+		];
+		const summary = [];
+		if (resolvedChannels.length > 0) summary.push(t("wizard.msteams.resolvedChannels", { entries: resolvedChannels.map((entry) => entry.channelId).filter(Boolean).join(", ") }));
+		if (resolvedTeams.length > 0) summary.push(t("wizard.msteams.resolvedTeams", { entries: resolvedTeams.map((entry) => entry.teamId).filter(Boolean).join(", ") }));
+		if (unresolved.length > 0) summary.push(t("wizard.msteams.unresolvedKept", { entries: unresolved.join(", ") }));
+		if (summary.length > 0) await params.prompter.note(summary.join("\n"), t("wizard.msteams.channelsLabel"));
+		return resolvedEntries;
+	} catch (err) {
+		await params.prompter.note(t("wizard.msteams.channelLookupFailed", { error: formatUnknownError(err) }), t("wizard.msteams.channelsLabel"));
+		return resolvedEntries;
+	}
+}
+const msteamsGroupAccess = {
+	label: t("wizard.msteams.channelsLabel"),
+	placeholder: "Team Name/Channel Name, teamId/conversationId",
+	currentPolicy: ({ cfg }) => cfg.channels?.msteams?.groupPolicy ?? "allowlist",
+	currentEntries: ({ cfg }) => listMSTeamsGroupEntries(cfg),
+	updatePrompt: ({ cfg }) => Boolean(cfg.channels?.msteams?.teams),
+	setPolicy: ({ cfg, policy }) => setMSTeamsGroupPolicy(cfg, policy),
+	resolveAllowlist: async ({ cfg, entries, prompter }) => await resolveMSTeamsGroupAllowlist({
+		cfg,
+		entries,
+		prompter
+	}),
+	applyAllowlist: ({ cfg, resolved }) => setMSTeamsTeamsAllowlist(cfg, resolved)
+};
+const msteamsDmPolicy = createTopLevelChannelDmPolicy({
+	label: "MS Teams",
+	channel,
+	policyKey: "channels.msteams.dmPolicy",
+	allowFromKey: "channels.msteams.allowFrom",
+	getCurrent: (cfg) => cfg.channels?.msteams?.dmPolicy ?? "pairing",
+	promptAllowFrom: promptMSTeamsAllowFrom
+});
+const msteamsSetupWizardBase = createMSTeamsSetupWizardBase();
+const msteamsSetupWizard = {
+	...msteamsSetupWizardBase,
+	finalize: async (params) => {
+		const baseFinalize = msteamsSetupWizardBase.finalize;
+		const baseResult = baseFinalize ? await baseFinalize(params) : void 0;
+		let next = baseResult?.cfg ?? params.cfg;
+		const finalCreds = resolveMSTeamsCredentials(next.channels?.msteams);
+		if (finalCreds?.type === "secret") {
+			if (await params.prompter.confirm({
+				message: t("wizard.msteams.delegatedAuthPrompt"),
+				initialValue: false
+			})) {
+				next = {
+					...next,
+					channels: {
+						...next.channels,
+						msteams: {
+							...next.channels?.msteams,
+							delegatedAuth: { enabled: true }
+						}
+					}
+				};
+				try {
+					const { loginMSTeamsDelegated } = await import("./oauth-BUxlphX3.js");
+					const progress = params.prompter.progress(t("wizard.msteams.delegatedOAuthProgress"));
+					saveDelegatedTokens(await loginMSTeamsDelegated({
+						isRemote: true,
+						openUrl: openDelegatedOAuthUrl,
+						log: (msg) => params.prompter.note(msg),
+						note: (msg, title) => params.prompter.note(msg, title),
+						prompt: (msg) => params.prompter.text({ message: msg }),
+						progress
+					}, {
+						tenantId: finalCreds.tenantId,
+						clientId: finalCreds.appId,
+						clientSecret: finalCreds.appPassword
+					}));
+					progress.stop(t("wizard.msteams.delegatedAuthConfigured"));
+				} catch (err) {
+					await params.prompter.note(`Delegated auth setup failed: ${formatUnknownError(err)}\n` + t("wizard.msteams.delegatedAuthRetry"), t("wizard.msteams.delegatedAuthTitle"));
+				}
+			}
+		}
+		return {
+			...baseResult,
+			cfg: next
+		};
+	},
+	dmPolicy: msteamsDmPolicy,
+	groupAccess: msteamsGroupAccess,
+	disable: (cfg) => ({
+		...cfg,
+		channels: {
+			...cfg.channels,
+			msteams: {
+				...cfg.channels?.msteams,
+				enabled: false
+			}
+		}
+	})
+};
+//#endregion
+export { looksLikeMSTeamsTargetId as a, parseMSTeamsConversationId as c, resolveMSTeamsUserAllowlist as d, msteamsSetupAdapter as i, parseMSTeamsTeamChannelInput as l, openDelegatedOAuthUrl as n, normalizeMSTeamsMessagingTarget as o, createMSTeamsSetupWizardBase as r, normalizeMSTeamsUserInput as s, msteamsSetupWizard as t, resolveMSTeamsChannelAllowlist as u };