@openclaw/msteams 2026.10.1-beta.2 → 2026.10.5-beta.1

package/dist/.setup/oauth-CWJ85AMw.cjs

@@ -0,0 +1,55 @@
+const require_resolve_allowlist = require("./resolve-allowlist-DdDBVCzl.cjs");
+let openclaw_plugin_sdk_provider_auth = require("openclaw/plugin-sdk/provider-auth");
+let openclaw_plugin_sdk_provider_auth_runtime = require("openclaw/plugin-sdk/provider-auth-runtime");
+//#region extensions/msteams/src/oauth.flow.ts
+function buildMSTeamsAuthUrl(params) {
+	const scopes = params.scopes ?? require_resolve_allowlist.MSTEAMS_DEFAULT_DELEGATED_SCOPES;
+	return `${require_resolve_allowlist.buildMSTeamsAuthEndpoint(params.tenantId)}?${new URLSearchParams({
+		client_id: params.clientId,
+		response_type: "code",
+		redirect_uri: require_resolve_allowlist.MSTEAMS_OAUTH_REDIRECT_URI,
+		scope: scopes.join(" "),
+		code_challenge: params.challenge,
+		code_challenge_method: "S256",
+		state: params.state,
+		prompt: "consent"
+	}).toString()}`;
+}
+//#endregion
+//#region extensions/msteams/src/oauth.ts
+async function loginMSTeamsDelegated(ctx, params) {
+	await ctx.note([
+		"You are running in a remote/VPS environment.",
+		"A URL will be shown for you to open in your LOCAL browser.",
+		"After signing in, copy the redirect URL and paste it back here."
+	].join("\n"), "MSTeams Delegated OAuth");
+	const { verifier, challenge } = (0, openclaw_plugin_sdk_provider_auth.generateHexPkceVerifierChallenge)();
+	const state = (0, openclaw_plugin_sdk_provider_auth_runtime.generateOAuthState)();
+	const authUrl = buildMSTeamsAuthUrl({
+		tenantId: params.tenantId,
+		clientId: params.clientId,
+		challenge,
+		state,
+		scopes: require_resolve_allowlist.MSTEAMS_DEFAULT_DELEGATED_SCOPES
+	});
+	ctx.progress.update("OAuth URL ready");
+	ctx.log(`\nOpen this URL in your LOCAL browser:\n\n${authUrl}\n`);
+	ctx.progress.update("Waiting for you to paste the callback URL...");
+	const callbackInput = await ctx.prompt("Paste the redirect URL here: ");
+	const parsed = (0, openclaw_plugin_sdk_provider_auth_runtime.parseOAuthCallbackInput)(callbackInput, {
+		missingState: "Missing 'state' parameter in URL. Paste the full redirect URL.",
+		invalidInput: "Paste the full redirect URL (including code and state parameters), not just the authorization code."
+	});
+	if ("error" in parsed) throw new Error(parsed.error);
+	if (parsed.state !== state) throw new Error("OAuth state mismatch - please try again");
+	ctx.progress.update("Exchanging authorization code for tokens...");
+	return require_resolve_allowlist.exchangeMSTeamsCodeForTokens({
+		tenantId: params.tenantId,
+		clientId: params.clientId,
+		clientSecret: params.clientSecret,
+		code: parsed.code,
+		verifier
+	});
+}
+//#endregion
+exports.loginMSTeamsDelegated = loginMSTeamsDelegated;

package/dist/.setup/{reaction-types-B-GEv57k.cjs → reaction-types-Ig9sQJuR.cjs}

@@ -1,4 +1,4 @@
-const require_resolve_allowlist = require("./resolve-allowlist-Ct9yxQUw.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-DdDBVCzl.cjs");
 //#region extensions/msteams/src/graph-thread.ts
 /**
 * Strip HTML tags from Teams message content, preserving @mention display names.
@@ -57,8 +57,8 @@ async function fetchChatMessageText(token, chatId, messageId, deadline) {
 * Graph API workaround for this; pagination via `@odata.nextLink` can retrieve more
 * replies but still in ascending order only.
 */
-async function fetchThreadReplies(token, groupId, channelId, messageId, limit = 50, deadline) {
-	const path = `/teams/${encodeURIComponent(groupId)}/channels/${encodeURIComponent(channelId)}/messages/${encodeURIComponent(messageId)}/replies?$top=${Math.min(Math.max(limit, 1), 50)}`;
+async function fetchThreadReplies(token, groupId, channelId, messageId, deadline) {
+	const path = `/teams/${encodeURIComponent(groupId)}/channels/${encodeURIComponent(channelId)}/messages/${encodeURIComponent(messageId)}/replies?$top=50`;
 	return (await require_resolve_allowlist.fetchGraphJson({
 		token,
 		path,

package/dist/.setup/{resolve-allowlist-Ct9yxQUw.cjs → resolve-allowlist-DdDBVCzl.cjs}

@@ -1,7 +1,7 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("../runtime-api.cjs");
-const require_bot_framework_service_url = require("./bot-framework-service-url-BUhTe8F3.cjs");
-const require_token_config = require("./token-config-DOt3XwVa.cjs");
+const require_bot_framework_service_url = require("./bot-framework-service-url-CPp4d-Q6.cjs");
+const require_token_config = require("./token-config-CqIh8z7Q.cjs");
 let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
@@ -131,12 +131,8 @@ const GRAPH_SHARED_LINK_HOST_SUFFIXES = [
 	"onedrive.com"
 ];
 function isGraphSharedLinkUrl(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		return false;
-	}
+	const parsed = URL.parse(url);
+	if (!parsed) return false;
 	const host = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(parsed.hostname);
 	if (parsed.protocol !== "https:" || !host) return false;
 	return GRAPH_SHARED_LINK_HOST_SUFFIXES.some((suffix) => host === suffix || host.endsWith(suffix.startsWith(".") ? suffix : `.${suffix}`));
@@ -161,9 +157,9 @@ function normalizeContentType(value) {
 	return `${trimmed.slice(0, parameterIndex).trim().toLowerCase()}${trimmed.slice(parameterIndex)}`;
 }
 function resolveMSTeamsMediaKind(params) {
-	const mime = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.contentType ?? "");
-	const name = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.fileName ?? "");
-	const fileType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.fileType ?? "");
+	const mime = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.contentType);
+	const name = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.fileName);
+	const fileType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(params.fileType);
 	return mime.startsWith("image/") || IMAGE_EXT_RE.test(name) || IMAGE_EXT_RE.test(`x.${fileType}`) ? "image" : "document";
 }
 function isLikelyImageAttachment(att) {
@@ -195,11 +191,7 @@ function extractHtmlFromAttachment(att) {
 	return typeof att.content.text === "string" ? att.content.text : typeof att.content.body === "string" ? att.content.body : typeof att.content.content === "string" ? att.content.content : void 0;
 }
 function fileHintFromUrl(src) {
-	try {
-		return new URL(src).pathname.split("/").pop() || void 0;
-	} catch {
-		return;
-	}
+	return URL.parse(src)?.pathname.split("/").pop() || void 0;
 }
 function extractInlineImageReferences(attachments) {
 	const out = [];
@@ -242,19 +234,16 @@ function extractInlineImageReferences(attachments) {
 	return out;
 }
 function safeHostForUrl(url) {
-	try {
-		return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(new URL(url).hostname);
-	} catch {
-		return "invalid-url";
-	}
+	const parsed = URL.parse(url);
+	return parsed ? (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(parsed.hostname) : "invalid-url";
 }
 function isMockFetchFn(fetchFn) {
 	const candidate = fetchFn;
 	return Boolean(candidate.mock || Object.hasOwn(candidate, "_isMockFunction"));
 }
-function resolveGuardedFetchImpl(params) {
-	if (!params.fetchFn) return;
-	if (params.fetchFnSupportsDispatcher === true || params.fetchFn === fetch || params.fetchFn === globalThis.fetch || isMockFetchFn(params.fetchFn)) return params.fetchFn;
+function resolveGuardedFetchImpl(fetchFn) {
+	if (!fetchFn) return;
+	if (fetchFn === fetch || fetchFn === globalThis.fetch || isMockFetchFn(fetchFn)) return fetchFn;
 	throw new Error("MSTeams attachment fetchFn must set fetchFnSupportsDispatcher to use guarded DNS pinning");
 }
 function resolveRetainedAuthorizationRedirectHostnameAllowlist(input) {
@@ -272,16 +261,6 @@ function applyAuthorizationHeaderForUrl(params) {
 	if (params.bearerToken && (0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(params.url, params.authAllowHosts)) params.headers.set("Authorization", `Bearer ${params.bearerToken}`);
 	else params.headers.delete("Authorization");
 }
-async function resolveAndValidateIP(hostname, resolveFn) {
-	const resolve = resolveFn ?? node_dns_promises.lookup;
-	let resolved;
-	try {
-		resolved = await resolve(hostname);
-	} catch {
-		throw new Error(`DNS resolution failed for "${hostname}"`);
-	}
-	if ((0, openclaw_plugin_sdk_ssrf_policy.isPrivateIpAddress)(resolved.address)) throw new Error(`Hostname "${hostname}" resolves to private/reserved IP (${resolved.address})`);
-}
 const MAX_SAFE_REDIRECTS = 5;
 function isRedirectStatus(status) {
 	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
@@ -297,62 +276,33 @@ function isRedirectStatus(status) {
 async function safeFetchWithPolicy(params) {
 	const { allowHosts, authAllowHosts } = params.policy;
 	const resolveFn = params.resolveFn ?? node_dns_promises.lookup;
-	const hasDispatcher = params.requestInit && "dispatcher" in params.requestInit;
 	const currentHeaders = new Headers(params.requestInit?.headers);
 	const currentUrl = params.url;
 	if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(currentUrl, allowHosts)) throw new Error(`Initial download URL blocked: ${currentUrl}`);
 	if (currentHeaders.has("authorization") && !(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(currentUrl, authAllowHosts)) currentHeaders.delete("authorization");
-	if (!hasDispatcher) {
-		const lookupFn = async (hostname) => {
-			const resolved = await resolveFn(hostname);
-			return [{
-				...resolved,
-				family: resolved.address.includes(":") ? 6 : 4
-			}];
-		};
-		const guarded = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
-			url: currentUrl,
-			fetchImpl: resolveGuardedFetchImpl({
-				fetchFn: params.fetchFn,
-				fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher
-			}),
-			init: {
-				...params.requestInit,
-				headers: currentHeaders
-			},
-			maxRedirects: MAX_SAFE_REDIRECTS,
-			requireHttps: true,
-			policy: (0, openclaw_plugin_sdk_ssrf_policy.buildHostnameAllowlistPolicyFromSuffixAllowlist)(allowHosts),
-			lookupFn,
-			retainAuthorizationRedirectHostnameAllowlist: resolveRetainedAuthorizationRedirectHostnameAllowlist(authAllowHosts),
-			auditContext: "msteams.attachment",
-			timeoutMs: params.timeoutMs ?? 3e4
-		});
-		return (0, openclaw_plugin_sdk_fetch_runtime.responseWithRelease)(guarded.response, guarded.release);
-	}
-	try {
-		const initialHost = new URL(currentUrl).hostname;
-		await resolveAndValidateIP(initialHost, resolveFn);
-	} catch {
-		throw new Error(`Initial download URL blocked: ${currentUrl}`);
-	}
-	const res = await (params.fetchFn ?? fetch)(currentUrl, {
-		...params.requestInit,
-		headers: currentHeaders,
-		redirect: "manual"
+	const lookupFn = async (hostname) => {
+		const resolved = await resolveFn(hostname);
+		return [{
+			...resolved,
+			family: resolved.address.includes(":") ? 6 : 4
+		}];
+	};
+	const guarded = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
+		url: currentUrl,
+		fetchImpl: resolveGuardedFetchImpl(params.fetchFn),
+		init: {
+			...params.requestInit,
+			headers: currentHeaders
+		},
+		maxRedirects: MAX_SAFE_REDIRECTS,
+		requireHttps: true,
+		policy: (0, openclaw_plugin_sdk_ssrf_policy.buildHostnameAllowlistPolicyFromSuffixAllowlist)(allowHosts),
+		lookupFn,
+		retainAuthorizationRedirectHostnameAllowlist: resolveRetainedAuthorizationRedirectHostnameAllowlist(authAllowHosts),
+		auditContext: "msteams.attachment",
+		timeoutMs: params.timeoutMs ?? 3e4
 	});
-	if (!isRedirectStatus(res.status)) return res;
-	const location = res.headers.get("location");
-	if (!location) return res;
-	let redirectUrl;
-	try {
-		redirectUrl = new URL(location, currentUrl).toString();
-	} catch {
-		throw new Error(`Invalid redirect URL: ${location}`);
-	}
-	if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(redirectUrl, allowHosts)) throw new Error(`Media redirect target blocked by allowlist: ${redirectUrl}`);
-	if (currentHeaders.has("authorization") && !(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(redirectUrl, authAllowHosts)) currentHeaders.delete("authorization");
-	return res;
+	return (0, openclaw_plugin_sdk_fetch_runtime.responseWithRelease)(guarded.response, guarded.release);
 }
 //#endregion
 //#region extensions/msteams/src/cloud.ts
@@ -361,19 +311,15 @@ const PUBLIC_MSTEAMS_SERVICE_HOST = "smba.trafficmanager.net";
 const CHINA_BOT_FRAMEWORK_SERVICE_HOST = "botframework.azure.cn";
 function normalizeOptionalServiceUrl(value) {
 	const trimmed = value?.trim();
-	if (!trimmed) return null;
-	try {
-		const parsed = new URL(trimmed);
-		parsed.hash = "";
-		parsed.search = "";
-		parsed.pathname = parsed.pathname.replace(/\/+$/, "");
-		return {
-			value: parsed.toString().replace(/\/+$/, ""),
-			host: parsed.hostname.toLowerCase()
-		};
-	} catch {
-		return null;
-	}
+	const parsed = trimmed ? URL.parse(trimmed) : null;
+	if (!parsed) return null;
+	parsed.hash = "";
+	parsed.search = "";
+	parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+	return {
+		value: parsed.toString().replace(/\/+$/, ""),
+		host: parsed.hostname.toLowerCase()
+	};
 }
 function resolveMSTeamsSdkCloudOptions(cfg) {
 	const cloud = cfg?.cloud ?? DEFAULT_MSTEAMS_CLOUD;
@@ -438,6 +384,7 @@ async function prepareMSTeamsConnectorRequest() {
 	}
 	return assertCurrent;
 }
+const msteamsConnectorEffectMiddleware = { invoke: (_context, next) => (0, openclaw_plugin_sdk_fetch_runtime.captureEffectAuthority)().initiate(next) };
 const msteamsConnectorHandoffInterceptor = { request: async ({ config }) => {
 	const assertCurrent = await prepareMSTeamsConnectorRequest();
 	if (!assertCurrent) return config;
@@ -576,7 +523,7 @@ async function createMSTeamsExpressAdapter(serverOrApp) {
 	const { ExpressAdapter } = await loadSdkModules();
 	return new ExpressAdapter(serverOrApp);
 }
-async function createMSTeamsApp(creds, options) {
+async function loadMSTeamsSdkWithAuth(creds, options) {
 	const { App, cloudFromName } = await loadSdkModules();
 	const privateQaRuntime = resolveMSTeamsPrivateQaRuntime();
 	const cloud = options?.cloud ?? "Public";
@@ -585,7 +532,8 @@ async function createMSTeamsApp(creds, options) {
 		client: privateQaRuntime?.client ?? options?.httpClient ?? {
 			headers: { "User-Agent": buildOpenClawUserAgentFragment() },
 			timeout: 3e4,
-			interceptors: [msteamsConnectorHandoffInterceptor]
+			interceptors: [msteamsConnectorHandoffInterceptor],
+			middlewares: [msteamsConnectorEffectMiddleware]
 		},
 		...privateQaRuntime ? {
 			clientSecret: "",
@@ -598,24 +546,15 @@ async function createMSTeamsApp(creds, options) {
 		...serviceUrl ? { serviceUrl } : {},
 		...options?.oauthDefaultConnectionName ? { oauth: { defaultConnectionName: options.oauthDefaultConnectionName } } : {}
 	};
-	if (creds.type === "federated") return await createFederatedApp(creds, App, {
-		clientSecret: "",
-		...appOptions
-	});
-	return new App({
+	const createApp = (auth) => ({ app: new App({
 		clientId: creds.appId,
-		clientSecret: creds.appPassword,
 		tenantId: creds.tenantId,
+		...auth,
 		...appOptions
-	});
-}
-async function createFederatedApp(creds, App, appOptions) {
-	if (creds.useManagedIdentity) return new App({
-		clientId: creds.appId,
-		tenantId: creds.tenantId,
-		managedIdentityClientId: creds.managedIdentityClientId ?? "system",
-		...appOptions
-	});
+	}) });
+	if (creds.type !== "federated") return createApp({ clientSecret: creds.appPassword });
+	appOptions.clientSecret = "";
+	if (creds.useManagedIdentity) return createApp({ managedIdentityClientId: creds.managedIdentityClientId ?? "system" });
 	if (!creds.certificatePath) throw new Error("Federated credentials require either a certificate path or managed identity.");
 	let privateKey;
 	try {
@@ -623,21 +562,13 @@ async function createFederatedApp(creds, App, appOptions) {
 	} catch {
 		throw new Error("Failed to read certificate file: the configured credential is unavailable.");
 	}
-	return createCertificateApp(creds, privateKey, App, appOptions);
-}
-function createCertificateApp(creds, privateKey, App, appOptions) {
 	let credentialPromise = null;
 	const tokenProvider = async (scope) => {
 		const token = await (await (credentialPromise ??= loadAzureIdentity().then((az) => new az.ClientCertificateCredential(creds.tenantId, creds.appId, { certificate: privateKey })))).getToken(scope);
 		if (!token?.token) throw new Error("Failed to acquire token via certificate credential.");
 		return token.token;
 	};
-	return new App({
-		clientId: creds.appId,
-		tenantId: creds.tenantId,
-		token: tokenProvider,
-		...appOptions
-	});
+	return createApp({ token: tokenProvider });
 }
 function createMSTeamsTokenProvider(app) {
 	return { async getAccessToken(scope) {
@@ -648,14 +579,9 @@ function createMSTeamsTokenProvider(app) {
 		return (await app.tokenProvider.getAppToken(app.cloud?.botScope ?? "https://api.botframework.com/.default"))?.toString() ?? "";
 	} };
 }
-async function loadMSTeamsSdkWithAuth(creds, options) {
-	return { app: await createMSTeamsApp(creds, options) };
-}
 //#endregion
 //#region extensions/msteams/src/oauth.shared.ts
 const MSTEAMS_OAUTH_REDIRECT_URI = "http://localhost:8086/oauth2callback";
-const MSTEAMS_OAUTH_CALLBACK_PORT = 8086;
-const MSTEAMS_OAUTH_CALLBACK_PATH = "/oauth2callback";
 const MSTEAMS_DEFAULT_TOKEN_FETCH_TIMEOUT_MS = 1e4;
 const MSTEAMS_DEFAULT_DELEGATED_SCOPES = [
 	"ChatMessage.Send",
@@ -874,8 +800,7 @@ async function fetchGraphAbsoluteUrl(params) {
 		url: params.url,
 		init: { headers: {
 			"User-Agent": buildUserAgent(),
-			Authorization: `Bearer ${params.token}`,
-			...params.headers
+			Authorization: `Bearer ${params.token}`
 		} },
 		auditContext: "msteams.graph.absolute",
 		timeoutMs: MSTEAMS_REQUEST_TIMEOUT_MS,
@@ -893,10 +818,6 @@ async function fetchGraphAbsoluteUrl(params) {
 		}
 	}
 }
-/**
-* Fetch all pages of a Graph API collection, following @odata.nextLink.
-* Optionally stop early when `findOne` matches an item.
-*/
 async function fetchAllGraphPages(params) {
 	const maxPages = params.maxPages ?? 50;
 	const items = [];
@@ -1016,9 +937,6 @@ async function findGraphUsersByExactIdentity(params) {
 }
 //#endregion
 //#region extensions/msteams/src/inbound.ts
-/**
-* Strip HTML tags, preserving text content.
-*/
 function htmlToPlainText(html) {
 	return (0, openclaw_plugin_sdk_html_entity_runtime.decodeHtmlEntities)(html.replace(/<[^>]*>/g, " ")).replaceAll("\xA0", " ").replace(/\s+/g, " ").trim();
 }
@@ -1081,17 +999,9 @@ function uniqueItemsById(items) {
 	}
 	return [...byId.values()];
 }
-function findExactNames(items, query) {
+function findExactMatches(items, query, fields = ["displayName"]) {
 	const normalized = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(query);
-	return uniqueItemsById(items.filter((item) => (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(item.displayName) === normalized));
-}
-function findExactUsers(items, query) {
-	const normalized = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(query);
-	return uniqueItemsById(items.filter((item) => [
-		item.displayName,
-		item.mail,
-		item.userPrincipalName
-	].some((value) => (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(value) === normalized)));
+	return uniqueItemsById(items.filter((item) => fields.some((field) => (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(item[field]) === normalized)));
 }
 function isStableMSTeamsUserId(raw) {
 	return /^[0-9a-fA-F-]{16,}$/.test(normalizeMSTeamsUserInput(raw));
@@ -1103,20 +1013,21 @@ function normalizeStaticMSTeamsAllowEntry(raw) {
 	const id = normalizeMSTeamsUserInput(trimmed);
 	return isStableMSTeamsUserId(id) ? id : void 0;
 }
-function projectStableMSTeamsUserAllowlist(entries) {
-	if (!entries) return;
-	const projected = entries.map((entry) => normalizeStaticMSTeamsAllowEntry(entry)).filter((entry) => Boolean(entry));
-	return [...new Map(projected.map((entry) => [(0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(entry), entry])).values()];
-}
-function projectStableMSTeamsGroupAllowlist(entries) {
+function projectStableMSTeamsAllowlist(entries, allowConversations) {
 	if (!entries) return;
 	const projected = entries.map((entry) => {
-		const stableUserEntry = normalizeStaticMSTeamsAllowEntry(entry);
-		if (stableUserEntry) return stableUserEntry;
+		const stable = normalizeStaticMSTeamsAllowEntry(entry);
+		if (stable || !allowConversations) return stable;
 		const conversationId = normalizeMSTeamsConversationId(normalizeMSTeamsUserInput(entry));
 		return MSTEAMS_GROUP_CONVERSATION_ID.test(conversationId) ? conversationId : void 0;
 	}).filter((entry) => Boolean(entry));
-	return [...new Map(projected.map((entry) => [MSTEAMS_GROUP_CONVERSATION_ID.test(entry) ? `conversation:${entry}` : (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(entry), entry])).values()];
+	return [...new Map(projected.map((entry) => [allowConversations && MSTEAMS_GROUP_CONVERSATION_ID.test(entry) ? `conversation:${entry}` : (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(entry), entry])).values()];
+}
+function projectStableMSTeamsUserAllowlist(entries) {
+	return projectStableMSTeamsAllowlist(entries, false);
+}
+function projectStableMSTeamsGroupAllowlist(entries) {
+	return projectStableMSTeamsAllowlist(entries, true);
 }
 function stripProviderPrefix(raw) {
 	return raw.replace(/^(msteams|teams):/i, "");
@@ -1283,7 +1194,7 @@ async function resolveMSTeamsChannelAllowlist(params) {
 					resolved: false,
 					note: "team lookup incomplete"
 				};
-				const exactTeams = findExactNames(result.items, team);
+				const exactTeams = findExactMatches(result.items, team);
 				const [exactTeam] = exactTeams;
 				if (!exactTeam) return {
 					input,
@@ -1327,7 +1238,7 @@ async function resolveMSTeamsChannelAllowlist(params) {
 					note: "channel lookup failed"
 				};
 			}
-			const generalChannels = findExactNames(teamChannels, "general");
+			const generalChannels = findExactMatches(teamChannels, "general");
 			if (params.teamIdMode !== "graph" && generalChannels.length !== 1) return {
 				input,
 				resolved: false,
@@ -1344,7 +1255,7 @@ async function resolveMSTeamsChannelAllowlist(params) {
 				teamName
 			};
 			const channelById = teamChannels.find((item) => item.id === channel);
-			const exactChannels = channelById ? [channelById] : findExactNames(teamChannels, channel);
+			const exactChannels = channelById ? [channelById] : findExactMatches(teamChannels, channel);
 			if (exactChannels.length === 0) return {
 				input,
 				resolved: false,
@@ -1458,7 +1369,7 @@ async function resolveMSTeamsUserAllowlist(params) {
 	return await (0, openclaw_plugin_sdk_allow_from.mapAllowlistResolutionInputs)({
 		inputs: params.entries,
 		mapInput: async (input) => {
-			const query = normalizeQuery(normalizeMSTeamsUserInput(input));
+			const query = normalizeMSTeamsUserInput(input);
 			if (!query) return {
 				input,
 				resolved: false
@@ -1477,7 +1388,11 @@ async function resolveMSTeamsUserAllowlist(params) {
 				resolved: false,
 				note: "user lookup incomplete"
 			};
-			const users = findExactUsers(result.items, query);
+			const users = findExactMatches(result.items, query, [
+				"displayName",
+				"mail",
+				"userPrincipalName"
+			]);
 			const [match] = users;
 			if (!match) return {
 				input,
@@ -1523,18 +1438,6 @@ Object.defineProperty(exports, "MSTEAMS_DEFAULT_DELEGATED_SCOPES", {
 		return MSTEAMS_DEFAULT_DELEGATED_SCOPES;
 	}
 });
-Object.defineProperty(exports, "MSTEAMS_OAUTH_CALLBACK_PATH", {
-	enumerable: true,
-	get: function() {
-		return MSTEAMS_OAUTH_CALLBACK_PATH;
-	}
-});
-Object.defineProperty(exports, "MSTEAMS_OAUTH_CALLBACK_PORT", {
-	enumerable: true,
-	get: function() {
-		return MSTEAMS_OAUTH_CALLBACK_PORT;
-	}
-});
 Object.defineProperty(exports, "MSTEAMS_OAUTH_REDIRECT_URI", {
 	enumerable: true,
 	get: function() {

package/dist/.setup/{send-7VV1iCai.cjs → send-rJpcVtRp.cjs}

@@ -1,11 +1,11 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("../runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-Ct9yxQUw.cjs");
-const require_bot_framework_service_url = require("./bot-framework-service-url-BUhTe8F3.cjs");
-const require_token_config = require("./token-config-DOt3XwVa.cjs");
-const require_channel = require("./channel-BFhXodl2.cjs");
-const require_channel_setup = require("./channel.setup-ss0TO-ap.cjs");
-const require_conversation_store_state = require("./conversation-store-state-f7V8CVNy.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-DdDBVCzl.cjs");
+const require_bot_framework_service_url = require("./bot-framework-service-url-CPp4d-Q6.cjs");
+const require_token_config = require("./token-config-CqIh8z7Q.cjs");
+const require_channel = require("./channel-Cifn9fsv.cjs");
+const require_channel_setup = require("./channel.setup-BjbHugkL.cjs");
+const require_conversation_store_state = require("./conversation-store-state-DprmOfl7.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
@@ -196,13 +196,13 @@ function createMSTeamsSendReceipt(params) {
 	return receipt;
 }
 function createMSTeamsSendResult(params) {
-	const platformMessageIds = (params.platformMessageIds?.length ? [...params.platformMessageIds] : [params.messageId]).map((messageId) => messageId.trim()).filter((messageId) => messageId && messageId !== "unknown");
+	const platformMessageId = params.messageId.trim();
 	return {
 		messageId: params.messageId,
 		conversationId: params.conversationId,
 		receipt: createMSTeamsSendReceipt({
 			conversationId: params.conversationId,
-			platformMessageIds,
+			platformMessageIds: platformMessageId && platformMessageId !== "unknown" ? [platformMessageId] : [],
 			kind: params.kind
 		}),
 		...params.pendingUploadId ? { pendingUploadId: params.pendingUploadId } : {}
@@ -386,7 +386,6 @@ async function sendTextWithMedia(ctx, text, mediaUrl, options) {
 			app,
 			conversationRef: ref,
 			messages,
-			retry: {},
 			onRetry: (event) => {
 				log.debug?.("retrying send", {
 					conversationId,

package/dist/.setup/{setup-plugin-api-B0OFG32J.cjs → setup-plugin-api-DfoVOqMJ.cjs}

@@ -1,3 +1,3 @@
-const require_channel_setup = require("./channel.setup-ss0TO-ap.cjs");
+const require_channel_setup = require("./channel.setup-BjbHugkL.cjs");
 require("../setup-plugin-api.cjs");
 exports.msteamsSetupPlugin = require_channel_setup.msteamsSetupPlugin;

package/dist/.setup/{thread-session-ClI-lSyG.cjs → thread-session-B74FC1Id.cjs}

@@ -1,4 +1,4 @@
-const require_resolve_allowlist = require("./resolve-allowlist-Ct9yxQUw.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-DdDBVCzl.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_approval_auth_runtime = require("openclaw/plugin-sdk/approval-auth-runtime");
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");

package/dist/.setup/{token-config-DOt3XwVa.cjs → token-config-CqIh8z7Q.cjs}

@@ -5,12 +5,11 @@ let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input
 const MSTEAMS_DELEGATED_TOKEN_LEGACY_FILENAME = "msteams-delegated.json";
 const MSTEAMS_DELEGATED_TOKEN_NAMESPACE = "delegated-token";
 const MSTEAMS_DELEGATED_TOKEN_KEY = "current";
-function openDelegatedTokenStore(env) {
+function openDelegatedTokenStore() {
 	return require_runtime.getMSTeamsRuntime().state.openKeyedStore({
 		namespace: MSTEAMS_DELEGATED_TOKEN_NAMESPACE,
 		maxEntries: 1,
-		overflowPolicy: "reject-new",
-		...env ? { env } : {}
+		overflowPolicy: "reject-new"
 	});
 }
 function normalizeMSTeamsDelegatedTokens(value) {
@@ -25,13 +24,13 @@ function normalizeMSTeamsDelegatedTokens(value) {
 		...typeof token.userPrincipalName === "string" ? { userPrincipalName: token.userPrincipalName } : {}
 	};
 }
-async function loadMSTeamsDelegatedTokens(env) {
-	return normalizeMSTeamsDelegatedTokens(await openDelegatedTokenStore(env).lookup("current")) ?? void 0;
+async function loadMSTeamsDelegatedTokens() {
+	return normalizeMSTeamsDelegatedTokens(await openDelegatedTokenStore().lookup("current")) ?? void 0;
 }
-async function saveMSTeamsDelegatedTokens(tokens, env) {
+async function saveMSTeamsDelegatedTokens(tokens) {
 	const normalized = normalizeMSTeamsDelegatedTokens(tokens);
 	if (!normalized) throw new Error("Invalid Microsoft Teams delegated token payload");
-	await openDelegatedTokenStore(env).register(MSTEAMS_DELEGATED_TOKEN_KEY, normalized);
+	await openDelegatedTokenStore().register(MSTEAMS_DELEGATED_TOKEN_KEY, normalized);
 }
 //#endregion
 //#region extensions/msteams/src/token-config.ts

package/dist/api.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./.setup/channel-BFhXodl2.cjs");
-const require_channel_setup = require("./.setup/channel.setup-ss0TO-ap.cjs");
+const require_channel = require("./.setup/channel-Cifn9fsv.cjs");
+const require_channel_setup = require("./.setup/channel.setup-BjbHugkL.cjs");
 exports.createMSTeamsSetupWizardBase = require_channel_setup.createMSTeamsSetupWizardBase;
 exports.msteamsPlugin = require_channel.msteamsPlugin;
 exports.msteamsSetupAdapter = require_channel_setup.msteamsSetupAdapter;

package/dist/channel-config-api.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_config_schema = require("./.setup/config-schema-0KoBzb0t.cjs");
+const require_config_schema = require("./.setup/config-schema-Dk0mRIam.cjs");
 exports.MSTeamsChannelConfigSchema = require_config_schema.MSTeamsChannelConfigSchema;

package/dist/channel-plugin-api.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./.setup/channel-BFhXodl2.cjs");
+const require_channel = require("./.setup/channel-Cifn9fsv.cjs");
 exports.msteamsPlugin = require_channel.msteamsPlugin;

package/dist/directory-contract-api.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_resolve_allowlist = require("./.setup/resolve-allowlist-Ct9yxQUw.cjs");
-const require_token_config = require("./.setup/token-config-DOt3XwVa.cjs");
+const require_resolve_allowlist = require("./.setup/resolve-allowlist-DdDBVCzl.cjs");
+const require_token_config = require("./.setup/token-config-CqIh8z7Q.cjs");
 let openclaw_plugin_sdk_directory_runtime = require("openclaw/plugin-sdk/directory-runtime");
 const msteamsDirectoryContractPlugin = {
 	id: "msteams",