@openclaw/msteams 2026.10.10 → 2026.11.5-beta.1

package/dist/.setup/{resolve-allowlist-CqNzS9bZ.cjs → resolve-allowlist-Drj1jaq0.cjs}

@@ -1,8 +1,8 @@
 const require_bot_framework_service_url = require("./bot-framework-service-url-CgVuKiIR.cjs");
-const require_token_config = require("./token-config-DTZ00Ibq.cjs");
+const require_token_config = require("./token-config-7K6UbNCo.cjs");
 const require_runtime = require("./runtime-CbKazLGv.cjs");
 require("../runtime-api.cjs");
-const require_delegated_state = require("./delegated-state-CbMd3rIh.cjs");
+const require_delegated_state = require("./delegated-state-DhIHahf1.cjs");
 let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
@@ -14,13 +14,14 @@ let openclaw_plugin_sdk_fetch_runtime = require("openclaw/plugin-sdk/fetch-runti
 let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
 let node_buffer = require("node:buffer");
-let node_dns_promises = require("node:dns/promises");
 let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
 let openclaw_plugin_sdk_secret_file = require("openclaw/plugin-sdk/secret-file");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let node_module = require("node:module");
+let node_crypto = require("node:crypto");
+let openclaw_plugin_sdk_provider_oauth_runtime = require("openclaw/plugin-sdk/provider-oauth-runtime");
 let openclaw_plugin_sdk_html_entity_runtime = require("openclaw/plugin-sdk/html-entity-runtime");
 // extensions/msteams/src/accounts.ts
 const { listAccountIds, resolveDefaultAccountId } = (0, openclaw_plugin_sdk_account_helpers.createAccountListHelpers)("msteams", {
@@ -169,6 +170,20 @@ function inspectMSTeamsAccount(params) {
 		path: account.config.webhook?.path ?? "/api/messages"
 	};
 }
+// extensions/msteams/src/microsoft-hosts.ts
+const GRAPH_HOSTS = [
+	"graph.microsoft.com",
+	"graph.microsoft.us",
+	"graph.microsoft.de",
+	"graph.microsoft.cn"
+];
+const SHAREPOINT_HOSTS = [
+	"sharepoint.com",
+	"sharepoint.us",
+	"sharepoint.de",
+	"sharepoint.cn",
+	"sharepoint-df.com"
+];
 // extensions/msteams/src/request-timeout.ts
 const MSTEAMS_REQUEST_TIMEOUT_MS = 3e4;
 const MSTEAMS_SHAREPOINT_UPLOAD_BASE_TIMEOUT_MS = 3e5;
@@ -227,7 +242,7 @@ const IMAGE_EXT_RE = /\.(avif|bmp|gif|heic|heif|jpe?g|png|tiff?|webp)$/i;
 * tag wins, and a quoted value may contain `>`. Each `<tag` start is resolved from
 * precomputed next-`>` and next-quote positions in one forward pass.
 */
-function htmlTagAttributeValues(html, tag, attr) {
+function htmlTagAttributeValues(html, tag, attr, visit) {
 	const length = html.length;
 	const nextGt = new Int32Array(length + 1).fill(length);
 	const nextQuote = new Int32Array(length + 1).fill(length);
@@ -257,13 +272,37 @@ function htmlTagAttributeValues(html, tag, attr) {
 		while (pastWindow < candidates.length && candidates[pastWindow].start <= lastStart) pastWindow += 1;
 		const candidate = candidates[pastWindow - 1];
 		if (candidate && candidate.start > nameEnd) {
-			values.push(html.slice(candidate.valueStart, candidate.valueEnd));
+			const value = html.slice(candidate.valueStart, candidate.valueEnd);
+			if (visit) visit(value, open.index, candidate.end);
+			else values.push(value);
 			resumeAt = candidate.end;
 		}
 	}
 	return values;
 }
 const GRAPH_HOSTED_CONTENT_SRC_RE = /\/hostedContents\/([^/?#]+)/i;
+const TEAMS_EMOJI_CDN_HOST = "statics.teams.cdn.office.net";
+const TEAMS_EMOJI_ASSET_PATH_RE = /\/emoji([/?#]|$)/i;
+const IMG_ALT_ATTR_RE = /\balt=["']([^"']*)["']/i;
+const EMOJI_PICTOGRAPHIC_RE = /\p{Extended_Pictographic}/u;
+function isTeamsEmojiSpriteImage(src, imgTag) {
+	const url = URL.parse(src);
+	const host = url?.hostname.toLowerCase() ?? "";
+	if (host !== TEAMS_EMOJI_CDN_HOST && !host.endsWith(`.${TEAMS_EMOJI_CDN_HOST}`)) return false;
+	return TEAMS_EMOJI_ASSET_PATH_RE.test(url?.pathname ?? "") || EMOJI_PICTOGRAPHIC_RE.test(IMG_ALT_ATTR_RE.exec(imgTag)?.[1] ?? "");
+}
+function replaceTeamsEmojiSpriteImagesWithAltText(html) {
+	const parts = [];
+	let cursor = 0;
+	htmlTagAttributeValues(html, "img", "src", (src, start, end) => {
+		const imgTag = html.slice(start, end);
+		if (isTeamsEmojiSpriteImage(src.trim(), imgTag)) {
+			parts.push(html.slice(cursor, start), IMG_ALT_ATTR_RE.exec(imgTag)?.[1] ?? "");
+			cursor = end;
+		}
+	});
+	return parts.join("") + html.slice(cursor);
+}
 function resolveInlineImageSourceId(src) {
 	const hostedContentId = GRAPH_HOSTED_CONTENT_SRC_RE.exec(src)?.[1];
 	if (!hostedContentId) return src;
@@ -274,15 +313,8 @@ function resolveInlineImageSourceId(src) {
 	}
 }
 const DEFAULT_MEDIA_HOST_ALLOWLIST = [
-	"graph.microsoft.com",
-	"graph.microsoft.us",
-	"graph.microsoft.de",
-	"graph.microsoft.cn",
-	"sharepoint.com",
-	"sharepoint.us",
-	"sharepoint.de",
-	"sharepoint.cn",
-	"sharepoint-df.com",
+	...GRAPH_HOSTS,
+	...SHAREPOINT_HOSTS,
 	"1drv.ms",
 	"onedrive.com",
 	"teams.microsoft.com",
@@ -304,10 +336,7 @@ const DEFAULT_MEDIA_AUTH_HOST_ALLOWLIST = [
 	"botframework.com",
 	"smba.trafficmanager.net",
 	"botframework.azure.cn",
-	"graph.microsoft.com",
-	"graph.microsoft.us",
-	"graph.microsoft.de",
-	"graph.microsoft.cn"
+	...GRAPH_HOSTS
 ];
 const GRAPH_ROOT = "https://graph.microsoft.com/v1.0";
 /**
@@ -319,11 +348,7 @@ const GRAPH_ROOT = "https://graph.microsoft.com/v1.0";
 * https://learn.microsoft.com/en-us/graph/api/shares-get for the encoding.
 */
 const GRAPH_SHARED_LINK_HOST_SUFFIXES = [
-	".sharepoint.com",
-	".sharepoint.us",
-	".sharepoint.de",
-	".sharepoint.cn",
-	".sharepoint-df.com",
+	...SHAREPOINT_HOSTS.map((host) => `.${host}`),
 	"1drv.ms",
 	"onedrive.live.com",
 	"onedrive.com"
@@ -401,7 +426,7 @@ function extractInlineImageReferences(attachments) {
 	for (const att of attachments) {
 		const html = extractHtmlFromAttachment(att);
 		if (!html) continue;
-		for (const value of htmlTagAttributeValues(html, "img", "src")) {
+		for (const value of htmlTagAttributeValues(replaceTeamsEmojiSpriteImagesWithAltText(html), "img", "src")) {
 			const src = value.trim();
 			if (src) {
 				if (src.startsWith("data:")) out.push({
@@ -434,15 +459,6 @@ function safeHostForUrl(url) {
 	const parsed = URL.parse(url);
 	return parsed ? (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(parsed.hostname) : "invalid-url";
 }
-function isMockFetchFn(fetchFn) {
-	const candidate = fetchFn;
-	return Boolean(candidate.mock || Object.hasOwn(candidate, "_isMockFunction"));
-}
-function resolveGuardedFetchImpl(fetchFn) {
-	if (!fetchFn) return;
-	if (fetchFn === fetch || fetchFn === globalThis.fetch || isMockFetchFn(fetchFn)) return fetchFn;
-	throw new Error("MSTeams attachment fetchFn must set fetchFnSupportsDispatcher to use guarded DNS pinning");
-}
 function resolveRetainedAuthorizationRedirectHostnameAllowlist(input) {
 	if (!input) return;
 	if (input.includes("*")) return ["*"];
@@ -464,21 +480,20 @@ function isRedirectStatus(status) {
 }
 /**
 * Fetch a URL with redirect: "manual", validating each redirect target
-* against the hostname allowlist and optional DNS-resolved IP (anti-SSRF).
+* against the hostname allowlist and DNS-resolved IP (anti-SSRF).
 *
 * This prevents:
 * - Auto-following redirects to non-allowlisted hosts
-* - DNS rebinding attacks when a lookup function is provided
+* - DNS rebinding attacks through the pinned DNS lookup
 */
 async function safeFetchWithPolicy(params) {
 	const { allowHosts, authAllowHosts } = params.policy;
-	const resolveFn = params.resolveFn ?? node_dns_promises.lookup;
 	const currentHeaders = new Headers(params.requestInit?.headers);
 	const currentUrl = params.url;
 	if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(currentUrl, allowHosts)) throw new Error(`Initial download URL blocked: ${currentUrl}`);
 	if (currentHeaders.has("authorization") && !(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(currentUrl, authAllowHosts)) currentHeaders.delete("authorization");
 	const lookupFn = async (hostname) => {
-		const resolved = await resolveFn(hostname);
+		const resolved = await params.resolveFn(hostname);
 		return [{
 			...resolved,
 			family: resolved.address.includes(":") ? 6 : 4
@@ -486,7 +501,6 @@ async function safeFetchWithPolicy(params) {
 	};
 	const guarded = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 		url: currentUrl,
-		fetchImpl: resolveGuardedFetchImpl(params.fetchFn),
 		init: {
 			...params.requestInit,
 			headers: currentHeaders
@@ -792,7 +806,7 @@ const EXPIRY_BUFFER_MS = 3e5;
 function parseMSTeamsTokenResponse(data, failureLabel) {
 	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(data)) throw new Error(`MSTeams ${failureLabel} failed: invalid token response fields`);
 	const expiresAt = (0, openclaw_plugin_sdk_number_runtime.resolveExpiresAtMsFromDurationSeconds)(data.expires_in, { bufferMs: EXPIRY_BUFFER_MS });
-	if (typeof data.access_token !== "string" || !data.access_token || expiresAt === void 0 || data.refresh_token !== void 0 && typeof data.refresh_token !== "string" || data.scope !== void 0 && typeof data.scope !== "string") throw new Error(`MSTeams ${failureLabel} failed: invalid token response fields`);
+	if (typeof data.access_token !== "string" || !data.access_token || expiresAt === void 0 || data.refresh_token !== void 0 && (typeof data.refresh_token !== "string" || !data.refresh_token) || data.scope !== void 0 && typeof data.scope !== "string") throw new Error(`MSTeams ${failureLabel} failed: invalid token response fields`);
 	return {
 		access_token: data.access_token,
 		refresh_token: data.refresh_token,
@@ -801,7 +815,11 @@ function parseMSTeamsTokenResponse(data, failureLabel) {
 	};
 }
 async function fetchMSTeamsTokens(params) {
+	let dispatched = false;
 	const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
+		beforeRequest: () => {
+			dispatched = true;
+		},
 		url: params.tokenUrl,
 		init: {
 			method: "POST",
@@ -813,10 +831,56 @@ async function fetchMSTeamsTokens(params) {
 			signal: AbortSignal.timeout(MSTEAMS_DEFAULT_TOKEN_FETCH_TIMEOUT_MS)
 		},
 		auditContext: params.auditContext
+	}).catch((cause) => {
+		if (!params.refresh) throw cause;
+		throw (0, openclaw_plugin_sdk_provider_oauth_runtime.createOAuthRefreshError)("MSTeams refresh transport failed", dispatched ? {
+			version: 1,
+			phase: "token-response",
+			outcome: "unchanged",
+			recovery: {
+				kind: "later",
+				evidence: "documented-reusable-grant"
+			}
+		} : {
+			version: 1,
+			phase: "before-dispatch",
+			outcome: "not-attempted",
+			recovery: {
+				kind: "later",
+				evidence: "dispatch-not-started"
+			}
+		}, { cause });
 	});
 	try {
-		if (!response.ok) throw await (0, openclaw_plugin_sdk_provider_http.createProviderHttpError)(response, `MSTeams ${params.failureLabel} failed`);
-		return parseMSTeamsTokenResponse(await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `MSTeams ${params.failureLabel} failed`), params.failureLabel);
+		if (!response.ok && !params.refresh) throw await (0, openclaw_plugin_sdk_provider_http.createProviderHttpError)(response, `MSTeams ${params.failureLabel} failed`);
+		let data;
+		try {
+			data = await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `MSTeams ${params.failureLabel} failed`);
+		} catch (cause) {
+			if (!params.refresh) throw cause;
+			if (!response.ok) throw (0, openclaw_plugin_sdk_provider_oauth_runtime.createOAuthRefreshResponseError)("MSTeams token refresh", response.status, void 0, "documented-reusable-grant");
+			throw (0, openclaw_plugin_sdk_provider_oauth_runtime.createOAuthRefreshError)("MSTeams refresh response could not be read", {
+				version: 1,
+				phase: "token-response",
+				outcome: "unchanged",
+				recovery: {
+					kind: "later",
+					evidence: "documented-reusable-grant"
+				}
+			}, { cause });
+		}
+		if (params.refresh && (!response.ok || (0, openclaw_plugin_sdk_provider_oauth_runtime.readOAuthRefreshErrorReason)(data))) throw (0, openclaw_plugin_sdk_provider_oauth_runtime.createOAuthRefreshResponseError)("MSTeams token refresh", response.status, data, "documented-reusable-grant");
+		try {
+			return parseMSTeamsTokenResponse(data, params.failureLabel);
+		} catch (cause) {
+			if (!params.refresh) throw cause;
+			throw (0, openclaw_plugin_sdk_provider_oauth_runtime.createOAuthRefreshError)("MSTeams refresh response fields are invalid", {
+				version: 1,
+				phase: "after-token-response",
+				outcome: "unknown",
+				status: response.status
+			}, { cause });
+		}
 	} finally {
 		await release();
 	}
@@ -834,7 +898,8 @@ async function requestMSTeamsDelegatedTokens(params) {
 		tokenUrl: buildMSTeamsTokenEndpoint(params.tenantId),
 		body,
 		auditContext: params.auditContext,
-		failureLabel: params.failureLabel
+		failureLabel: params.failureLabel,
+		refresh: params.grantType === "refresh_token"
 	});
 	return {
 		accessToken: data.access_token,
@@ -849,7 +914,6 @@ async function exchangeMSTeamsCodeForTokens(params) {
 		clientId: params.clientId,
 		clientSecret: params.clientSecret,
 		grantType: "authorization_code",
-		scopes: params.scopes,
 		values: {
 			code: params.code,
 			redirect_uri: MSTEAMS_OAUTH_REDIRECT_URI,
@@ -877,22 +941,67 @@ async function refreshMSTeamsDelegatedTokens(params) {
 	});
 }
 // extensions/msteams/src/token.ts
+const refreshes = /* @__PURE__ */ new WeakMap();
 async function resolveDelegatedAccessToken(params) {
-	const tokens = await require_delegated_state.loadMSTeamsDelegatedTokens(params.accountId);
-	if (!tokens) return;
+	const runtime = require_runtime.getMSTeamsRuntime();
+	const callerKey = (0, node_crypto.createHash)("sha256").update(JSON.stringify([
+		runtime.state.resolveStateDir(),
+		require_delegated_state.resolveMSTeamsAccountStateNamespace("delegated-token", params.accountId),
+		params.tenantId,
+		params.clientId,
+		params.clientSecret
+	])).digest("hex");
+	const state = await require_delegated_state.loadMSTeamsDelegatedTokenState(params.accountId);
+	const tokens = require_delegated_state.normalizeMSTeamsDelegatedTokens(state);
+	const active = refreshes.get(runtime) ?? /* @__PURE__ */ new Map();
+	refreshes.set(runtime, active);
+	if (state && "refreshClaim" in state && state.callerKey === callerKey) {
+		const pending = active.get(state.requestKey);
+		if (pending) return await pending;
+	}
+	if (!tokens) return state && "refreshClaim" in state && state.callerKey === callerKey ? await active.get(state.requestKey) : void 0;
 	if ((0, openclaw_plugin_sdk_number_runtime.isFutureDateTimestampMs)(tokens.expiresAt)) return tokens.accessToken;
+	const key = (0, node_crypto.createHash)("sha256").update(JSON.stringify([callerKey, tokens])).digest("hex");
+	const pending = active.get(key);
+	if (pending) return await pending;
+	const task = (async () => {
+		try {
+			const claim = await require_delegated_state.claimMSTeamsDelegatedTokenRefresh(tokens, key, callerKey, params.accountId);
+			if (!claim) return;
+			let refreshed;
+			try {
+				if (require_runtime.getMSTeamsRuntime() !== runtime) throw (0, openclaw_plugin_sdk_provider_oauth_runtime.createOAuthRefreshError)("Microsoft Teams token owner changed before refresh dispatch", {
+					version: 1,
+					phase: "before-dispatch",
+					outcome: "not-attempted",
+					recovery: {
+						kind: "later",
+						evidence: "dispatch-not-started"
+					}
+				});
+				refreshed = await refreshMSTeamsDelegatedTokens({
+					...params,
+					refreshToken: tokens.refreshToken,
+					scopes: tokens.scopes
+				});
+			} catch (error) {
+				if ((0, openclaw_plugin_sdk_provider_oauth_runtime.isRecoverableOAuthRefreshFailure)(error)) await claim.settle(tokens);
+				else await claim.reject();
+				return;
+			}
+			return await claim.settle({
+				...tokens,
+				...refreshed
+			}) ? refreshed.accessToken : void 0;
+		} catch {
+			return;
+		}
+	})();
+	active.set(key, task);
 	try {
-		const refreshed = await refreshMSTeamsDelegatedTokens({
-			tenantId: params.tenantId,
-			clientId: params.clientId,
-			clientSecret: params.clientSecret,
-			refreshToken: tokens.refreshToken,
-			scopes: tokens.scopes
-		});
-		await require_delegated_state.saveMSTeamsDelegatedTokens(refreshed, params.accountId);
-		return refreshed.accessToken;
-	} catch {
-		return;
+		return await task;
+	} finally {
+		if (active.get(key) === task) active.delete(key);
 	}
 }
 // extensions/msteams/src/graph.ts
@@ -910,9 +1019,6 @@ function captureGraphRequestCurrentness(assertReadAuthority) {
 		assertCurrent();
 	};
 }
-function normalizeQuery(value) {
-	return value?.trim() ?? "";
-}
 function escapeOData(value) {
 	return value.replace(/'/g, "''");
 }
@@ -1053,9 +1159,6 @@ async function resolveGraphToken(cfg, options) {
 	if (!accessToken) throw new Error("MS Teams graph token unavailable");
 	return accessToken;
 }
-async function listTeamsByName(token, query) {
-	return (await listTeamsByNameWithPageInfo(token, query)).items;
-}
 async function listTeamsByNameWithPageInfo(token, query) {
 	const filter = `resourceProvisioningOptions/Any(x:x eq 'Team') and startsWith(displayName,'${escapeOData(query)}')`;
 	return await fetchAllGraphPages({
@@ -1071,9 +1174,6 @@ async function deleteGraphRequest(params) {
 		errorPrefix: "Graph DELETE"
 	})).body?.cancel().catch(() => void 0);
 }
-async function listChannelsForTeam(token, teamId) {
-	return (await listChannelsForTeamWithPageInfo(token, teamId)).items;
-}
 async function listChannelsForTeamWithPageInfo(token, teamId) {
 	return await fetchAllGraphPages({
 		token,
@@ -1093,7 +1193,7 @@ async function searchGraphUsers(params) {
 			path
 		})).value ?? [];
 	}
-	const top = typeof params.top === "number" && params.top > 0 ? params.top : 10;
+	const top = params.top !== void 0 && params.top > 0 ? params.top : 10;
 	const path = `/users?$search=${encodeURIComponent(`"displayName:${query}"`)}&$select=id,displayName,mail,userPrincipalName&$top=${top}`;
 	return (await fetchGraphJson({
 		token: params.token,
@@ -1190,6 +1290,22 @@ function parseMSTeamsActivityTimestamp(value) {
 function stripMSTeamsMentionTags(text) {
 	return text.replace(/<at[^>]*>.*?<\/at>/gi, "").trim();
 }
+function normalizeMSTeamsMentionTags(text, activity, options = {}) {
+	const normalizeTag = (tag) => tag.trim().replace(/<\/?at\b/gi, (delimiter) => delimiter.toLowerCase());
+	const botId = activity.recipient?.id;
+	const botMentions = /* @__PURE__ */ new Map();
+	for (const entity of activity.entities ?? []) {
+		if (entity.type !== "mention" || typeof entity.text !== "string") continue;
+		const tag = normalizeTag(entity.text);
+		const isBot = Boolean(botId && entity.mentioned?.id === botId);
+		botMentions.set(tag, isBot && botMentions.get(tag) !== false);
+	}
+	return text.replace(/<at\b[^>]*>([\s\S]*?)<\/at\s*>/gi, (tag, label) => {
+		if (botMentions.get(normalizeTag(tag))) return options.preserveHtml ? " " : "";
+		const displayName = htmlToPlainText(label);
+		return displayName ? `@${options.preserveHtml ? label : displayName}` : "";
+	}).trim();
+}
 function wasMSTeamsBotMentioned(activity) {
 	const botId = activity.recipient?.id;
 	if (!botId) return false;
@@ -1203,27 +1319,22 @@ function keepConfiguredMSTeamsAllowlistActive(configured, projected) {
 	if (!Array.isArray(configured) || configured.every((entry) => !entry?.trim())) return projected;
 	return projected && projected.length > 0 ? projected : [MSTEAMS_UNMATCHABLE_THREAD_ID];
 }
-function uniqueItemsById(items) {
+function findExactMatches(items, query, fields = ["displayName"]) {
+	const normalized = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(query);
 	const byId = /* @__PURE__ */ new Map();
 	for (const item of items) {
+		if (!fields.some((field) => (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(item[field]) === normalized)) continue;
 		const id = item.id?.trim();
 		if (id && !byId.has(id)) byId.set(id, item);
 	}
 	return [...byId.values()];
 }
-function findExactMatches(items, query, fields = ["displayName"]) {
-	const normalized = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(query);
-	return uniqueItemsById(items.filter((item) => fields.some((field) => (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(item[field]) === normalized)));
-}
-function isStableMSTeamsUserId(raw) {
-	return /^[0-9a-fA-F-]{16,}$/.test(normalizeMSTeamsUserInput(raw));
-}
 function normalizeStaticMSTeamsAllowEntry(raw) {
 	const trimmed = raw.trim();
 	if (!trimmed) return;
 	if (trimmed === "*" || /^accessGroup:/i.test(trimmed)) return trimmed;
 	const id = normalizeMSTeamsUserInput(trimmed);
-	return isStableMSTeamsUserId(id) ? id : void 0;
+	return /^[0-9a-fA-F-]{16,}$/.test(normalizeMSTeamsUserInput(id)) ? id : void 0;
 }
 function projectStableMSTeamsAllowlist(entries, allowConversations) {
 	if (!entries) return;
@@ -1645,11 +1756,17 @@ async function resolveMSTeamsUserAllowlist(params) {
 				input,
 				resolved: true,
 				id: match.id,
-				name: match.displayName ?? void 0
+				name: match.displayName
 			};
 		}
 	});
 }
+Object.defineProperty(exports, "GRAPH_HOSTS", {
+	enumerable: true,
+	get: function() {
+		return GRAPH_HOSTS;
+	}
+});
 Object.defineProperty(exports, "GRAPH_ROOT", {
 	enumerable: true,
 	get: function() {
@@ -1674,6 +1791,12 @@ Object.defineProperty(exports, "MSTEAMS_REQUEST_TIMEOUT_MS", {
 		return MSTEAMS_REQUEST_TIMEOUT_MS;
 	}
 });
+Object.defineProperty(exports, "SHAREPOINT_HOSTS", {
+	enumerable: true,
+	get: function() {
+		return SHAREPOINT_HOSTS;
+	}
+});
 Object.defineProperty(exports, "applyAuthorizationHeaderForUrl", {
 	enumerable: true,
 	get: function() {
@@ -1842,12 +1965,6 @@ Object.defineProperty(exports, "keepConfiguredMSTeamsAllowlistActive", {
 		return keepConfiguredMSTeamsAllowlistActive;
 	}
 });
-Object.defineProperty(exports, "listChannelsForTeam", {
-	enumerable: true,
-	get: function() {
-		return listChannelsForTeam;
-	}
-});
 Object.defineProperty(exports, "listChannelsForTeamWithPageInfo", {
 	enumerable: true,
 	get: function() {
@@ -1860,10 +1977,10 @@ Object.defineProperty(exports, "listMSTeamsAccountIds", {
 		return listMSTeamsAccountIds;
 	}
 });
-Object.defineProperty(exports, "listTeamsByName", {
+Object.defineProperty(exports, "listTeamsByNameWithPageInfo", {
 	enumerable: true,
 	get: function() {
-		return listTeamsByName;
+		return listTeamsByNameWithPageInfo;
 	}
 });
 Object.defineProperty(exports, "loadMSTeamsSdkWithAuth", {
@@ -1902,22 +2019,22 @@ Object.defineProperty(exports, "normalizeMSTeamsConversationId", {
 		return normalizeMSTeamsConversationId;
 	}
 });
-Object.defineProperty(exports, "normalizeMSTeamsMessagingTarget", {
+Object.defineProperty(exports, "normalizeMSTeamsMentionTags", {
 	enumerable: true,
 	get: function() {
-		return normalizeMSTeamsMessagingTarget;
+		return normalizeMSTeamsMentionTags;
 	}
 });
-Object.defineProperty(exports, "normalizeMSTeamsUserInput", {
+Object.defineProperty(exports, "normalizeMSTeamsMessagingTarget", {
 	enumerable: true,
 	get: function() {
-		return normalizeMSTeamsUserInput;
+		return normalizeMSTeamsMessagingTarget;
 	}
 });
-Object.defineProperty(exports, "normalizeQuery", {
+Object.defineProperty(exports, "normalizeMSTeamsUserInput", {
 	enumerable: true,
 	get: function() {
-		return normalizeQuery;
+		return normalizeMSTeamsUserInput;
 	}
 });
 Object.defineProperty(exports, "parseMSTeamsActivityTimestamp", {
@@ -1962,6 +2079,12 @@ Object.defineProperty(exports, "projectStableMSTeamsUserAllowlist", {
 		return projectStableMSTeamsUserAllowlist;
 	}
 });
+Object.defineProperty(exports, "replaceTeamsEmojiSpriteImagesWithAltText", {
+	enumerable: true,
+	get: function() {
+		return replaceTeamsEmojiSpriteImagesWithAltText;
+	}
+});
 Object.defineProperty(exports, "resolveAttachmentFetchPolicy", {
 	enumerable: true,
 	get: function() {

package/dist/.setup/{secret-contract-api-BOzdWSn9.cjs → secret-contract-api-DFqDvc_a.cjs}

@@ -1,4 +1,4 @@
-let openclaw_plugin_sdk_setup = require("openclaw/plugin-sdk/setup");
+let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_channel_secret_basic_runtime = require("openclaw/plugin-sdk/channel-secret-basic-runtime");
 // extensions/msteams/src/secret-contract.ts
 const secretTargetRegistryEntries = (0, openclaw_plugin_sdk_channel_secret_basic_runtime.createChannelSecretTargetRegistryEntries)({
@@ -10,13 +10,14 @@ function collectRuntimeConfigAssignments(params) {
 	const resolved = (0, openclaw_plugin_sdk_channel_secret_basic_runtime.getChannelSurface)(params.config, "msteams");
 	if (!resolved) return;
 	const { channel: msteams, surface } = resolved;
+	const defaultEnabled = (surface.hasExplicitAccounts ? surface.accounts.find(({ accountId }) => (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(accountId) === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID) : void 0)?.enabled ?? surface.channelEnabled;
 	(0, openclaw_plugin_sdk_channel_secret_basic_runtime.collectSecretInputAssignment)({
 		value: msteams.appPassword,
 		path: "channels.msteams.appPassword",
 		expected: "string",
 		defaults: params.defaults,
 		context: params.context,
-		active: isRootDefaultIdentityActive(msteams, surface),
+		active: defaultEnabled && (isConfiguredIdentityField(msteams.appId) || isConfiguredIdentityField(msteams.appPassword)),
 		inactiveReason: "no enabled account inherits this top-level Microsoft Teams appPassword.",
 		owner: {
 			ownerKind: "account",
@@ -42,7 +43,7 @@ function collectRuntimeConfigAssignments(params) {
 			inactiveReason: "Microsoft Teams account is disabled.",
 			owner: {
 				ownerKind: "account",
-				ownerId: `msteams:${(0, openclaw_plugin_sdk_setup.normalizeAccountId)(accountId)}`,
+				ownerId: `msteams:${(0, openclaw_plugin_sdk_account_id.normalizeAccountId)(accountId)}`,
 				requiredForGateway: false,
 				disposition: "isolate",
 				contract: account
@@ -57,9 +58,6 @@ function isConfiguredIdentityField(value) {
 	if (typeof value === "string") return value.trim().length > 0;
 	return value !== void 0 && value !== null;
 }
-function isRootDefaultIdentityActive(channel, surface) {
-	return ((surface.hasExplicitAccounts ? surface.accounts.find(({ accountId }) => (0, openclaw_plugin_sdk_setup.normalizeAccountId)(accountId) === openclaw_plugin_sdk_setup.DEFAULT_ACCOUNT_ID) : void 0)?.enabled ?? surface.channelEnabled) && (isConfiguredIdentityField(channel.appId) || isConfiguredIdentityField(channel.appPassword));
-}
 const channelSecrets = {
 	secretTargetRegistryEntries,
 	collectRuntimeConfigAssignments

package/dist/.setup/{secret-contract-api-5aH1Fl_c.cjs → secret-contract-api-YGHrfAT0.cjs}

@@ -1,4 +1,4 @@
-const require_secret_contract_api = require("./secret-contract-api-BOzdWSn9.cjs");
+const require_secret_contract_api = require("./secret-contract-api-DFqDvc_a.cjs");
 exports.channelSecrets = require_secret_contract_api.channelSecrets;
 exports.collectRuntimeConfigAssignments = require_secret_contract_api.collectRuntimeConfigAssignments;
 exports.secretTargetRegistryEntries = require_secret_contract_api.secretTargetRegistryEntries;