@openclaw/msteams 2026.10.5-beta.4 → 2026.10.10-beta.2

package/dist/.setup/{oauth-CWJ85AMw.cjs → oauth-D9u8sPCD.cjs}

@@ -1,4 +1,4 @@
-const require_resolve_allowlist = require("./resolve-allowlist-DdDBVCzl.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-tYgAHx0t.cjs");
 let openclaw_plugin_sdk_provider_auth = require("openclaw/plugin-sdk/provider-auth");
 let openclaw_plugin_sdk_provider_auth_runtime = require("openclaw/plugin-sdk/provider-auth-runtime");
 //#region extensions/msteams/src/oauth.flow.ts

package/dist/.setup/{reaction-types-Ig9sQJuR.cjs → reaction-types-DSQWVA4Z.cjs}

@@ -1,5 +1,10 @@
-const require_resolve_allowlist = require("./resolve-allowlist-DdDBVCzl.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-tYgAHx0t.cjs");
 //#region extensions/msteams/src/graph-thread.ts
+/** Keep inbound thread enrichment bounded while still reaching recent replies. */
+const MAX_REPLY_PAGES = 50;
+function compareThreadMessagesChronologically(a, b) {
+	return Date.parse(a.createdDateTime ?? "") - Date.parse(b.createdDateTime ?? "") || (a.id ?? "").localeCompare(b.id ?? "");
+}
 /**
 * Strip HTML tags from Teams message content, preserving @mention display names.
 * Teams wraps mentions in <at>Name</at> tags.
@@ -50,20 +55,21 @@ async function fetchChatMessageText(token, chatId, messageId, deadline) {
 /**
 * Fetch thread replies for a channel message, ordered chronologically.
 *
-* **Limitation:** The Graph API replies endpoint (`/messages/{id}/replies`) does not
-* support `$orderby`, so results are always returned in ascending (oldest-first) order.
-* Combined with the `$top` cap of 50, this means only the **oldest 50 replies** are
-* returned for long threads — newer replies are silently omitted. There is currently no
-* Graph API workaround for this; pagination via `@odata.nextLink` can retrieve more
-* replies but still in ascending order only.
+* Graph caps each replies page at 50 and does not support `$orderby`. Follow
+* `@odata.nextLink`, then return the newest bounded window in chronological order.
 */
 async function fetchThreadReplies(token, groupId, channelId, messageId, deadline) {
 	const path = `/teams/${encodeURIComponent(groupId)}/channels/${encodeURIComponent(channelId)}/messages/${encodeURIComponent(messageId)}/replies?$top=50`;
-	return (await require_resolve_allowlist.fetchGraphJson({
+	const { items, truncated } = await require_resolve_allowlist.fetchAllGraphPages({
 		token,
 		path,
+		maxPages: MAX_REPLY_PAGES,
 		...deadline ? { deadline } : {}
-	})).value ?? [];
+	});
+	if (truncated) throw new Error("MS Teams thread replies pagination did not reach the newest replies");
+	if (items.length <= 50) return items;
+	if (!items.every((item) => Number.isFinite(Date.parse(item.createdDateTime ?? "")))) throw new Error("MS Teams thread replies have incomplete timestamps");
+	return items.toSorted(compareThreadMessagesChronologically).slice(-50);
 }
 function buildThreadContext(messages, currentMessageId) {
 	const context = [];

package/dist/.setup/{resolve-allowlist-DdDBVCzl.cjs → resolve-allowlist-tYgAHx0t.cjs}

@@ -1,9 +1,13 @@
+const require_bot_framework_service_url = require("./bot-framework-service-url-B3FWn2SV.cjs");
+const require_token_config = require("./token-config-bEpua_Q7.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("../runtime-api.cjs");
-const require_bot_framework_service_url = require("./bot-framework-service-url-CPp4d-Q6.cjs");
-const require_token_config = require("./token-config-CqIh8z7Q.cjs");
+const require_delegated_state = require("./delegated-state-Bv5cWuec.cjs");
 let openclaw_plugin_sdk_lazy_runtime = require("openclaw/plugin-sdk/lazy-runtime");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
+let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
+let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
+let openclaw_plugin_sdk_secret_file_runtime = require("openclaw/plugin-sdk/secret-file-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let node_async_hooks = require("node:async_hooks");
 let openclaw_plugin_sdk_fetch_runtime = require("openclaw/plugin-sdk/fetch-runtime");
@@ -18,21 +22,177 @@ let openclaw_plugin_sdk_secret_file = require("openclaw/plugin-sdk/secret-file")
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let node_module = require("node:module");
 let openclaw_plugin_sdk_html_entity_runtime = require("openclaw/plugin-sdk/html-entity-runtime");
+//#region extensions/msteams/src/accounts.ts
+const { listAccountIds, resolveDefaultAccountId } = (0, openclaw_plugin_sdk_account_helpers.createAccountListHelpers)("msteams", {
+	normalizeAccountId: openclaw_plugin_sdk_account_id.normalizeAccountId,
+	hasImplicitDefaultAccount: (cfg) => require_token_config.hasConfiguredMSTeamsCredentials(cfg.channels?.msteams)
+});
+const listMSTeamsAccountIds = listAccountIds;
+const resolveDefaultMSTeamsAccountId = resolveDefaultAccountId;
+function withAccountScopedMSTeamsConfig(params) {
+	return {
+		...params.cfg,
+		channels: {
+			...params.cfg.channels,
+			msteams: params.accountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID ? params.accountConfig : {
+				...params.accountConfig,
+				defaultAccount: params.accountId
+			}
+		}
+	};
+}
+function accountDefinesIdentity(account) {
+	return Boolean(account?.appId || account?.appPassword);
+}
+function resolveMSTeamsAccountEntry(accounts, accountId) {
+	const key = resolveMSTeamsAccountEntryKey(accounts, accountId);
+	return key ? accounts?.[key] : void 0;
+}
+function resolveMSTeamsAccountEntryKey(accounts, accountId) {
+	if (!accounts) return;
+	for (const key of Object.keys(accounts)) if ((0, openclaw_plugin_sdk_account_id.normalizeAccountId)(key) === accountId) return key;
+}
+function resolveMSTeamsAccountConfigPath(cfg, accountId) {
+	const normalized = (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(accountId);
+	const rawAccountKey = resolveMSTeamsAccountEntryKey(cfg.channels?.msteams?.accounts, normalized);
+	if (rawAccountKey) return `channels.msteams.accounts.${rawAccountKey}`;
+	return normalized === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID ? "channels.msteams" : `channels.msteams.accounts.${normalized}`;
+}
+function isAccountScopedChannelConfig(channelConfig, accountId) {
+	if (!channelConfig) return false;
+	const accounts = channelConfig.accounts;
+	return (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(channelConfig.defaultAccount) === accountId && (!accounts || Object.keys(accounts).length === 0) && accountDefinesIdentity(channelConfig);
+}
+function clearNamedAccountInheritedIdentity(merged, account) {
+	const next = { ...merged };
+	if (account?.appId === void 0) delete next.appId;
+	if (account?.appPassword === void 0) delete next.appPassword;
+	if (account?.legacyWebhook === void 0) delete next.legacyWebhook;
+	return next;
+}
+function resolveMSTeamsAccountConfig(cfg, accountId) {
+	const resolvedAccountId = (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(accountId ?? resolveDefaultMSTeamsAccountId(cfg));
+	const channelConfig = cfg.channels?.msteams;
+	const account = resolveMSTeamsAccountEntry(channelConfig?.accounts, resolvedAccountId);
+	const merged = (0, openclaw_plugin_sdk_account_helpers.resolveMergedAccountConfig)({
+		channelConfig,
+		accounts: channelConfig?.accounts,
+		accountId: resolvedAccountId,
+		normalizeAccountId: openclaw_plugin_sdk_account_id.normalizeAccountId,
+		omitKeys: ["defaultAccount"],
+		nestedObjectKeys: [
+			"webhook",
+			"markdown",
+			"streaming",
+			"blockStreamingCoalesce",
+			"dms",
+			"teams",
+			"heartbeat",
+			"healthMonitor",
+			"delegatedAuth",
+			"sso"
+		]
+	});
+	if (resolvedAccountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID || !account && isAccountScopedChannelConfig(channelConfig, resolvedAccountId)) return merged;
+	const config = clearNamedAccountInheritedIdentity(merged, account);
+	return {
+		...config,
+		webhook: {
+			...config.webhook,
+			path: require_bot_framework_service_url.resolveMSTeamsWebhookPath(channelConfig, resolvedAccountId, account)
+		}
+	};
+}
+function resolveMSTeamsRuntimeAccount(params) {
+	const accountId = (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(params.accountId ?? resolveDefaultMSTeamsAccountId(params.cfg));
+	const config = params.msteamsCfg ?? resolveMSTeamsAccountConfig(params.cfg, accountId);
+	return {
+		accountId,
+		config,
+		credentials: require_token_config.resolveMSTeamsCredentials(config, {
+			allowEnvFallback: accountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+			pathPrefix: resolveMSTeamsAccountConfigPath(params.cfg, accountId)
+		})
+	};
+}
+function resolveMSTeamsAccountWithMode(params) {
+	const accountId = (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(params.accountId ?? resolveDefaultMSTeamsAccountId(params.cfg));
+	const channelEnabled = params.cfg.channels?.msteams?.enabled !== false;
+	const config = resolveMSTeamsAccountConfig(params.cfg, accountId);
+	const accountEnabled = config.enabled !== false;
+	const pathPrefix = resolveMSTeamsAccountConfigPath(params.cfg, accountId);
+	const credentialResolution = params.mode === "inspect" ? require_token_config.inspectMSTeamsCredentials(config, { allowEnvFallback: accountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID }) : (() => {
+		const credentials = require_token_config.resolveMSTeamsCredentials(config, {
+			allowEnvFallback: accountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+			pathPrefix
+		});
+		return {
+			credentials,
+			status: credentials ? "available" : "missing"
+		};
+	})();
+	const credentials = credentialResolution.credentials;
+	const certificatePath = credentials?.type === "federated" && !credentials.useManagedIdentity ? credentials.certificatePath : void 0;
+	const channelConfig = params.cfg.channels?.msteams;
+	const rawAccountKey = resolveMSTeamsAccountEntryKey(channelConfig?.accounts, accountId);
+	const certificateConfigPath = (rawAccountKey ? channelConfig?.accounts?.[rawAccountKey] : void 0)?.certificatePath?.trim() ? `channels.msteams.accounts.${rawAccountKey}.certificatePath` : channelConfig?.certificatePath?.trim() ? "channels.msteams.certificatePath" : "env.MSTEAMS_CERTIFICATE_PATH";
+	const certificate = certificatePath ? (0, openclaw_plugin_sdk_secret_file_runtime.tryReadSecretFileSync)(certificatePath, "Microsoft Teams certificate", void 0, { configPath: certificateConfigPath }) : void 0;
+	const unavailable = credentialResolution.status === "configured_unavailable" || certificate?.status === "configured_unavailable";
+	const credentialDiagnostics = certificate?.status === "configured_unavailable" ? [certificate.diagnostic] : void 0;
+	return {
+		accountId,
+		enabled: channelEnabled && accountEnabled,
+		configured: credentialResolution.status !== "missing",
+		tokenStatus: credentialResolution.status === "missing" ? "missing" : unavailable ? "configured_unavailable" : "available",
+		...credentialDiagnostics ? { credentialDiagnostics } : {},
+		config
+	};
+}
+function resolveMSTeamsAccount(params) {
+	return resolveMSTeamsAccountWithMode({
+		...params,
+		mode: "runtime"
+	});
+}
+function inspectMSTeamsAccount(params) {
+	const account = resolveMSTeamsAccountWithMode({
+		...params,
+		mode: "inspect"
+	});
+	return {
+		accountId: account.accountId,
+		enabled: account.enabled,
+		configured: account.configured,
+		tokenStatus: account.tokenStatus,
+		...account.credentialDiagnostics ? { credentialDiagnostics: account.credentialDiagnostics } : {},
+		hasIdentity: account.accountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID || accountDefinesIdentity(resolveMSTeamsAccountEntry(params.cfg.channels?.msteams?.accounts, account.accountId)),
+		path: account.config.webhook?.path ?? "/api/messages"
+	};
+}
+//#endregion
 //#region extensions/msteams/src/request-timeout.ts
 const MSTEAMS_REQUEST_TIMEOUT_MS = 3e4;
 const MSTEAMS_SHAREPOINT_UPLOAD_BASE_TIMEOUT_MS = 3e5;
 const MSTEAMS_SHAREPOINT_UPLOAD_MIN_BYTES_PER_SECOND = 262144;
-const MSTEAMS_INBOUND_PREPROCESS_TIMEOUT_MS = 1e4;
-function createMSTeamsInboundDeadline() {
+const MSTEAMS_INBOUND_ENRICHMENT_TIMEOUT_MS = 1e4;
+const MSTEAMS_INBOUND_MEDIA_TIMEOUT_MS = 12e4;
+function createMSTeamsInboundEnrichmentDeadline() {
 	return (0, openclaw_plugin_sdk_provider_http.createProviderOperationDeadline)({
 		label: "MS Teams inbound preprocessing",
-		timeoutMs: MSTEAMS_INBOUND_PREPROCESS_TIMEOUT_MS
+		timeoutMs: MSTEAMS_INBOUND_ENRICHMENT_TIMEOUT_MS
 	});
 }
+function createMSTeamsInboundMediaDeadline() {
+	return (0, openclaw_plugin_sdk_provider_http.createProviderOperationDeadline)({
+		label: "MS Teams inbound media",
+		timeoutMs: MSTEAMS_INBOUND_MEDIA_TIMEOUT_MS
+	});
+}
+/** Per-request timeout: the operation deadline's remaining budget, else the default request cap. */
 function resolveMSTeamsRequestTimeoutMs(deadline) {
 	return deadline ? (0, openclaw_plugin_sdk_provider_http.resolveProviderOperationTimeoutMs)({
 		deadline,
-		defaultTimeoutMs: MSTEAMS_REQUEST_TIMEOUT_MS
+		defaultTimeoutMs: deadline.timeoutMs ?? 3e4
 	}) : MSTEAMS_REQUEST_TIMEOUT_MS;
 }
 /** Bound non-abortable SDK and credential work to the same operation deadline as fetches. */
@@ -41,7 +201,7 @@ async function withMSTeamsRequestDeadline(params) {
 	return await (0, openclaw_plugin_sdk_text_utility_runtime.withTimeout)(params.work(), timeoutMs, params.label);
 }
 function resolveMSTeamsSharePointUploadTimeoutMs(sizeInBytes) {
-	const transferBudgetMs = Math.ceil((Number.isFinite(sizeInBytes) && sizeInBytes > 0 ? Math.ceil(sizeInBytes) : 0) / MSTEAMS_SHAREPOINT_UPLOAD_MIN_BYTES_PER_SECOND * 1e3);
+	const transferBudgetMs = Math.ceil(sizeInBytes / MSTEAMS_SHAREPOINT_UPLOAD_MIN_BYTES_PER_SECOND * 1e3);
 	return (0, openclaw_plugin_sdk_number_runtime.resolveTimerTimeoutMs)(MSTEAMS_SHAREPOINT_UPLOAD_BASE_TIMEOUT_MS + transferBudgetMs, MSTEAMS_SHAREPOINT_UPLOAD_BASE_TIMEOUT_MS, 1);
 }
 function createMSTeamsRequestTimeoutError(label, timeoutMs) {
@@ -689,7 +849,7 @@ async function refreshMSTeamsDelegatedTokens(params) {
 //#endregion
 //#region extensions/msteams/src/token.ts
 async function resolveDelegatedAccessToken(params) {
-	const tokens = await require_token_config.loadMSTeamsDelegatedTokens();
+	const tokens = await require_delegated_state.loadMSTeamsDelegatedTokens(params.accountId);
 	if (!tokens) return;
 	if ((0, openclaw_plugin_sdk_number_runtime.isFutureDateTimestampMs)(tokens.expiresAt)) return tokens.accessToken;
 	try {
@@ -700,7 +860,7 @@ async function resolveDelegatedAccessToken(params) {
 			refreshToken: tokens.refreshToken,
 			scopes: tokens.scopes
 		});
-		await require_token_config.saveMSTeamsDelegatedTokens(refreshed);
+		await require_delegated_state.saveMSTeamsDelegatedTokens(refreshed, params.accountId);
 		return refreshed.accessToken;
 	} catch {
 		return;
@@ -733,7 +893,7 @@ async function requestGraph(params) {
 	const assertRequestCurrent = captureGraphRequestCurrentness(assertReadAuthority);
 	assertRequestCurrent?.();
 	const hasBody = params.body !== void 0;
-	const url = `${params.root ?? "https://graph.microsoft.com/v1.0"}${params.path}`;
+	const url = params.absoluteUrl ?? `${params.root ?? "https://graph.microsoft.com/v1.0"}${params.path}`;
 	const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 		url,
 		init: {
@@ -746,7 +906,7 @@ async function requestGraph(params) {
 			},
 			body: hasBody ? JSON.stringify(params.body) : void 0
 		},
-		auditContext: "msteams.graph",
+		auditContext: params.absoluteUrl ? "msteams.graph.absolute" : "msteams.graph",
 		timeoutMs: resolveMSTeamsRequestTimeoutMs(params.deadline),
 		beforeRequest: assertRequestCurrent
 	});
@@ -794,28 +954,15 @@ async function fetchGraphJson(params) {
 */
 async function fetchGraphAbsoluteUrl(params) {
 	const assertReadAuthority = (0, openclaw_plugin_sdk_fetch_runtime.captureChannelReadAuthority)();
-	const assertRequestCurrent = captureGraphRequestCurrentness(assertReadAuthority);
-	assertRequestCurrent?.();
-	const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
-		url: params.url,
-		init: { headers: {
-			"User-Agent": buildUserAgent(),
-			Authorization: `Bearer ${params.token}`
-		} },
-		auditContext: "msteams.graph.absolute",
-		timeoutMs: MSTEAMS_REQUEST_TIMEOUT_MS,
-		beforeRequest: assertRequestCurrent
-	});
 	try {
-		assertReadAuthority?.();
-		if (!response.ok) throw await (0, openclaw_plugin_sdk_provider_http.createProviderHttpError)(response, `Graph ${params.url} failed`);
+		const response = await requestGraph({
+			token: params.token,
+			path: params.url,
+			absoluteUrl: params.url
+		});
 		return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, `Graph ${params.url} failed`);
 	} finally {
-		try {
-			await release();
-		} finally {
-			assertReadAuthority?.();
-		}
+		assertReadAuthority?.();
 	}
 }
 async function fetchAllGraphPages(params) {
@@ -826,7 +973,8 @@ async function fetchAllGraphPages(params) {
 		const res = await fetchGraphJson({
 			token: params.token,
 			path: nextPath,
-			headers: params.headers
+			headers: params.headers,
+			...params.deadline ? { deadline: params.deadline } : {}
 		});
 		const pageItems = res.value ?? [];
 		const match = params.findOne ? pageItems.find(params.findOne) : void 0;
@@ -848,15 +996,20 @@ async function fetchAllGraphPages(params) {
 async function resolveGraphToken(cfg, options) {
 	const assertRequestCurrent = captureGraphRequestCurrentness((0, openclaw_plugin_sdk_fetch_runtime.captureChannelReadAuthority)());
 	assertRequestCurrent?.();
-	const msteamsCfg = cfg?.channels?.msteams;
-	const creds = require_token_config.resolveMSTeamsCredentials(msteamsCfg);
+	const openClawCfg = cfg;
+	const { accountId, config: msteamsCfg, credentials: creds } = resolveMSTeamsRuntimeAccount({
+		cfg: openClawCfg,
+		accountId: options?.accountId
+	});
+	if (openClawCfg.channels?.msteams?.enabled === false || msteamsCfg.enabled === false) throw new Error("MS Teams account disabled: " + accountId);
 	if (!creds) throw new Error("MS Teams credentials missing");
 	if (msteamsCfg?.cloud === "China") throw new Error("Microsoft Teams Graph operations are not supported for channels.msteams.cloud=China until Graph requests are routed through the Azure China Graph endpoint.");
 	if (options?.preferDelegated && msteamsCfg?.delegatedAuth?.enabled && creds.type === "secret") {
 		const delegated = await resolveDelegatedAccessToken({
 			tenantId: creds.tenantId,
 			clientId: creds.appId,
-			clientSecret: creds.appPassword
+			clientSecret: creds.appPassword,
+			accountId
 		});
 		assertRequestCurrent?.();
 		if (delegated) return delegated;
@@ -1145,7 +1298,7 @@ function parseMSTeamsTeamEntry(raw) {
 async function resolveMSTeamsChannelAllowlist(params) {
 	let tokenPromise;
 	const getToken = () => {
-		tokenPromise ??= resolveGraphToken(params.cfg);
+		tokenPromise ??= resolveGraphToken(params.cfg, { accountId: params.accountId });
 		return tokenPromise;
 	};
 	return await (0, openclaw_plugin_sdk_allow_from.mapAllowlistResolutionInputs)({
@@ -1313,6 +1466,7 @@ async function resolveMSTeamsTeamsConfig(params) {
 	};
 	const resolved = await resolveMSTeamsChannelAllowlist({
 		cfg: params.cfg,
+		accountId: params.accountId,
 		entries: entries.map((entry) => entry.input),
 		teamIdMode: params.teamIdMode
 	});
@@ -1363,7 +1517,7 @@ async function resolveMSTeamsTeamsConfig(params) {
 async function resolveMSTeamsUserAllowlist(params) {
 	let tokenPromise;
 	const getToken = () => {
-		tokenPromise ??= resolveGraphToken(params.cfg);
+		tokenPromise ??= resolveGraphToken(params.cfg, { accountId: params.accountId });
 		return tokenPromise;
 	};
 	return await (0, openclaw_plugin_sdk_allow_from.mapAllowlistResolutionInputs)({
@@ -1480,10 +1634,16 @@ Object.defineProperty(exports, "createMSTeamsExpressAdapter", {
 		return createMSTeamsExpressAdapter;
 	}
 });
-Object.defineProperty(exports, "createMSTeamsInboundDeadline", {
+Object.defineProperty(exports, "createMSTeamsInboundEnrichmentDeadline", {
+	enumerable: true,
+	get: function() {
+		return createMSTeamsInboundEnrichmentDeadline;
+	}
+});
+Object.defineProperty(exports, "createMSTeamsInboundMediaDeadline", {
 	enumerable: true,
 	get: function() {
-		return createMSTeamsInboundDeadline;
+		return createMSTeamsInboundMediaDeadline;
 	}
 });
 Object.defineProperty(exports, "createMSTeamsTokenProvider", {
@@ -1570,6 +1730,12 @@ Object.defineProperty(exports, "htmlToPlainText", {
 		return htmlToPlainText;
 	}
 });
+Object.defineProperty(exports, "inspectMSTeamsAccount", {
+	enumerable: true,
+	get: function() {
+		return inspectMSTeamsAccount;
+	}
+});
 Object.defineProperty(exports, "isAdvertisedFileAttachment", {
 	enumerable: true,
 	get: function() {
@@ -1606,6 +1772,12 @@ Object.defineProperty(exports, "listChannelsForTeamWithPageInfo", {
 		return listChannelsForTeamWithPageInfo;
 	}
 });
+Object.defineProperty(exports, "listMSTeamsAccountIds", {
+	enumerable: true,
+	get: function() {
+		return listMSTeamsAccountIds;
+	}
+});
 Object.defineProperty(exports, "listTeamsByName", {
 	enumerable: true,
 	get: function() {
@@ -1714,12 +1886,42 @@ Object.defineProperty(exports, "resolveAttachmentFetchPolicy", {
 		return resolveAttachmentFetchPolicy;
 	}
 });
+Object.defineProperty(exports, "resolveDefaultMSTeamsAccountId", {
+	enumerable: true,
+	get: function() {
+		return resolveDefaultMSTeamsAccountId;
+	}
+});
 Object.defineProperty(exports, "resolveGraphToken", {
 	enumerable: true,
 	get: function() {
 		return resolveGraphToken;
 	}
 });
+Object.defineProperty(exports, "resolveMSTeamsAccount", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsAccount;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsAccountConfig", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsAccountConfig;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsAccountConfigPath", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsAccountConfigPath;
+	}
+});
+Object.defineProperty(exports, "resolveMSTeamsAccountEntryKey", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsAccountEntryKey;
+	}
+});
 Object.defineProperty(exports, "resolveMSTeamsChannelAllowlist", {
 	enumerable: true,
 	get: function() {
@@ -1744,6 +1946,12 @@ Object.defineProperty(exports, "resolveMSTeamsRequestTimeoutMs", {
 		return resolveMSTeamsRequestTimeoutMs;
 	}
 });
+Object.defineProperty(exports, "resolveMSTeamsRuntimeAccount", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsRuntimeAccount;
+	}
+});
 Object.defineProperty(exports, "resolveMSTeamsSdkCloudOptions", {
 	enumerable: true,
 	get: function() {
@@ -1816,6 +2024,12 @@ Object.defineProperty(exports, "wasMSTeamsBotMentioned", {
 		return wasMSTeamsBotMentioned;
 	}
 });
+Object.defineProperty(exports, "withAccountScopedMSTeamsConfig", {
+	enumerable: true,
+	get: function() {
+		return withAccountScopedMSTeamsConfig;
+	}
+});
 Object.defineProperty(exports, "withMSTeamsAbortableRequestTimeout", {
 	enumerable: true,
 	get: function() {

package/dist/.setup/{secret-contract-api-ChQdBeU1.cjs → secret-contract-api-YY3v6MP8.cjs}

@@ -1,4 +1,4 @@
-const require_secret_contract_api = require("./secret-contract-api-ipiUsANg.cjs");
+const require_secret_contract_api = require("./secret-contract-api-wAyY5UHv.cjs");
 exports.channelSecrets = require_secret_contract_api.channelSecrets;
 exports.collectRuntimeConfigAssignments = require_secret_contract_api.collectRuntimeConfigAssignments;
 exports.secretTargetRegistryEntries = require_secret_contract_api.secretTargetRegistryEntries;

package/dist/.setup/secret-contract-api-wAyY5UHv.cjs

@@ -0,0 +1,85 @@
+let openclaw_plugin_sdk_setup = require("openclaw/plugin-sdk/setup");
+let openclaw_plugin_sdk_channel_secret_basic_runtime = require("openclaw/plugin-sdk/channel-secret-basic-runtime");
+//#region extensions/msteams/src/secret-contract.ts
+const secretTargetRegistryEntries = (0, openclaw_plugin_sdk_channel_secret_basic_runtime.createChannelSecretTargetRegistryEntries)({
+	channelKey: "msteams",
+	account: ["appPassword"],
+	channel: ["appPassword"]
+});
+function collectRuntimeConfigAssignments(params) {
+	const resolved = (0, openclaw_plugin_sdk_channel_secret_basic_runtime.getChannelSurface)(params.config, "msteams");
+	if (!resolved) return;
+	const { channel: msteams, surface } = resolved;
+	(0, openclaw_plugin_sdk_channel_secret_basic_runtime.collectSecretInputAssignment)({
+		value: msteams.appPassword,
+		path: "channels.msteams.appPassword",
+		expected: "string",
+		defaults: params.defaults,
+		context: params.context,
+		active: isRootDefaultIdentityActive(msteams, surface),
+		inactiveReason: "no enabled account inherits this top-level Microsoft Teams appPassword.",
+		owner: {
+			ownerKind: "account",
+			ownerId: "msteams:default",
+			requiredForGateway: false,
+			disposition: "isolate",
+			contract: msteams
+		},
+		apply: (value) => {
+			msteams.appPassword = value;
+		}
+	});
+	if (!surface.hasExplicitAccounts) return;
+	for (const { accountId, account, enabled } of surface.accounts) {
+		if (!(0, openclaw_plugin_sdk_channel_secret_basic_runtime.hasOwnProperty)(account, "appPassword")) continue;
+		(0, openclaw_plugin_sdk_channel_secret_basic_runtime.collectSecretInputAssignment)({
+			value: account.appPassword,
+			path: `channels.msteams.accounts.${accountId}.appPassword`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: enabled,
+			inactiveReason: "Microsoft Teams account is disabled.",
+			owner: {
+				ownerKind: "account",
+				ownerId: `msteams:${(0, openclaw_plugin_sdk_setup.normalizeAccountId)(accountId)}`,
+				requiredForGateway: false,
+				disposition: "isolate",
+				contract: account
+			},
+			apply: (value) => {
+				account.appPassword = value;
+			}
+		});
+	}
+}
+function isConfiguredIdentityField(value) {
+	if (typeof value === "string") return value.trim().length > 0;
+	return value !== void 0 && value !== null;
+}
+function isRootDefaultIdentityActive(channel, surface) {
+	return ((surface.hasExplicitAccounts ? surface.accounts.find(({ accountId }) => (0, openclaw_plugin_sdk_setup.normalizeAccountId)(accountId) === openclaw_plugin_sdk_setup.DEFAULT_ACCOUNT_ID) : void 0)?.enabled ?? surface.channelEnabled) && (isConfiguredIdentityField(channel.appId) || isConfiguredIdentityField(channel.appPassword));
+}
+const channelSecrets = {
+	secretTargetRegistryEntries,
+	collectRuntimeConfigAssignments
+};
+//#endregion
+Object.defineProperty(exports, "channelSecrets", {
+	enumerable: true,
+	get: function() {
+		return channelSecrets;
+	}
+});
+Object.defineProperty(exports, "collectRuntimeConfigAssignments", {
+	enumerable: true,
+	get: function() {
+		return collectRuntimeConfigAssignments;
+	}
+});
+Object.defineProperty(exports, "secretTargetRegistryEntries", {
+	enumerable: true,
+	get: function() {
+		return secretTargetRegistryEntries;
+	}
+});